Protocol · Case study:
Tapo V4 reconstructs the Tapo C510W camera’s local control and media protocols from Android app analysis and device probing.
Reviewed freeKC/tapo-v4-protocol@9ff08ff
Protocol · Case study:
Omni Tray reconstructs USB HID control of the SteelSeries Arctis Nova Pro Omni GameHub in a Windows tray client.
Protocol · Case study:
tapo-local implements local control of the TP-Link Tapo P110 smart plug using TPAP communication recovered from the Tapo Android app.
Reviewed carboni123/tapo-local@2e8888c
Protocol · Case study:
castty reconstructs configuration of the Mionix Castor mouse on Linux from captured HID feature reports.
Reviewed fawaz7/castty@ac12436
Protocol · Case study:
legion-gpu-rgb reconstructs RGB lighting control for a Lenovo OEM RTX 5070 Ti by tracing its DDC-side NvAPI I2C transactions.
Reviewed violentbunny/legion-gpu-rgb@849d011
Protocol · Case study:
SoundcoreBridge reconstructs Soundcore Space 2 headphone controls over the vendor Bluetooth channel for a macOS menu-bar app and CLI.
Reviewed mervin008/soundcorebridge@3a631b9
Protocol · Case study:
NiimBridge reconstructs the NIIMBOT D110_M printer's Bluetooth print exchange from HCI captures of the vendor Android app.
Protocol · Case study:
The OMS fingerprint module investigation reconstructs USB communication with the 33a7:2388 match-on-chip sensor and implements it as a libfprint driver.
Protocol · Case study:
zwift-api maps selected private Zwift HTTP data interfaces and implements a read-only Node client for profile, achievements, events, quests and catalogue data.
Reviewed noerdk/zwift-api@ebd4869
Protocol · Case study:
Gear VR Controller research decodes the Samsung ET-YO324 remote's Bluetooth LE commands and sensor stream.
Protocol · Case study:
Acer Predator Helios 16 RGB documents lighting exchanges for PH16-series laptops and implements Linux control through a Python CLI and OpenRGB controllers.
Protocol · Case study:
Powerology AM8268N reconstructs the USB display protocol used by dual-screen laptop extenders built around the Actions Micro AM8268N.
Reviewed N7le/powerology-actions-usb-display-linux-driver@c94dbb1
Protocol · Case study:
SuperCam Thermal Viewer is a cross-platform client for QuanLi/LangChi thermal cameras built from investigation of their proprietary network traffic.
Reviewed GunayAnach/QuanLi-SuperCam@4f484f9
Protocol · Case study:
ktctl reconstructs the FiiO JA11 runtime USB control protocol in a Rust CLI and TUI for five-band PEQ, presets and gain.
Reviewed ParkWardRR/fiio-ja11-jcally-jm12-moondropkt02-kt02h20-dac-amp-control@c59b923
Binary · Case study:
The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747.
Reviewed eddinos2/CVE-2026-64747@c62251c
Protocol · Case study:
Indian Thunder Stroke documents a listen-only J1939 CAN decoder for a 2017 Indian Springfield motorcycle, with ESP32-S3 firmware and an Android instrument cluster.
Protocol · Case study:
Smart Ring Dashboard implements direct Web Bluetooth access to Anko/Jring and Colmi/Yawell smart rings using documented BLE packet formats.
Protocol · Case study:
Thermal Cam implements a macOS viewer for the Thermal Master P1 using a documented USB control and frame protocol.
Reviewed johnboiles/thermal-cam@9dad5c9
Protocol · Case study:
controlvault3-linux-fingerprint reconstructs the encrypted command exchange of the Dell/Broadcom ControlVault 3 fingerprint sensor and implements enrollment and verification on Linux.
Reviewed japananimetime/controlvault3-linux-fingerprint@a597fd3
Protocol · Case study:
glorouter reconstructs the Huawei B311-221 router's HiLink web API in a Python CLI and local dashboard.
