# Curated reverse engineering resources · Page 44

> Page 44 of 52, entries 4,301–4,400. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/44/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/44/index.md>

## Protocols (100)

- [ORBCOMM receiver](https://awesomerea.org/resources/orbcomm-receiver/index.md): Tool · ORBCOMM receiver decodes satellite transmissions into packets and parses known packet types. Its Python scripts process recorded IQ data or live RTL-SDR input, compensate for satellite motion and report message, network and ephemeris fields. The repository includes sample recordings and DSP exercises for timing and phase recovery.
- [iridium-sniffer](https://awesomerea.org/resources/iridium-sniffer/index.md): Tool · iridium-sniffer detects and demodulates Iridium L-band bursts from supported SDR devices or recorded IQ files. Its C pipeline emits iridium-toolkit RAW frames and can decode IDA and ACARS/SBD messages, with GSMTAP output for Wireshark analysis.
- [Booma.Proxy](https://awesomerea.org/resources/booma-proxy/index.md): Tool · Booma.Proxy is a set of C# libraries that model Phantasy Star Online Blue Burst's binary packets for client and server emulation. It uses a metadata-based serializer to represent packet structures as C# types and documents game packet opcodes, payloads and transmission directions.
- [gr-elster](https://awesomerea.org/resources/gr-elster/index.md): Tool · gr-elster receives and decodes 902–928 MHz packets from Elster smart meters with a GNU Radio block and sample flow graphs. It dumps packets in hexadecimal, writes pcap files and extracts meter readings and hourly electricity usage. Its packet and payload interpretation remains partial.
- [COMS-1 Meteorological Satellite Tools](https://awesomerea.org/resources/coms-1-meteorological-tools/index.md): Tool · COMS-1 Meteorological Satellite Tools parse LRIT and HRIT files carried by the satellite's L-band downlinks. The scripts display xRIT headers, extract Meteorological Imager segments and additional data, create images and overlays, and handle decryption key messages. Sample xRIT files and decoded images accompany the tools.
- [renard-phy](https://awesomerea.org/resources/renard-phy/index.md): Tool · renard-phy processes Sigfox uplink and downlink radio frames in Python for software-defined radios. It demodulates recorded WAV signals, identifies preambles and frames, delegates content decoding to renard, and generates HackRF One transmission samples.
- [Bus Pirate](https://awesomerea.org/resources/bus-pirate-v3-v4/index.md): Tool · Bus Pirate firmware turns v3 and v4 boards into terminal-controlled tools for investigating electronic buses. It provides SPI and I2C traffic sniffers, a low-speed logic analyzer and scriptable bitbang, 1-Wire, I2C, SPI and UART modes.
- [EDACS-FM Florida Man Edition](https://awesomerea.org/resources/edacs-fm/index.md): Tool · EDACS-FM decodes EDACS 9600 trunked-radio control channels and follows assigned voice channels. It accepts rtl_fm or GNU Radio inputs, including UDP audio from SDR++ or GQRX, and provides single- and two-dongle operating modes.
- [orbcomm-rx](https://awesomerea.org/resources/orbcomm-rx/index.md): Tool · orbcomm-rx demodulates and decodes Orbcomm VHF Subscriber Transmitter downlinks. Its documented signal uses SDPSK at 4.8 kbps on carriers between 137 and 138 MHz, carrying satellite position, orbital elements, channel information and encrypted user messages.
- [Meteor LRPT Decoder](https://awesomerea.org/resources/metlrpt/index.md): Tool · Meteor LRPT Decoder processes Meteor M N2 satellite transmissions into channel packets. Its C++ pipeline synchronizes frames, corrects phase shifts, performs Viterbi and Reed-Solomon decoding, and passes decoded channel data to a Python packet demultiplexer.
- [open-appleremote: Siri Remote protocol reconstruction](https://awesomerea.org/resources/open-appleremote-case/index.md): Case study · Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. The Python implementation and protocol notes distinguish measured behavior, historical reports and inferred meanings.
- [GAMEKB-K17: reconstructing a macropad configuration protocol](https://awesomerea.org/resources/gamekb-k17-case/index.md): Case study · Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. It writes key mappings, firmware macros and RGB settings, then reads them back; protocol notes separate tested commands from unconfirmed observations and other-device findings.
- [cooler-lcd: a Thermalright display protocol implementation](https://awesomerea.org/resources/cooler-lcd-case/index.md): Case study · Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. The documented protocol sends a header and JPEG frames, with periodic resends to prevent the device reverting to its logo.
- [NJFE: a Soulear camera protocol bridge for desktop inspection](https://awesomerea.org/resources/njfe-ear-camera-bridge-case/index.md): Case study · Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. The author credits Claude Code for implementation and reports streaming one Hopefox Find T to a Windows PC, with recording, orientation and LED controls.
- [ultimate2: 8BitDo controller configuration protocol and Linux client](https://awesomerea.org/resources/8bitdo-controller-hid-case/index.md): Case study · ultimate2 reconstructs the configuration protocol for supported 8BitDo controllers and implements command-line, graphical and browser clients. Its protocol document reports using REA with Ghidra on a native DLL and ILSpy on .NET assemblies to recover HID reports and configuration records. The clients read, edit and write controller settings.
