# Curated reverse engineering resources · Page 46

> Page 46 of 52, entries 4,501–4,600. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/46/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/46/index.md>

## Protocols (100)

- [Resonance: reconstructing Sony headphone control on Windows](https://awesomerea.org/resources/resonance-sound-connect-case/index.md): Case study · Resonance reconstructs Sony headphone controls in a Windows app using a documented Bluetooth Classic MDR protocol. Its core library and CLI implement framing and commands for noise control, equalizer, battery, touch settings, and device switching; the protocol notes distinguish app-derived fields from device observations.
- [AtomFast → ESP32 → Web UI: reconstructing dosimeter BLE telemetry](https://awesomerea.org/resources/atomfast-esp32-case/index.md): Case study · AtomFast → ESP32 → Web UI implements a read-only BLE gateway for AtomFast dosimeters. ESPHome firmware parses a 13-byte measurement payload into count rate, dose, battery and temperature readings and publishes them in a browser; protocol notes map GATT characteristics and payload fields.
- [moldqueen: Mould King toy control through reconstructed BLE advertisements](https://awesomerea.org/resources/moldqueen-case/index.md): Case study · moldqueen controls Mould King building-block toys by encoding commands as BLE advertisements derived from a reconstructed device protocol. Raspberry Pi, Android and ESP32-S3 radio cores expose a shared WebSocket API to a browser client; the Mould King 13112 excavator is the documented hardware reference.
- [DJI RC: reconstructing joystick values from DUML USB messages](https://awesomerea.org/resources/dji-rc-joystick-case/index.md): Case study · DJI RC Joystick Bridge reconstructs the stick-value exchange of a locked DJI RM-series controller over its DUML USB interface. The Python client polls command set 0x06, command 0xf5, decodes four little-endian axes from the payload and exposes them as a Linux uinput gamepad.
- [Minisforum MS-A1: reconstructing embedded-controller sensor access](https://awesomerea.org/resources/ms-a1-ec-case/index.md): Case study · Minisforum MS-A1 EC fan / temperature driver documents the embedded controller's sensor command exchange and implements a Linux hwmon module for CPU temperature, board temperature and three fan RPM readings. The investigation records direct port I/O at 0x6C and 0x68, the 0xDD temperature and 0xD5 fan commands, and a command sweep used to examine the available interface.
- [NFC PM-Pro: reconstructing the FURUI reader's HID protocol](https://awesomerea.org/resources/nfc-pm-pro-case/index.md): Case study · NFC PM-Pro reconstructs the FURUI NFC PM-Pro reader's USB HID command exchange and implements a Linux GUI and CLI around it. The protocol notes describe report framing, RC4 encryption, CRC-16 and device commands; the client reads, writes and clones supported RFID cards, runs dictionary, nested, darkside and hardnested key recovery, and handles dumps and NDEF records.
- [RF Power Meter V5 Companion: reconstructing the meter's serial protocol](https://awesomerea.org/resources/rf-power-meter-v5-companion-case/index.md): Case study · RF Power Meter V5 Companion reconstructs the USB RF Power Meter V5 serial exchange and uses it in a Windows monitoring app. Its protocol notes describe 460800 8N1 communication, calibrated dBm records, burst markers, and device settings; the author reports comparing live captures with an IL decompile of the vendor executable.
- [miband-lit: reconstructing Mi Band 5 BLE heart-rate access](https://awesomerea.org/resources/miband-lit-case/index.md): Case study · miband-lit implements direct BLE communication with a Mi Band 5 to authenticate, stream heart-rate readings and send notifications or vibration commands. Its write-up describes the band's 16-byte key and AES challenge-response exchange. A Streamlit dashboard displays readings, while an optional WiZ bulb integration reacts to them.
- [Zafro AC: replacing the I4season device cloud locally](https://awesomerea.org/resources/zafro-ha-local-case/index.md): Case study · zafro-ha-local replaces the cloud endpoint used by a Zafro A9092R air conditioner with a LAN server. Its protocol notes derive the device's REST login, MQTT 3.1 WebSocket messages, topics and state commands from captured traffic. The Python service handles the device connection and publishes Home Assistant entities through MQTT Discovery.
- [open-apt-flash: reconstructing the APT 860C UART flasher](https://awesomerea.org/resources/open-apt-flash-case/index.md): Case study · open-apt-flash reconstructs the UART bootloader exchange used by APT Burn Tools to flash the APT 860C e-bike display. Its Python library, CLI and GUI implement 57600 8N1 communication, page framing, checksum, acknowledgments and a sync handshake. The author reports comparison with original-tool traffic and a complete flash on a live display.
- [MADLIONS 60 Configurator: reconstructing MAD60 USB HID configuration](https://awesomerea.org/resources/madlions-configurator-case/index.md): Case study · MADLIONS 60 Configurator implements a Windows client for the MAD60 keyboard using USB HID commands reconstructed from vendor web app traffic. Its device layer builds configuration reports and reads settings back from the board; the interface covers per-key lighting, animations, Hall Effect settings, and profiles. Capture helpers support investigation of other models.
- [ax206-usb-display-macos: driving the QDtech display over USB](https://awesomerea.org/resources/ax206-usb-display-macos-case/index.md): Case study · ax206-usb-display-macos implements macOS control of a QDtech AX206-derived USB display. Its Python driver sends RGB565 frames through USB Mass-Storage Bulk-Only framing and the device's BLIT command; an image viewer and live system dashboard use that driver.