Reviewed exbyte-dev/glorouter@26cb9d4
Protocol · Case study:
OpticFilm 135i reconstructs USB control of the Plustek OpticFilm 135i film scanner for Linux.
Protocol · Case study:
The Martian Notifier toolkit reconstructs Bluetooth communication with the T200/MN200 smartwatch.
Protocol · Case study:
E88 / E99 Drone PC Control reconstructs the Wi-Fi control and video exchanges of an E99-labeled toy drone with an E88D board and FlyUFO app.
Protocol · Case study:
Samsung Washer Monitor for ESPHome decodes the receive-only UART stream between a Samsung WW11BGA046 washer's DC92-01950B panel and main board.
Protocol · Case study:
Fluval Connect light implements local Home Assistant control of Fluval Connect aquarium lights over Bluetooth, using commands recovered from the FluvalConnect Android app.
Protocol · Case study:
Citroën Connected Camera is an iOS client for browsing, downloading and managing ConnectedCAM dashcam recordings over local Wi-Fi.
Protocol · Case study:
The Canon GM2080 macOS driver reconstructs the printer's IVEC XML and PWG Raster print stream from observed output of Canon's Linux driver.
Reviewed fzhnet/canon-gm2080-macos@18e003c
Protocol · Case study:
Agent Phone uses a Polycom CX300 desk phone as an attention and dictation controller for coding agents.
Reviewed SJM7/agent-phone@d3a2ef7
Protocol · Case study:
RingLink reconstructs direct access to RingConn Gen 3 smart rings in an offline Android client.
Reviewed zazaulola/ringlink@19bcb71
Protocol · Case study:
GarminHRM600 implements a direct BLE client for the Garmin HRM 600 heart-rate strap using documented Multi-Link, GFDI and protobuf FileSyncService exchanges.
Reviewed mskerwiderski/GarminHRM600@c48b98e
Protocol · Case study:
Canon IVEC driver reconstructs print and maintenance commands for PIXMA and MAXIFY inkjets in an open Linux CUPS driver.
Protocol · Case study:
Minitela do Positivo Vision R15M implements Linux tools for the laptop’s 240×240 secondary display.
Reviewed caio-imperial/minitela-r15@f95277c
Protocol · Case study:
Truma Aventa controls a second-generation Aventa roof air conditioner from Home Assistant over BLE.
Reviewed omc69/Truma-Aventa2-HomeAssistant-Integration@96b3629
Protocol · Case study:
PetKit Eversweet Max 2 UVC BLE Gateway uses a local Python or ESP32-C3 client in place of the Wi-Fi PetKit device that relays the fountain’s data.
Protocol · Case study:
WalleCube UPS provides local Home Assistant monitoring and control for the W150 mini-UPS through a reconstructed BLE GATT protocol.
Reviewed jeburks2/wallecube-bt-ha@339b144
Protocol · Case study:
toppingctl implements local control of Topping DACs through USB HID reports derived from observed WebHID traffic and the vendor web bundle.
Reviewed gjcourt/toppingctl@011bec0
Protocol · Case study:
tuya-ipc-p2p-sdk implements a Python client for Tuya IPC cameras’ native P2P video protocol.
Protocol · Case study:
The SYNA8002 investigation reconstructs the SPI transport, secure-channel setup and image capture path of the fingerprint reader in a ThinkPad X1 Tablet Gen 3.
Protocol · Case study:
fx_lcd_software drives ID-COOLING FX cooler LCDs from Linux through a USB HID image-transfer protocol observed from the vendor software.
Protocol · Case study:
ti83-link reconstructs TI-83 Plus link-port transfers using Raspberry Pi GPIO and Python.
Reviewed tiiow-fedora/ti83-link@b3351fd
Protocol · Case study:
catbus99 reconstructs control of the Epomaker TH99 Pro keyboard display from captured driver WebHID traffic.