- [remote-me: an Apple TV remote built from iOS Companion protocol analysis](https://awesomerea.org/resources/remote-me-apple-tv-companion-case/index.md): Case study · remote-me implements an Apple TV browser remote from analysis of iOS TVRemoteCore and Rapport frameworks. The author reports using REA and Ghidra to recover Companion transport, pairing, session, HID, touch, and keyboard behavior, then testing requests against an Apple TV. The project also controls LG webOS TVs through SSAP.
- [Attack Shark K86: recovering HID controls from the official driver](https://awesomerea.org/resources/attack-shark-k86-case/index.md): Case study · Attack Shark K86 reconstructs the yc3121 keyboard's HID controls from analysis of its official driver with REA. The notes describe 64-byte feature reports, checksums and commands; a Windows Electron client uses them to set lighting, per-key colours and the 240 × 135 display.
- [Redragon K652: macOS control from driver and HID analysis](https://awesomerea.org/resources/redragon-k652-macos-case/index.md): Case study · Redragon K652 macOS control reconstructs the keyboard's HID configuration protocol from decompilation of its Windows driver with REA and Ghidra. A SwiftUI app and k652ctl CLI use IOKit reports for wired lighting and key settings, while the protocol document ties fields to driver functions and records device observations. The tested model is the Azure K652GG-RGB-PRO.
- [AK·LINK: reconstructing AJAZZ AK820 Pro HID control](https://awesomerea.org/resources/aklink-case/index.md): Case study · AK·LINK implements Linux control of the AJAZZ AK820 Pro keyboard through its recovered wired HID commands for lighting, per-key RGB and the TFT screen. Its author documents REA-assisted investigation of a separate 2.4 GHz dongle channel, including observed usage pages, checksums and read-only probe responses; native dongle control remains in progress.
- [Etrel Load Guard Configurator: reconstructing the meter's UDP protocol](https://awesomerea.org/resources/etrel-load-guard-configurator-case/index.md): Case study · Etrel Load Guard Configurator is a Python CLI for discovering, reading and configuring Etrel Load Guard energy meters through a reconstructed UDP protocol. The author reports using REA with Ghidra on LoadGuardConfigurator.exe to recover packet fields and settings, then checking byte order and read-only measurements on a device. The tool includes dry-run writes and a simulator.
- [hw-harness: scanner USB protocol investigation](https://awesomerea.org/resources/hw-harness-reference-case/index.md): Case study · Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. The released harness organizes reference capture and comparison; it does not automatically recover a complete protocol specification.
- [Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud](https://awesomerea.org/resources/roborock-local-server-cloud-case/index.md): Case study · Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.
- [pypush: a Python client for Apple’s push protocol](https://awesomerea.org/resources/pypush-apns-protocol-case/index.md): Case study · Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.
- [PixMob IR reverse engineering: controlling event wristbands at home](https://awesomerea.org/resources/pixmob-ir-protocol-case/index.md): Case study · Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.
- [OpenDrop: an open reimplementation of Apple AirDrop](https://awesomerea.org/resources/opendrop-airdrop-reimplementation-case/index.md): Case study · Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.
- [bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol](https://awesomerea.org/resources/bluefluff-furby-connect-ble-case/index.md): Case study · Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.
- [pyatv: a reverse-engineered client for Apple TV and AirPlay protocols](https://awesomerea.org/resources/pyatv-apple-tv-airplay-protocols-case/index.md): Case study · Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. That page records the recovered binary formats, Zeroconf properties, the OPACK encoding, pair-setup and pair-verify exchanges and Companion commands, with some request headers taken from Wireshark captures of the iPhone Remote app, and the bundled atvproxy relays MRP, Companion and AirPlay sessions to print decrypted messages for further analysis. On this basis pyatv provides remote control, metadata with push updates, app and account switching, audio-output management and AirPlay streaming to Apple TVs, HomePods and third-party receivers.
- [BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocol](https://awesomerea.org/resources/budspro-headtracking-case/index.md): Case study · Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. It connects to the earbuds’ GEARMANAGER (or FACTORY) RFCOMM serial service, frames packets with start and end markers and a CRC16-CCITT checksum, enables the sensor stream with attach and two-second keep-alive messages, and decodes the rotation quaternion from the data events. A contributed script converts the quaternion to Euler angles and forwards it over local UDP to a Unity receiver; results are shown only as author-provided sample output.
- [fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote control](https://awesomerea.org/resources/fuji-cam-wifi-tool-protocol-case/index.md): Case study · Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. Its headers name the control, event and JPEG live-view ports, message types and camera property codes, and source comments keep hex traces of exchanges along with what "the app" sends; the client connects, fires the shutter, records video, adjusts exposure settings and focus point, and streams live view, optionally into a Linux webcam device. README calls the tool very limited and mostly undocumented, so the protocol knowledge lives in code and comments rather than a specification.
- [Gymnasticon: bridging proprietary exercise-bike data to standard cycling sensors](https://awesomerea.org/resources/gymnasticon-exercise-bike-bridge-case/index.md): Case study · Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike. The author's development notes describe working out the Flywheel Home Bike's stats packets on its Bluetooth UART service after the vendor shut its home service down; Peloton support reads the bike's data cable through a USB serial adapter, while the Schwinn IC4 and Keiser M clients parse the standard Fitness Machine Service and Keiser's documented broadcasts. Bike and app compatibility is project-reported.