- [SP542E MQTT ↔ BLE bridge: local control through the controller protocol](https://awesomerea.org/resources/sp542e-ha-bridge-case/index.md): Case study · An MQTT-to-BLE bridge that controls the SP542E LED controller from Home Assistant using BanlanX_6xx commands. Its protocol notes identify service FFE0, write characteristic FFE1, plaintext 53-prefixed frames and acknowledged writes for power, white color temperature and brightness.
- [ESPHome — Technibel SCDF32C5I IR Climate: reconstructing air-conditioner infrared control](https://awesomerea.org/resources/esphome-technibel-scdf32-case/index.md): Case study · ESPHome — Technibel SCDF32C5I IR Climate reconstructs the air conditioner's 48-bit infrared command format from raw captures. Its protocol notes map frame fields and checksum behavior, while an ESP32 frame builder and ESPHome configuration send commands through a Home Assistant climate entity.
- [Atomberg BLDC IR Remote: reconstructing fan infrared commands](https://awesomerea.org/resources/atomberg-bldc-ir-remote-case/index.md): Case study · Atomberg BLDC IR Remote implements an Android infrared client for Atomberg ceiling fans using 38 kHz NEC commands. Its command table covers power, speed, boost, timer and sleep; the author reports recovering a working Sleep code after an earlier published value failed on an Erica Meta fan.
- [GameGent: reconstructing GameSir Tarantula Pro HID configuration](https://awesomerea.org/resources/gamegent-tarantula-pro-case/index.md): Case study · GameGent is a Linux client for configuring GameSir Tarantula Pro controllers through a reconstructed USB HID exchange. Its protocol notes derive packet fields from the vendor Electron app and a Ghidra-decompiled DLL; the CLI reads state and mappings and sets lighting, sticks, motion controls, remaps and rumble.
- [xgecu-t48-reverse: reconstructing the T48 eMMC USB protocol](https://awesomerea.org/resources/xgecu-t48-reverse-case/index.md): Case study · xgecu-t48-reverse reconstructs the XGecu T48 programmer's eMMC USB exchange from Xgpro.exe analysis and captured device traffic. Its notes describe command opcodes, endpoint roles, bulk transfers and ISP settings; Python examples read and write eMMC through the T48 adapter.
- [Miele XKM3000Z: reconstructing a local Zigbee appliance bridge](https://awesomerea.org/resources/miele-xkm3000z-bridge-case/index.md): Case study · The Miele XKM3000Z bridge decodes local Zigbee telemetry from an older Miele washing machine and publishes status, program, timing, and door events through MQTT for Home Assistant. Its protocol notes map endpoints and clusters, including the raw 0x0B02 event cluster and parameter blocks.
- [PolyWollyWin: reconstructing ASUS AniMe Matrix HID control](https://awesomerea.org/resources/polywollywin-case/index.md): Case study · PolyWollyWin controls the ASUS ROG Strix Flare II Animate keyboard's AniMe Matrix through a USB HID format confirmed from captures of the official software. The Windows app sends 312 LED values in a documented report and provides effects, image playback, and a paint editor. The repository also documents hardware porting.
- [gloriousctl: mapping Pixart Model I 2 mouse settings](https://awesomerea.org/resources/gloriousctl-linux-pixart-case/index.md): Case study · gloriousctl adds Linux control of Pixart Model I 2 mice through a hardware-mapped, write-only HID report format. The author documents corrected DPI, stage color, polling-rate, and fragment timing fields, alongside a CLI and GTK front end.
- [divoom-protocol: reconstructed BLE control for Divoom displays](https://awesomerea.org/resources/divoom-protocol-case/index.md): Case study · divoom-protocol implements a Python BLE client for Divoom Backpack M and TimeBox-Evo-audio displays using reconstructed framing and command sequences. Its documentation covers session initialization, brightness, channel switching, image frames and animation upload, and identifies commands that remain undecoded.
- [hestia: replacing the Keemple smart-home cloud](https://awesomerea.org/resources/hestia-keemple-case/index.md): Case study · hestia reimplements the Keemple gateway's cleartext 0x7e-framed protocol for local smart-home control. A specification derived from observed LAN traffic covers framing, TLVs, handshakes, device commands and reports. The Python server operates as a decoding proxy or a standalone cloud replacement, with a web dashboard and local automation.
- [gigabyte-gpu-lcd: reconstructing AORUS GPU LCD control](https://awesomerea.org/resources/gigabyte-gpu-lcd-case/index.md): Case study · gigabyte-gpu-lcd reconstructs I2C control of the LCD on a Gigabyte AORUS GeForce RTX 5090 MASTER ICE. Protocol notes derived from Gigabyte Control Center components map 256-byte commands, display modes, and image uploads; a Python library and CLI send static screens and RLE animations on Linux.
- [Ricoh SP 200 Linux CUPS Driver: reconstructing the printer's USB print protocol](https://awesomerea.org/resources/ricoh-sp200-linux-case/index.md): Case study · Ricoh SP 200 Linux CUPS Driver reconstructs the printer's USB print exchange from captures of its Windows driver. Its notes identify PJL commands around JBIG1 raster data, document page transitions and image chunking, and accompany a C filter that converts CUPS raster input into the observed job format.
- [HyperX QuadCast 2 S: reconstructing RGB control on macOS](https://awesomerea.org/resources/hyperx-quadcast-2s-rgb-case/index.md): Case study · HyperX QuadCast 2 S RGB control implements a macOS client for the microphone's USB HID lighting exchange. The source documents seven-packet color updates, acknowledgments, upper and lower LED zones, and IOKit collection selection and response draining. The app controls solid colors and brightness through a menu bar interface.
