# Curated reverse engineering resources · Page 47

> Page 47 of 52, entries 4,601–4,700. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/47/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/47/index.md>

## Protocols (100)

- [Tapo V4: reconstructing C510W local control and media protocols](https://awesomerea.org/resources/tapo-v4-protocol-case/index.md): Case study · Tapo V4 reconstructs the Tapo C510W camera’s local control and media protocols from Android app analysis and device probing. A byte-level specification and Python client cover SPAKE2+ login, AES-128-CCM /ds requests, media-port authentication and SD-card clip download. The author reports operation on a C510W and limited reports from other models.
- [Omni Tray: reconstructing Arctis Nova Pro Omni USB control](https://awesomerea.org/resources/omni-tray-arctis-protocol-case/index.md): Case study · Omni Tray reconstructs USB HID control of the SteelSeries Arctis Nova Pro Omni GameHub in a Windows tray client. Its protocol notes map report collections, command transfers and event channels; the client exposes battery, mute, ANC and volume state and can relay telemetry through MQTT.
- [tapo-local: reconstructing local control of the Tapo P110](https://awesomerea.org/resources/tapo-local-case/index.md): Case study · tapo-local implements local control of the TP-Link Tapo P110 smart plug using TPAP communication recovered from the Tapo Android app. Python clients provision the plug over BLE, then use Wi-Fi sessions with SPAKE2+ and AES-128-CCM for relay control, power readings and automation.
- [castty: reconstructing Mionix Castor control on Linux](https://awesomerea.org/resources/castty-mionix-castor-case/index.md): Case study · castty reconstructs configuration of the Mionix Castor mouse on Linux from captured HID feature reports. Its protocol notes describe command report 0x60, profile report 0x61, readback, and field offsets; the Rust GUI and CLI use those findings for lighting, DPI, buttons, macros, and profiles.
- [legion-gpu-rgb: reconstructing Lenovo GPU lighting control](https://awesomerea.org/resources/legion-gpu-rgb-case/index.md): Case study · legion-gpu-rgb reconstructs RGB lighting control for a Lenovo OEM RTX 5070 Ti by tracing its DDC-side NvAPI I2C transactions. It documents the controller's register writes and supplies a Python controller, an OpenRGB plugin and a patch that exposes the DDC bus to OpenRGB.
- [SoundcoreBridge: reconstructing Soundcore Space 2 headphone controls](https://awesomerea.org/resources/soundcorebridge-case/index.md): Case study · SoundcoreBridge reconstructs Soundcore Space 2 headphone controls over the vendor Bluetooth channel for a macOS menu-bar app and CLI. Its protocol map documents command addressing, state offsets, noise-cancelling modes and equalizer values from observed traffic and device responses.
- [NiimBridge: reconstructing the NIIMBOT D110_M print protocol](https://awesomerea.org/resources/niimbridge-d110m-case/index.md): Case study · NiimBridge reconstructs the NIIMBOT D110_M printer's Bluetooth print exchange from HCI captures of the vendor Android app. Its Kotlin driver implements packet framing, checksums, row encoding, transport, and print-state handling; a separate SDK and diagnostic app expose printing and packet inspection. The author reports byte-identical packet comparisons for two captured jobs.
- [OMS fingerprint module: reconstructing USB communication for a Linux driver](https://awesomerea.org/resources/oms-fingerprint-linux-case/index.md): Case study · The OMS fingerprint module investigation reconstructs USB communication with the 33a7:2388 match-on-chip sensor and implements it as a libfprint driver. Its notes describe USBC transport acknowledgements, EF01 frames, checksums and enrollment and identification responses; the author reports successful hardware enrollment and verification.
- [zwift-api: mapping Zwift's private data endpoints](https://awesomerea.org/resources/zwift-api-case/index.md): Case study · zwift-api maps selected private Zwift HTTP data interfaces and implements a read-only Node client for profile, achievements, events, quests and catalogue data. Its documentation records proxy-captured endpoints and protobuf wire decoding without schemas. The author reports that epic-challenge progress travels over a realtime UDP path rather than the mapped HTTP endpoints.