- [garmin-ble: a Python client for Garmin's GFDI watch protocol](https://awesomerea.org/resources/garmin-ble-gfdi-protocol-case/index.md): Case study · Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service. It implements the handshake, multi-link routing, COBS framing, CRC16 checks and protobuf service messages, streams typed readings such as heart rate, HRV, SpO2, stress, Body Battery and accelerometer data, and adds a simulator and recorded-session replay for work without hardware. Its acknowledgements credit Gadgetbridge for the protocol logic and schemas, while a published journal shows how the author decoded the accelerometer payload, which Gadgetbridge only logged, from labelled recordings.
- [bosectl: reconstructing Bose’s BMAP headphone protocol](https://awesomerea.org/resources/bosectl-bose-bmap-protocol-case/index.md): Case study · Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM. The author documents BMAP’s function blocks, operators, payload layouts and error codes in NOTES.md, reportedly worked out by probing RFCOMM channels, capturing Bluetooth traffic while changing settings in the Bose app and testing each operator, and the libraries cover noise cancellation, EQ, spatial audio, button remapping, profiles and device settings. Support is reported per model by the author and contributors.
- [lib-osmo-ble: DJI Osmo Pocket 3 Bluetooth LE protocol library](https://awesomerea.org/resources/osmo-pocket-3-ble-protocol-case/index.md): Case study · Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app. The author reports working from a third party's Wireshark captures and dissector of Mimo traffic, a Go client and trial-and-error debugging; PROTOCOL.md documents the frame layout, CRC parameters, BLE characteristic roles and command IDs. A write-up and bundled patch trace seven bugs that kept the earlier node-osmo library from working with the camera, and the author reports that the patched library completed pairing, Wi-Fi setup and RTMP streaming.
- [DJI MIMO BLE artifacts: reconstructing the DJI Osmo control protocol](https://awesomerea.org/resources/dji-mimo-ble-reveng-case/index.md): Case study · Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.
- [Cat Printer BLE: reconstructing the MXW01 thermal printer protocol](https://awesomerea.org/resources/catprinterble-mxw01-printer-case/index.md): Case study · Replaces the vendor phone app for the MXW01 “cat printer”, a small Bluetooth Low Energy thermal printer, with a Windows command-line client. The author reports starting from the iOS-only Moblin implementation and then reverse-engineering the vendor's phone app further, and the client sends CRC8-checked commands to one GATT service while streaming 384-pixel image lines in 1-bit or 4-bit grayscale. Several command IDs remain marked as unknown, and the author tested only this one printer model.
- [a0rfid: an open driver for A0-protocol UHF RFID readers](https://awesomerea.org/resources/a0rfid-uhf-reader-protocol-case/index.md): Case study · Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK. A userspace CH340 driver, a Python CLI and GUI, and a small Android app then talk to the reader directly for inventory and tag-memory reads. docs/PROTOCOL.md records the frame layout, checksum, command table, response formats and the different field orders of READ and WRITE.
- [Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interface](https://awesomerea.org/resources/xiaomi-kettle-ble-protocol-case/index.md): Case study · Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library. The write-up covers the connection and authentication handshake, the layout of status notifications and the writable settings characteristics, with a small Go reimplementation of the cipher helpers. The author built a kettle-to-MQTT bridge for Home Assistant from it but did not publish that code.
- [Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio bus](https://awesomerea.org/resources/ford-fiesta-mk5-ms-can-case/index.md): Case study · Documents the medium-speed CAN bus that links the 6000CD radio and the dashboard of a restyled (post-2006) Ford Fiesta MK5, worked out by tapping the bus at the radio's QuadLock connector with a Seeed CAN-BUS Shield on an Arduino Uno. The README describes 18 partly or fully decoded message IDs on the 125 kbit/s bus, with byte layouts and scaling formulas: radio text sent to the dashboard LCD over ISO-TP, station names, volume, CD track and steering-column mode and seek buttons, as well as broadcast clock, door, lock, reverse-gear, indicator, light, handbrake, airbag-lamp, pedal, RPM, speed, coolant, key-position, battery and partial VIN data. An incomplete Kayak .kcd definition encodes only the clock and gas-pedal/RPM/speed messages.
- [uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetry](https://awesomerea.org/resources/uniden-r8-ble-telemetry-case/index.md): Case study · Decodes the undocumented Bluetooth Low Energy output of a Uniden R8 radar detector into a receive-only collector for a Raspberry Pi, with live telemetry, alert start/update/end events, SQLite history and optional MQTT and Home Assistant publishing. The author worked the protocol out from the wire on a real detector, building on earlier R8w findings from AegisX86/UnidenR8wlink, and grades every claim in PROTOCOL.md by its evidence: measured on this R8, seen on another model, decompiled from an app but untested, or inference. Unknown fields are carried through raw rather than given invented meanings.
- [opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol](https://awesomerea.org/resources/opendash-scanmatik-sm3-protocol-case/index.md): Case study · Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present.