Reviewed terraboops/catbus99@3415745
Protocol · Case study:
OpenWatch implements an Android companion for LJ736/LY736D-based smartwatches using BLE commands reconstructed from the LaxaFit Pro APK and captured traffic.
Protocol · Case study:
Quntis Monitor Light for ESPHome recreates local control of a 26-inch Quntis monitor light through its observed XN297-compatible RF protocol.
Reviewed willadamskeane/quntis-monitor-light-esphome@27fb0dc
Protocol · Case study:
Bosch Smart System maps the BLE diagnostic and Live Data interfaces of Bosch eBikes through captured traffic and field comparisons.
Protocol · Case study:
GreenPods is an Android app that reads AirPods BLE advertisements and offers Apple Accessory Protocol controls over L2CAP where available.
Reviewed andrewkomkov/GreenPods@cd171e5
Protocol · Case study:
dualsense-bridge recovers microphone audio carried inside DualSense Bluetooth HID reports and exposes it as a macOS audio input.
Reviewed tomarai85/dualsense-bridge@9472c8a
Protocol · Case study:
FX30 Controller implements remote control of the Sony FX30 camera on an M5Stack Cardputer ADV.
Protocol · Case study:
P215 Scan replaces the Canon imageFORMULA P-215II desktop scanning workflow on macOS and documents the scanner’s file-tunnel transport.
Reviewed philipyaz/p215-scan@e4d462d
Protocol · Case study:
Sirius Dev Kit documents a measured investigation of the Hengbot Sirius robot dog and provides a browser control tool.
Reviewed PHCsubOceana/sirius-dev-kit@f94435c
Protocol · Case study:
Narwal Robot Vacuum is a Home Assistant integration built around the vacuums' local WebSocket interface.
Reviewed sytchi/NarwalIntegration@f527b72
Protocol · Case study:
landbook-api reconstructs Landbook smart-home client access in Python from analysis of its iOS app.
Reviewed zackwag/landbook-api@0fc9992
Protocol · Case study:
SF900 ESP32 Dongle implements the SF900/SF2000 controller's 2.4 GHz XN297L radio protocol on an ESP32-S3 receiver.
Protocol · Case study:
hydroshift2 reconstructs direct USB control of the Lian Li HydroShift II LCD-C in a Rust library.
Reviewed andyjusa/hydroshift2-rs@5b5c95d
Protocol · Case study:
N2Elite-ng reconstructs control of the N2 Elite / Amiiqo USB dongle in a Python CLI and Tkinter GUI.
Reviewed Jonaaaa/N2Elite-ng@dacf60a
Protocol · Case study:
Huawei MateBook 13 · Linux reconstructs communication with the Goodix GXFP51A0 fingerprint reader and provides a Linux libfprint driver for it.
Protocol · Case study:
TP2-Y Label Studio implements direct label printing to the TP2-Y thermal printer over Bluetooth Classic RFCOMM.
Reviewed M1STERS/tp2y-label-studio@646584d
Protocol · Case study:
Halo Home for Home Assistant controls Eaton HALO Home Bluetooth mesh lights locally and targets other Avi-on lights using the same protocol.
Reviewed tinic/ha-halo-home@1dc4727
Protocol · Case study:
foobot-local reconstructs Foobot communication so the air-quality monitor can send readings to a local service.
Reviewed kerosix/foobot-local@043bfb8
Binary · Case study:
noirm1 reconstructs the NOIR M1 mouse's wired USB HID settings protocol from disassembly of the vendor's Windows utility and device checks.
Reviewed zzeeqqee/noir-m1-linux@a1bb1bd
Protocol · Case study:
PetMarvel C1 Local reconstructs the litter box's cloud-facing TLS and MQTT exchanges in a router-hosted Go broker.
Reviewed KiriKira/petmarvel-c1-local@ca0d1bd
Protocol · Case study:
omen-lcd reconstructs the USB HID control exchange for the HP OMEN AIO cooler's LCD and implements a Linux driver.
