# Curated reverse engineering resources · Page 34

> Page 34 of 52, entries 3,301–3,400. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/34/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/34/index.md>

## Apps (100)

- [iX500 Scan: a macOS client for the reverse-engineered ScanSnap Wi-Fi protocol](https://awesomerea.org/resources/ix500-scan-scansnap-wifi-case/index.md): Case study · Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.
- [WristBeam: reconstructing Garmin’s watch protocol for a Mac companion](https://awesomerea.org/resources/wristbeam-garmin-watch-protocol-case/index.md): Case study · Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.
- [usque: an open reimplementation of Cloudflare WARP’s MASQUE mode](https://awesomerea.org/resources/usque-warp-masque-client-case/index.md): Case study · Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.
- [Webamp: a browser reimplementation of Winamp 2](https://awesomerea.org/resources/webamp-winamp-reimplementation-case/index.md): Case study · Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.
- [NOOP: an offline WHOOP strap client built from Bluetooth protocol research](https://awesomerea.org/resources/noop-whoop-ble-client-case/index.md): Case study · Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. A versioned protocol reference documents framing, checksums, commands and sensor records per strap family, building on the community my-whoop and goose projects. WHOOP 4.0 is the supported path; deeper WHOOP 5.0/MG metrics and Oura ring support remain experimental.
- [NiimBlue: an independent web client for NIIMBOT label printers](https://awesomerea.org/resources/niimblue-niimbot-printer-client-case/index.md): Case study · Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. Printer communication comes from the same author's NiimBlueLib, which the README calls the most complete implementation of the NIIMBOT protocol; the protocol is documented on the NIIMBOT Community Wiki, and owners of models that do not print are asked for a packet capture of a print made with the official app. The README says the client runs entirely in the browser and keeps label data there.
- [open_oura: a cloud-free Oura Ring client built on its reverse-engineered BLE protocol](https://awesomerea.org/resources/open-oura-ring-protocol-case/index.md): Case study · Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. The author reports recovering the GATT layout, packet framing and AES app-auth flow from the decompiled Android app, and porting history-event decoders and several on-device metrics, such as HRV, sleep debt and nightly temperature baselines, from Ghidra decompilations of the app's native libraries. Event bodies are stored raw in SQLite so they can be re-decoded as decoders improve.
- [Sony Headphones Client: a desktop client for Sony’s headset control protocol](https://awesomerea.org/resources/sony-headphones-client-case/index.md): Case study · Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. The author reports reverse engineering the phone app to define its control protocol, and the code rebuilds its message framing, with start and end markers, byte escaping, sequence numbers, a sum checksum and acknowledgements, together with the two set-parameter commands the client sends. Full support is reported for few models, mainly the WH-1000XM3, and the project is archived.
- [cbyge: reconstructing the C by GE smart-bulb cloud protocol](https://awesomerea.org/resources/cbyge-c-by-ge-protocol-case/index.md): Case study · Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app. The author reports decompiling the Android app with Apktool, finding its JSON HTTP API for login and device lists and a separate raw TCP protocol to the vendor's server, then working out that protocol's type-and-length message framing and packet encodings from proxied traffic and the Smali code. The resulting API lists devices, reads their status and sets power, brightness, color tone and RGB color.
- [Clickwill: reconstructing iPod library database editing](https://awesomerea.org/resources/clickwill-case/index.md): Case study · Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app. It reads and writes iTunesDB and ArtworkDB on the device, preserves unknown record bytes, handles hash58 signatures and publishes a byte map that distinguishes measured fields from uncertain ones.
- [Spark Mail: rehosting the Windows desktop app on Linux with Wine shims](https://awesomerea.org/resources/spark-mail-linux-case/index.md): Case study · spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts. The project documents application startup, browser authentication, notifications, clipboard and file-opening behavior, then patches specific DLL imports and bridges those functions to the Linux desktop.
- [OpenTracks: a UWP port of OpenTracks7 BETA1](https://awesomerea.org/resources/opentracks-uwp-case/index.md): Case study · OpenTracks is an early UWP port of the OpenTracks7 BETA1 Windows Phone music app informed by the author's reverse engineering. Its C# and XAML implementation updates page control access and replaces WP7 MediaPlayerLauncher with UWP media playback APIs.
- [RTO eChalan: investigating a BankBot Android APK](https://awesomerea.org/resources/rto-echalan-android-analysis-case/index.md): Case study · The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.
- [AOL 7.0 Retro Server: reconstructing the P3 server session](https://awesomerea.org/resources/aol7-retro-server-case/index.md): Case study · AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client. It reconstructs the proprietary P3 login and security exchange, the handoff between login and BOS servers, and post-login data used to display the welcome screen and buddy list.
- [SteelSeries Overlay Hook: mapping and hooking the GameOverlay swapchain](https://awesomerea.org/resources/steelseries-overlay-hook-case/index.md): Case study · SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook. Its injector and hook render Dear ImGui content through the existing GameOverlay window by intercepting Present and ResizeBuffers.