- [Gear VR Controller: decoding Samsung's BLE remote protocol](https://awesomerea.org/resources/gear-vr-controller-ble-case/index.md): Case study · Gear VR Controller research decodes the Samsung ET-YO324 remote's Bluetooth LE commands and sensor stream. Its protocol notes map GATT characteristics, a command acknowledgement handshake, IMU samples, touchpad and button fields; Python captures and tests support a macOS air-mouse app and a live three.js viewer.
- [Acer Predator Helios 16: reconstructing Linux lighting control](https://awesomerea.org/resources/acer-predator-helios-16-rgb-case/index.md): Case study · Acer Predator Helios 16 RGB documents lighting exchanges for PH16-series laptops and implements Linux control through a Python CLI and OpenRGB controllers. It maps the keyboard's vendor HID reports and the standard HID LampArray interfaces used by the front bar, lid logo, and rear glass bar.
- [Powerology AM8268N: reconstructing a USB display protocol for Linux](https://awesomerea.org/resources/powerology-am8268n-usb-display-case/index.md): Case study · Powerology AM8268N reconstructs the USB display protocol used by dual-screen laptop extenders built around the Actions Micro AM8268N. A Linux userspace driver presents each panel through evdi and sends JSON-RPC control and H.264 video over vendor-defined HID interfaces; the protocol notes derive from captures of the Windows application.
- [SuperCam Thermal Viewer: reconstructing QuanLi camera streaming](https://awesomerea.org/resources/quanli-supercam-case/index.md): Case study · SuperCam Thermal Viewer is a cross-platform client for QuanLi/LangChi thermal cameras built from investigation of their proprietary network traffic. It displays 160×120 radiometric infrared frames alongside 1920×1080 H.264 video, while research notes document UDP discovery, TCP control and stream negotiation.
- [ktctl: reconstructing FiiO JA11 USB equalizer control](https://awesomerea.org/resources/ktctl-ja11-case/index.md): Case study · ktctl reconstructs the FiiO JA11 runtime USB control protocol in a Rust CLI and TUI for five-band PEQ, presets and gain. Its protocol notes specify framing, CRC-8/MAXIM and command bytes derived from Android app analysis and device probing. The author reports a successful read, write and save round trip on a JA11.
- [AppleAVE2: reconstructing the IOKit wire format and driver validation path](https://awesomerea.org/resources/appleave2-wire-format-case/index.md): Case study · The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747. It includes a userspace reachability program, wire-format notes, overflow arithmetic and patched-host logs. The author reports that a hardware capability gate prevented a live overflow on that host.
- [Indian Thunder Stroke: decoding motorcycle CAN signals](https://awesomerea.org/resources/indian-thunderstroke-canbus-case/index.md): Case study · Indian Thunder Stroke documents a listen-only J1939 CAN decoder for a 2017 Indian Springfield motorcycle, with ESP32-S3 firmware and an Android instrument cluster. Its findings map messages for tyre pressure and temperature, fault codes, controls and engine state, including measured PGN and byte positions; the hardware publishes decoded values over BLE.
- [Smart Ring Dashboard: direct BLE access to generic smart rings](https://awesomerea.org/resources/smart-ring-dashboard-case/index.md): Case study · Smart Ring Dashboard implements direct Web Bluetooth access to Anko/Jring and Colmi/Yawell smart rings using documented BLE packet formats. Its protocol reference describes GATT services, commands and response layouts, while the browser app displays heart rate, activity, sleep and oxygen readings.
- [Thermal Cam: decoding the Thermal Master P1 USB stream](https://awesomerea.org/resources/thermal-cam-p1-protocol-case/index.md): Case study · Thermal Cam implements a macOS viewer for the Thermal Master P1 using a documented USB control and frame protocol. Its Swift driver starts the vendor stream through libusb, decodes radiometric frames into temperatures, and displays palettes, per-pixel readings, and snapshots.
