App · Case study:
Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs.
Reviewed jonaswagnr/ix500-scan@24a5f7c
Protocol · Case study:
Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect.
Reviewed kongdayan/wristbeam@712f577
Protocol · Case study:
Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding.
Reviewed Diniboy1123/usque@6aa03fc
App · Case study:
Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port.
Reviewed captbaritone/webamp@f01369f
Protocol · Case study:
Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device.
Reviewed ryanbr/noop@8e4b0c1
App · Case study:
Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface.
Reviewed MultiMote/niimblue@82c5605
Protocol · Case study:
Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service.
Reviewed Th0rgal/open_oura@e57c43c
App · Case study:
Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset.
Protocol · Case study:
Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app.
Reviewed unixpickle/cbyge@459be53
App · Case study:
Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app.
Reviewed jakubwarzecha00/clickwill@194b138
App · Case study:
spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts.
App · Case study:
OpenTracks is an early UWP port of the OpenTracks7 BETA1 Windows Phone music app informed by the author's reverse engineering.
Reviewed mediaexplorer74/OpenTracks@b960886
App · Case study:
The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis.
Reviewed Gautam-CyberSec/Android-Malware-Analysis-Report@5af85ed
App · Case study:
AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client.
App · Case study:
SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook.
Reviewed meowdiocre/ss-overlay-hook@30de968
App · Case study:
An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB.
App · Case study:
Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client.
Reviewed bo2themax/Siriously@01c29a7
App · Case study:
tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python.
Reviewed AboveColin/tuya-mobile@8630117
App · Case study:
ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form.
Reviewed hxreborn/ddg-tenor-bridge@fadbaf3
App · Case study:
MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app.
Reviewed Izero/msp-csv-format@d666b16
Firmware · Case study:
Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes.
Binary · Case study:
This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer.
App · Case study:
grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS.
Reviewed eliel9012/grsimwrite-mac@280c565
App · Case study:
dola-client reconstructs access to the Dola AI Android app API from captured phone traffic.
Reviewed Linkmail16/DolaAI-API@c88b5fe
App · Case study:
mcp-fitbod maps Fitbod backend endpoints and serialization schemas from decompiled Kotlin models in the Android app, then uses the documented interface in an MCP account client.
Reviewed Muno459/mcp-fitbod@94c1a81
App · Case study:
FlyBird-ProtocolAnalysis investigates the FlyBird proxy client's subscription delivery and APXS v2 format across Windows, Android, Linux and OpenWrt.
App · Case study:
SwiftCUA reconstructs the behavior of a macOS computer-use service in Swift 6 after studying the Codex Computer Use.app bundle, its local IPC, permissions and input engine.
Reviewed V1ki/swift-computer-use@2c2f337
App · Case study:
IOSVM ports Darwin/XNU components so user-supplied iOS 16.5 user space can boot in QEMU on Linux.
Reviewed lshan99q/iosvm@68c23fb
App · Case study:
A specification reconstructs the .tsl.json preset format used by BOSS Tone Studio for the GX-10 processor.
Reviewed ihorman/gx-10-tsl-spec@79f2259
Protocol · Case study:
Valeton GP180 Reverse Engineering investigates the guitar processor's USB MIDI SysEx traffic, firmware and companion Suite software.
Protocol · Case study:
fiilpod reconstructs FIIL earbud control protocols and integrates their battery, noise-control, EQ, and spatial-audio state into Xiaomi HyperOS.
Reviewed FNKG9527/FiilPods@4286929
App · Case study:
upright reconstructs Lightroom Classic's Upright perspective correction from catalog transforms, controlled application runs, and selected CameraRaw binary observations.
Reviewed rohanpandula/upright@490391d
App · Case study:
studio3svg reconstructs readable parts of Silhouette Studio .studio3 documents and converts their cut outlines to millimetre-based SVG.
Reviewed zaydmulani09/studio3svg@e8c3a58
App · Case study:
technics-az100 reimplements control of Technics EAH-AZ100 earbuds on Windows through the Airoha RACE Bluetooth RFCOMM channel.
