Protocol · Tool:
ORBCOMM receiverC2
ORBCOMM receiver decodes satellite transmissions into packets and parses known packet types.
- Protocol
Reviewed fbieberly/ORBCOMM-receiver@b1b5e4c
Curated reverse engineering resources
5,191Evidence class
- C0full software reconstruction
- C1partial scope or analysis entry
- C2code & docs, no demo or download
- C3notes only
- ?Source unavailable or unreadable at review time
Protocols
720Protocol · Tool:
iridium-snifferC2
iridium-sniffer detects and demodulates Iridium L-band bursts from supported SDR devices or recorded IQ files.
- Protocol
Reviewed alphafox02/iridium-sniffer@830e34c
Game · Tool:
Booma.ProxyC2
Booma.Proxy is a set of C# libraries that model Phantasy Star Online Blue Burst's binary packets for client and server emulation.
- Game
- Protocol
Reviewed HelloKitty/Booma.Proxy@579effb
Protocol · Tool:
gr-elsterC2
gr-elster receives and decodes 902–928 MHz packets from Elster smart meters with a GNU Radio block and sample flow graphs.
- Protocol
Reviewed argilo/gr-elster@bd33fcd
Protocol · Tool:
COMS-1 Meteorological Satellite ToolsC2
COMS-1 Meteorological Satellite Tools parse LRIT and HRIT files carried by the satellite's L-band downlinks.
- Protocol
Reviewed sam210723/COMS-1@0d1d712
Protocol · Tool:
renard-phyC1
renard-phy processes Sigfox uplink and downlink radio frames in Python for software-defined radios.
- Protocol
Reviewed Jeija/renard-phy@d71ebb2
Protocol · Tool:
Bus PirateC2
Bus Pirate firmware turns v3 and v4 boards into terminal-controlled tools for investigating electronic buses.
- Protocol
Reviewed ElderlyPirate/Bus_Pirate@44574ce
Protocol · Tool:
EDACS-FM Florida Man EditionC2
EDACS-FM decodes EDACS 9600 trunked-radio control channels and follows assigned voice channels.
- Protocol
Reviewed lwvmobile/edacs-fm@d92422e
Protocol · Tool:
orbcomm-rxC2
orbcomm-rx demodulates and decodes Orbcomm VHF Subscriber Transmitter downlinks.
- Protocol
Reviewed sam210723/orbcomm-rx@0f86152
Protocol · Tool:
Meteor LRPT DecoderC3
Meteor LRPT Decoder processes Meteor M N2 satellite transmissions into channel packets.
- Protocol
Reviewed opensatelliteproject/metlrpt@3457acd
Protocol · Case study:
open-appleremote: Siri Remote protocol reconstructionC2
Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures.
- Protocol
Reviewed a-funk/open-appleremote@1e6e190
Protocol · Case study:
GAMEKB-K17: reconstructing a macropad configuration protocolC2
Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad.
- Protocol
Reviewed dvdarkin/gamekb-k17@e61f444
Protocol · Case study:
cooler-lcd: a Thermalright display protocol implementationC2
Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application.
- Protocol
Reviewed kristjaningi/cooler-lcd@9a34367
Protocol · Case study:
NJFE: a Soulear camera protocol bridge for desktop inspectionC2
Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer.
- Protocol
Reviewed WildweaselMS/NJFE@992866c
Protocol · Case study:
ultimate2: 8BitDo controller configuration protocol and Linux clientC1
ultimate2 reconstructs the configuration protocol for supported 8BitDo controllers and implements command-line, graphical and browser clients.
- Protocol
Binary · Case study:
remote-me: an Apple TV remote built from iOS Companion protocol analysisC2
remote-me implements an Apple TV browser remote from analysis of iOS TVRemoteCore and Rapport frameworks.
- Binary
- Protocol
Reviewed jxgedouard/remote-me@702a81c
Protocol · Case study:
Attack Shark K86: recovering HID controls from the official driverC1
Attack Shark K86 reconstructs the yc3121 keyboard's HID controls from analysis of its official driver with REA.
- Protocol
Protocol · Case study:
Redragon K652: macOS control from driver and HID analysisC2
Redragon K652 macOS control reconstructs the keyboard's HID configuration protocol from decompilation of its Windows driver with REA and Ghidra.
