# Curated reverse engineering resources · Page 45

> Page 45 of 52, entries 4,401–4,500. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/45/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/45/index.md>

## Protocols (100)

- [akp02: reconstructing the Ajazz AKP02 display protocol](https://awesomerea.org/resources/akp02-display-protocol-case/index.md): Case study · akp02 reconstructs the Ajazz AKP02 secondary display's USB HID protocol as a Linux Python library. It documents command report framing and implements full or partial image updates, brightness and power controls, firmware queries, orientation and keepalive.
- [RK M75: reconstructing wired and wireless RGB control](https://awesomerea.org/resources/rk-m75-case/index.md): Case study · RK M75 reconstructs RGB control for the Royal Kludge RK M75 keyboard from wired USB HID captures and 2.4 GHz wireless experiments. A Python library sends per-key wired frames and grouped wireless frames; the repository also contains protocol notes, captures and a wired SignalRGB plugin.
- [ACiQ K18W: reconstructing a mini split's UART protocol](https://awesomerea.org/resources/aciq-minisplit-protocol-case/index.md): Case study · ACiQ K18W documents the UART protocol between a mini split's indoor board and TCL WBR1 Wi-Fi module. Captures and decoders map 115200 8N1 traffic, 0xA5 frames, CRC-16/XMODEM, acknowledgments, and appliance fields; ESPHome configurations provide passive monitoring or local control after replacing the module.
- [RND Companion: reconstructing the RND Synth SysEx protocol](https://awesomerea.org/resources/rnd-companion-case/index.md): Case study · RND Companion reconstructs the Cymaforma RND Synth's SysEx control vocabulary and implements a C++ codec and companion plugin for patch seeds. The protocol notes identify framing and seed or status commands from a web app and one hardware capture. The client can use a direct MIDI port or host MIDI routing and stores a curated seed library.
- [viture-v2: a reconstructed VITURE Gen2 glasses protocol and driver](https://awesomerea.org/resources/viture-v2-case/index.md): Case study · viture-v2 documents and implements the USB HID protocol used by VITURE Gen2 XR glasses. The author matched usbmon captures to SDK frame logs, then wrote a Rust driver with hidraw, usbfs and io_uring transports for queries and IMU streams. Measurements and compatibility claims cover the VITURE Pro 2 XR.
- [BikeStation: local Echelon Connect control over Bluetooth LE](https://awesomerea.org/resources/bikestation-case/index.md): Case study · BikeStation is a local Windows client for Echelon Connect exercise bikes built on community research into their proprietary Bluetooth LE protocol. It reads cadence and resistance telemetry, queries the bike's resistance range, writes motorized resistance commands and records rides without the vendor cloud.
- [PartyBox for Home Assistant: reconstructing JBL speaker control over Bluetooth](https://awesomerea.org/resources/partybox-for-home-assistant-case/index.md): Case study · PartyBox for Home Assistant replaces the JBL PartyBox phone app's control path with a Bluetooth client and MQTT entities. Its documented protocol was reconstructed from the JBL PartyBox Android app 3.14.20 and observed traffic, including command frames over GATT and ATT over classic Bluetooth.
- [carlinkit-cxx: Linux receiver for Carlinkit Auto Box USB messages](https://awesomerea.org/resources/carlinkit-cxx-case/index.md): Case study · carlinkit-cxx implements a Linux host for Carlinkit Auto Box USB dongles using their framed bulk-message protocol. It receives CarPlay or Android Auto H.264 video and PCM audio, sends touch input and displays decoded video through VAAPI, V4L2 or software paths.
- [mchose-linux: MCHOSE HID settings protocol and Linux client](https://awesomerea.org/resources/mchose-hid-linux-case/index.md): Case study · mchose-linux reconstructs the MCHOSE mouse settings protocol and implements Linux CLI and GUI clients for it. Its documentation traces HID feature-report commands and configuration fields from the M HUB web bundle and an L7 Pro mouse. The clients read and change DPI, polling rate, lift-off distance and other stored settings.
- [K1C CFS without official Creality firmware: CFS protocol client and Klipper integration](https://awesomerea.org/resources/k1c-cfs-klipper-case/index.md): Case study · K1C CFS without official Creality firmware reconstructs part of the Creality CFS RS-485 control protocol so a K1C running a community Klipper stack can operate the filament box. Its Python client and Klipper extension cover discovery, addressing, sensors, RFID, filament feed and retraction; the combined toolchange macro remains unfinished.
- [Open TechEd: reconstructing NanoDrop 1000 USB control](https://awesomerea.org/resources/open-teched-nanodrop-case/index.md): Case study · Open TechEd reconstructs USB control of the Thermo Fisher NanoDrop 1000 spectrophotometer. The pilot captures vendor-software traffic, documents command and data endpoints, calibration reads, lamp and clamp controls, and pixel decoding, then implements a Python driver used through PyLabRobot.
- [douze: SSL 12 USB control protocol and Linux client](https://awesomerea.org/resources/douze-case/index.md): Case study · douze reconstructs the Solid State Logic SSL 12 USB control protocol and applies it in a Linux command-line controller and local mixer interface. Its protocol notes and captures cover framing, checksums, gain routing, monitoring, preamps and loopback.
- [Osmotic: a Mac client for DJI Osmo camera protocols](https://awesomerea.org/resources/osmotic-case/index.md): Case study · Osmotic implements a macOS client for DJI Osmo cameras using their BLE pairing, DUML-over-UDP control and file-list protocol. It downloads media over the camera's Wi-Fi, provides recording and live-view controls, and includes Swift protocol code and documentation derived in part from earlier Osmo projects.