App · Case study:
SberBoom Remote implements Android and Windows clients for local control of SberBoom speakers over StarOS WebSocket messages.
Reviewed matvey68568/sberboom-remote@d18027b
App · Case study:
Curiosity Daily API documents endpoint paths recovered by decompiling version 3.21.6 of the Curiosity Android app.
Reviewed ohaswin/curiosity-daily-api@9d13443
App · Case study:
prism_connect implements the remote-control protocol of PRISM Live Studio v4.0.0+ as a Dart library.
Reviewed entriphy/prism_connect@e49a150
App · Case study:
qcywatch-android replaces the QCY companion app for the QCY Watch GT2 using BLE frames derived from the vendor app and captured watch traffic.
Reviewed DhrubaDC1/qcywatch-android@de3b2ac
App · Case study:
Tabelog API reconstructs an OpenAPI 3.0.3 description of the Tabelog Inbound 2.24.1 app backend from decompiled smali.
Reviewed horse-3903/tabelog-api-spec@09ac7bf
App · Case study:
Platinenlupe reconstructs an EarVision Wi-Fi ear camera's communication for browser-based PCB inspection.
Reviewed ElektroGandhi/PlatinenLupe@a1271d0
App · Case study:
Wuwa Tappo Linux reimplements the Windows-only shell of the Wuwa Tappo desktop pet as a Qt 6 application for Linux.
App · Case study:
Ocypus Digital Controller implements a Linux daemon and CLI for Ocypus digital cooler displays using USB HID communication recovered from the Ocypus Digital Elite Windows utility.
App · Case study:
dvpn-decrypter reconstructs a mnemonic export path for the SOLAR Labs dVPN app.
Protocol · Case study:
OpenCfMoto for iOS reimplements the PXC dashboard exchange used by Carbit and EasyConnect motorcycle displays.
Reviewed Kevinparra535/opencfmoto-ios@ce4e598
App · Case study:
MechControl replaces the OEM Control Center on Uniwill-built MECHREVO, XMG and Eluktronics laptops with a native Windows application.
Reviewed Liddo-kun/MechControl-RE@2bb3328
App · Case study:
codex-app for macOS reconstructs the Codex desktop workspace as an Electron, React and TypeScript client for the official Codex app-server.
Reviewed keriae/codex-app@237ce3c
Protocol · Case study:
The FIIL headphone study reconstructs Bluetooth control framing and command behavior from FIIL+ 3.5.2 analysis and headset captures.
App · Case study:
The 喜鹊儿 App notes reconstruct login, timetable and attendance API behavior from packet captures, app decompilation and active server probes.
Protocol · Case study:
BtCarKey implements an Android client for a keyless car box using a reconstructed FTK BLE interface.
Reviewed simoneluconi/BtCarKey@ac6c083
App · Case study:
printer-craft reconstructs the CUPS printing pipeline identified in PdfCraft.app as a Python library and CLI.
Reviewed dharantej1/PrinterCraft@7b3467a
App · Case study:
studo.js implements a TypeScript client for the Studo app's REST and socket.io chat interfaces after APK and network-packet analysis.
Reviewed studojs/studo.js@56619ff
App · Case study:
MAL Private API documents the private MyAnimeList JSON interface recovered from version 0.11.8 of its Android app and supplies a Node.js client.
Reviewed jonbarrow/mal-private-api@9a10021
App · Case study:
Better Essential Space reconstructs access to Nothing's Essential Space in a native macOS client after studying its Android app and undocumented APIs.
App · Case study:
The EasyKit investigation reconstructs local access to a BTicino / Legrand door station from companion-app analysis and SIP-TLS traffic.
App · Case study:
Bull MosHome implements a Python client and Home Assistant integration using MosHome cloud behavior analyzed from the Android app and network requests.
Reviewed gn0451/bull-moshome@227b7dc
App · Case study:
xperia-firmware-toolkit documents how Xperia Companion stores and downloads Sony Xperia firmware.
App · Case study:
FABA on Linux reconstructs how the FABA speaker stores and plays songs by examining the myFaba Electron app and files on the device.