- Protocol
Protocol · Case study:
AK·LINK: reconstructing AJAZZ AK820 Pro HID controlC2
AK·LINK implements Linux control of the AJAZZ AK820 Pro keyboard through its recovered wired HID commands for lighting, per-key RGB and the TFT screen.
- Protocol
Reviewed AaditPani-RVU/aklink@fe33f8f
Protocol · Case study:
Etrel Load Guard Configurator: reconstructing the meter's UDP protocolC2
Etrel Load Guard Configurator is a Python CLI for discovering, reading and configuring Etrel Load Guard energy meters through a reconstructed UDP protocol.
- Protocol
Reviewed XavierGeerinck/etrel-load-guard-configurator@6e1fc40
Protocol · Case study:
hw-harness: scanner USB protocol investigationC2
Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters.
- Protocol
Reviewed cschalle/hw-harness@093afc5
Protocol · Case study:
Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloudC2
Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes.
- Protocol
Protocol · Case study:
pypush: a Python client for Apple’s push protocolC2
Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications.
- Protocol
Reviewed JJTech0130/pypush@71aa2e4
Protocol · Case study:
PixMob IR reverse engineering: controlling event wristbands at homeC2
Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets.
- Protocol
Reviewed danielweidman/pixmob-ir-reverse-engineering@b372420
Protocol · Case study:
OpenDrop: an open reimplementation of Apple AirDropC2
Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research.
- Protocol
Reviewed seemoo-lab/opendrop@11fe7ba
Protocol · Case study:
bluefluff: reverse engineering Furby Connect's Bluetooth LE protocolC2
Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error.
- Protocol
Reviewed Jeija/bluefluff@9e865c4
Protocol · Case study:
pyatv: a reverse-engineered client for Apple TV and AirPlay protocolsC2
Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered.
- Protocol
Reviewed postlund/pyatv@b277a4c
Protocol · Case study:
BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocolC2
Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time.
- Protocol
Protocol · Case study:
fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote controlC2
Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point.
- Protocol
Reviewed hkr/fuji-cam-wifi-tool@c597fc4
Protocol · Case study:
Gymnasticon: bridging proprietary exercise-bike data to standard cycling sensorsC1
Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike.
- Protocol
Reviewed ptx2/gymnasticon@e142f53
Protocol · Case study:
garmin-ble: a Python client for Garmin's GFDI watch protocolC1
Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service.
- Protocol
Reviewed gwerneckp/garmin-ble@b662032
Protocol · Case study:
bosectl: reconstructing Bose’s BMAP headphone protocolC1
Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM.
- Protocol
Reviewed aaronsb/bosectl@70570b2
Protocol · Case study:
lib-osmo-ble: DJI Osmo Pocket 3 Bluetooth LE protocol libraryC2
Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app.
- Protocol
Reviewed yigitkonur/lib-osmo-ble@021e96c
Protocol · Case study:
DJI MIMO BLE artifacts: reconstructing the DJI Osmo control protocolC2
Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI.
- Protocol
Protocol · Case study:
Cat Printer BLE: reconstructing the MXW01 thermal printer protocolC1
Replaces the vendor phone app for the MXW01 “cat printer”, a small Bluetooth Low Energy thermal printer, with a Windows command-line client.
- Protocol
Reviewed MaikelChan/CatPrinterBLE@007f821
Protocol · Case study:
a0rfid: an open driver for A0-protocol UHF RFID readersC2
Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK.
- Protocol
Reviewed uaih3k9x/a0rfid@944ec15
Protocol · Case study:
Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interfaceC2
Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library.
- Protocol
Reviewed anna-oake/xiaomi-kettle@fbc0b51
Protocol · Case study:
Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio busC2
Documents the medium-speed CAN bus that links the 6000CD radio and the dashboard of a restyled (post-2006) Ford Fiesta MK5, worked out by tapping the bus at the radio's QuadLock connector with a Seeed CAN-BUS Shield on an Arduino Uno.
- Protocol
Protocol · Case study:
uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetryC2
Decodes the undocumented Bluetooth Low Energy output of a Uniden R8 radar detector into a receive-only collector for a Raspberry Pi, with live telemetry, alert start/update/end events, SQLite history and optional MQTT and Home Assistant publishing.
- Protocol
Protocol · Case study:
opendash: reconstructing the Scanmatik SM3 J2534 adapter protocolC2
Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top.