- [WeChat: recovering SQLCipher keys through CommonCrypto hooks](https://awesomerea.org/resources/wechat-4-1-10-macos-key-case/index.md): Case study · An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB. It compares that approach with memory scanning and sqlite3_key breakpoints, and describes an offline check against a decrypted SQLite page.
- [Siriously: recovering macOS Writing Tools entry points](https://awesomerea.org/resources/siriously-writing-tools-case/index.md): Case study · Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client. The author used Objective-C runtime introspection and behavioral tracing to identify private WritingToolsUI classes, then passes selected text to the popover and writes accepted results back through Accessibility APIs. The findings concern one macOS build.
- [tuya-mobile: a Python reconstruction of Tuya app signing and API calls](https://awesomerea.org/resources/tuya-mobile-security-layer-case/index.md): Case study · tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.
- [ddg-tenor-bridge: replacing Gboard's Tenor search endpoint](https://awesomerea.org/resources/ddg-tenor-bridge-case/index.md): Case study · ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form. Its documented workflow changes Gboard's persisted search URL flag while leaving other Tenor features on their original endpoint.
- [MSP CSV Export Format: reconstructing My Stocks Portfolio exports](https://awesomerea.org/resources/msp-csv-format-case/index.md): Case study · MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app. The author compared eleven iOS exports, app displays and public translation strings to describe columns, blocks and transaction replay. A dependency-free Python parser and synthetic export exercise the documented rules and flag malformed input.
- [Benro Polaris Firmware Patcher: rebuilding camera control and mapping the app protocol](https://awesomerea.org/resources/benro-polaris-firmware-patcher-case/index.md): Case study · Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. Its documentation maps Benro Connect app behavior and the TCP messages used to control the device. The author reports end-to-end testing with a Canon EOS R5 Mark II.
- [Malware Analysis: a trojanized FL Studio installer and Go stealer](https://awesomerea.org/resources/fl-studio-stealer-analysis-case/index.md): Case study · This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer. The author traces the wrapper statically and studies the payload in an isolated Windows environment with process, registry and network observations, recovering its reported command-and-control mechanism.
- [grsimwrite-mac: reconstructing GRSIMWrite for macOS](https://awesomerea.org/resources/grsimwrite-mac-case/index.md): Case study · grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS. Its research records card-family profiles and APDU write behavior, while the implementation identifies cards, reads elementary files, writes selected fields, and builds formatting sequences.
- [dola-client: reconstructing Dola's Android app API access](https://awesomerea.org/resources/dola-client-case/index.md): Case study · dola-client reconstructs access to the Dola AI Android app API from captured phone traffic. It provides Python signing and API-call code, a demonstration chat CLI, and session import from a logged-in Android app or browser cookies.
- [mcp-fitbod: mapping Fitbod Android models and backend APIs](https://awesomerea.org/resources/mcp-fitbod-api-case/index.md): Case study · mcp-fitbod maps Fitbod backend endpoints and serialization schemas from decompiled Kotlin models in the Android app, then uses the documented interface in an MCP account client. Its endpoint map and schema notes identify request paths, model fields and wire names, including JSON:API and Moshi naming differences.
- [FlyBird-ProtocolAnalysis: FlyBird client subscription protocol and APXS v2 format](https://awesomerea.org/resources/flybird-protocol-analysis-case/index.md): Case study · FlyBird-ProtocolAnalysis investigates the FlyBird proxy client's subscription delivery and APXS v2 format across Windows, Android, Linux and OpenWrt. Its reports describe client static analysis, process-memory inspection, GDB breakpoints and TLS observation; accompanying code decrypts the envelope and reproduces the documented mTLS request flow using user-supplied account credentials and certificates from the user's installed client.
- [SwiftCUA: reconstructing a macOS computer-use service](https://awesomerea.org/resources/swiftcua-case/index.md): Case study · SwiftCUA reconstructs the behavior of a macOS computer-use service in Swift 6 after studying the Codex Computer Use.app bundle, its local IPC, permissions and input engine. It provides a background service, CLI, JavaScript bridge and MCP servers for accessibility inspection, screenshots and input, with separate research reports on the original.
- [IOSVM: booting iOS 16.5 user space in QEMU on Linux](https://awesomerea.org/resources/iosvm-case/index.md): Case study · IOSVM ports Darwin/XNU components so user-supplied iOS 16.5 user space can boot in QEMU on Linux. Its QMP input channel and web/VNC bridge expose taps, swipes, keyboard input, and rendered frames; the author reports that home-screen boots remain intermittent and rendering uses a CPU rasterizer.
- [BOSS GX-10: reconstructing the TSL preset format](https://awesomerea.org/resources/boss-gx10-tsl-format-case/index.md): Case study · A specification reconstructs the .tsl.json preset format used by BOSS Tone Studio for the GX-10 processor. It maps the JSON structure, hex-encoded parameter arrays, patch names, effect routing and control assignments, with Python examples and research notes.