- [OWL: an open Apple Wireless Direct Link implementation](https://awesomerea.org/resources/owl-awdl-open-implementation-case/index.md): Case study · Reimplements Apple Wireless Direct Link (AWDL), the proprietary Wi-Fi ad hoc protocol Apple devices use for peer-to-peer links such as AirDrop, as a user-space C daemon for Linux and macOS; the README calls it the result of reverse engineering by the Open Wireless Link project at TU Darmstadt's SEEMOO lab. OWL runs the master election, synchronises availability windows and the channel sequence, parses and crafts AWDL action and data frames, and provides an awdl0 virtual interface with a link-local IPv6 address, so unmodified IPv6 programs such as SEEMOO's OpenDrop AirDrop client can reach Apple devices. The authors describe the recovered protocol in a MobiCom 2018 paper.
- [QuestPad: a USB gamepad from the Quest Touch radio protocol](https://awesomerea.org/resources/questpad-case/index.md): Case study · QuestPad implements the Quest Touch controllers' private 2.4 GHz radio protocol on nRF52840 firmware so a computer can use them as a USB gamepad. Its protocol reference documents pairing, AES-CCM encrypted controller packets, 2 ms link frames and input data; the firmware exposes generic gamepad, DS4 and XInput modes.
- [Stadiacast: reconstructing the Stadia Controller's Wi-Fi service](https://awesomerea.org/resources/stadiacast-case/index.md): Case study · Stadiacast recreates the network service used by the Stadia Controller's Wi-Fi firmware so the controller can connect to a local computer. The receiver answers boot and discovery requests, completes WebRTC and DTLS sessions, decodes input and sends rumble commands. Protocol notes record findings from firmware reading and live controller runs, with protobuf schemas and receiver code in the repository.
- [os-xgs-npu: reconstructing Sophos XGS coprocessor interfaces](https://awesomerea.org/resources/os-xgs-npu-case/index.md): Case study · os-xgs-npu reconstructs interfaces to Sophos XGS appliance coprocessors through FreeBSD kernel modules and an OPNsense plugin. The work documents undocumented registers, PCIe device families and measured coprocessor behavior to expose front ports and offload firewall flows and IPsec associations.
- [LibreMP: an Epson EasyMP screen caster from packet-capture research](https://awesomerea.org/resources/libremp-easymp-case/index.md): Case study · LibreMP casts desktop screens to Epson EasyMP projectors using a protocol reconstructed from Windows client packet captures. Its Rust core handles registration and login messages, projector QR decoding, JPEG tile streaming and changed-region updates; a CLI and Tauri interface use the same core. The project documents control on TCP 3620 and video on TCP 3621.
- [Sony CDX-A250: reconstructing the LCD panel interface](https://awesomerea.org/resources/lc75826-sony-cdx-a250-case/index.md): Case study · Sony CDX-A250 LCD Panel reconstructs the serial control needed to drive the radio's detachable display independently through its LC75826W driver. Wiring notes, CCB transfer documentation, and an Arduino sketch cover display-data groups, control bits, test patterns, and experimental segment mapping.
- [MacroPad: reconstructing a USB macropad configuration protocol](https://awesomerea.org/resources/macropad-usb-protocol-case/index.md): Case study · MacroPad reconstructs the USB HID configuration exchange of a 12-key, two-knob macropad identified as 1189:8840 and implements it in a Linux GUI. The author documents capturing MINI_KEYBOARD.exe traffic with usbmon, decoding configuration and commit reports, and replaying captured packets in tests.
- [Monix: reconstructing Audient iD USB mixer control on Linux](https://awesomerea.org/resources/monix-audient-id-case/index.md): Case study · Monix implements Linux mixer control for Audient iD USB audio interfaces through a companion kernel module, protocol library and GUI. Its protocol documentation maps USB control requests from official-app captures and macOS binary analysis, covering routing, faders, metering and device profiles.
- [Scooter Link: a Xiaomi scooter client built from BLE protocol research](https://awesomerea.org/resources/scooter-link-case/index.md): Case study · Scooter Link implements an Android client for Xiaomi Electric Scooter 5 Pro and 5 Max using a reconstructed BLE authentication protocol. Its research log covers GATT characteristics and investigation of the ECDH P-256, HKDF-SHA256, and AES-CCM exchange; the app reads ride and battery data and controls supported settings.
- [Sound Blaster AE-9: reconstructing Linux control from Windows driver analysis](https://awesomerea.org/resources/sb-ae9-case/index.md): Case study · Sound Blaster AE-9 Linux support reconstructs card and Audio Control Module behavior using static analysis of Creative's Windows drivers and hardware observations. The included investigations document CtxHda.sys, CtxHdb.sys, and the ACM's SysEx-framed UART protocol; the driver implements selected playback and controls.
- [thermalmaster: a Go client for ThermalMaster camera USB commands](https://awesomerea.org/resources/thermalmaster-case/index.md): Case study · thermalmaster implements a Go USB client for ThermalMaster P3 and P1 thermal cameras using documented VDCMD control transfers. It captures PNG frames, streams thermal and IR video to Linux v4l2loopback, and records USB command framing and model identifiers for interoperability.