- [ControlVault 3: reconstructing Linux fingerprint support](https://awesomerea.org/resources/controlvault3-linux-fingerprint-case/index.md): Case study · controlvault3-linux-fingerprint reconstructs the encrypted command exchange of the Dell/Broadcom ControlVault 3 fingerprint sensor and implements enrollment and verification on Linux. It offers a libfprint TOD driver for fprintd and an alternative standalone PAM path. The author describes deriving the channel from Windows USB captures and crypto hooks and reports testing on a Dell Latitude 5531.
- [glorouter: reconstructing the Huawei B311-221 HiLink API](https://awesomerea.org/resources/glorouter-case/index.md): Case study · glorouter reconstructs the Huawei B311-221 router's HiLink web API in a Python CLI and local dashboard. Its protocol notes trace endpoints from served JavaScript and browser captures, including SCRAM-SHA256 login and CSRF token handling; the client exposes signal, traffic, network, SMS and USSD controls.
- [OpticFilm 135i: reconstructing native USB scanning on Linux](https://awesomerea.org/resources/opticfilm-135i-linux-case/index.md): Case study · OpticFilm 135i reconstructs USB control of the Plustek OpticFilm 135i film scanner for Linux. Its Python driver handles calibration, film movement and 16-bit image capture at five resolutions, while a separate SANE backend exposes scanning to standard frontends; research notes record protocol and calibration findings.
- [Martian Notifier: reconstructing smartwatch Bluetooth commands](https://awesomerea.org/resources/martian-notifier-toolkit-case/index.md): Case study · The Martian Notifier toolkit reconstructs Bluetooth communication with the T200/MN200 smartwatch. Its protocol notes specify RFCOMM framing, BLE GATT identifiers and command opcodes for battery queries, time and date updates and keepalive. Python tools pair with the watch, send commands and probe additional opcodes from Linux.
- [E88 / E99 Drone: reconstructing Wi-Fi flight control and video access](https://awesomerea.org/resources/e88-e99-drone-pc-control-case/index.md): Case study · E88 / E99 Drone PC Control reconstructs the Wi-Fi control and video exchanges of an E99-labeled toy drone with an E88D board and FlyUFO app. Its Python client sends documented UDP stick and heartbeat packets, receives telemetry and presents an RTSP-derived MJPEG stream in a browser.
- [Samsung Washer Monitor: reconstructing a washer panel UART feed](https://awesomerea.org/resources/samsung-washer-monitor-esphome-case/index.md): Case study · Samsung Washer Monitor for ESPHome decodes the receive-only UART stream between a Samsung WW11BGA046 washer's DC92-01950B panel and main board. Its ESPHome component exposes program selections, displayed time, indicators and inferred cycle status to Home Assistant. The documentation records connector observations, wiring and the limits of the author's single-machine testing.
- [Fluval Connect light: reconstructing local Bluetooth control for aquarium lights](https://awesomerea.org/resources/hass-fluval-connect-case/index.md): Case study · Fluval Connect light implements local Home Assistant control of Fluval Connect aquarium lights over Bluetooth, using commands recovered from the FluvalConnect Android app. It exposes lighting, modes, schedules and clock synchronization, with support confirmed by the author on a Roma & Shaker 2.0 light.
- [Citroën Connected Camera: reconstructing the ConnectedCAM local API](https://awesomerea.org/resources/citroen-connected-camera-ios-case/index.md): Case study · Citroën Connected Camera is an iOS client for browsing, downloading and managing ConnectedCAM dashcam recordings over local Wi-Fi. Its protocol reference reconstructs the camera's cleartext HTTP /virb command endpoint, media access and session handshake from traffic captured from the official app.