- [Valeton GP180: USB MIDI SysEx protocol investigation](https://awesomerea.org/resources/valeton-gp180-rev-eng-case/index.md): Case study · Valeton GP180 Reverse Engineering investigates the guitar processor's USB MIDI SysEx traffic, firmware and companion Suite software. Its capture analysis reassembles fragmented SysEx messages and records framing, transaction fields and observed message families for presets, effects, settings and file transfers.
- [fiilpod: FIIL earbud protocols integrated into HyperOS](https://awesomerea.org/resources/fiilpod-case/index.md): Case study · fiilpod reconstructs FIIL earbud control protocols and integrates their battery, noise-control, EQ, and spatial-audio state into Xiaomi HyperOS. Its LSPosed module injects into Bluetooth and settings processes, communicates over SPP or BLE GATT, and documents GAIA, Mate, Airoha, and other command families.
- [upright: reconstructing Lightroom Classic's perspective correction](https://awesomerea.org/resources/lightroom-upright-case/index.md): Case study · upright reconstructs Lightroom Classic's Upright perspective correction from catalog transforms, controlled application runs, and selected CameraRaw binary observations. It publishes a two-camera homography model, measured Auto-mode behavior, evidence files, and an MIT-licensed Python port; the author reports that the port performs poorly on real photographs.
- [studio3svg: reconstructing the Silhouette Studio document format](https://awesomerea.org/resources/studio3svg-case/index.md): Case study · studio3svg reconstructs readable parts of Silhouette Studio .studio3 documents and converts their cut outlines to millimetre-based SVG. Its format specification records section structure, shapes, page size and stored previews, while a CLI, library and browser converter implement the reader.
- [technics-az100: a Windows client for EAH-AZ100 earbud controls](https://awesomerea.org/resources/technics-az100-case/index.md): Case study · technics-az100 reimplements control of Technics EAH-AZ100 earbuds on Windows through the Airoha RACE Bluetooth RFCOMM channel. A tray app and CLI set noise cancellation and ambient modes and read battery and codec status; a protocol log records frames and command IDs recovered from Android app analysis and Bluetooth captures.
- [SberBoom Remote: reconstructing local speaker control and StarOS messages](https://awesomerea.org/resources/sberboom-remote-case/index.md): Case study · SberBoom Remote implements Android and Windows clients for local control of SberBoom speakers over StarOS WebSocket messages. It ports the TLV protocol from a credited Home Assistant integration, then records pairing behaviour, opcodes and responses measured on a SberBoom Mini. An accompanying investigation examines the official Салют APK for device settings and their transport.
- [Curiosity Daily API: endpoints recovered from the Android app](https://awesomerea.org/resources/curiosity-daily-api-case/index.md): Case study · Curiosity Daily API documents endpoint paths recovered by decompiling version 3.21.6 of the Curiosity Android app. Its tables group GET, POST and DELETE routes for feeds, content, subscriptions, likes and authentication.
- [prism_connect: PRISM Live Studio remote protocol implementation](https://awesomerea.org/resources/prism-connect-prism-live-studio-case/index.md): Case study · prism_connect implements the remote-control protocol of PRISM Live Studio v4.0.0+ as a Dart library. Its protocol notes describe the QR-code connection data, raw TCP session, message layout and commands; the example connects, sends commands and handles server messages.
- [qcywatch-android: a QCY Watch GT2 client built from BLE protocol research](https://awesomerea.org/resources/qcywatch-android-case/index.md): Case study · qcywatch-android replaces the QCY companion app for the QCY Watch GT2 using BLE frames derived from the vendor app and captured watch traffic. It forwards notifications and weather, exports health data to Health Connect and saves workouts as TCX files; frame handling and parsers are implemented in Kotlin.
- [Tabelog API: reconstructing the Tabelog Inbound backend specification](https://awesomerea.org/resources/tabelog-api-spec-case/index.md): Case study · Tabelog API reconstructs an OpenAPI 3.0.3 description of the Tabelog Inbound 2.24.1 app backend from decompiled smali. Its scripts extract API definitions and serializers into YAML and JSON specifications, while notes cover endpoint paths, token handling, and selected live checks reported by the author.
- [Platinenlupe: reconstructing an EarVision camera protocol for browser viewing](https://awesomerea.org/resources/platinenlupe-case/index.md): Case study · Platinenlupe reconstructs an EarVision Wi-Fi ear camera's communication for browser-based PCB inspection. The author documents APK and firmware analysis that recovered BLE wake-up, Wi-Fi access, UDP JPEG framing and light control, then implements a two-board ESP bridge and local viewer.
- [Wuwa Tappo Linux: a Qt reconstruction of the desktop shell](https://awesomerea.org/resources/wuwa-tappo-linux-case/index.md): Case study · Wuwa Tappo Linux reimplements the Windows-only shell of the Wuwa Tappo desktop pet as a Qt 6 application for Linux. It loads the web frontend extracted locally from the user's own 1.0.1 installer and supplies native window, input and WebSocket components; the author reports tests mainly in a nested Fedora Asahi Remix Wayland session.