- [open-rknpu: Rockchip NPU task-program reconstruction](https://awesomerea.org/resources/open-rknpu-case/index.md): Case study · open-rknpu reconstructs a task-program interface for the Rockchip RV1103/RV1106 NPU from board experiments and black-box comparisons. Its Python compiler emits register commands, weight and quantization blocks, and a container for bounded static ONNX convolution graphs; a C runtime submits them through /dev/rknpu. Research files document register and numerical findings.
- [hardsid4u: reconstructing the HardSID 4U USB protocol](https://awesomerea.org/resources/hardsid4u-case/index.md): Case study · hardsid4u reconstructs the HardSID 4U USB protocol and implements a libusb Python driver for its SID-chip sockets. The investigation combines vendor-binary analysis, USB captures, and hardware probes to document command framing, initialization, register writes, timing, and flow control; a MIDI instrument uses the driver.
- [PyEilik: a client for the Eilik robot's USB protocol](https://awesomerea.org/resources/pyeilik-case/index.md): Case study · PyEilik implements control of an Eilik desk robot over a recovered USB serial protocol. Its C library and Python wrapper move four servos, read and update the 128×64 display, and play video with synchronized movement. The protocol reference documents 125000-baud framing, command IDs, checksums and acknowledgements.
- [libfprint-goodixtls: a reconstructed Goodix GXFP5187 fingerprint driver](https://awesomerea.org/resources/libfprint-goodixtls-case/index.md): Case study · libfprint-goodixtls reconstructs communication with the Goodix GXFP5187 SPI fingerprint sensor in the Huawei MateBook X Pro as a libfprint TOD driver. It reads a PSK from sensor RAM, establishes the sensor's TLS-PSK channel, decodes captured images, and uses local descriptors for host-side matching. The author reports enrolment and verification through fprintd and GNOME Settings; detailed reverse-engineering notes are kept outside the repository.
- [RazerStream: reconstructing Stream Controller device control](https://awesomerea.org/resources/razerstream-case/index.md): Case study · RazerStream replaces the retired control software for the Razer Stream Controller with a macOS app, Swift protocol library and CLI. Its documented device protocol runs over a USB serial port, performs a WebSocket upgrade, then exchanges framed commands and input events. The app configures touchscreen tiles, knobs, buttons and LEDs.
- [DABplay+: reconstructing USB DAB+ dongle control](https://awesomerea.org/resources/dabplayplus-case/index.md): Case study · DABplay+ implements an Android DAB radio using a reverse-engineered USB dongle protocol. It drives the DTR-100 family directly, decodes broadcast data and audio, and documents additional dongle protocols alongside hardware findings and tests.
- [PocketPrinter5890: reconstructing the Lidl 5890 printer protocol](https://awesomerea.org/resources/pocketprinter5890-case/index.md): Case study · PocketPrinter5890 reconstructs the BLE printing protocol of Lidl's Tronic, SILVERCREST, and Parkside model 5890 pocket printers. Its specification documents activation writes, flow-control credits, and raster bands; Swift, Kotlin, and TypeScript libraries implement printing for Apple devices, Android, and browsers.
- [Parking sensor kit: reconstructing its display protocol](https://awesomerea.org/resources/parking-sensor-protocol-case/index.md): Case study · This parking-sensor investigation reconstructs the signal sent from a kit's controller to its display. Oscilloscope observations and tests with different sensor states identify fields in roughly 48-bit frames for sensor address, connection and proximity. A PlatformIO example for ATmega328P reads and reports the parsed frames.
- [pyhaseiq: reconstructing the older Hase iQ stove's WebSocket protocol](https://awesomerea.org/resources/pyhaseiq-case/index.md): Case study · pyhaseiq reconstructs the local WebSocket protocol of Hase iQ wood stoves used with the flamemonitor app and implements an asynchronous read-only Python client. The specification records base64-encoded request and response frames, serial dialogue and observation status for each finding; the client reads combustion phase, temperature and performance.
- [LED Controller: a BanlanX BLE client with audio-feed protocol findings](https://awesomerea.org/resources/led-controller-banlanx-case/index.md): Case study · LED Controller uses BanlanX BLE commands to control SP611E-family LED strips from a desktop app. Its documentation maps GATT commands and state notifications, and reports probing an audio-feed message used by the controller’s music effects; included tools inspect advertisements, GATT state and Bluetooth captures.
- [Zemismart Blind Controller Protocol: RF command reconstruction](https://awesomerea.org/resources/zemismart-blind-protocol-case/index.md): Case study · Zemismart Blind Controller Protocol documents the 433.92 MHz OOK PWM messages used by Zemismart motorized blind remotes. It records pulse timing, payload fields and formulas for channel and button commands, with Python scripts to capture IQ samples and encode or decode transmissions.
- [vanmoof-certificates: decoding VanMoof bike certificates](https://awesomerea.org/resources/vanmoof-certificates-case/index.md): Case study · vanmoof-certificates decodes the access certificates used with VanMoof SA5 and Series 6 bikes. It documents an Ed25519 signature followed by a CBOR payload containing bike serials, user identity, access role and expiry, and provides Go code to request, parse and check certificates. The source says the SA5 verification key was recovered from a bike BLE certificate.