Reviewed elladann/omen-lcd@ef913cb
Protocol · Case study:
QCY Control for macOS implements a Swift menu-bar client for QCY MeloBuds Pro using the documented QCY BLE GATT protocol.
Reviewed Muyubu1/qcy-control-macos@0820c14
Protocol · Case study:
BTHackers documents the AIREC voice recorder’s BLE GATT service and command protocol from captured sessions.
Reviewed RegeneratusLabs/BTHackers@4b4a67e
Protocol · Case study:
MacBook ALS maps the 122-byte HID report of an Apple Silicon MacBook ambient-light sensor.
Protocol · Case study:
The SteelSeries Apex 3 RGB Controller uses recovered USB HID reports to set the keyboard’s lighting colors from Linux.
Reviewed Shank404/Apex3_RGBController@c98d861
Protocol · Case study:
rfserver implements Raspberry Pi Pico W firmware for controlling LED lights through a decoded 433 MHz remote signal.
Reviewed bitcrshr/rfserver@2a0d00a
Protocol · Case study:
ro is a Rust command-line client for controlling the LB-Link BL-WR2000 repeater through its HTTP interface.
Reviewed prajwalch/ro@289530f
Protocol · Case study:
dvf3060 implements control of the Kenwood DVF-3060 DVD player's front panel through its PT6311 SPI controller.
Reviewed deermichel/dvf3060@5296eb5
Protocol · Case study:
galaxy-buds-plus implements a Perl client for Samsung Galaxy Buds Plus settings through the headset's RFCOMM serial interface.
Reviewed mpxc/galaxy-buds-plus@3dc65ab
Protocol · Case study:
DT No.1 F2 reconstructs the Bluetooth LE exchange between the smartwatch and its Android companion.
Protocol · Case study:
The Maia Ds2 investigation documents Bluetooth serial commands for controlling the amplifier.
Protocol · Case study:
fifine-ampligame-d6 reconstructs USB control of the Fifine AmpliGame D6 macro pad in a Python macOS driver.
Protocol · Case study:
PS5 pela rede provides a Node command-line client for checking whether a PS5 is on or resting and for waking or resting it over a home network.
Protocol · Case study:
BudsCtl reconstructs SoundPEATS Air4 Pro GAIA V2 controls for a macOS menu bar app that changes noise mode and reads each earbud's battery level.
Reviewed hammad-iftikhar/budsctl@48d28a1
Protocol · Case study:
A Linux ALSA driver reconstructs the RME Babyface Pro FS proprietary USB mode from Windows captures.
Protocol · Case study:
wolfmix-automation reconstructs the Wolfmix W1 .wpj project format and USB control protocol from controlled editor changes, owned project files, and device observations.
Reviewed Adridot/wolfmix-automation@d1d77ef
Protocol · Case study:
This study reconstructs the receive side of the LoRa link from a Mammotion RTK 3 station to a Luba mini AWD 800H mower.
Reviewed Ve2mrx/mammotion-rtk-lora@7cb61c3
Protocol · Case study:
DingTalk A1 Local Toolkit reconstructs the recorder's BLE authentication and recording-transfer exchange for local access from Windows or Linux.
Protocol · Case study:
Remote for Apple TV implements Apple TV control on Android through Kotlin modules for Companion Link pairing, encrypted OPACK commands, and an MRP-over-AirPlay media tunnel.
Reviewed msthind04/AppleTV-Remote@d72fd6d
Protocol · Case study:
panelbeater lets a Linux host respond to the Scan button on a ScanSnap iX1500 over Wi-Fi or USB.
Reviewed appositeit/panelbeater@a7b99e0
Protocol · Case study:
VT-Ragnaros implements a Linux driver and daemon for the Redragon SS552 Ragnaros USB control deck.
Reviewed ValentinTorassa/VT-Ragnaros@ccd1cb6
Protocol · Case study:
A Flipper Zero signal set and Python generator reproduce PixMob Wave2 and Waveband 2 group-0 RF commands for European 868.415 MHz wristbands.