- [Ocypus Digital Controller: reconstructing cooler display communication](https://awesomerea.org/resources/ocypus-controller-case/index.md): Case study · Ocypus Digital Controller implements a Linux daemon and CLI for Ocypus digital cooler displays using USB HID communication recovered from the Ocypus Digital Elite Windows utility. Its documentation maps standard 64-byte reports and a YCC variant, including temperature, utilization, fan and display mode fields.
- [dvpn-decrypter: exporting SOLAR Labs dVPN mnemonics](https://awesomerea.org/resources/dvpn-decrypter-case/index.md): Case study · dvpn-decrypter reconstructs a mnemonic export path for the SOLAR Labs dVPN app. Its Go utility signs in with account credentials, requests the encrypted app key and mnemonic from the service, and uses Themis to decrypt the key and then the mnemonic.
- [OpenCfMoto for iOS: a PXC motorcycle-dashboard client](https://awesomerea.org/resources/opencfmoto-ios-case/index.md): Case study · OpenCfMoto for iOS reimplements the PXC dashboard exchange used by Carbit and EasyConnect motorcycle displays. The Swift app joins the bike's Wi-Fi, performs the control handshake, streams an H.264 navigation interface, and receives dashboard touch events. Its specifications trace behavior extracted from the Android OpenCfMoto app.
- [MechControl: replacing Uniwill laptop control through EC research](https://awesomerea.org/resources/mechcontrol-case/index.md): Case study · MechControl replaces the OEM Control Center on Uniwill-built MECHREVO, XMG and Eluktronics laptops with a native Windows application. It uses recovered embedded-controller registers, encodings and write sequences to manage CPU and GPU power, fans, battery modes and lighting. The author reports hardware testing on one MECHREVO IDY_7Y board; other model profiles derive from OEM data.
- [codex-app for macOS: reconstructing the Codex desktop workspace](https://awesomerea.org/resources/codex-app-case/index.md): Case study · codex-app for macOS reconstructs the Codex desktop workspace as an Electron, React and TypeScript client for the official Codex app-server. Its study combines source and asset inspection, recorded interactions, layout measurements and protocol traces; the client implements chats, editing, diffs, terminals and browser tabs.
- [FIIL headphones: reconstructing Bluetooth control commands](https://awesomerea.org/resources/fiil-headphone-protocol-case/index.md): Case study · The FIIL headphone study reconstructs Bluetooth control framing and command behavior from FIIL+ 3.5.2 analysis and headset captures. Its documents cover GAIA, Mate and Doubao command spaces, SPP and BLE GATT transport, connection handshakes and response parsing.
- [喜鹊儿 App: reconstructing login, timetable and attendance API behavior](https://awesomerea.org/resources/kingosoft-api-notes-case/index.md): Case study · The 喜鹊儿 App notes reconstruct login, timetable and attendance API behavior from packet captures, app decompilation and active server probes. They describe school routing, action/step requests, timetable day buckets and attendance checks, and pair those findings with a small Python client. The request-envelope encoder remains a version-specific placeholder.
- [BtCarKey: reconstructing a BLE car-key box client](https://awesomerea.org/resources/btcarkey-case/index.md): Case study · BtCarKey implements an Android client for a keyless car box using a reconstructed FTK BLE interface. Its protocol notes map advertising data, GATT UUIDs, a 16-byte frame header, checksums, challenge authentication and car control commands. The client uses those messages to pair with and operate the box.
- [printer-craft: reconstructing PdfCraft.app's CUPS printing pipeline](https://awesomerea.org/resources/printer-craft-case/index.md): Case study · printer-craft reconstructs the CUPS printing pipeline identified in PdfCraft.app as a Python library and CLI. Its analysis maps Mach-O symbols and disassembly to printer discovery through lpstat, PPD option parsing through lpoptions, argument assembly and print submission through lp.
- [studo.js: a client for Studo's recovered chat API](https://awesomerea.org/resources/studo-js-case/index.md): Case study · studo.js implements a TypeScript client for the Studo app's REST and socket.io chat interfaces after APK and network-packet analysis. Its endpoint notes cover request headers and API paths, while the client handles SMS login, channels, tabs, topics and messages.
- [MAL Private API: reconstructing MyAnimeList Android endpoints](https://awesomerea.org/resources/mal-private-api-case/index.md): Case study · MAL Private API documents the private MyAnimeList JSON interface recovered from version 0.11.8 of its Android app and supplies a Node.js client. Its reference describes request encoding, selected endpoint fields, and client-ID use for the examined app version.
- [Better Essential Space: reconstructing a macOS client for Nothing's service](https://awesomerea.org/resources/better-essential-space-case/index.md): Case study · Better Essential Space reconstructs access to Nothing's Essential Space in a native macOS client after studying its Android app and undocumented APIs. It implements the five-step account login, request signing, record and collection retrieval, audio downloads, and edits to record titles, summaries, and topics; research notes and Frida scripts document the findings.