- [GogglesView: receiving DJI Goggles 3 video over USB-C](https://awesomerea.org/resources/gogglesview-dji-goggles-3-case/index.md): Case study · GogglesView receives the DJI Goggles 3 live video feed over a reverse-engineered USB-C connection on macOS. It decodes H.264 with VideoToolbox and offers local viewing, passthrough recording and streaming outputs; the repository includes protocol research notes and Swift source.
- [Xiaomi X-WPFTB LiDAR: decoding a robot-vacuum sensor's UART frames](https://awesomerea.org/resources/xiaomi-wpftb-lidar-case/index.md): Case study · Xiaomi X-WPFTB LiDAR documents the one-way UART data format of the X-WPFTB-V2.6.2 sensor used in Xiaomi and Dreame robot vacuums. The author reports decoding 36-byte frames carrying eight distance samples, angle, quality and flags, then implements an Arduino parser and Windows visualizers.
- [RedMagic Cooler for macOS: a Bluetooth controller for the VC Cooler 6 Pro](https://awesomerea.org/resources/redmagic-cooler-mac-case/index.md): Case study · RedMagic Cooler for macOS reconstructs the REDMAGIC VC Cooler 6 Pro's Bluetooth control path in a menu bar app. It uses packet captures and vendor app observation to map GATT characteristics for cooling, fan speed, lighting and telemetry, and includes probe scripts for testing command bytes.
- [Panasonic HC-X2 / HC-X20 Remote Control: HC-ROP protocol client](https://awesomerea.org/resources/panasonic-hc-x2-control-case/index.md): Case study · Panasonic HC-X2 / HC-X20 Remote Control implements a Python client for the cameras' HC-ROP/P2Control protocol. It sends XML control commands over TCP, decodes UDP telemetry and recording events, and documents the handshake and command set. The author reports testing it on HC-X2 and HC-X20 bodies.
- [open-m711pro: reconstructing Redragon M711 Pro USB control](https://awesomerea.org/resources/open-m711pro-case/index.md): Case study · open-m711pro reconstructs the Redragon M711 Pro mouse's USB HID configuration exchanges from vendor-app traffic captured with usbmon and Wireshark. Its Python Linux driver and interfaces read and set lighting, DPI, button mappings and polling rate through hidraw, with packet builders tested against captured bytes.
- [vestaboard-offline: local control of a Vestaboard display](https://awesomerea.org/resources/vestaboard-offline-case/index.md): Case study · vestaboard-offline restores local control of a Vestaboard split-flap display with a Python web controller running on the board. It sends 6×22 character grids to the on-board vbctrl service and documents the display's RS485 flap-bus framing, commands and recovery path.
- [Better RGB: reconstructing the Tongfang/ITE8291 keyboard lighting protocol](https://awesomerea.org/resources/better-rgb-case/index.md): Case study · Better RGB reconstructs the USB HID lighting protocol of Tongfang laptops with an ITE8291 keyboard controller and implements a Windows per-key RGB client. The author describes comparing vendor-software captures with visible lighting changes to identify feature-report commands, output-report buffers and key offsets.
- [aiowapy: a Python implementation of WhatsApp Multi-Device protocols](https://awesomerea.org/resources/aiowapy-whatsapp-protocol-case/index.md): Case study · aiowapy implements a Python client for WhatsApp Multi-Device using Noise transport, Signal sessions and a WABinary codec. Its protocol notes describe framing, pairing and message stanzas; the code also covers media, groups, app-state sync and SQLite session storage. The author reports extensive offline tests but no live end-to-end message delivery yet.
- [redmi-buds-linux: rebuilding Redmi earbud controls over JieLi RCSP](https://awesomerea.org/resources/redmi-buds-linux-case/index.md): Case study · redmi-buds-linux reimplements Redmi and Xiaomi earbud controls on Linux using a documented variant of JieLi RCSP over Bluetooth Classic RFCOMM. The author derived the challenge-response transform from the companion app's native library and compared protocol behavior with a phone-to-buds HCI capture. Its Rust CLI and GTK app expose battery status, EQ, gestures and earbud finding; noise control is available on models with ANC.
- [iPod Classic LCD: recovering the display pinout and bus protocol](https://awesomerea.org/resources/ipod-classic-lcd-protocol-case/index.md): Case study · The iPod Classic LCD investigation maps the 34-pin display connector and decodes its 18-lane RGB666, 8080-series bus using logic-analyser captures and electrical measurements. It documents command framing, initialization, power sequencing and pixel timing, and includes Python tools to decode captures and reconstruct screen images.
- [OBSBOT Tiny 3: USB control protocol investigation](https://awesomerea.org/resources/obsbot-tiny3-protocol-case/index.md): Case study · obsbot-tiny3-protocol investigates direct USB control of the OBSBOT Tiny 3 camera. It documents UVC extension-unit addressing, V3 frame fields and CRC, Tiny 3 AI mode values, and command behavior checked against camera-reported state; Python probes inspect UVC properties and test vendor opcodes.
- [StargateCryo: an Intel Cryo controller dashboard built on serial-protocol research](https://awesomerea.org/resources/stargatecryo-case/index.md): Case study · StargateCryo is a Rust dashboard that monitors and controls Intel Cryo cooling controllers over a documented reverse-engineered serial protocol. It adds controller telemetry, PID profiles, diagnostics, session history, and sensor integrations to an earlier open-source controller. The documented hardware evaluation covers one modified Gen 1 controller with a Gen 2 TEC.