- [whoop4-ble: reconstructing Whoop 4.0 sensor data access](https://awesomerea.org/resources/whoop4-ble-case/index.md): Case study · whoop4-ble reconstructs direct BLE access to Whoop 4.0 sensor records in a Python client. It documents command framing, CRCs, historical-data draining, and a five-byte SET_CLOCK payload that the author reports fixes stalled flash recording; tools export HR, RR, and accelerometer samples and monitor packets.
- [MSI Mystic Light RGB Web Control Panel: reconstructing B760M-A lighting control](https://awesomerea.org/resources/msi-mystic-light-web-case/index.md): Case study · MSI Mystic Light RGB Web Control Panel reconstructs USB HID lighting commands for the MSI PRO B760M-A DDR4 II motherboard. Captures from MSI Center inform its 185-byte Feature Report layout, enable bit and two-packet send sequence; a Linux Flask service exposes zone controls in a browser.
- [Open Trofeo LCD: implementing Thermalright Trofeo USB display control](https://awesomerea.org/resources/open-trofeo-lcd-case/index.md): Case study · Open Trofeo LCD drives the Thermalright Trofeo Vision 9.16-inch display from Linux using documented USB transfers. Its notes combine the project's captures with prior trcc-linux work to describe initialization, JPEG frame chunks, and acknowledgments. A native PyUSB path feeds a dashboard with themes, system telemetry, media, weather, and game statistics.
- [Soundpeats Mini Pro HS Controller: rebuilding earbud controls over Bluetooth](https://awesomerea.org/resources/soundpeats-mini-pro-hs-controller-case/index.md): Case study · Soundpeats Mini Pro HS Controller rebuilds earbud control through a Kotlin Android app and Python tool using reverse-engineered Bluetooth SPP commands. It queries battery and mode state and sends ANC, touch, game-mode, and seven-band EQ commands, including 17-byte packets for individual EQ bands.
- [breezyd: reconstructing local control of Twinfresh Breezy ventilators](https://awesomerea.org/resources/breezyd-twinfresh-protocol-case/index.md): Case study · breezyd implements local UDP/4000 control for Vents Twinfresh Breezy 160 and Elite 160 Pro ventilators. Its Go library, CLI and daemon read sensors and set operating modes, while retained Python probes and snapshot diffs document how vendor-app actions were mapped to device parameters.
- [ebkn-m61-protocol: reconstructing biometric terminal communications](https://awesomerea.org/resources/ebkn-m61-protocol-case/index.md): Case study · ebkn-m61-protocol documents communication with EBKN and Realand BioFace M61 biometric access terminals and supplies a Python reference listener. Its specifications cover WebSocket with XML messages, FkWeb HTTP posts with JSON, and raw TCP XML streaming, including attendance events and supported command exchanges.
- [Divoom Times Frame: partial cloud and local API reconstruction](https://awesomerea.org/resources/divoom-times-frame-research-case/index.md): Case study · Divoom Times Frame research maps parts of the photo frame's cloud and local HTTP command interfaces and provides Python probes for login, photo listing, file upload and local display control. The author reports that the command binding an uploaded photo to the frame remains unknown; RongCloud messaging is a hypothesis.
- [labelwriter: DYMO LabelWriter protocol drivers](https://awesomerea.org/resources/labelwriter-dymo-case/index.md): Case study · labelwriter implements TypeScript drivers for DYMO LabelWriter printers around a shared command-encoding core. Its documentation covers LW raster, LW5 raster and Duo tape wire protocols, while Node USB/TCP and browser WebUSB packages deliver print jobs to supported devices.
- [jl-dv-viewer: reconstructing Jieli-DV camera streaming](https://awesomerea.org/resources/jl-dv-viewer-case/index.md): Case study · jl-dv-viewer reconstructs the local streaming exchange of Jieli-DV-style Wi-Fi rearview and dash cameras in a Kotlin Android viewer. It sends length-prefixed CTP control messages over TCP, reassembles custom UDP chunks into MJPEG frames, and documents the command vocabulary and frame format. The app also offers crop, rotation and reconnection controls.
- [picoscope-libusb: reconstructing PicoScope 2204A USB control](https://awesomerea.org/resources/picoscope-libusb-case/index.md): Case study · picoscope-libusb reconstructs PicoScope 2204A USB control from SDK traces and device experiments. Its protocol notes document endpoints, command framing, firmware upload, capture modes, and waveform transfers; a C libusb driver exposes these functions to a Wails desktop GUI and an Android JNI library. Firmware blobs must be extracted from the user's own device.
- [pyPredator: reconstructing Predator PH18-73 RGB control](https://awesomerea.org/resources/pypredator-case/index.md): Case study · pyPredator reconstructs RGB control for the Acer Predator PH18-73 keyboard from PredatorSense USB captures. Its Python program streams 128 main-key and 16 WASD-zone pixels through documented USB control and bulk packets at 30 Hz, with a Tk GUI for effects. Ring, logo and underglow control delegates to a separate CLI submodule.
- [FT9201 Linux: reconstructing fingerprint-reader USB capture](https://awesomerea.org/resources/ft9201-linux-case/index.md): Case study · FT9201 Linux documents the USB exchanges needed to poll finger presence and capture a 64×80 grayscale frame from a FocalTech FT9201 reader. A C libusb proof of concept follows the recorded control-transfer and bulk-IN sequence and writes raw and PGM images.