Protocol · Case study:
The Goodix 55a4 project reconstructs Linux support for the 27c6:55a4 fingerprint sensor through a libfprint patch.
Reviewed Hydrogell/goodix-27c6-55a4-fingerprint-linux@fe27b48
Protocol · Case study:
allmiibo-sync reconstructs the Pixl.js and AmiiboLink Bluetooth LE virtual filesystem protocol to synchronize folders with NFC emulator devices.
Reviewed mahoudeau/allmiibo-sync@f1f8ad2
Protocol · Case study:
EBO for Home Assistant reconstructs the EBO HOME cloud exchange to control Enabot robots from Home Assistant.
Reviewed Playcolors-co/ha-enabot@9310d50
Protocol · Case study:
iM.Master SDK reconstructs the iM.Master toy robot's BLE advertising commands and exposes them through a Python control API.
Reviewed 2alf/iM.Master-SDK@35bd08c
Protocol · Case study:
A protocol reference and Python decoder reconstruct the baseband infrared register broadcast of SymCom and Littelfuse PumpSaver Plus pump-protection relays.
Protocol · Case study:
Mazda MX-5 ND3 OBD-II PID Research maps diagnostic responses from a 2025 MX-5 RF Club.
Protocol · Case study:
QUII Helper reconstructs communication with QUII and Qualvision video intercoms in a Python client for snapshots, video, RTSP forwarding, device inspection, and door commands.
Reviewed xaer981/quii-helper@4a038ee
Protocol · Case study:
KlipschRemote implements Bluetooth LE control of Klipsch The Fives, Sevens and Nines speakers through desktop, CLI, Python and browser clients.
Reviewed Nixer1337/KlipschRemote@0cbf507
Protocol · Case study:
AirMini Sync reconstructs the ResMed AirMini telemetry exchange in an Android client that retrieves and exports sleep records as JSON.
Protocol · Case study:
OpenNord reconstructs Nord Stage program handling and USB transfer in a keyboard companion app.
Reviewed simonflore/opennord@19b5f59
Protocol · Case study:
OpenStrap research reconstructs WHOOP 4.0 BLE framing, history synchronization and sensor-record decoding.
Reviewed OpenStrap/research@c6be09c
Protocol · Case study:
fpdrv reconstructs communication with the Synaptics 06cb:00e7 fingerprint sensor as a Linux userspace driver, libfprint TOD module and diagnostic CLI.
Protocol · Case study:
PixyPilot implements Linux control of the EMEET PIXY camera using V4L2 ioctls and decoded vendor HID commands.
Reviewed Romonaga/PixyPilot@85afaaf
Protocol · Case study:
Prismatic reconstructs the SteelSeries Arena 7 speaker lighting exchange in a macOS menu bar app.
Reviewed szamski/Prismatic-for-macOS@3632505
Protocol · Case study:
A Linux Python CLI uses the reconstructed HID++ HITS feature of the Logitech G PRO X2 SUPERSTRIKE mouse to read and set per-button click haptics and actuation points.
Reviewed kazehana99k/Logitech-PRO-X2-SUPERSTRIKE-Linux-haptics-actuation-control-@1b599dd
Protocol · Case study:
AT2 HT implements the Baofeng ALERVITES AT2 radio's BLE control and off-network messaging in an Android app.
Protocol · Case study:
Empatica E4 wristband work reconstructs the device's BLE telemetry flow and provides a local recorder and decoder for accelerometer, skin temperature, electrodermal activity, and raw photoplethysmogram data.
Reviewed Vijtus/empatica-e4-local@1c7a2a0
Protocol · Case study:
Polylux implements Windows control of ASUS ROG AniMe Matrix, LiveDash OLED, Ryujin LCD, Aura RGB, and fan hardware.
Reviewed vladulus/polylux@2a93aba