- [EasyKit: reconstructing local TLS and SIP control of a door station](https://awesomerea.org/resources/bticino-easykit-reclaim-case/index.md): Case study · The EasyKit investigation reconstructs local access to a BTicino / Legrand door station from companion-app analysis and SIP-TLS traffic. Its scripts recover the owner's TLS client identity; the author reports a successful handshake and accepted SIP registration. The author also reports a separate home service for ring photos and lock release, whose implementation remains unpublished.
- [Bull MosHome: reconstructing cloud controls for Home Assistant](https://awesomerea.org/resources/bull-moshome-case/index.md): Case study · Bull MosHome implements a Python client and Home Assistant integration using MosHome cloud behavior analyzed from the Android app and network requests. Its protocol notes cover x-ca HMAC-SHA256 signing, login encryption, HTTPS controls and MQTT state updates for supported switches, lights, curtains and chargers.
- [xperia-firmware-toolkit: Xperia Companion and firmware-delivery findings](https://awesomerea.org/resources/xperia-firmware-toolkit-case/index.md): Case study · xperia-firmware-toolkit documents how Xperia Companion stores and downloads Sony Xperia firmware. Its investigation covers the app's Java/OSGi bundles, the ESS API request sequence and the SIN boot-image layout. PowerShell scripts capture firmware downloaded by Companion, and a separate guide covers Xperia 1 IV rooting and data migration.
- [FABA on Linux: reconstructing the speaker's song format](https://awesomerea.org/resources/faba-tools-case/index.md): Case study · FABA on Linux reconstructs how the FABA speaker stores and plays songs by examining the myFaba Electron app and files on the device. It documents MKI folder naming and XOR plus bit-rotation audio encoding, then provides Python tools to convert, encode, and load user-provided MP3s from Linux.
- [Voicemeeter: mapping the Audio Callback API](https://awesomerea.org/resources/voicemeeter-audio-callback-case/index.md): Case study · Voicemeeter Audio Callback research maps callback modes, command codes, buffer layouts, and calling conventions observed in Voicemeeter Potato. Python ctypes examples explore modes, preserve audio passthrough, and measure channel levels. The author reports testing on Potato 3.1.3.0.
- [Lidl Plus: mapping Lidl Pay API requests](https://awesomerea.org/resources/lidl-plus-pay-api-case/index.md): Case study · lidl-plus-reverse documents Lidl Pay requests observed between the Lidl Plus app and its server. Its endpoint reference records authentication headers, methods, and bodies for loyalty lookup, payment methods, PIN validation, QR generation, and activation in the Spain region.
- [open-cardi: reconstructing Cardi lighting control over BLE](https://awesomerea.org/resources/open-cardi-case/index.md): Case study · open-cardi reconstructs BLE control of Cardi K3 and K4 Active Ultra lighting kits in Android and web clients. The author derived GATT services, packet framing, and command behavior from decompiled vendor apps and HCI snoop replay, including color, zone, pattern, and reset operations.
- [Pool Comfort / Galaxywind: a local heat-pump client from Android and UDP analysis](https://awesomerea.org/resources/poolcomfort-galaxywind-case/index.md): Case study · Pool Comfort / Galaxywind implements a local Python client and Home Assistant component for pool heat pumps using UDP behavior recovered from the vendor Android app and LAN captures. It documents discovery on port 8818, sessions on port 1194, login, state attributes and control commands.
- [Mondeer Bluetooth scale: reconstructing BLE weighing and binding](https://awesomerea.org/resources/mondeer-bluetooth-scale-ha-case/index.md): Case study · Mondeer Bluetooth scale reconstructs the BLE exchange used by Mondeer and WanKa C1 bathroom scales and implements a Python listener that publishes weighing data to Home Assistant over MQTT. The documented work combines decompilation of the original Android app with traffic observation; a separate Android companion app displays readings and exports to Health Connect.
- [Smartboard notebook Exporter: documenting and converting .notebook files](https://awesomerea.org/resources/smartboard-notebook-exporter-case/index.md): Case study · Smartboard notebook Exporter documents the .notebook file format produced by a SMART Board MX065 iQ and converts whiteboard pages to SVG, PNG or PDF. It treats the document as a ZIP container, reads page SVGs and their order from the manifest, then adjusts page canvases before export.
- [WeChat: recovering macOS chat databases for HTML export](https://awesomerea.org/resources/wechat-export-case/index.md): Case study · The WeChat export investigation recovers chat data from WeChat 4.x for macOS. A Frida hook captures keys passed to CommonCrypto's CCCryptorCreate; Python scripts match the per-database keys to SQLCipher stores, decrypt the files, parse contact and message tables, and generate browser-readable HTML. The documentation records database paths and message-layout differences.