- [SP656E CLI: a BanlanX Bluetooth lighting client](https://awesomerea.org/resources/sp656e-cli-case/index.md): Case study · SP656E CLI implements a Bluetooth Low Energy client for SP656E and SP638E lighting controllers using the documented BanlanX 0x53 command format. Its Python interface scans devices, reads status and sends power, color, brightness, effect and raw commands; the protocol basis is credited to earlier community research.
- [Navico GoFree: screen-mirroring protocol findings](https://awesomerea.org/resources/navico-gofree-protocol-case/index.md): Case study · Navico GoFree records screen-mirroring protocol behavior observed on a Simrad NSS12 evo3 marine display. It maps UDP multicast discovery at 239.2.1.1:2052, the TCP connection on port 6633 that enables video output, and the RTSP /screenmirror endpoint, with small client probes.
- [Claude Code inbox socket: documenting session messages and delivery](https://awesomerea.org/resources/claude-code-inbox-socket-case/index.md): Case study · The Claude Code inbox-socket project documents the internal session messaging protocol carried over a Unix socket or Windows named pipe. It describes JSON-line frames, transport, receipts and delivery behavior, and supplies client examples and conformance checks against installed Claude Code versions.
- [Fujitsu FGL Type A Bus Protocol: decoding an air-conditioner wired remote](https://awesomerea.org/resources/fujitsu-fgl-type-a-bus-case/index.md): Case study · Fujitsu FGL Type A Bus Protocol reconstructs BWR wired-remote messages of an older Fujitsu/General air conditioner from logic-analyzer captures. Its specification records 500-baud 8E1 framing, heartbeat and command frames, and temperature and fan encoding; Python tools decode stored captures or sniff the bus live.
- [UniFi Protect: reconstructing siren and AI Horn audio control](https://awesomerea.org/resources/unifi-protect-audio-control-case/index.md): Case study · The UniFi Protect audio investigation maps private HTTP endpoints and a WebSocket talkback stream for a UNVR running Protect 7.1.x. It documents siren, TTS, ringtone and volume calls, plus AAC-LC ADTS frame pacing for the AI Horn; Python examples implement the requests.
- [sr16-bridge: reconstructing SR16 smart-ring BLE history sync](https://awesomerea.org/resources/sr16-bridge-case/index.md): Case study · sr16-bridge reconstructs the SR16 smart ring's vendor BLE history-sync protocol in a local Python client. It reassembles segmented notifications, checks CRCs, decodes heart-rate records and imports HCI snoop traffic into SQLite; probe logs record the observed message behavior.
- [alpha1s: reconstructing UBTECH Alpha 1S Bluetooth control](https://awesomerea.org/resources/alpha1s-sdk-case/index.md): Case study · alpha1s reconstructs the UBTECH Alpha 1S robot's Bluetooth control link as a Python SDK for telemetry, servo movement and stored actions. Its protocol layer documents FB BF frame headers, length and checksum fields, RFCOMM channel 6, a 16-servo command and optional BLE transport, with examples and tests against captured frames.
- [Daybreak: rebuilding COLMI R09 BLE communication for an offline ring client](https://awesomerea.org/resources/daybreak-colmi-r09-case/index.md): Case study · Daybreak rebuilds COLMI R09 smart-ring communication in an offline Android client. Its Kotlin protocol module handles 16-byte commands and checksum validation, reassembles multi-packet sleep records, and processes heart-rate logs, steps and SpO2 data; the app computes local sleep, recovery and activity scores from the readings.
- [USB-Endoscope: reconstructing Usee Plus USB video streaming](https://awesomerea.org/resources/usb-endoscope-case/index.md): Case study · USB-Endoscope reconstructs the i4season Usee Plus endoscope’s vendor USB video protocol in a local WebUSB viewer. The author traced the Android app’s USBDEVFS calls with Frida and documented two stream-start control transfers followed by YUYV422 frames from bulk endpoint 0x82. The application displays live video and saves photos or recordings.
- [Cigar Oasis: reconstructing SmartHumidor cloud control](https://awesomerea.org/resources/cigar-oasis-smarthumidor-case/index.md): Case study · The Cigar Oasis Home Assistant integration reconstructs the SmartHumidor app’s cloud calls for humidity and temperature readings and setpoint control. The author captured app traffic with mitmproxy, documented the login and device endpoints, and implemented Python scripts and a Home Assistant package.
- [qss-switch-api: reconstructing QNAP QSS switch control](https://awesomerea.org/resources/qss-switch-api-case/index.md): Case study · qss-switch-api reconstructs access to the private REST interface of a QNAP QSS-managed switch from its web UI JavaScript. Its Python CLI logs in, reads port, PoE, sensor and LLDP telemetry, and can send explicit API calls; the documentation records bearer-token authentication and response fields.
- [NameLand: reconstructing Casio KL-A45 serial printing](https://awesomerea.org/resources/nameland-case/index.md): Case study · NameLand reconstructs serial printing for the Casio KL-A45 label printer from communication observed between the device and Casio's Windows XP software. Its Python program sends arbitrary text as QR codes through a USB-to-serial cable with a 2.5 mm TRS connection. The README describes the cable wiring and notes that other printer models may need code changes.
- [dh360d: reconstructing the Darkflash cooler LCD protocol](https://awesomerea.org/resources/dh360d-case/index.md): Case study · dh360d reconstructs the Darkflash DH360D cooler LCD's serial protocol from traffic captured between the hardware and its Windows Electron app. Its Python Linux driver sends CPU temperature, pump speed, CPU use and RAM use through a CH340 USB-to-UART link. The protocol notes specify the 115200-baud framing, handshake, status fields and device acknowledgments.