- Protocol
Reviewed PabloSoage/opendash@7c8d729
Protocol · Case study:
OWL: an open Apple Wireless Direct Link implementationC2
Reimplements Apple Wireless Direct Link (AWDL), the proprietary Wi-Fi ad hoc protocol Apple devices use for peer-to-peer links such as AirDrop, as a user-space C daemon for Linux and macOS; the README calls it the result of reverse engineering by the Open Wireless Link project at TU Darmstadt's SEEMOO lab.
- Protocol
Reviewed seemoo-lab/owl@0ee3263
Protocol · Case study:
QuestPad: a USB gamepad from the Quest Touch radio protocolC1
QuestPad implements the Quest Touch controllers' private 2.4 GHz radio protocol on nRF52840 firmware so a computer can use them as a USB gamepad.
- Protocol
Reviewed Jakey-Jakey/questpad@0a96a24
Protocol · Case study:
Stadiacast: reconstructing the Stadia Controller's Wi-Fi serviceC2
Stadiacast recreates the network service used by the Stadia Controller's Wi-Fi firmware so the controller can connect to a local computer.
- Protocol
Reviewed jkfran/stadiacast@61e8aee
Protocol · Case study:
os-xgs-npu: reconstructing Sophos XGS coprocessor interfacesC2
os-xgs-npu reconstructs interfaces to Sophos XGS appliance coprocessors through FreeBSD kernel modules and an OPNsense plugin.
- Protocol
Reviewed AbdelmonemAwad/os-xgs-npu@d469551
Protocol · Case study:
LibreMP: an Epson EasyMP screen caster from packet-capture researchC2
LibreMP casts desktop screens to Epson EasyMP projectors using a protocol reconstructed from Windows client packet captures.
- Protocol
Reviewed MuazTPM-YT/libre-mp@c0fe797
Protocol · Case study:
Sony CDX-A250: reconstructing the LCD panel interfaceC2
Sony CDX-A250 LCD Panel reconstructs the serial control needed to drive the radio's detachable display independently through its LC75826W driver.
- Protocol
Protocol · Case study:
MacroPad: reconstructing a USB macropad configuration protocolC2
MacroPad reconstructs the USB HID configuration exchange of a 12-key, two-knob macropad identified as 1189:8840 and implements it in a Linux GUI.
- Protocol
Reviewed Probler-Yt/MacroPad@2b75543
Protocol · Case study:
Monix: reconstructing Audient iD USB mixer control on LinuxC2
Monix implements Linux mixer control for Audient iD USB audio interfaces through a companion kernel module, protocol library and GUI.
- Protocol
Reviewed sKuhLight/monix@121a1f5
Protocol · Case study:
Scooter Link: a Xiaomi scooter client built from BLE protocol researchC1
Scooter Link implements an Android client for Xiaomi Electric Scooter 5 Pro and 5 Max using a reconstructed BLE authentication protocol.
- Protocol
Binary · Case study:
Sound Blaster AE-9: reconstructing Linux control from Windows driver analysisC2
Sound Blaster AE-9 Linux support reconstructs card and Audio Control Module behavior using static analysis of Creative's Windows drivers and hardware observations.
- Binary
- Protocol
Reviewed verzic/sb-ae9@cbfef7e
Protocol · Case study:
thermalmaster: a Go client for ThermalMaster camera USB commandsC2
thermalmaster implements a Go USB client for ThermalMaster P3 and P1 thermal cameras using documented VDCMD control transfers.
- Protocol
Reviewed xaionaro-go/thermalmaster@4a52a1f
Protocol · Case study:
open-rknpu: Rockchip NPU task-program reconstructionC2
open-rknpu reconstructs a task-program interface for the Rockchip RV1103/RV1106 NPU from board experiments and black-box comparisons.
- Protocol
Reviewed dnhkng/open-rknpu@0e0afcd
Protocol · Case study:
hardsid4u: reconstructing the HardSID 4U USB protocolC2
hardsid4u reconstructs the HardSID 4U USB protocol and implements a libusb Python driver for its SID-chip sockets.
- Protocol
Reviewed pjthulin/hardsid4u@539fdb2
Protocol · Case study:
PyEilik: a client for the Eilik robot's USB protocolC1
PyEilik implements control of an Eilik desk robot over a recovered USB serial protocol.