- [led-hue-cycle: reconstructing LEDDMX strip control over BLE](https://awesomerea.org/resources/led-hue-cycle-case/index.md): Case study · led-hue-cycle reconstructs LED LAMP's BLE commands for LEDDMX-family light strips in a native Android app and Python scripts. Its protocol reference specifies the FFE0 service, FFE1 write characteristic and nine-byte frames for color, power, brightness and patterns; the clients use those commands to cycle one or more strips through hues.
- [OPPO 移动电源助手: reconstructing power bank control on macOS](https://awesomerea.org/resources/oppo-powerbank-mac-case/index.md): Case study · OPPO 移动电源助手 reconstructs power bank control on macOS from analysis of a Windows .NET assistant and its USB serial exchange. Its reports describe 0x5A packet headers, command IDs, and CRC8, while the Avalonia client displays battery and port status and synchronizes the clock.
- [LaMetric TIME Recovery Toolkit: recovering the clock setup API](https://awesomerea.org/resources/lametric-time-recovery-case/index.md): Case study · LaMetric TIME Recovery Toolkit reconstructs the clock's Wi-Fi provisioning exchange from its Android APK and implements it in Linux scripts. It documents the setup AP's HTTP endpoints, account and Wi-Fi payloads, authentication and status codes, with DEX inspection helpers for examining the app.
- [AvellSucks: reconstructing Avell laptop EC controls](https://awesomerea.org/resources/avellsucks-case/index.md): Case study · AvellSucks is a Windows control app for an Avell gaming laptop’s fan, power settings and devices. The author recovered fan and power EC registers and WMI ACPI calls from the decompiled OEM app and hardware probes; the WPF app uses read-back checks and an audit log for EC writes. Other device controls use Windows APIs.
- [PodFlick: reconstructing iPod Video library editing](https://awesomerea.org/resources/podflick-case/index.md): Case study · PodFlick reconstructs iTunesDB editing for fifth-generation iPod Video devices in a macOS video-transfer app. It converts clips to H.264 Baseline and AAC with ffmpeg, then writes video records directly into the device database without iTunes. The repository includes a format specification, Python reference implementation and database fixtures.
- [Vcf-compiler: reconstructing the VCutWorks VCF file format](https://awesomerea.org/resources/vcf-compiler-case/index.md): Case study · Vcf-compiler reconstructs the binary VCF file format used by Ruida VCutWorks. It compares native files with generated variants, documents header, layer, geometry and trailer fields, and implements a Python writer that converts DXF input or a specification into VCF. The author reports that generated files load in VCutWorks with geometry and cutting parameters displayed.
- [podscribe: reconstructing the old iPod iTunesDB writer](https://awesomerea.org/resources/podscribe-itunesdb-case/index.md): Case study · podscribe reconstructs old-format iTunesDB writing for the 5.5-generation iPod Video in TypeScript. Its format notes map the little-endian chunk tree and playlist references, while the library writes track and playlist records and includes a reader for comparison with an iTunes-generated database.
- [GameSir Connect: reconstructing controller-profile share codes](https://awesomerea.org/resources/gamesir-connect-codec-case/index.md): Case study · GameSir Connect share-code research reconstructs the desktop app's controller-profile export format and supplies a Python codec for editing and reimporting profiles. The documented GAMESIR: pipeline combines JSON, gzip, Base64 and AES-256-CBC, with a derived key and IV; the author reports testing on a GameSir G7 Pro.
- [sperax-rm01: reconstructing the Sperax RM-01 BLE controls](https://awesomerea.org/resources/sperax-rm01-case/index.md): Case study · sperax-rm01 reconstructs the Sperax RM-01 walking pad's BLE controls as a Python library and CLI. Analysis of the Sperax Fitness Android app's Dart AOT binary informed its documented FFF0 service, F5-framed messages, CRC-16 variant and start, stop and speed commands for model WLT6200.
- [UNAR6: reconstructing the AR6 archive format](https://awesomerea.org/resources/unar6-case/index.md): Case study · UNAR6 reconstructs the AR6 archive format used by the Manažer M602 DOS file manager from observed archives. Its format notes specify record headers, directory entries, checksums and PKWARE DCL compression, while C, Pascal and Python implementations list, test and extract archive contents.
- [BlackBerry 10 Assistant: reconstructing Dragon and Maluuba protocols](https://awesomerea.org/resources/bb10-assistant-protocol-case/index.md): Case study · The BlackBerry 10 Assistant reference reconstructs the Dragon speech-service and Maluuba intent-service exchanges needed by the phone's original Assistant. It documents multipart audio and NLSML messages, JSON classifications, plugin intent fields and dialogue turns, along with the device settings and patches needed to direct the client to a replacement server.
- [Packet Tracer .pkt/.pka: reconstructing the lab file format](https://awesomerea.org/resources/packet-tracer-pkt-format-case/index.md): Case study · The Packet Tracer .pkt/.pka project reconstructs Cisco Packet Tracer's encrypted lab-file containers and their XML payloads. Its Python codec and CLI decode, re-encode, inspect, diff and export files, while a builder generates lab topologies and scored activities using documented cipher, compression and schema details.