- [infrared: LG and Vityas remote command mappings](https://awesomerea.org/resources/infrared-remote-configs-case/index.md): Case study · infrared documents command mappings for LG 6710CMA family and Vityas RC-5 remotes through LIRC and irplus configuration files. The LG notes describe the 0x0808 pre-data, a possible 38.3 kHz carrier and a 256-code command space; a full irplus configuration lets readers try that space against compatible devices.
- [Winbond Keyboard Colour: reconstructing keyboard lighting commands](https://awesomerea.org/resources/winbond-keyboard-colour-case/index.md): Case study · Winbond Keyboard Colour implements lighting control for Winbond-based keyboards on Linux using USB command bytes mapped from the original Windows software. Its graphical interface lets users select and apply lighting effects.
- [OBOX Controller ViGEm Driver: a Windows client for the Snail OBox gamepad](https://awesomerea.org/resources/obox-controller-vigem-case/index.md): Case study · OBOX Controller ViGEm Driver implements a Windows client for the Snail OBox Bluetooth gamepad using a documented HID protocol. Its Rust driver maps buttons, sticks and triggers to a ViGEmBus Xbox 360 controller and sends rumble and LED commands through HID output reports; the repository also includes a Python prototype.
- [OsmoFresh Quella Pro: hardware and UART protocol investigation](https://awesomerea.org/resources/osmofresh-quella-pro-hardware-case/index.md): Case study · An OsmoFresh Quella Pro investigation records reconstructed PCB schematics, identified components and a UART communication model for the water dispenser. The protocol notes distinguish main-to-display responses from display-to-main AA frames and give a SUM16 calculation, while leaving several payload meanings unresolved.
- [Colorful 2F4C:1018: reconstructing a motherboard ARGB HID interface](https://awesomerea.org/resources/colorful-2f4c-openrgb-case/index.md): Case study · Colorful 2F4C:1018 reconstructs the HID commands used to drive a COLORFIRE motherboard's ARGB headers from vendor-app analysis and live probing. It identifies interface 2 as the lighting channel and documents 20-LED data reports followed by commit reports. Included OpenRGB controller code sends direct frames and host-rendered effects.
- [Deli XiangYinBao X1: reconstructing a Bluetooth label printer protocol](https://awesomerea.org/resources/deli-xiangyinbao-x1-protocol-case/index.md): Case study · Deli XiangYinBao X1 reconstructs the portable label printer's proprietary Bluetooth printing protocol from HCI captures and Frida observations. It documents CRC32 framing, 384-dot bitmap encoding, replies, and print sequencing, with Python and JavaScript implementations, capture parsers, and regression tests.
- [KardiaMobile 6L Unlocked: a direct BLE ECG client](https://awesomerea.org/resources/kardiamobile-6l-unlocked-case/index.md): Case study · KardiaMobile 6L Unlocked reconstructs the BLE exchange used to obtain ECG samples from the AliveCor KardiaMobile 6L. Android HCI captures inform the bonding sequence, derived unlock token, and two-channel sample framing; a Python client records the stream on Linux and writes CSV, PNG, and PDF outputs.
- [Elan 04f3:0903: reconstructing a fingerprint sensor's Linux interface](https://awesomerea.org/resources/elan-0903-fingerprint-linux-case/index.md): Case study · Elan 04f3:0903 reconstructs a laptop fingerprint sensor's USB interface after analysis of its Windows driver DLLs and provides a Linux capture and authentication pipeline. The source identifies command, touch and raw-frame endpoints, then describes OpenCV preprocessing, ORB features and RANSAC matching for a PAM integration.
- [FIIL 耳机控制: a Windows client for FIIL headphone BLE commands](https://awesomerea.org/resources/fiil-headphone-control-case/index.md): Case study · FIIL 耳机控制 implements a Windows client from reverse-engineered BLE GATT commands used by FIIL headphones. Protocol notes describe the fdb3 service, ff17 write and ff18 notification characteristics, message framing, unlock sequence and command responses. The desktop app controls supported modes and records raw traffic alongside parsed results.
- [Wireless AA Bridge: reconstructing a wireless Android Auto relay](https://awesomerea.org/resources/wireless-aa-bridge-case/index.md): Case study · Wireless AA Bridge reconstructs a wireless Android Auto relay on a spare Android phone. It presents a USB AOA connection to a wired car head unit, performs Bluetooth and Wi-Fi projection setup with the client phone, and forwards AAP traffic while preserving its in-band TLS exchange.
- [atmos-lcd: a replacement client for the MasterLiquid Atmos II LCD](https://awesomerea.org/resources/atmos-lcd-case/index.md): Case study · atmos-lcd is a Windows client for the Cooler Master MasterLiquid Atmos II LCD built around a reverse-engineered USB HID protocol. It controls screen content, brightness, rotation, and stored media; the repository documents handshake and command framing and includes a C# probe and packet-capture parser.
- [B&K 2318: reconstructing a thermal printer's serial interface](https://awesomerea.org/resources/bk2318-esp32-case/index.md): Case study · B&K 2318 documents measured behavior of a vintage thermal printer's ZI 0054 serial interface, including XON/XOFF flow control, text commands, character sets, and graphics. An ESP32-C6 and SP3232 adapter connects a modern computer to the unmodified printer; the repository includes firmware, a Python client, probe scripts, and logs.