- [Cosmic Byte Firestorm Controller: a USB protocol client for mouse settings](https://awesomerea.org/resources/cosmic-byte-firestorm-controller-case/index.md): Case study · Cosmic Byte Firestorm Controller implements a Linux client for the mouse's recovered USB settings protocol. Its Python CLI sends control and interrupt transfers to configure lighting effects, per-DPI indicator colours and sensitivity levels, while PROTOCOL.md records packet structures and command sequences.
- [Centerpiece Projects: decoding Finalmouse Centerpiece USB control](https://awesomerea.org/resources/finalmouse-centerpiece-protocol-case/index.md): Case study · Centerpiece Projects documents observed USB control messages for the Finalmouse Centerpiece keyboard and implements scripts around them. Its notes describe HID framing and message types for uploads, status, slot switching and preview chunks; PowerShell and Python helpers expose device operations.
- [FAAC E145 Gate Connect: reconstructing EasyBoard gate commands](https://awesomerea.org/resources/faac-e145-gate-connect-case/index.md): Case study · FAAC E145 Gate Connect implements local control of an FAAC E145 gate through serial commands reconstructed from EasyBoard software traffic. The documentation lists POLL, OPEN, CLOSE and STOP byte sequences and describes their framing and checksum. The Python gateway adds position monitoring plus web, REST and MQTT interfaces.
- [stagg-net: investigating the Fellow Stagg EKG kettle UART](https://awesomerea.org/resources/stagg-net-case/index.md): Case study · stagg-net investigates the Fellow Stagg EKG kettle's internal UART interface and documents its connector, serial settings, observed heartbeat packet, and startup message. The repository includes a logic capture, decoder source, probing scripts, and ESPHome configuration for an ESP32-C6 connection.
- [TOZO Control: a Linux earbuds client built from the TOZO BLE protocol](https://awesomerea.org/resources/tozo-control-case/index.md): Case study · TOZO Control provides a Linux GTK4 client for TOZO earbuds using a BLE GATT protocol recovered from the vendor's Android app. It sends commands to characteristic B611, receives notifications on B612, and documents GET and SET packet layouts and parameter IDs. The author reports testing the T10 model for battery, game mode, equalizer and balance controls.
- [BMS RS485 Service Suite: reconstructing a battery-service bus protocol](https://awesomerea.org/resources/bms-rs485-service-suite-case/index.md): Case study · BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED. The specification covers framing, length and checksum fields, request and response rules and decoded service IDs; the wider suite connects JK and DALY BLE data to MQTT and dashboards.
- [Petkit Local: reconstructing feeder cloud and fountain BLE controls](https://awesomerea.org/resources/petkit-local-case/index.md): Case study · Petkit Local replaces selected Petkit D4 feeder cloud exchanges with a local Home Assistant server and relays Eversweet Max 2 CTW3 fountain messages over BLE. The integration implements device registration, heartbeats, schedules, events and commands based on observed device communication.
- [IPI STAY FLY Driver: reconstructing mouse configuration over HID](https://awesomerea.org/resources/ipi-stay-fly-driver-case/index.md): Case study · IPI STAY FLY Driver reconstructs mouse configuration in a Windows app using reverse-engineered 16-byte HID frames. It exposes DPI, polling, button and sensor settings, documents a frame checksum, and includes a WebHID capture extension plus protocol notes for ATK FIERCE X.
- [Soundcore D3200: reconstructing BLE recording transfer and decryption](https://awesomerea.org/resources/soundcore-d3200-ble-case/index.md): Case study · A Soundcore D3200 investigation reconstructs the BLE exchange used to list and transfer encrypted recordings. Its Python client performs a P-256 ECDH handshake, derives session and file keys, decrypts AES-256-CTR Opus packets and writes an Ogg/Opus file.
- [K1 Pro OpenDeck Suite: a Linux driver for the Stream Dock K1 Pro](https://awesomerea.org/resources/k1-pro-opendeck-suite-case/index.md): Case study · K1 Pro OpenDeck Suite includes a Linux OpenDeck driver for the HOTSPOTEK/Mirabox Stream Dock K1 Pro based on its reverse-engineered USB/HID CRT protocol. The driver handles connection and keepalive messages, 64×64 JPEG key displays, RGB ring controls, and three knob inputs. Four accompanying plugins add generic OpenDeck functions.
- [iDotMatrix: Home Assistant control through a reconstructed BLE protocol](https://awesomerea.org/resources/idotmatrix-ha-case/index.md): Case study · iDotMatrix Home Assistant integration controls the HXS-002 / NL-XSD-32 LED panel over a BLE protocol derived from analysis of the vendor Android app. Its vendored protocol module and hardware-capture tests support power, brightness, clock controls and chunked 32×32 image uploads with CRC32.
- [Dell ControlVault 2 fingerprint on Linux: adapting a driver for BCM5880](https://awesomerea.org/resources/dell-controlvault2-fingerprint-linux-case/index.md): Case study · Dell ControlVault 2 fingerprint on Linux adapts a locally obtained Broadcom driver to the older BCM5880 fingerprint reader through five signature-matched byte patches. The accompanying investigation maps the device’s USB endpoints, command header and driver checks. The author reports working capture, while enrollment and matching remain unreliable or unconfirmed.