- [mihealth-api: reconstructing Mi Fitness health-data access](https://awesomerea.org/resources/mihealth-api-case/index.md): Case study · mihealth-api reconstructs access to personal Mi Fitness health data from the com.mi.health client API. Its Python client implements session handling and encrypted requests, synchronizes records into SQLite, and exposes local HTTP queries and a dashboard; API notes document endpoint and field behavior.
- [garmin-proto-lab: reconstructing Garmin watch communication](https://awesomerea.org/resources/garmin-proto-lab-case/index.md): Case study · garmin-proto-lab reconstructs Garmin watch-facing GFDI communication in a Python compatibility client using findings from Garmin Connect's Android package. Its specification covers BLE routing, pairing, authentication, MultiLink transport, file access and FIT validation; the author reports offline implementation and tests, with live watch checks remaining.
- [Dorado: reconstructing a Zune HD application runtime](https://awesomerea.org/resources/dorado-emu-case/index.md): Case study · Dorado reconstructs a Zune HD application runtime for .zcp and .ccgame packages. It parses NX and cabinet containers, remaps .NET Compact Framework identities and runs managed XNA 3.1 applications against a clean-room compatibility layer; the implemented desktop host also tests game rendering.
- [eJay: static recompilation of the Dance eJay audio engines](https://awesomerea.org/resources/ejay-static-recompilation-case/index.md): Case study · eJay statically recompiles the audio and graphics libraries of Dance eJay titles for a new cross-platform host. Its tools lift user-supplied DLLs to C for Linux and macOS, while a host drives the original libraries on Windows; the documented eJay 2 workspace supports sample browsing, block placement and playback.
- [vclights: reconstructing VC-BLELIGHT lamp commands](https://awesomerea.org/resources/vclights-case/index.md): Case study · vclights reconstructs VC-BLELIGHT lamp control from the Raingel Android app's BLE commands. Its Python client sets power, brightness, color and firmware modes, while protocol notes identify GATT services, write characteristics and opcode payloads; camera-based observations document device responses and color limits.
- [ilo2ctl: rebuilding the HP iLO 2 remote console and controls](https://awesomerea.org/resources/ilo2ctl-case/index.md): Case study · ilo2ctl rebuilds HP iLO 2 remote-console and management controls in C++, including DVC video decoding, keyboard and mouse input, RIBCL power and health operations, and ISO virtual media. The author reports comparing ported applet components byte for byte with recorded outputs from HP's Java classes.
- [gpcli: reconstructing MyGP subscriber app API flows](https://awesomerea.org/resources/gpcli-case/index.md): Case study · gpcli reconstructs the MyGP Android subscriber app's API behavior as a Python command-line client. Based on decompiled APK and smali analysis, it implements authentication, balances, packs, purchases, recharge, billing and other account flows; the author reports live validation of read paths and selected transactions.
- [Atmoph Window 2 Remote: reconstructing local BLE control](https://awesomerea.org/resources/atmoph-window-2-remote-case/index.md): Case study · Atmoph Window 2 Remote implements local Home Assistant control of an Atmoph Window 2 through BLE commands recovered from the vendor Android app. Its documentation maps GATT characteristics, control tokens and quick settings, and records which behavior remains to be checked on AW102 hardware.
- [Antigravity session interoperability: reconstructing the CLI session format](https://awesomerea.org/resources/antigravity-session-interoperability-case/index.md): Case study · Antigravity session interoperability reconstructs a subset of Antigravity CLI 1.1.16's local SQLite and protobuf session format on Linux x86-64. Its Python generator creates synthetic conversation and summary databases; the author reports that the CLI displayed and resumed the generated session.
- [MIRO SmartHome: reconstructing app API control in Home Assistant](https://awesomerea.org/resources/miro-smarthome-ha-case/index.md): Case study · MIRO SmartHome reconstructs control of devices registered in the MIRO SmartHome app through a Home Assistant integration. It uses the app-derived cloud API and server model definitions to create fan, humidifier, sensor and switch entities. The author reports hardware tests on the MF03 fan and NR07 humidifier; other listed models were checked against definitions.
- [ScanStudio: reconstructing a Nikon LS-5000 scanning workflow](https://awesomerea.org/resources/scanstudio-nikon-coolscan-case/index.md): Case study · ScanStudio provides a native macOS scanning workflow for the Nikon SUPER COOLSCAN 5000 ED. It combines documented observation of Nikon Scan 4 with a Swift app, Rust engine and optional CoolscanPy hardware bridge for previewing film, selecting frames and capturing scans; the author reports testing real scans on one Mac and scanner setup.
- [tc01a: reconstructing Fluke iSee TC01A USB control](https://awesomerea.org/resources/tc01a-thermal-camera-case/index.md): Case study · tc01a reconstructs Fluke iSee TC01A camera control from the Android app and native library behavior. Its Python libusb driver streams thermal video, decodes per-pixel temperatures and sends vendor USB commands for shutter, gain and emissivity settings.