- [TCOMAS LG600: reconstructing a cooler LCD's USB HID display protocol](https://awesomerea.org/resources/tcomas-lg600-lcd-case/index.md): Case study · TCOMAS LG600 reconstructs the USB HID image-transfer protocol of a 480×480 cooler LCD from vendor-app traffic. Its Python package encodes images as JPEG, splits each frame into HID output reports, and streams them to the display. The documented report format and timing constraints are based on one tested LG600 unit.
- [Wanderer: rebuilding sensor control over a reverse-engineered serial link](https://awesomerea.org/resources/wanderer-device-case/index.md): Case study · Wanderer implements control software and a data plotter for an Elektrobit/Extrabit portable sensor device from around 1991. The author says the unit they examined measures ambient temperature and vibration, and reports reversing its serial protocol and reimplementing parts of the original Windows control software in Python.
- [Clockwise Calipers Data Interface: reconstructing the DTCR-02 cable](https://awesomerea.org/resources/clockwise-calipers-data-interface-case/index.md): Case study · Clockwise Calipers Data Interface reconstructs the DTCR-02 data cable for Clockwise Tools DCLR-XX05 calipers. An Arduino reads the caliper's synchronous 24-bit measurements and presents them as USB keyboard input; the repository includes packet notes, firmware, KiCad designs and case models.
- [pocket_polar: WOOSIM PORTI-SM40 printer commands](https://awesomerea.org/resources/pocket-polar-case/index.md): Case study · pocket_polar investigates command bytes for a WOOSIM PORTI-SM40 Bluetooth receipt printer. Python scripts pack style, alignment and image commands and write them to a Bluetooth serial device; the image path is marked unfinished.
- [autowonder-claude-executor: reconstructing the AutoWonder executor interface](https://awesomerea.org/resources/autowonder-claude-executor-case/index.md): Case study · autowonder-claude-executor reconstructs AutoWonder's scheduler-to-executor interface in a Node and TypeScript daemon that runs Claude Code for dispatched tasks. Its specification covers WebSocket dispatch frames, package checks, inventory heartbeats, handoff, checkpoints and crash recovery.
- [LocalAC: local Gree air-conditioner control from protocol research](https://awesomerea.org/resources/localac-gree-protocol-case/index.md): Case study · LocalAC reconstructs local control of a Gree Pular T3 air conditioner through its LAN protocol. The author documents UDP port 7000 discovery, a bind handshake, AES-GCM command envelopes and property behavior measured on one firmware version. A C# protocol library supports a CLI and .NET MAUI app for status, temperature and other controls.
- [Panoptes: reconstructing Hik-Connect live-stream encryption](https://awesomerea.org/resources/panoptes-hik-connect-stream-case/index.md): Case study · Panoptes reconstructs the encryption layout of Hik-Connect live video streams for a self-hosted Hikvision DVR video wall. The author compares clear SPS data in SDP with encrypted in-band SPS, reports AES-128-ECB with the device verification code as key, and implements per-NAL decoding in an RTSP client that feeds go2rtc.
- [mchose-linux: reconstructing MCHOSE mouse controls on Linux](https://awesomerea.org/resources/mchose-linux-case/index.md): Case study · mchose-linux reconstructs MCHOSE A5 and AX5 Pro mouse settings on Linux from a decompiled Windows driver. It documents 65-byte HID Feature Reports, command groups and field offsets, then provides DPI and polling-rate controls, battery status and other settings through a CLI, GNOME extension and GTK app.
- [epson-scan-to-mac: reconstructing Epson panel scanning on Macs](https://awesomerea.org/resources/epson-scan-to-mac-case/index.md): Case study · epson-scan-to-mac reconstructs Epson's Scan to Computer exchange for Macs from captured printer and Event Manager traffic. A Python listener answers SLPv2 discovery and PushScan requests, then asks Epson ScanSmart to scan; a separate WSD listener can save JPEGs directly. The protocol notes document the observed message flow and bytes for an EPSON L6270.
- [OpenMouse: reconstructing Kysona M600 V2 mouse control](https://awesomerea.org/resources/openmouse-kysona-m600-case/index.md): Case study · OpenMouse implements a macOS client for the Kysona M600 V2 mouse from recovered HID control messages. The author derived framing and checksums from the vendor's Windows library, refined the protocol with USB captures, and wrote Swift code for settings such as DPI, report rate and button mapping.
- [WDA Konfigurator: a reconstructed Microsoft Wireless Display Adapter configuration client](https://awesomerea.org/resources/wda-konfigurator-case/index.md): Case study · WDA Konfigurator reconstructs the configuration client for Microsoft Wireless Display Adapters. The author derived its CGI request protocol from original-app traffic and app inspection, then built a Windows GUI and CLI for settings and official firmware installation. The documented protocol covers commands, discovery, errors and firmware transfer for Gen 1, Gen 1.5 and Gen 3.
- [irca-ble-protocol: reconstructing heater control over Bluetooth LE](https://awesomerea.org/resources/irca-ble-protocol-case/index.md): Case study · irca-ble-protocol documents the Bluetooth LE control protocol observed on an Olle POWER-family towel rail. It describes GATT characteristics, 20-byte command frames, status fields and authentication behavior, and provides Python, Home Assistant and Android implementations.
- [egm6-nixie-clock: reconstructing a nixie clock's Wi-Fi protocol](https://awesomerea.org/resources/egm6-nixie-clock-case/index.md): Case study · egm6-nixie-clock reconstructs the EGM6 six-tube clock's Wi-Fi control protocol from vendor Windows-app traffic. Its Python CLI sends TCP port 10000 frames for display, time, effects and scheduling settings. The README records the frame layout, command groups, sample bytes and unresolved groups.