- [Sony WH-CH720N: reconstructing headset control over RFCOMM](https://awesomerea.org/resources/sony-wh-ch720n-linux-case/index.md): Case study · Sony WH-CH720N control is reconstructed as a Linux Python client for the headset's Bluetooth Classic RFCOMM service. The project documents its framed messages, checksum, ACK sequence rule and command map, then uses them for battery readings, six-band EQ and noise-cancelling or ambient-mode control.
- [Kosmos CP1: reconstructing the CP2 cassette format](https://awesomerea.org/resources/kosmos-cp1-cassette-case/index.md): Case study · The Kosmos CP1 toolchain reconstructs the CP2 cassette interface from a digitized real save and implements Python WAV encoding and decoding. Its documentation specifies FSK carriers, bit timing, byte order and the 256-cell memory image. An assembler and emulator support writing and tracing CP1 programs; the author reports a byte-exact encoding round trip.
- [ISDT PB40: reconstructing a power bank's BLE protocol](https://awesomerea.org/resources/pb40-bluetooth-case/index.md): Case study · pb40-bluetooth reconstructs the ISDT PB40/LIMETA EB40 power bank's BLE advertisement and GATT protocol from LiMeta app analysis and device captures. Its Home Assistant integration reads charge state without connecting, polls power and energy through GATT, and exposes a find-device command and reported settings.
- [Jacuzzi JB1HL: decoding the J185 panel-link bus](https://awesomerea.org/resources/jacuzzi-jb1hl-protocol-case/index.md): Case study · Jacuzzi JB1HL Panel-Link Protocol documents the RS-485 messages between a Jacuzzi J185 hot tub's topside panel and I/O board. It identifies 38400 8N1 framing, a 34-byte poll-response burst, command bits and a checksum, then supplies an offline decoder and an ESPHome monitor for water temperature and pump or heater state.
- [Tenx USB Missile Launcher: reconstructing USB control commands](https://awesomerea.org/resources/tenx-usb-missile-launcher-case/index.md): Case study · The Tenx USB Missile Launcher controller implements movement and firing commands in PureBasic for a specific USB device. Its protocol reference documents two eight-byte headers and a 64-byte payload sent across two interfaces with a nonstandard control-transfer value.
- [Crypto Kakadu Alternative: reconstructing device transfers and .kkd backups](https://awesomerea.org/resources/crypto-kakadu-alternative-case/index.md): Case study · Crypto Kakadu Alternative reconstructs the Crypto Kakadu password manager's serial database transfer and .kkd backup format from analysis of its Java manager and device behavior. Four PureBasic utilities read and upload device databases and convert between JSON and AES-encrypted .kkd files; protocol notes record commands, row layouts and encryption details.
- [alienware-m15-rgb: Linux control of the m15 R2 lighting controllers](https://awesomerea.org/resources/alienware-m15-rgb-case/index.md): Case study · alienware-m15-rgb implements Linux control of the Alienware m15 R2's per-key keyboard and chassis lighting through HID reports. Its protocol notes describe the Darfon API_V5 feature-report sequence and AW-ELC API_V4 output reports, including separate handling for the power-button light.
- [Ideal Clima Nemo 1000: reconstructing local Tuya MCU control](https://awesomerea.org/resources/ideal-clima-nemo-local-control-case/index.md): Case study · Ideal Clima Nemo 1000 local control replaces its Wi-Fi module with an ESP32-C3 on the CN2 connector and speaks the documented Tuya MCU UART exchange. The implementation exposes power, setpoint, mode and fan control through ESPHome or MQTT, with Python tools for passive frame decoding and bench commands.
- [Switch 2 Pro Controller: bridging its USB HID reports to Windows XInput](https://awesomerea.org/resources/windows-switch2-pro-controller-case/index.md): Case study · Windows-Switch2-Pro-Controller reconstructs the Switch 2 Pro Controller's USB wake and HID report behavior in a Windows bridge. It parses button and stick reports, forwards input through ViGEmBus as an Xbox 360 pad, and relays rumble back to the controller; an optional BLE path is also described.
- [cyberboard-cli: reconstructing CyberBoard R4 configuration writes](https://awesomerea.org/resources/cyberboard-cli-case/index.md): Case study · cyberboard-cli reconstructs the AngryMiao CyberBoard R4 configuration protocol used by AM Master. Its CLI reads keymaps and writes keymap and LED configuration through USB CDC serial frames, with protocol notes describing 64-byte framing and CRC-8. The author reports hardware-tested writes and keymap reads; per-key LED authoring remains unfinished.
- [gm1356-recordings: reading a sound meter through its USB-HID protocol](https://awesomerea.org/resources/gm1356-recordings-case/index.md): Case study · gm1356-recordings implements a Python client for live readings and stored logs from the Benetech GM1356 sound level meter. Its protocol notes describe eight-byte USB-HID reports, the 0xB5 import handshake, 0xC4 pull loop and packed recording samples. The author reports comparing decoded recordings with data on the device.
- [TwoTrees SK1: reconstructing the display UART interface](https://awesomerea.org/resources/twotrees-sk1-display-case/index.md): Case study · TwoTrees SK1 display research documents the printer's HMI UART commands and incoming touch, numeric and startup frames. The repository uses that mapping in a Rust client connected to Moonraker, a Python demonstration host and an experimental ESP32-C6 display client.