- [Canon GM2080: reconstructing IVEC/PWG printing for macOS](https://awesomerea.org/resources/canon-gm2080-macos-case/index.md): Case study · The Canon GM2080 macOS driver reconstructs the printer's IVEC XML and PWG Raster print stream from observed output of Canon's Linux driver. Native CUPS filters generate that stream for a GM2080, with PPDs for related GM series models. The author reports end-to-end printing on a GM2080 running firmware 1.050.
- [Agent Phone: Polycom CX300 HID protocol findings](https://awesomerea.org/resources/agent-phone-cx300-case/index.md): Case study · Agent Phone uses a Polycom CX300 desk phone as an attention and dictation controller for coding agents. Its HID documentation preserves earlier protocol research and adds device-probe findings on report byte layouts, the voicemail LED, and host-controlled microphone mute. The Python daemon implements those controls alongside the phone’s audio and keypad handling.
- [RingLink: an offline RingConn Gen 3 client built on BLE protocol research](https://awesomerea.org/resources/ringlink-case/index.md): Case study · RingLink reconstructs direct access to RingConn Gen 3 smart rings in an offline Android client. It uses a documented BLE framing and SM3 authentication exchange to sync history and live readings into SQLite, then exports supported health records to Health Connect; it also sends vibration commands for calls and notifications.
- [GarminHRM600: reconstructing HRM 600 BLE and stored-file exchanges](https://awesomerea.org/resources/garminhrm600-case/index.md): Case study · GarminHRM600 implements a direct BLE client for the Garmin HRM 600 heart-rate strap using documented Multi-Link, GFDI and protobuf FileSyncService exchanges. Its CLI streams heart rate and Running Dynamics, downloads stored FIT files and reconstructs absolute timestamps from the strap's event clock and file identifiers. A protocol reference records message layouts and the author's probe results.
- [Canon IVEC driver: reconstructing PIXMA and MAXIFY print commands](https://awesomerea.org/resources/canon-ivec-driver-case/index.md): Case study · Canon IVEC driver reconstructs print and maintenance commands for PIXMA and MAXIFY inkjets in an open Linux CUPS driver. Its protocol reference documents IVEC XML job framing, PWG Raster page data and USB status handling. The author reports byte-for-byte matches against Canon driver output for 1,194 checked jobs and commands.
- [Minitela do Positivo Vision R15M: AHMI display protocol and ACF format](https://awesomerea.org/resources/minitela-r15-case/index.md): Case study · Minitela do Positivo Vision R15M implements Linux tools for the laptop’s 240×240 secondary display. The project documents its AHMI serial frames and ACF texture container using vendor-app captures, synthetic-image output comparisons, and analysis of the Windows texture compiler. Python tools send images, change pages and brightness, update display tags, and inspect the protocol.
- [Truma Aventa: Home Assistant control from BLE protocol findings](https://awesomerea.org/resources/truma-aventa2-ha-case/index.md): Case study · Truma Aventa controls a second-generation Aventa roof air conditioner from Home Assistant over BLE. The implementation uses captured TruMessageV3 and CBOR messages to expose climate, light, and diagnostic entities. Its findings document BLE framing, device addresses, routing, and pairing behavior observed on the appliance, including corrections to a prior protocol reference.
- [PetKit Eversweet Max 2 UVC: reconstructing fountain BLE telemetry](https://awesomerea.org/resources/petkit-eversweet-ble-gateway-case/index.md): Case study · PetKit Eversweet Max 2 UVC BLE Gateway uses a local Python or ESP32-C3 client in place of the Wi-Fi PetKit device that relays the fountain’s data. It reads state and drinking history and sends Telegram alerts. Its protocol notes document BLE framing, authentication, a 42-byte state map and history flow control derived from device observations.
- [WalleCube UPS: Home Assistant control through a reconstructed BLE protocol](https://awesomerea.org/resources/wallecube-bt-ha-case/index.md): Case study · WalleCube UPS provides local Home Assistant monitoring and control for the W150 mini-UPS through a reconstructed BLE GATT protocol. The author used Android app strings, Frida captures, and Dart disassembly to map telemetry and encrypted settings; PROTOCOL.md records the wire format. The integration exposes power and battery readings and selected settings, with writes checked by reading them back.