- [Guoran nixie clock: reconstructing its Bluetooth control protocol](https://awesomerea.org/resources/guoran-nixie-clock-case/index.md): Case study · Guoran nixie clock documents the BLE control protocol of GANXIN IN1204M family clocks and implements it in a Web Bluetooth app and Home Assistant integration. The author derived the commands from the original Android app and the clock manual; the protocol document records GATT characteristics, message handling, and open questions.
- [1st Player RT LCD: reconstructing a case-display HID protocol](https://awesomerea.org/resources/1stplayer-rt-lcd-case/index.md): Case study · 1st Player RT LCD reconstructs the USB HID control protocol for displays in 1st Player RT5, RT7, and RT9 cases. Its protocol notes describe 64-byte output reports, and Python scripts drive CPU and GPU telemetry, scrolling text, and a panel test on Linux.
- [Ecovacs Deebot X1: reconstructing local map and control interfaces](https://awesomerea.org/resources/ecovacs-x1-local-control-case/index.md): Case study · Ecovacs Deebot X1 Local Control Research documents the robot's map format, ROS messages, state stream, and control services for local operation. The repository includes captured message definitions, scripts for querying and calling the ROS graph, and deployment notes for a separate Valetudo fork. The author reports working map, cleaning, and settings control on an X1 device.
- [MyEnergy Dashboard: reconstructing INFINITY 1000 Bluetooth controls](https://awesomerea.org/resources/myenergy-dashboard-case/index.md): Case study · MyEnergy Dashboard reconstructs Bluetooth control and telemetry for the INFINITY 1000 portable power station in a browser app. Its TypeScript protocol package builds frames, checks Modbus CRC, decodes device messages and runs a simulator, while the web interface exposes power readings and controls.
- [sk700v-linux: a Linux display client for the Sudokoo SK700V](https://awesomerea.org/resources/sk700v-linux-case/index.md): Case study · sk700v-linux drives the Sudokoo SK700V cooler LCD from Linux using its observed USB HID protocol. The write-up maps 64-byte output reports, command payloads and sensor fields from vendor-app traffic and trial frames; a Python daemon sends CPU readings and a probe script sends manual frames.
- [OpenNoiseRep: a BLE client for the Noise REP fitness band](https://awesomerea.org/resources/opennoiserep-case/index.md): Case study · OpenNoiseRep implements a BLE client for the Noise REP band, with desktop, menu-bar and command-line views for historical health data and local CSV or JSON export. Its protocol notes reconstruct GATT characteristics, chunk framing and commands from a vendor sync capture and live probing.
- [rtchair: local control of the Rotai RT7709S massage chair](https://awesomerea.org/resources/rtchair-case/index.md): Case study · rtchair reconstructs local control of the Rotai RT7709S massage chair from its communication protocol. An OpenWrt router redirects the chair's MQTT connection to a local broker, while a CLI and Home Assistant integration expose controls and timed massage programs.
- [zte-cpe-sms: reconstructing ZTE CPE SMS API access](https://awesomerea.org/resources/zte-cpe-sms-case/index.md): Case study · zte-cpe-sms reconstructs access to the internal SMS API of ZTE MC889 and related 5G CPE devices. Its protocol notes describe login hashing, an RSA session-key exchange, a token that must be recalculated after key exchange, and UCS-2 message encoding; Node.js CLI and web clients use those findings to read and send SMS.
- [gs5-rgb: Creative Sound Blaster GS5 lighting protocol](https://awesomerea.org/resources/gs5-rgb-case/index.md): Case study · gs5-rgb reconstructs the Creative Sound Blaster GS5 lighting protocol from USB captures and implements it as a Linux Python library and CLI. Its protocol notes specify HID report framing, acknowledgments, effects, and status reads; the client controls seven strip segments, brightness, and built-in effects.
- [Telly Remote: reconstructing TYRC-1 remote control over Bluetooth and infrared](https://awesomerea.org/resources/telly-remote-case/index.md): Case study · Telly Remote controls a Telly TV through a Flipper Zero that emulates the TYRC-1 remote over Bluetooth HID and infrared. Its documentation records captured NEC extended infrared codes, Bluetooth advertisements and scan responses, and the PnP ID that selects the TV's key map; a local web server sends keys and menu sequences to the Flipper.
- [Wave Buds: a client for the JBL Wave Buds control protocol](https://awesomerea.org/resources/wave-buds-case/index.md): Case study · Wave Buds implements an Android companion for the original JBL Wave Buds using a Bluetooth control protocol documented from the author's traffic captures. It controls ambient sound, equalization and touch settings, and its reference records GATT characteristics and command frames.
- [manifold-558s-ble: reconstructing testo 558s measurement messages](https://awesomerea.org/resources/manifold-558s-ble-case/index.md): Case study · manifold-558s-ble reconstructs the testo 558s refrigeration manifold's Bluetooth LE message format from observed traffic between the device and its phone app. Its Python client subscribes to live pressure and temperature measurements, while companion scripts inspect GATT services and decode Android Bluetooth captures.
- [attackshark-x11prov2: decoding the X11 PRO V2 mouse configuration protocol](https://awesomerea.org/resources/attackshark-x11prov2-case/index.md): Case study · attackshark-x11prov2 reconstructs the ATTACK SHARK X11 PRO V2 mouse's HID configuration exchanges and implements a Python CLI for DPI stages, polling rate and lift-off distance. The documented report layouts include the LOD byte, checksum and read and write acknowledgments.