- [YouTubeClient: a UWP port of a decompiled WP7 client](https://awesomerea.org/resources/youtubeclient-uwp-case/index.md): Case study · YouTubeClient adapts a decompiled Windows Phone 7 YouTube client XAP into a UWP application for Windows 10 Mobile and desktop. The port replaces WP7 navigation, settings storage, and dialogs with UWP equivalents while retaining the original page structure. The author reports an early draft with broken interface elements and nonworking search and top-video display.
- [wuibi: recovering Quibi’s mobile API for a web client](https://awesomerea.org/resources/wuibi-case/index.md): Case study · wuibi reconstructs enough of Quibi’s mobile API to provide search and playback in a browser WebExtension. The author captured iOS and Android traffic, decompiled the Android APK, and recovered readable .proto definitions from embedded Protocol Buffer descriptors. The client then used those definitions to request playback information and hand streaming to Shaka Player; the service’s shutdown has left the client inoperative.
- [Smart Life cloud plug CLI: reconstructing mobile signing and control](https://awesomerea.org/resources/smartlife-app-tuya-case/index.md): Case study · Smart Life cloud plug CLI reconstructs the Smart Life Android 7.10.6 signing and login flow for cloud-connected plugs. It extracts app signing material from the user's APK, selects a compatible signature form, and sends signed requests to list devices, read status and switch a plug.
- [timeline-export: decoding Google Maps Timeline sync and place IDs](https://awesomerea.org/resources/timeline-export-case/index.md): Case study · timeline-export reconstructs Google Maps Timeline retrieval and decoding to export on-device location history as JSON. It calls Geller BatchSync, decrypts AES-256-GCM payloads, decodes SemanticSegment records and converts stored FeatureId values to Maps place IDs.
- [waze-stuff: mapping Waze tile formats](https://awesomerea.org/resources/waze-stuff-case/index.md): Case study · waze-stuff investigates Waze map-tile files through hex patterns and Python, TypeScript and C code for parsing and partial tile generation. It documents WZM/MAP_PKG, WZDF and WZT structures, including geometry, street labels and tile coordinates.
- [Notepad Tabs: mapping saved tab files](https://awesomerea.org/resources/notepad-tabs-format-case/index.md): Case study · Notepad Tabs maps the binary format of Windows Notepad’s saved and unsaved tab files. It documents NP headers, paths, content, selection positions, SHA-256 and CRC fields, plus unsaved edit chunks, and supplies sample dumps and an ImHex pattern.
- [MovieOkeAI: investigating and rebuilding MovieBot](https://awesomerea.org/resources/movieokeai-case/index.md): Case study · MovieOkeAI investigates the discontinued MovieBot animation app and builds a partial Python revival. The author describes APK inspection and MitMProxy captures to trace story prompts, the former web API, voice generation and animation settings, then implements basic generator, store and backend components.
- [xLamp: LampSmartPro lamp-control protocol and Android client](https://awesomerea.org/resources/xlamp-case/index.md): Case study · xLamp reconstructs LampSmartPro 1.4.0's pairing and lamp-control flow in a Flutter Android app. It documents a 31-byte command frame with AES-128, XOR, and CRC-16/CCITT processing, then broadcasts encoded commands through 13 Bluetooth service UUIDs to control pairing, power, brightness, color temperature, and scenes.
- [Slovak Telekom App API: mapping the mobile service requests](https://awesomerea.org/resources/slovak-telekom-app-api-case/index.md): Case study · Slovak Telekom App API documents HTTP requests recovered from the operator's mobile app. Its reference covers PIN verification, access and refresh tokens, account profiles, dashboard data and billing calls, with a Python example client.
- [dyson-lamp-ble: reconstructing local control of a Dyson lamp](https://awesomerea.org/resources/dyson-lamp-ble-case/index.md): Case study · dyson-lamp-ble reconstructs local control of a Dyson BLE lamp from MyDyson Android app analysis and device observations. Its Python library and CLI obtain an account-issued long-term key, perform the BLE session handshake and send power or synchronized-mode commands. The protocol notes describe GATT characteristics, HKDF-SHA256 key derivation and message framing.
- [MiFit-Hack-API: reconstructing Mi Fit account and fitness requests](https://awesomerea.org/resources/mifit-hack-api-case/index.md): Case study · MiFit-Hack-API documents Mi Fit Android app requests observed through mitmproxy and provides Python access scripts. Its notes map registration and login tokens, a band-data endpoint, and Base64-encoded step and sleep summaries.
- [Foreca S60: reconstructing a legacy weather service](https://awesomerea.org/resources/symbian-foreca-weather-server-case/index.md): Case study · The Foreca S60 weather server reconstructs the legacy HTTP service expected by Foreca Weather 1.4.x on Nokia Symbian phones. A Python bridge translates location and forecast requests to the current Foreca API and other map sources, while a SIS patcher changes the server host in a user's app package. Protocol notes describe the search and weather-package endpoints.