- Protocol
Reviewed aklto/PyEilik@b1bf7ea
Protocol · Case study:
libfprint-goodixtls: a reconstructed Goodix GXFP5187 fingerprint driverC2
libfprint-goodixtls reconstructs communication with the Goodix GXFP5187 SPI fingerprint sensor in the Huawei MateBook X Pro as a libfprint TOD driver.
- Protocol
Reviewed Sigfrodr/libfprint-goodixtls@bdf2f7e
Protocol · Case study:
RazerStream: reconstructing Stream Controller device controlC2
RazerStream replaces the retired control software for the Razer Stream Controller with a macOS app, Swift protocol library and CLI.
- Protocol
Reviewed ShoelessTim/RazerStream@3d762a1
Protocol · Case study:
DABplay+: reconstructing USB DAB+ dongle controlC1
DABplay+ implements an Android DAB radio using a reverse-engineered USB dongle protocol.
- Protocol
Reviewed jvspier/dabplayplus@f935586
Protocol · Case study:
PocketPrinter5890: reconstructing the Lidl 5890 printer protocolC2
PocketPrinter5890 reconstructs the BLE printing protocol of Lidl's Tronic, SILVERCREST, and Parkside model 5890 pocket printers.
- Protocol
Reviewed dimer47/PocketPrinter5890@2011897
Protocol · Case study:
Parking sensor kit: reconstructing its display protocolC2
This parking-sensor investigation reconstructs the signal sent from a kit's controller to its display.
- Protocol
Protocol · Case study:
pyhaseiq: reconstructing the older Hase iQ stove's WebSocket protocolC2
pyhaseiq reconstructs the local WebSocket protocol of Hase iQ wood stoves used with the flamemonitor app and implements an asynchronous read-only Python client.
- Protocol
Reviewed bbayszczak/pyhaseiq@e7bb8ce
Protocol · Case study:
LED Controller: a BanlanX BLE client with audio-feed protocol findingsC1
LED Controller uses BanlanX BLE commands to control SP611E-family LED strips from a desktop app.
- Protocol
Reviewed Antrubtor/LED-controller@f2c7c5f
Protocol · Case study:
Zemismart Blind Controller Protocol: RF command reconstructionC2
Zemismart Blind Controller Protocol documents the 433.92 MHz OOK PWM messages used by Zemismart motorized blind remotes.
- Protocol
Protocol · Case study:
vanmoof-certificates: decoding VanMoof bike certificatesC2
vanmoof-certificates decodes the access certificates used with VanMoof SA5 and Series 6 bikes.
- Protocol
Reviewed Knight1/vanmoof-certificates@1d34bf3
Protocol · Case study:
Cosmic Byte Firestorm Controller: a USB protocol client for mouse settingsC2
Cosmic Byte Firestorm Controller implements a Linux client for the mouse's recovered USB settings protocol.
- Protocol
Reviewed electrondefuser/cbfirestorm@65802f3
Protocol · Case study:
Centerpiece Projects: decoding Finalmouse Centerpiece USB controlC2
Centerpiece Projects documents observed USB control messages for the Finalmouse Centerpiece keyboard and implements scripts around them.
- Protocol
Protocol · Case study:
FAAC E145 Gate Connect: reconstructing EasyBoard gate commandsC2
FAAC E145 Gate Connect implements local control of an FAAC E145 gate through serial commands reconstructed from EasyBoard software traffic.
- Protocol
Protocol · Case study:
stagg-net: investigating the Fellow Stagg EKG kettle UARTC2
stagg-net investigates the Fellow Stagg EKG kettle's internal UART interface and documents its connector, serial settings, observed heartbeat packet, and startup message.
- Protocol
Reviewed linux4life798/stagg-net@d059204
Protocol · Case study:
TOZO Control: a Linux earbuds client built from the TOZO BLE protocolC2
TOZO Control provides a Linux GTK4 client for TOZO earbuds using a BLE GATT protocol recovered from the vendor's Android app.
- Protocol
Reviewed GabriWar/tozo-control@eb40bdf
Protocol · Case study:
BMS RS485 Service Suite: reconstructing a battery-service bus protocolC2
BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED.