- [epson-l3110-driver: investigating the printer's USB and ESC/P-R exchanges](https://awesomerea.org/resources/epson-l3110-driver-case/index.md): Case study · epson-l3110-driver investigates the Epson L3110's USB printing exchanges while developing a Linux driver in C. Its notes use captured print-job traffic to identify the IEEE 1284 device ID, EJL session setup and ESC/P-R command framing. USB communication is still in progress, and the driver cannot yet print pages.
- [MS5 WiFi Microscope: reconstructing the camera's UDP video protocol](https://awesomerea.org/resources/ms5-wifi-microscope-case/index.md): Case study · MS5 WiFi Microscope reconstructs the MS5 camera's UDP command and video protocol and supplies a Python client that serves its reassembled JPEG stream as MJPEG. The documentation specifies command headers, the OpenVideo port handshake, chunk layout and resolution queries; the author reports 1280×720 streaming at roughly 25–30 fps on MS5 hardware.
- [lux-lat-long-log: reconstructing LUMIX S5 BLE GPS communication](https://awesomerea.org/resources/lux-lat-long-log-case/index.md): Case study · lux-lat-long-log reconstructs the Panasonic LUMIX S5 Bluetooth LE GPS exchange in an ESP32 camera client. The project documents GATT identifiers, session ordering and GPS/time packets from Android HCI captures, then uses a GNSS module to send positions without the phone app.
- [Magene L308: reconstructing a smart taillight's BLE control protocol](https://awesomerea.org/resources/magene-l308-taillight-case/index.md): Case study · Magene L308 interop tools reconstruct the smart taillight's BLE control protocol and light_mode.bin pattern format. A protocol specification records GATT characteristics, command frames and upload sequences; browser, Python and Garmin clients use those findings to control settings and patterns directly.
- [xbloom-ble: a client for the xBloom Studio BLE protocol](https://awesomerea.org/resources/xbloom-ble-case/index.md): Case study · xbloom-ble implements a Python client for the xBloom Studio coffee machine's recovered Bluetooth LE protocol. The author documents capturing app traffic and comparing GATT command frames; the CLI and terminal UI load recipes, program dial presets, optionally start brewing and display live scale telemetry.
- [ak820: reconstructing AJAZZ AK820 Pro HID control on macOS](https://awesomerea.org/resources/ajazz-ak820-pro-mac-case/index.md): Case study · ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol. The Python CLI sets the clock, RGB lighting, and sleep timer over USB; accompanying notes describe Windows-driver analysis, packet framing, transaction handshakes, and the unresolved key-remapping commands.
- [GameTrak Liberation: a client for the controller's HID protocol](https://awesomerea.org/resources/gametrak-liberation-case/index.md): Case study · GameTrak Liberation implements a client for the GameTrak controller's reverse-engineered USB HID behavior. It sends the initialization and rolling-key keepalive messages needed for sustained reports, then exposes six-axis data through stdout, OSC, MIDI or WebSockets. Protocol notes, report captures and Processing and p5.js examples accompany the Python tools.
- [Cooper Hunter AC: UART and infrared protocol investigation](https://awesomerea.org/resources/cooper-hunter-ac-protocol-case/index.md): Case study · Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board. The author inferred UART status fields by comparing packets while operating the infrared remote. The resulting ESPHome design receives UART status and sends control through an infrared signal path.
- [aw5d-linux: driving an iBUYPOWER cooler LCD from USB-HID research](https://awesomerea.org/resources/aw5d-linux-case/index.md): Case study · aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report. Its research notes document report ID 0x10 and byte positions for CPU usage, clock, temperature and gauge styling. The author reports a working display on one 3402:0407 unit; other device variants remain unconfirmed.
- [MyJBxHeadsetControl: JBL Quantum 950 controls over USB HID](https://awesomerea.org/resources/myjbxheadsetcontrol-case/index.md): Case study · MyJBxHeadsetControl provides Stream Deck controls for the JBL Quantum 950 Wireless headset through its USB dongle's reverse-engineered HID exchange. It receives status packets for battery and sound modes, sends feature reports for settings, and uses the user's QuantumENGINE DLL to calculate EQ coefficients.
- [zlt: MTN ZLT T10D MAX router API reconstruction](https://awesomerea.org/resources/zltrouter-case/index.md): Case study · zlt reconstructs the LAN JSON API of the MTN ZLT T10D MAX router from its served JavaScript and observed responses. Its Python client handles reqproc requests, login and CSRF behavior, while a CLI and local dashboard expose signal, network mode, SMS and USSD operations. The protocol document identifies firmware-specific fields and porting limits.
- [claude-rc-api: reconstructing Claude Code Remote Control endpoints](https://awesomerea.org/resources/claude-rc-api-case/index.md): Case study · claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code. Its reference derives session endpoints, OAuth authentication, event envelopes, and streaming behavior from the CLI binary; a Python library and CLI use that interface to observe and steer sessions.