- [AULA Hub: reconstructing the AULA F99 Pro keyboard protocol](https://awesomerea.org/resources/aula-hub-f99-protocol-case/index.md): Case study · AULA Hub reconstructs the AULA F99 Pro keyboard's wired and 2.4 GHz HID commands and uses them in a Windows control app. Its protocol notes describe frame layouts, configuration pages, key records and per-key colour data; the app provides lighting, remapping, macros and battery display.
- [hpcs330: reconstructing the Hopoo spectrometer serial protocol](https://awesomerea.org/resources/hpcs330-case/index.md): Case study · hpcs330 implements a Python reader for the Hopoo HPCS-330 spectrometer using a USB serial protocol recovered from the vendor's Windows application. The protocol notes describe framing and measurement commands; the client retrieves spectral samples and the meter's computed light measurements.
- [LB-M8 Settings: reconstructing Lingbao M8 mouse commands](https://awesomerea.org/resources/lb-m8-settings-case/index.md): Case study · LB-M8 Settings implements a browser client for the Lingbao M8 mouse using HID commands recovered from its Windows driver. A byte-level protocol reference describes 40-byte feature reports, request and reply behavior, and settings for DPI, polling rate, sleep, and sensor options.
- [iMist: local diffuser control from a reconstructed Bluetooth protocol](https://awesomerea.org/resources/imist-diffuser-case/index.md): Case study · iMist implements local Home Assistant control for an aroma diffuser whose Bluetooth command format was inferred by observing reports while its buttons were pressed. Its protocol notes map the fff4 characteristic's aa MM LL mist and light bytes; the integration exposes state, color, mist, schedules, and a sleep timer.
- [Toshiba e-STUDIO2323AM: reconstructing a PJL/JBIG print stream for CUPS](https://awesomerea.org/resources/toshiba-estudio2323am-cups-driver-case/index.md): Case study · Toshiba e-STUDIO2323AM/2823AM CUPS driver reconstructs the printers' PJL and JBIG-1 print stream from captured Windows GDI driver output. A CUPS raster filter and PPD generate jobs for a socket print queue, while protocol notes describe job envelopes, page blocks, paper options, and copy behavior. The author reports byte-level capture comparisons and printing on an e-STUDIO2323AM.
- [CustomWatch: a Prixton Life Fit companion from BLE protocol research](https://awesomerea.org/resources/customwatch-case/index.md): Case study · CustomWatch implements an Android companion for the Prixton Life Fit smartwatch using a BLE protocol studied through static analysis, limited capture and one-device tests. It requests activity, pulse and battery data, stores sleep observations locally, and forwards selected notifications.
- [reticos-rgb: Speedlink RETICOS RGB mouse profile protocol](https://awesomerea.org/resources/reticos-rgb-case/index.md): Case study · reticos-rgb reconstructs the Speedlink RETICOS RGB mouse's HID profile protocol from a capture of its vendor driver. Its Python tools read and back up the onboard profile, change lighting, DPI and polling settings, and decode exported .bkm profiles. The documentation maps feature reports and selected profile bytes.
- [SPL Lab Web: NEXT LAB measurement client and device protocol](https://awesomerea.org/resources/spl-lab-web-case/index.md): Case study · SPL Lab Web replaces the measurement functions of the NEXT LAB bass meter's Windows software with a Node service, browser interface and Electron app. Its device protocol document draws on Ghidra decompilation, configuration files and live tests; the client reads USB serial data, computes measurements and exposes an HTTP/SSE API.
- [SainSmartDDS140: a USB oscilloscope client built from protocol research](https://awesomerea.org/resources/sainsmart-dds140-case/index.md): Case study · SainSmartDDS140 reimplements control of the SainSmart DDS140 USB oscilloscope through its recovered USB protocol. The author describes decompiling the vendor .NET app, examining its WinUSB wrapper and checking commands against hardware. A pyusb client exposes capture, calibration, recording and a local browser interface, while protocol notes document control transfers and interleaved channel samples.
- [haylou-rt-tools: reconstructing Haylou RT BLE and watch-face formats](https://awesomerea.org/resources/haylou-rt-tools-case/index.md): Case study · haylou-rt-tools reconstructs selected Haylou RT LS05S watch interactions and the .tbwf watch-face format from device observation and study of the Hello Haylou app. Its Python tools query firmware and battery status, pair with the watch, show a text alert during pairing, build and check faces, and preview main text elements. The protocol notes specify BLE services, frame checksums, and command IDs.
- [DJI RC Plus 2: control protocol and gamepad bridge](https://awesomerea.org/resources/dji-rc-plus-2-controls-case/index.md): Case study · A DJI RC Plus 2 investigation reconstructs its control-report protocol and maps the handheld’s sticks, wheels and buttons to gamepad input. The Android library decodes DUML reports, a tester displays live controls, and a Java SDL3 bridge presents them as an Xbox-style controller. Protocol notes give frame layout, checksums, keepalive and report rates.
- [AK820 Center: a Linux configurator for the AJAZZ AK820 Pro](https://awesomerea.org/resources/ak820-center-case/index.md): Case study · AK820 Center implements a Linux configurator for the AJAZZ AK820 Pro keyboard using a vendor HID protocol recovered from the Windows DeviceDriver.exe. Its protocol notes describe 65-byte feature reports, transaction framing and command banks; the Qt application controls lighting, remapping, macros and TFT uploads over wired USB.