- Protocol
Protocol · Case study:
Petkit Local: reconstructing feeder cloud and fountain BLE controlsC2
Petkit Local replaces selected Petkit D4 feeder cloud exchanges with a local Home Assistant server and relays Eversweet Max 2 CTW3 fountain messages over BLE.
- Protocol
Reviewed Opcodeffm/petkit-local@235aaeb
Protocol · Case study:
IPI STAY FLY Driver: reconstructing mouse configuration over HIDC1
IPI STAY FLY Driver reconstructs mouse configuration in a Windows app using reverse-engineered 16-byte HID frames.
- Protocol
Reviewed SpookyyQ/IPI-Stay-Fly-Driver@a302fc2
Protocol · Case study:
Soundcore D3200: reconstructing BLE recording transfer and decryptionC2
A Soundcore D3200 investigation reconstructs the BLE exchange used to list and transfer encrypted recordings.
- Protocol
Protocol · Case study:
K1 Pro OpenDeck Suite: a Linux driver for the Stream Dock K1 ProC2
K1 Pro OpenDeck Suite includes a Linux OpenDeck driver for the HOTSPOTEK/Mirabox Stream Dock K1 Pro based on its reverse-engineered USB/HID CRT protocol.
- Protocol
Protocol · Case study:
iDotMatrix: Home Assistant control through a reconstructed BLE protocolC2
iDotMatrix Home Assistant integration controls the HXS-002 / NL-XSD-32 LED panel over a BLE protocol derived from analysis of the vendor Android app.
- Protocol
Reviewed dallanwagz/idotmatrix-ha@e27d763
Binary · Case study:
Dell ControlVault 2 fingerprint on Linux: adapting a driver for BCM5880C2
Dell ControlVault 2 fingerprint on Linux adapts a locally obtained Broadcom driver to the older BCM5880 fingerprint reader through five signature-matched byte patches.
- Binary
- Protocol
Reviewed grosa787/dell-controlvault2-fingerprint-linux@45609be
Protocol · Case study:
epson-l3110-driver: investigating the printer's USB and ESC/P-R exchangesC2
epson-l3110-driver investigates the Epson L3110's USB printing exchanges while developing a Linux driver in C.
- Protocol
Reviewed mikel-btw/epson-l3110-driver@e0fbf77
Protocol · Case study:
MS5 WiFi Microscope: reconstructing the camera's UDP video protocolC2
MS5 WiFi Microscope reconstructs the MS5 camera's UDP command and video protocol and supplies a Python client that serves its reassembled JPEG stream as MJPEG.
- Protocol
Reviewed Fyfar/ms5-wifi-microscope@16cf577
Protocol · Case study:
lux-lat-long-log: reconstructing LUMIX S5 BLE GPS communicationC2
lux-lat-long-log reconstructs the Panasonic LUMIX S5 Bluetooth LE GPS exchange in an ESP32 camera client.
- Protocol
Protocol · Case study:
Magene L308: reconstructing a smart taillight's BLE control protocolC2
Magene L308 interop tools reconstruct the smart taillight's BLE control protocol and light_mode.bin pattern format.
- Protocol
Protocol · Case study:
xbloom-ble: a client for the xBloom Studio BLE protocolC1
xbloom-ble implements a Python client for the xBloom Studio coffee machine's recovered Bluetooth LE protocol.
- Protocol
Reviewed Janczykkkko/xbloom-ble@cfa29da
Protocol · Case study:
ak820: reconstructing AJAZZ AK820 Pro HID control on macOSC2
ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol.
- Protocol
Reviewed gusleig/ajazz-ak820-pro-mac@2ad5c55
Protocol · Case study:
GameTrak Liberation: a client for the controller's HID protocolC2
GameTrak Liberation implements a client for the GameTrak controller's reverse-engineered USB HID behavior.
- Protocol
Protocol · Case study:
Cooper Hunter AC: UART and infrared protocol investigationC2
Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board.
- Protocol
Protocol · Case study:
aw5d-linux: driving an iBUYPOWER cooler LCD from USB-HID researchC2
aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report.
- Protocol
Reviewed claygorman/aw5d-linux@e70d481
Protocol · Case study:
MyJBxHeadsetControl: JBL Quantum 950 controls over USB HIDC1
MyJBxHeadsetControl provides Stream Deck controls for the JBL Quantum 950 Wireless headset through its USB dongle's reverse-engineered HID exchange.