- [toppingctl: reconstructing Topping DAC control over USB HID](https://awesomerea.org/resources/toppingctl-case/index.md): Case study · toppingctl implements local control of Topping DACs through USB HID reports derived from observed WebHID traffic and the vendor web bundle. The CLI addresses registers for volume, gain, power and parametric EQ, while companion scripts read settings, inspect unsolicited meter data and probe unknown values. The author reports hardware confirmation on the DX5 II.
- [tuya-ipc-p2p-sdk: Python camera client for Tuya’s P2P protocol](https://awesomerea.org/resources/tuya-ipc-p2p-sdk-case/index.md): Case study · tuya-ipc-p2p-sdk implements a Python client for Tuya IPC cameras’ native P2P video protocol. It logs in through the mobile gateway, exchanges MQTT signaling, connects through a TCP relay with KCP conversations, authenticates a media channel, and decrypts and reassembles MJPEG frames. The implementation draws on a byte-level protocol reference in the author’s companion Go client.
- [SYNA8002: reconstructing a ThinkPad fingerprint reader's SPI protocol](https://awesomerea.org/resources/x1-tablet-gen3-fingerprint-case/index.md): Case study · The SYNA8002 investigation reconstructs the SPI transport, secure-channel setup and image capture path of the fingerprint reader in a ThinkPad X1 Tablet Gen 3. It includes a Python userspace driver and fprintd-compatible adapter; the author reports successful GDM login on one tablet, with a correlation matcher and an existing Windows-derived pairing key.
- [fx_lcd_software: reconstructing ID-COOLING FX display transfers](https://awesomerea.org/resources/fx-lcd-software-case/index.md): Case study · fx_lcd_software drives ID-COOLING FX cooler LCDs from Linux through a USB HID image-transfer protocol observed from the vendor software. It converts images to 240×240 baseline JPEG and sends framed data in paced 1024-byte chunks, with rotation options.
- [ti83-link: reconstructing TI-83 Plus link-port transfers](https://awesomerea.org/resources/ti83-link-case/index.md): Case study · ti83-link reconstructs TI-83 Plus link-port transfers using Raspberry Pi GPIO and Python. It sends and receives calculator variables, installs Flash applications, inspects TI file containers and documents packet handshakes and token values checked against hardware.
- [catbus99: reconstructing Epomaker TH99 Pro screen control over USB-HID](https://awesomerea.org/resources/catbus99-case/index.md): Case study · catbus99 reconstructs control of the Epomaker TH99 Pro keyboard display from captured driver WebHID traffic. Its Rust client sends USB-HID reports to display images and rendered widgets, while a protocol document maps the configuration and TFT interfaces. A daemon governs writes to the display's flash storage.
- [OpenWatch: reconstructing the LJ736/LY736D smartwatch BLE client](https://awesomerea.org/resources/openwatch-ly736d-case/index.md): Case study · OpenWatch implements an Android companion for LJ736/LY736D-based smartwatches using BLE commands reconstructed from the LaxaFit Pro APK and captured traffic. It handles pairing, notifications and clock synchronization locally, and can buzz the watch to help locate it. Protocol notes describe packet framing and watch-face transfer; the author reports that custom watch faces still display as blank black screens.
- [Quntis Monitor Light for ESPHome: reconstructing RF control](https://awesomerea.org/resources/quntis-monitor-light-esphome-case/index.md): Case study · Quntis Monitor Light for ESPHome recreates local control of a 26-inch Quntis monitor light through its observed XN297-compatible RF protocol. An ESP32-C3 and RF Nano transmit commands for power, brightness, color temperature and the separate glow light; protocol notes describe frames, CRC and rolling state.