- [Komimi: a Redmi Buds 6 Lite client built on its reconstructed control protocol](https://awesomerea.org/resources/komimi-case/index.md): Case study · Komimi reconstructs the Redmi Buds 6 Lite control protocol and uses it in a Windows tray client for battery status, noise control, and equalizer presets. Its protocol reference describes RFCOMM transport, framing, and commands, with a reusable C++17 message implementation.
- [Fisher & Paykel RF505BRNUX1: decoding refrigerator board traffic](https://awesomerea.org/resources/fisher-paykel-fridge-bus-case/index.md): Case study · The Fisher & Paykel RF505BRNUX1 bridge decodes two 9600-baud serial links on the refrigerator's main board and exposes door, setting, compressor, defrost, and temperature states to Home Assistant. Its documentation specifies frame layout, CRC-16/MODBUS, addresses, and byte maps; an ESPHome configuration reads the links without transmitting.
- [Lightstick Vibed Studio: reconstructing the Super Junior Ver. 2 BLE controls](https://awesomerea.org/resources/lightstick-vibed-studio-case/index.md): Case study · Lightstick Vibed Studio reconstructs BLE control of the Super Junior Ver. 2 lightstick from study of the SMTOWN Android app and checks on hardware. A local FastAPI console scans the device, sends color and effect commands, and offers a byte-level packet lab. The repository also contains a protocol specification and an Android client awaiting hardware BLE testing.
- [IOTBT701: BLE LED strip protocol and Windows client](https://awesomerea.org/resources/iotbt701-ambilight-case/index.md): Case study · IOTBT701 BLE LED Strip applies the protocol from the open-source lednetwf_ble integration to a Zengge-family Bluetooth light strip, checks it against the physical device and implements Windows C# clients. The notes describe GATT service FFFF, command characteristic FF01, status characteristic FF02, power and v3 color frames, plus device-specific hue behavior. A GUI maps screen color to the strip.
- [Heat & Glo RC300: a Homey client for the reconstructed 433 MHz protocol](https://awesomerea.org/resources/homey-heatnglo-rc300-case/index.md): Case study · The Heat & Glo RC300 Homey app reimplements 433 MHz commands from the IntelliFire Plus RC300 fireplace remote. Captures made with Homey's RF recorder inform a documented 47-symbol frame layout; the app learns the user's remote address, sends on/off, flame, and fan commands, and receives remote state changes.
- [APC SU1400RM2U: display pinout and LED driver reconstruction](https://awesomerea.org/resources/apc-su1400rm2u-display-case/index.md): Case study · An Arduino sketch reconstructs control of the APC SU1400RM2U display panel from its cable pinout and LED mapping. It identifies the A6276ELW LED driver, assigns latch, clock and serial-data lines, and demonstrates individual and sequential LED updates.
- [Silverbud: Galaxy Buds3 control over a documented RFCOMM protocol](https://awesomerea.org/resources/silverbud-case/index.md): Case study · Silverbud implements a Windows manager for Galaxy Buds3 over Samsung's RFCOMM control channel. It parses framed status and battery messages and sends settings commands for noise control, equalization and finding earbuds; its protocol notes credit GalaxyBudsClient for base layouts and document Buds3 observations.
- [hiska-keg450-lcd: reconstructing HISKA keyboard HID control](https://awesomerea.org/resources/hiska-keg450-lcd-case/index.md): Case study · hiska-keg450-lcd reconstructs Linux control of the HISKA HX-KEG450 keyboard from vendor HID traffic captured under Wine. Its Python client sends images, animation, lighting, settings, and clock commands through hidraw, while protocol notes specify report sizes, opcodes, acknowledgments, and upload sequences.
- [week-aqua-ble: reconstructing Week Aqua light control over BLE](https://awesomerea.org/resources/week-aqua-ble-case/index.md): Case study · week-aqua-ble reconstructs the Week Aqua P1200 Pro aquarium light's BLE commands by decompiling the Android app and recording its writes to a simulated light. ESPHome configurations use the recovered messages for channel brightness, fan, clock and schedule control through Home Assistant.
- [etnga-obd: mapping Toyota eTNGA vehicle diagnostics](https://awesomerea.org/resources/etnga-obd-case/index.md): Case study · etnga-obd maps the OBD-II diagnostic surface of Toyota eTNGA vehicles, including the bZ4X, Subaru Solterra and Lexus RZ. It records UDS over ISO-TP addresses, gateway sub-targets, decoded telemetry formulas and selected broadcast CAN frames, with confidence levels for individual findings.
- [DMR-39 Remote Bridge: reconstructing set-top-box remote control](https://awesomerea.org/resources/dmr39-case/index.md): Case study · DMR-39 Remote Bridge reconstructs remote control of the SUPER DMR-39 set-top box by probing its I2C front panel and capturing NEC infrared signals. The resulting ESP32-C3 firmware and Python tools expose mapped buttons through a web relay, with HDMI capture used to observe responses. The author reports mapping all 41 remote buttons.
- [open-drong-display: reconstructing Drong Display USB control](https://awesomerea.org/resources/open-drong-display-case/index.md): Case study · open-drong-display replaces the Drong Display 1CBE:0003 dongle's Windows software with an IddCx display driver using a reconstructed USB protocol. The project documents bulk-transfer commands and session startup, then sends H.264 frames to the dongle for HDMI output.