- Protocol
Reviewed 666mille/MyJBxHeadsetControl@0c839ef
Protocol · Case study:
zlt: MTN ZLT T10D MAX router API reconstructionC2
zlt reconstructs the LAN JSON API of the MTN ZLT T10D MAX router from its served JavaScript and observed responses.
- Protocol
Reviewed exbyte-dev/zltrouter@60a47a6
Protocol · Case study:
claude-rc-api: reconstructing Claude Code Remote Control endpointsC2
claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code.
- Protocol
Protocol · Case study:
MSI Mystic Light on Linux: reconstructing B860/X870 lighting controlC2
MSI Mystic Light on Linux implements lighting control for an MSI motherboard from USB traffic captured while MSI Center ran in a Windows VM.
- Protocol
Reviewed Picachuchu69/msi-mystic-light-b860-x870-linux@166a622
Protocol · Case study:
LinkCam: controlling Insta360 Link 2 through UVC extension researchC2
LinkCam implements macOS menu-bar and command-line controls for the Insta360 Link 2 webcam.
- Protocol
Reviewed fmontes/linkcam@f4c3d87
Protocol · Case study:
shark-k86-mac: a client for the Attack Shark K86 HID protocolC2
shark-k86-mac reconstructs the Attack Shark K86 keyboard's vendor HID controls as a Python CLI and library for macOS and Linux.
- Protocol
Reviewed RaphaelCaputo2/shark-k86-mac@f9c8910
Protocol · Case study:
fitdays: reconstructing a smart-scale cloud clientC2
fitdays recreates read-only access to the Fitdays smart-scale cloud API from traffic observed in the vendor app.
- Protocol
Reviewed AboveColin/fitdays@7068418
Protocol · Case study:
trvision: implementing Thermalright Vision USB display controlC2
trvision implements direct USB control of Thermalright Vision display panels using previously documented protocol research.
- Protocol
Reviewed 0iroN/trvision@bc88670
Protocol · Case study:
pocket-client: a BLE client for the Pocket voice recorderC2
pocket-client implements the Pocket voice recorder's recovered BLE command protocol in a Swift library and CLI.
- Protocol
Protocol · Case study:
KeyAxis: decoding a magnetic keyboard's analog HID streamC2
KeyAxis documents the HID travel stream of keyboards using the 0416:7372 controller and turns key depth into virtual gamepad axes.
- Protocol
Reviewed RigZeeel/KeyAxis@53a7e1b
Protocol · Case study:
A.O. Smith water heater: local CTA-2045 control and protocol findingsC2
The A.O. Smith water-heater project implements local monitoring and demand-response control of an HPS10-50H45DV over its CTA-2045 RS-485 port, publishing readings to MQTT.
- Protocol
Protocol · Case study:
j2208-band-tools: a direct client for the J2208 fitness-band protocolC2
j2208-band-tools implements a direct BLE client for J2208-family fitness bands using protocol findings recovered from the FitTrack Health companion app.
- Protocol
Protocol · Case study:
Eufy Local Light: reconstructing BLE control for E10 and E22 lightsC2
Eufy Local Light implements a Home Assistant client for Eufy Outdoor String Lights E10 and Permanent Outdoor Lights E22 using BLE traffic analyzed from the Eufy app.
- Protocol
Reviewed SudoSaturn/eufy-local-ha@4f21642
Protocol · Case study:
OpenPeats: reconstructing SoundPEATS earbud controlsC2
OpenPeats reconstructs the SoundPEATS earbud control protocol for desktop and Android clients.
- Protocol
Reviewed Wasabules/OpenPeats@8e8357d
Protocol · Case study:
hongtai-panel: reconstructing a cooler LCD's USB serial protocolC2
hongtai-panel implements Linux control of a LovingCool AIO cooler LCD using a USB CDC-ACM serial protocol reconstructed from the vendor's Electron application.
- Protocol
Reviewed GOG1071/hongtai-panel@121634c
Protocol · Case study:
ESPHome ↔ L&S Emotion Control: reconstructing a smart-light radio clientC2
An ESPHome component recreates L&S Emotion Control remote commands so an ESP32 with a CC2500 radio can control furniture lights and reflect physical remote presses in Home Assistant.
- Protocol
Reviewed SergeyZh/emotion-control-ha@05134b3