- [KW330 OBD Data Access: reconstructing the scanner's USB data stream](https://awesomerea.org/resources/kw330-obd-datastream-case/index.md): Case study · KW330 OBD Data Access reconstructs how the KONNWEI KW330 handheld scanner exposes live OBD data through its USB CDC serial port. Python scripts find the port, capture the Print Data Stream output, and parse its Latin-1 label-and-value lines into time-series JSON keyed by engine-running time.
- [AstralPool Halo Cloud: reconstructing chlorinator cloud control](https://awesomerea.org/resources/astralpool-halo-cloud-case/index.md): Case study · AstralPool Halo Cloud reconstructs cloud control of Halo chlorinators as a Home Assistant integration. BLE onboarding retrieves device-generated credentials, after which a client uses the vendor WebSocket relay and parsed device messages for telemetry and control. The security notes document authentication values extracted from the official app binary.
- [zen-go-tui: reconstructing Zen Go USB HID controls](https://awesomerea.org/resources/zen-go-tui-case/index.md): Case study · zen-go-tui reconstructs control of the Antelope Zen Go Synergy Core audio interface through its USB HID protocol. The Rust terminal app manages outputs, mixer strips, preamp settings and meters, while protocol notes describe captured frame types, command payloads and state fields.
- [tinyscreen: reconstructing an ArtInChip USB display protocol](https://awesomerea.org/resources/tinyscreen-artinchip-case/index.md): Case study · tinyscreen implements a Linux client for ArtInChip USB bar displays using a reconstructed device protocol. It performs the display's two-phase RSA challenge-response exchange and sends JPEG frames with 20-byte headers over USB bulk transfers. The client can present dashboards, video, web pages or an EVDI virtual monitor.
- [Panavox PSS-12 INV: reconstructing air-conditioner UART control](https://awesomerea.org/resources/panavox-pss12-inv-protocol-case/index.md): Case study · Panavox PSS-12 INV reconstructs control of a split air conditioner through its W950 UART connector. The C++ library builds command frames, handles acknowledgments and periodic status requests, and parses 150-byte status responses; a companion specification records frame layout and commands refined through physical-unit testing.
- [WB-SG1-8G: reconstructing a signal generator's serial commands](https://awesomerea.org/resources/wbsg1-case/index.md): Case study · The WB-SG1-8G project documents the BG7TBL signal generator's serial protocol and implements a browser controller over Web Serial. Its protocol notes specify connection settings, $X...* command framing, frequency and sweep commands, hardware toggles and observed replies. The page controls both output channels and monitors received and transmitted traffic.
- [Brother HL-4150CDN: reconstructing the XL2HB print stream](https://awesomerea.org/resources/brother-hl4150cdn-driver-case/index.md): Case study · The Brother HL-4150CDN driver reconstructs the proprietary XL2HB print stream produced by Brother's 32-bit x86 filter. Its Python and optional Cython implementation handles raster encoding, color processing, PJL job settings and CUPS integration, with comparison fixtures for byte-level output matching.
- [monclub-bot: reconstructing MonClub booking requests](https://awesomerea.org/resources/monclub-bot-case/index.md): Case study · monclub-bot reconstructs MonClub app booking exchanges from intercepted HTTPS traffic. Its research notes document two-step authentication, request identifiers and endpoints for listing sessions, booking and cancellation. A Rust CLI and Discord bot use the recovered exchanges to manage reservations and export upcoming sessions.
- [glow-linux: reconstructing Spacetronik Glow Three LED control](https://awesomerea.org/resources/glow-linux-case/index.md): Case study · glow-linux reconstructs the Spacetronik Glow Three 27V LED controller's USB serial exchange from captured traffic. It documents the CH340 initialization sequence and AA 55 framed handshake, color and heartbeat messages, then uses pyusb for Linux lighting control and PipeWire screen capture for ambient color sync.
- [nanparty: reconstructing PavoTube II 6C BLE mesh control](https://awesomerea.org/resources/nanparty-case/index.md): Case study · nanparty reconstructs Nanlite PavoTube II 6C control over BLE mesh and bridges MIDI controls to light settings. Its Python code provisions the light, builds mesh messages and drives hue, saturation, brightness and effects; the protocol reference maps GATT characteristics, authentication and vendor PDUs.
- [M3508I: reconstructing the motor RS485 protocol](https://awesomerea.org/resources/m3508i-rs485-case/index.md): Case study · m3508i reconstructs the M3508I motor’s half-duplex RS485 command and reply format. The repository documents field offsets, motor selection, speed encoding and CRC16, and supplies a C frame builder and parser, an STM32 example and an adapter-board design.
- [KeyMission 360 Tools: reconstructing the camera's USB formatting command](https://awesomerea.org/resources/keymission360tools-case/index.md): Case study · KeyMission 360 Tools documents and implements USB PTP control of the Nikon KeyMission 360, including the FormatStore command for its SD card. Its protocol research records USB endpoints, PTP container layouts and command responses. The Linux toolkit also provides camera information, downloads, time sync and media controls.
- [Evnia: reconstructing Philips 49M2C8900 Ambiglow USB control](https://awesomerea.org/resources/evnia-ambiglow-case/index.md): Case study · Evnia reconstructs USB control of the Philips Evnia 49M2C8900 monitor's 44 Ambiglow LEDs in a macOS Swift library. Its protocol notes identify vendor-specific endpoint-zero requests, the 0xE100 RGB frame buffer, and control blocks for taking and releasing software ownership.