Reviewed aleeraser/faba-tools@2385f05
App · Case study:
Voicemeeter Audio Callback research maps callback modes, command codes, buffer layouts, and calling conventions observed in Voicemeeter Potato.
Reviewed tandurkarsa/voicemeeter-audio-callback-reverse-engineering@6a2fd6b
App · Case study:
lidl-plus-reverse documents Lidl Pay requests observed between the Lidl Plus app and its server.
Reviewed c0desyntax/lidl-plus-reverse@b04a505
App · Case study:
open-cardi reconstructs BLE control of Cardi K3 and K4 Active Ultra lighting kits in Android and web clients.
Reviewed harshmandan/open-cardi@d8eaf5b
App · Case study:
Pool Comfort / Galaxywind implements a local Python client and Home Assistant component for pool heat pumps using UDP behavior recovered from the vendor Android app and LAN captures.
Protocol · Case study:
Mondeer Bluetooth scale reconstructs the BLE exchange used by Mondeer and WanKa C1 bathroom scales and implements a Python listener that publishes weighing data to Home Assistant over MQTT.
App · Case study:
Smartboard notebook Exporter documents the .notebook file format produced by a SMART Board MX065 iQ and converts whiteboard pages to SVG, PNG or PDF.
App · Case study:
The WeChat export investigation recovers chat data from WeChat 4.x for macOS.
Reviewed patients760/wechat-export@783b4a5
Protocol · Case study:
led-hue-cycle reconstructs LED LAMP's BLE commands for LEDDMX-family light strips in a native Android app and Python scripts.
Reviewed Rishi-Goyal/led-hue-cycle@6d4f7bd
App · Case study:
OPPO 移动电源助手 reconstructs power bank control on macOS from analysis of a Windows .NET assistant and its USB serial exchange.
App · Case study:
LaMetric TIME Recovery Toolkit reconstructs the clock's Wi-Fi provisioning exchange from its Android APK and implements it in Linux scripts.
Reviewed angristan/lametric-time@84971d2
App · Case study:
AvellSucks is a Windows control app for an Avell gaming laptop’s fan, power settings and devices.
Reviewed rodrigogs/avell-sucks@b5ad4e6
App · Case study:
PodFlick reconstructs iTunesDB editing for fifth-generation iPod Video devices in a macOS video-transfer app.
Reviewed rockerlabs/podflick@a168920
App · Case study:
Vcf-compiler reconstructs the binary VCF file format used by Ruida VCutWorks.
Reviewed outpost2026/Vcf-compiler@c6d9d65
App · Case study:
podscribe reconstructs old-format iTunesDB writing for the 5.5-generation iPod Video in TypeScript.
Reviewed menor/podscribe@6df55f5
App · Case study:
GameSir Connect share-code research reconstructs the desktop app's controller-profile export format and supplies a Python codec for editing and reimporting profiles.
Protocol · Case study:
sperax-rm01 reconstructs the Sperax RM-01 walking pad's BLE controls as a Python library and CLI.
Reviewed nathanabrewer/sperax-rm01@aaf5611
App · Case study:
UNAR6 reconstructs the AR6 archive format used by the Manažer M602 DOS file manager from observed archives.
Reviewed mariolacko/unar6@b11244f
Protocol · Case study:
The BlackBerry 10 Assistant reference reconstructs the Dragon speech-service and Maluuba intent-service exchanges needed by the phone's original Assistant.
App · Case study:
The Packet Tracer .pkt/.pka project reconstructs Cisco Packet Tracer's encrypted lab-file containers and their XML payloads.
App · Case study:
mihealth-api reconstructs access to personal Mi Fitness health data from the com.mi.health client API.
Reviewed Aaron-gx/mihealth-api@05edd13
Protocol · Case study:
garmin-proto-lab reconstructs Garmin watch-facing GFDI communication in a Python compatibility client using findings from Garmin Connect's Android package.
App · Case study:
Dorado reconstructs a Zune HD application runtime for .zcp and .ccgame packages.