- [INNO X2 for macOS: reconstructing mouse control over HID](https://awesomerea.org/resources/innox2-mac-case/index.md): Case study · INNO X2 for macOS reconstructs configuration of the VortexSeries INNO X2 PRO mouse through its vendor HID feature reports. Its Swift app sets DPI, polling rate, buttons and macros, and shows battery status; the notes document 64-byte packets, checksums, receiver exchanges and opcodes.
- [pro2-linux: reconstructing Logitech PRO 2 LIGHTSPEED control on Linux](https://awesomerea.org/resources/pro2-linux-case/index.md): Case study · pro2-linux reconstructs configuration of the Logitech G PRO 2 LIGHTSPEED mouse on Linux from its HID++ 2.0 exchanges and onboard profile format 0x07. Its Python tools and libratbag patch handle DPI, report rate, RGB and button settings, while protocol notes record feature IDs and report layouts.
- [beam-revival: local Beam+ control from motor protocol research](https://awesomerea.org/resources/beam-revival-case/index.md): Case study · beam-revival reconstructs local control of the Suitable Technologies Beam+ telepresence robot after its cloud service ended. Its Python stack implements the documented motor-board serial protocol and provides browser driving, camera video, audio and docking, plus tools to build a bootable USB image.
- [NXOSC Reborn: reconstructing Waves Nx Head Tracker BLE output](https://awesomerea.org/resources/nxosc-reborn-case/index.md): Case study · NXOSC Reborn reconstructs the Waves Nx Head Tracker's BLE communication from analysis of Nxosc and captures from a physical tracker. Its Python app decodes orientation packets and sends configurable OSC messages to spatial-audio software, with profiles, smoothing and adjustable output rate.
- [BLE LED Matrix Controller: reconstructing GIF upload for a 96×20 display](https://awesomerea.org/resources/ble-led-matrix-controller-case/index.md): Case study · BLE LED Matrix Controller investigates the BLE commands of an ATOTOZONE CI-VIALD19 96×20 LED matrix and supplies a Python uploader for GIFs and static images. Its notes record packet acknowledgments and commands for brightness and screen blanking; the author reports successful GIF uploads below 49,980 bytes.
- [LSC Smart Connect / Battletron: reconstructing LAN lighting control](https://awesomerea.org/resources/lsc-battletron-bridge-case/index.md): Case study · LSC Smart Connect / Battletron reconstructs the desktop application's LAN lighting protocol in a Rust bridge for SignalRGB. It supports QR login, authenticated local color streaming and device management, with a JavaScript and QML plugin for the SignalRGB canvas.
- [Razer Key Light Chroma: a SignalRGB client for its lighting protocol](https://awesomerea.org/resources/razer-key-light-chroma-protocol-case/index.md): Case study · Razer Key Light Chroma adds local RGB control to SignalRGB using the lamp's documented TCP and UDP message sequence. It performs acknowledged setup on TCP port 10003, streams 95-byte color packets on UDP port 10005, and includes fixtures and tests comparing packets with the original SDK.
- [lochinvar-native-modbus: mapping Knight boiler telemetry](https://awesomerea.org/resources/lochinvar-native-modbus-case/index.md): Case study · lochinvar-native-modbus reconstructs the read-only Modbus register map exposed by Lochinvar Knight boilers through the SMART SYSTEM display's USB PC Connection port. Probe scripts and display comparisons identify telemetry for temperatures, firing rate, flame signal and counters; ESPHome and MQTT bridges publish readings to Home Assistant.
- [Cindy Band: a client for the Xiaomi Smart Band 8 BLE protocol](https://awesomerea.org/resources/cindy-band-case/index.md): Case study · Cindy Band implements PC and Android clients for Xiaomi Smart Band 8 NFC using a documented BLE protocol. The project records FE95 GATT framing, cmd26/27 authentication, HKDF session keys and AES-CCM business frames, alongside a local server and MCP access to band functions.
- [hd60-macos: reconstructing Elgato HD60 USB control on macOS](https://awesomerea.org/resources/hd60-macos-case/index.md): Case study · hd60-macos recreates host control of the original Elgato Game Capture HD60 on macOS from USB traces of Elgato's application. Its libusb driver uploads a user-extracted firmware image, replays trace-derived I²C initialization sequences, and streams H.264 video and audio as MPEG-TS to stdout, UDP, or OBS.
- [Lumalou Revival: reconstructing the lamp's encrypted BLE control](https://awesomerea.org/resources/lumalou-revival-case/index.md): Case study · Lumalou Revival reconstructs control of the Fisher-Price Lumalou lamp after its app was discontinued. An ESPHome bridge and Python client implement the documented MPID BLE exchange, including ECDH session setup, AES-128-CTR packets and framed sound-and-light commands. The reference lists 68 opcodes; the author reports testing on one lamp.
- [openedu09: reconstructing WSEDU09 oscilloscope control](https://awesomerea.org/resources/openedu09-case/index.md): Case study · openedu09 reconstructs control of the Whadda WSEDU09 USB oscilloscope from analysis of the vendor software and captures from a real device. It implements the HID protocol in a Python driver, GUI, calibration tools and an MCP server that lets agents acquire and measure signals.
- [Tonebook: decoding NanoCore preset SysEx commands](https://awesomerea.org/resources/tonebook-case/index.md): Case study · Tonebook documents and implements MIDI control of the LIVTRA NanoCore guitar pedal from a browser. Its protocol notes map the documented control messages and observed SysEx framing used by the vendor app to name and save presets. The site applies song tones, adjusts parameters live, and stores presets on the pedal after confirmation.