- [audeze-filter-cli: reconstructing Audeze Filter HID controls](https://awesomerea.org/resources/audeze-filter-cli-case/index.md): Case study · audeze-filter-cli reconstructs the Audeze Filter USB speaker's settings interface as a Python CLI. Research notes trace command bytes and value conversions through the AudezeHub Mach-O binary, while the protocol reference describes HID report IDs, packet headers and read/write operations.
- [casio_fx: documenting Casio calculator serial transfers](https://awesomerea.org/resources/casio-fx-case/index.md): Case study · casio_fx implements Linux serial transfers for Casio calculators and documents their section-based message exchange and CAS file structure. Its send and receive utilities handle program data for fx-7700GB and fx-7700GE; a converter turns supported monochrome CAS screen dumps into PBM images.
- [Falmec Nuvola 90: reconstructing a 433 MHz remote protocol](https://awesomerea.org/resources/falmec-radio-case/index.md): Case study · Falmec Nuvola 90 remote research reconstructs the range hood's 433 MHz OOK control messages from captured signals. The documented 33-bit frame encodes fan speed and light state using 320 and 640 µs pulses; Python receiver tools decode captures, while Raspberry Pi and ATtiny85 transmitters send replacement commands.
- [HeronSquawk: reconstructing RYLR999 LoRa framing for a mesh network](https://awesomerea.org/resources/heronsquawk-case/index.md): Case study · HeronSquawk reconstructs the RYLR999 LoRa module's on-air framing from SDR captures so it can exchange packets with Heltec V3.1 SX1262 nodes. The resulting mesh system combines a Python desktop base station, MicroPython node firmware and an Android BLE client, with encrypted messages routed across nodes.
- [TP-Link SG3428: reconstructing its USB console access](https://awesomerea.org/resources/tplink-sg3428-usb-reset-case/index.md): Case study · TP-Link SG3428 USB Reset reconstructs access to a JetStream switch's USB console through a Python raw-USB client. The investigation found that a vendor-class interface responds to CDC ACM line-coding requests; the tool sets 38400/8N1, exchanges data over bulk endpoints and exposes an interactive console, baud scan and BootUtil reset workflow.
- [ak820-linux: reconstructing AJAZZ AK820 Pro USB control](https://awesomerea.org/resources/ak820-linux-case/index.md): Case study · ak820-linux reconstructs USB HID control for the AJAZZ AK820 Pro keyboard from the vendor's Windows configurator. Its Linux CLI and GUI send lighting effects, per-key colors, images or GIFs to the keyboard screen, and clock updates; the protocol reference records interfaces, report sizes, opcodes, and payload layouts.
- [LUMIX Remote: reconstructing Panasonic S5 camera communication](https://awesomerea.org/resources/lumix-remote-s5-case/index.md): Case study · LUMIX Remote reconstructs Panasonic LUMIX camera control in a Python server, web interface and CLI. For the DC-S5, its notes map cam.cgi commands, UPnP services, UDP live view and Bluetooth LE connection sequences; the client supports shooting, settings, file import and timelapse operation.
- [fix-whxm4-voice: reconstructing WH-1000XM4 voice-pack upload](https://awesomerea.org/resources/fix-whxm4-voice-case/index.md): Case study · fix-whxm4-voice creates replacement voice packs for Sony WH-1000XM4 headphones and uploads them over Bluetooth. Its research notes map the pack's language layout and trace Sony's app through the Airoha FOTA upload flow over Bluetooth Classic RFCOMM. The tool can download stock packs, convert replacement audio and install the result as a selected language.
- [OrangeCar: reconstructing the wired CarPlay phone side](https://awesomerea.org/resources/orangecar-case/index.md): Case study · OrangeCar reconstructs the phone side of wired Apple CarPlay on an Orange Pi 5 Plus so a car displays a locally rendered dashboard. Its protocol documentation follows USB role switching, iAP2 identification, CDC-NCM networking, mDNS and the AirPlay session that carries H.264 video, audio and input.
- [AirDrop-for-Everything: reimplementing AirDrop file transfer](https://awesomerea.org/resources/airdrop-for-everything-case/index.md): Case study · AirDrop-for-Everything reimplements Apple's AirDrop discovery and file transfer in a Rust core with command-line, desktop, Android and macOS interfaces. The documented protocol covers mDNS discovery, binary-plist /Discover and /Ask requests, and DVZip-framed cpio uploads. AWDL works where an interface exists; other platforms use LAN transport.
- [IQOS Bar: a USB HID client for IQOS ILUMA usage counters](https://awesomerea.org/resources/iqos-bar-case/index.md): Case study · IQOS Bar implements read-only USB HID access to an IQOS ILUMA i ONE, displaying battery status and lifetime usage counters in a desktop tray or menu bar. Its protocol notes describe report framing, register queries and hidapi response offsets, adapting the command layer credited to iqos-scope.
- [Chorus: reconstructing Logitech Harmony remote programming](https://awesomerea.org/resources/chorus-harmony-remote-case/index.md): Case study · Chorus identifies and backs up Logitech Harmony USB remotes, learns and decodes IR codes, and controls hubs over a local network. Its browser editor creates JSON device and activity configurations; technical notes document the vendor setup app and newer USB packet protocol.
- [tinycoral: reconstructing the Coral Edge TPU instruction set and USB runtime](https://awesomerea.org/resources/tinycoral-edge-tpu-case/index.md): Case study · tinycoral reconstructs the Google Coral Edge TPU instruction set and USB runtime for a tinygrad backend. It includes decoded instruction layouts, a code generator, DarwiNN executable handling and a Python driver for firmware upload, register access and DMA transfers; the author reports byte-identical generated programs against Google's compiler for supported operations.