Reviewed project-dorado/dorado-emu@8b1fee6
App · Case study:
eJay statically recompiles the audio and graphics libraries of Dance eJay titles for a new cross-platform host.
Reviewed sp00nznet/ejay@c9ccad1
App · Case study:
vclights reconstructs VC-BLELIGHT lamp control from the Raingel Android app's BLE commands.
Reviewed agustinprod/vclights@5d37a7a
App · Case study:
ilo2ctl rebuilds HP iLO 2 remote-console and management controls in C++, including DVC video decoding, keyboard and mouse input, RIBCL power and health operations, and ISO virtual media.
Reviewed centlakestefan/ilo2ctl@0cdc866
App · Case study:
gpcli reconstructs the MyGP Android subscriber app's API behavior as a Python command-line client.
Reviewed hopfian/gpcli@067cd1d
Protocol · Case study:
Atmoph Window 2 Remote implements local Home Assistant control of an Atmoph Window 2 through BLE commands recovered from the vendor Android app.
Reviewed disruptivepatternmaterial/atmoph-win-2-remote@3c1ecae
App · Case study:
Antigravity session interoperability reconstructs a subset of Antigravity CLI 1.1.16's local SQLite and protobuf session format on Linux x86-64.
Reviewed xhluca/antigravity-session-interoperability@b85c60a
App · Case study:
MIRO SmartHome reconstructs control of devices registered in the MIRO SmartHome app through a Home Assistant integration.
Reviewed ripe-avocado/miro_ha@438fb32
App · Case study:
ScanStudio provides a native macOS scanning workflow for the Nikon SUPER COOLSCAN 5000 ED.
Reviewed rohanpandula/nikon-coolscan4-software-archaeology@fa09658
App · Case study:
tc01a reconstructs Fluke iSee TC01A camera control from the Android app and native library behavior.
Reviewed dazchi/tc01a-python@4252e40
App · Case study:
YouTubeClient adapts a decompiled Windows Phone 7 YouTube client XAP into a UWP application for Windows 10 Mobile and desktop.
App · Case study:
wuibi reconstructs enough of Quibi’s mobile API to provide search and playback in a browser WebExtension.
Reviewed gmosley/wuibi@291f75f
App · Case study:
Smart Life cloud plug CLI reconstructs the Smart Life Android 7.10.6 signing and login flow for cloud-connected plugs.
Reviewed reetamdan/smartlife-app-tuya@80faedc
App · Case study:
timeline-export reconstructs Google Maps Timeline retrieval and decoding to export on-device location history as JSON.
Reviewed arkenoi/timeline-export@3c1faa0
App · Case study:
waze-stuff investigates Waze map-tile files through hex patterns and Python, TypeScript and C code for parsing and partial tile generation.
Reviewed michei69/waze-stuff@e2111a0
App · Case study:
Notepad Tabs maps the binary format of Windows Notepad’s saved and unsaved tab files.
Reviewed JustArion/Notepad-Tabs@37b1fd8
App · Case study:
MovieOkeAI investigates the discontinued MovieBot animation app and builds a partial Python revival.
Reviewed divided099/MovieOkeAI@ff4d92a
App · Case study:
xLamp reconstructs LampSmartPro 1.4.0's pairing and lamp-control flow in a Flutter Android app.
Reviewed qinjunhaocn/xLamp@9229e9f
App · Case study:
Slovak Telekom App API documents HTTP requests recovered from the operator's mobile app.
Reviewed TheMorc/telekom-api@9eced6d
App · Case study:
dyson-lamp-ble reconstructs local control of a Dyson BLE lamp from MyDyson Android app analysis and device observations.
Reviewed bikenthusiast/dyson-lamp-ble@bd048fa
App · Case study:
MiFit-Hack-API documents Mi Fit Android app requests observed through mitmproxy and provides Python access scripts.
Reviewed bysiber/MiFit-Hack-API@dffefe9
App · Case study:
The Foreca S60 weather server reconstructs the legacy HTTP service expected by Foreca Weather 1.4.x on Nokia Symbian phones.