- [MSI Mystic Light on Linux: reconstructing B860/X870 lighting control](https://awesomerea.org/resources/msi-mystic-light-b860-x870-linux-case/index.md): Case study · MSI Mystic Light on Linux implements lighting control for an MSI motherboard from USB traffic captured while MSI Center ran in a Windows VM. Its Python script sends a 290-byte HID Feature report to controller 0db0:0076, while the documentation maps modes, RGB palette bytes, brightness, direction and the flash-save flag.
- [LinkCam: controlling Insta360 Link 2 through UVC extension research](https://awesomerea.org/resources/linkcam-case/index.md): Case study · LinkCam implements macOS menu-bar and command-line controls for the Insta360 Link 2 webcam. It uses standard UVC controls for pan, tilt and zoom, while its extension-unit investigation identifies a feature-mask bit and selector for AI tracking.
- [shark-k86-mac: a client for the Attack Shark K86 HID protocol](https://awesomerea.org/resources/shark-k86-mac-case/index.md): Case study · shark-k86-mac reconstructs the Attack Shark K86 keyboard's vendor HID controls as a Python CLI and library for macOS and Linux. Its clean-room protocol notes describe 64-byte feature reports, checksums and opcodes; the client controls lighting and the TFT screen and reads device information.
- [fitdays: reconstructing a smart-scale cloud client](https://awesomerea.org/resources/fitdays-protocol-case/index.md): Case study · fitdays recreates read-only access to the Fitdays smart-scale cloud API from traffic observed in the vendor app. Its asynchronous Python client logs in with the service's password digest, follows regional redirects, renews sessions, and retrieves scale, profile, and body-composition measurement records.
- [trvision: implementing Thermalright Vision USB display control](https://awesomerea.org/resources/trvision-case/index.md): Case study · trvision implements direct USB control of Thermalright Vision display panels using previously documented protocol research. It captures desktop frames, encodes JPEG or RGB565 according to the handshake reply, and sends framed data over bulk USB; a companion parser reads USBPcap captures.
- [pocket-client: a BLE client for the Pocket voice recorder](https://awesomerea.org/resources/pocket-client-case/index.md): Case study · pocket-client implements the Pocket voice recorder's recovered BLE command protocol in a Swift library and CLI. It documents authentication, status and recording inventory exchanges, MP3 transfer and control commands, using findings from vendor-app HCI captures and live device probes.
- [KeyAxis: decoding a magnetic keyboard's analog HID stream](https://awesomerea.org/resources/keyaxis-keyboard-hid-case/index.md): Case study · KeyAxis documents the HID travel stream of keyboards using the 0416:7372 controller and turns key depth into virtual gamepad axes. Its protocol notes specify the vendor interface, ARM and DISARM commands, 64-byte host reports and row, column and depth fields recovered from captured traffic.
- [A.O. Smith water heater: local CTA-2045 control and protocol findings](https://awesomerea.org/resources/aosmith-water-heater-case/index.md): Case study · The A.O. Smith water-heater project implements local monitoring and demand-response control of an HPS10-50H45DV over its CTA-2045 RS-485 port, publishing readings to MQTT. Its documentation records frame structure, checksums, control responses and observed behavior of this specific tank.
- [j2208-band-tools: a direct client for the J2208 fitness-band protocol](https://awesomerea.org/resources/j2208-band-tools-case/index.md): Case study · j2208-band-tools implements a direct BLE client for J2208-family fitness bands using protocol findings recovered from the FitTrack Health companion app. Its Python tools read stored health history and live sensor values, probe GATT services and collect readings into SQLite. The author checked the documented 16-byte frame protocol against one Hume Band V2.
- [Eufy Local Light: reconstructing BLE control for E10 and E22 lights](https://awesomerea.org/resources/eufy-local-ha-case/index.md): Case study · Eufy Local Light implements a Home Assistant client for Eufy Outdoor String Lights E10 and Permanent Outdoor Lights E22 using BLE traffic analyzed from the Eufy app. Its protocol notes describe GATT endpoints, packet framing, AES-128-CBC session setup, and light-control commands.
- [OpenPeats: reconstructing SoundPEATS earbud controls](https://awesomerea.org/resources/openpeats-case/index.md): Case study · OpenPeats reconstructs the SoundPEATS earbud control protocol for desktop and Android clients. Its specification describes frames and opcodes derived from analysis of the official Android app and checked against SOUNDPEATS H3 hardware. Go and Kotlin implementations expose ANC, equalizer and multipoint controls, plus battery status.
- [hongtai-panel: reconstructing a cooler LCD's USB serial protocol](https://awesomerea.org/resources/hongtai-panel-case/index.md): Case study · hongtai-panel implements Linux control of a LovingCool AIO cooler LCD using a USB CDC-ACM serial protocol reconstructed from the vendor's Electron application. Its documentation describes control-frame layout, checksums, JSON replies, and opcodes; the client displays system statistics, media, or screen mirroring.
- [ESPHome ↔ L&S Emotion Control: reconstructing a smart-light radio client](https://awesomerea.org/resources/emotion-control-ha-case/index.md): Case study · An ESPHome component recreates L&S Emotion Control remote commands so an ESP32 with a CC2500 radio can control furniture lights and reflect physical remote presses in Home Assistant. Its documented radio configuration uses MSK at 2436.2 MHz, a sync word, and 14-byte payloads carrying the remote ID, command, and value.