- [ninebot-go: reconstructing Ninebot app cloud communication](https://awesomerea.org/resources/ninebot-go-case/index.md): Case study · ninebot-go reconstructs the Ninebot app's encrypted cloud communication in a Go client. It implements NET request encryption and response decryption using AES and RSA, then exposes vehicle, battery and travel data through CLI, web and MCP interfaces; vehicle-control commands remain unfinished.
- [open-g2-hub: a local Even G2 client built on BLE protocol findings](https://awesomerea.org/resources/open-g2-hub-case/index.md): Case study · open-g2-hub replaces the Even Realities G2 companion app with a local hub for native widgets and voice input on stock firmware. Its protocol notes describe dual-lens BLE characteristics, an AA 21 control frame, CRC-16 checksums, service IDs, heartbeats and LC3 microphone data.
- [Edifier Speakers BLE: reconstructing M60 and M90 speaker control](https://awesomerea.org/resources/edifier-speakers-ble-case/index.md): Case study · Edifier Speakers BLE reconstructs the M60 and M90 speakers' BLE control protocols and uses them in a Home Assistant integration. Its references describe model-specific GATT services, frame checksums, commands, responses, and limits; the integration exposes volume, source, EQ, playback, and selected device settings.
- [Halyard: reconstructing Shadow cloud PC streaming on handhelds](https://awesomerea.org/resources/halyard-case/index.md): Case study · Halyard reimplements the Shadow cloud PC streaming protocol for Nintendo Switch and PS Vita homebrew. It authenticates to a subscribed user's machine, negotiates over TLS, and carries encrypted video, audio, input and cursor channels; the consoles use hardware video decoding. The repository records protocol findings and platform-specific limits.
- [Axial: mapping and controlling the DJI RS 4 Mini over Bluetooth](https://awesomerea.org/resources/axial-dji-rs4-mini-case/index.md): Case study · Axial documents and implements Bluetooth control of the DJI RS 4 Mini gimbal. Its Mac GimbalProfiler observes messages and tests commands, while an iPhone app uses a model-specific .axial profile and shared DUML framing to send controls and decode signals.
- [Fiat Ducato X250: decoding the body CAN bus](https://awesomerea.org/resources/fiat-ducato-x250-wican-case/index.md): Case study · The Fiat Ducato X250 WiCAN project decodes the 2009 vehicle's 50 kbit/s body-CAN messages into speed, RPM, lights, doors and other signals. It preserves five captures, a CAN ID reference, a Python decoder and listen-only WiCAN filters that publish values to Home Assistant over MQTT. The author reports checking signals against vehicle controls and instruments.
- [Unrack: extending reconstructed t.racks DSP control](https://awesomerea.org/resources/unrack-dsp-control-case/index.md): Case study · Unrack controls the t.racks DSP 4x4 Mini Pro through WebHID, an Android USB bridge, or an ESP32-S3 Wi-Fi bridge. It builds on earlier protocol research and provides rebuilt transport, state management, and interface code; its protocol notes detail request and reply frames carried in 64-byte USB HID reports, commands, and parameter scaling.
- [ArmorX Toolkit: reconstructing ARMORX Pro configuration and control](https://awesomerea.org/resources/armorx-toolkit-case/index.md): Case study · ArmorX Toolkit reconstructs configuration and control behavior for the BIGBIG WON ARMORX Pro controller accessory. It decodes and builds 144-byte configuration records with CRC16, records key mappings and BLE/USB command behavior, and supplies capture, CLI, and configurator tools based on the findings.
- [dsh-ls125-uv-probe: reconstructing the LS125 probe protocol and host](https://awesomerea.org/resources/dsh-ls125-uv-probe-case/index.md): Case study · dsh-ls125-uv-probe reconstructs the UART exchange between a LinShang LS125 meter and its UVALED-X3 UV probe and implements a replacement STM32F103 host. Its protocol notes cover 9600 8N1 framing, polling and clear commands, measurement fields and CRC-16/MODBUS. Capture and decoding scripts and a sample trace accompany the agent skill.
- [HT-203U: reconstructing thermal camera capture on Linux](https://awesomerea.org/resources/ht-203u-linux-case/index.md): Case study · HT-203U Linux tools reconstruct video and temperature capture for the HT-203U USB thermal camera. Protocol notes document its UVC frame layout, USB control sequence and calibrated mode 8 temperature encoding; the supplied scripts display live video, read summaries and save per-pixel temperature frames.
- [Pair-Raught: bridging Steam Controller RF to Switch 2 USB](https://awesomerea.org/resources/pair-raught-case/index.md): Case study · Pair-Raught implements an nRF52840 controller bridge that receives Steam Controller input over Valve's RF link and presents a Pro Controller over USB to Nintendo Switch 2. Its firmware also sends a BLE console wake, forwards motion and rumble, and stores pairing and settings on the puck.
- [SPORTident SRR: reconstructing the short-range radio link](https://awesomerea.org/resources/sportident-srr-protocol-case/index.md): Case study · SPORTident SRR reconstructs the 2.4 GHz radio exchange used by SIAC cards and BSF8-SRR stations to send punches. Its documentation maps CC2500 settings, packet fields, acknowledgements and timing, while an ESP32/CC2500 sketch receives and acknowledges frames and a Python tool decodes captures.