- [Bosch Smart System: BLE diagnostic and live data protocol map](https://awesomerea.org/resources/bosch-smart-system-ble-case/index.md): Case study · Bosch Smart System maps the BLE diagnostic and Live Data interfaces of Bosch eBikes through captured traffic and field comparisons. It documents characteristics 0x0011 and eb21, frame structure, telemetry scaling and request behavior, with machine-readable field tables. The principal observations come from a Performance Line CX bike; comparison with a Performance Line SX is preliminary.
- [GreenPods: reconstructing AirPods control on Android](https://awesomerea.org/resources/greenpods-airpods-protocol-case/index.md): Case study · GreenPods is an Android app that reads AirPods BLE advertisements and offers Apple Accessory Protocol controls over L2CAP where available. Its protocol research records packet structures, transport requirements and captured device behavior for battery status, noise control, gestures and head tracking. The app exposes features according to the available Android Bluetooth path.
- [dualsense-bridge: reconstructing DualSense Bluetooth microphone access](https://awesomerea.org/resources/dualsense-bridge-case/index.md): Case study · dualsense-bridge recovers microphone audio carried inside DualSense Bluetooth HID reports and exposes it as a macOS audio input. Its research note documents the extended-report switch and microphone-enable output report; the application also maps controller input to desktop controls.
- [FX30 Controller: reconstructing Sony FX30 remote control](https://awesomerea.org/resources/fx30-controller-case/index.md): Case study · FX30 Controller implements remote control of the Sony FX30 camera on an M5Stack Cardputer ADV. It joins the camera's Wi-Fi Direct network, performs PTP-IP and Sony SDIO handshakes, and uses documented property and control codes for recording, exposure adjustments and status. It also provides live view.
- [P215 Scan: reconstructing the Canon P-215II file-tunnel transport](https://awesomerea.org/resources/p215-scan-case/index.md): Case study · P215 Scan replaces the Canon imageFORMULA P-215II desktop scanning workflow on macOS and documents the scanner’s file-tunnel transport. Its reconstructed Auto Start mode exchanges SCSI command and data blocks through two files on an emulated USB volume; the main scanning mode uses the SANE canon_dr backend.
- [Sirius Dev Kit: Hengbot Sirius API and action-format findings](https://awesomerea.org/resources/sirius-dev-kit-case/index.md): Case study · Sirius Dev Kit documents a measured investigation of the Hengbot Sirius robot dog and provides a browser control tool. Its findings map command behavior, ROS topics, sensor readings, and the robot’s RIFF/AVI action-file structure. Firmware comparisons identify changes to the ToF sensor path, while the tool uses the documented interfaces for robot control.
- [Narwal Robot Vacuum: local WebSocket control and protocol probing](https://awesomerea.org/resources/narwal-integration-case/index.md): Case study · Narwal Robot Vacuum is a Home Assistant integration built around the vacuums' local WebSocket interface. It includes helpers to capture phone-to-robot traffic, decode protobuf frames from packet captures and probe commands, alongside cleaning, station and map controls.
- [landbook-api: reconstructing Landbook cloud and local device access](https://awesomerea.org/resources/landbook-api-case/index.md): Case study · landbook-api reconstructs Landbook smart-home client access in Python from analysis of its iOS app. It handles REST login and device queries, MQTT state and control messages over WebSocket/TLS, and direct TCP control on a local network.
- [SF900 ESP32 Dongle: implementing the SF900 controller radio protocol](https://awesomerea.org/resources/sf900-esp32-dongle-case/index.md): Case study · SF900 ESP32 Dongle implements the SF900/SF2000 controller's 2.4 GHz XN297L radio protocol on an ESP32-S3 receiver. It presents controller input as USB HID or BLE HID and includes a separate USB Wi-Fi mode.
- [hydroshift2: reconstructing HydroShift II LCD-C USB control](https://awesomerea.org/resources/hydroshift2-case/index.md): Case study · hydroshift2 reconstructs direct USB control of the Lian Li HydroShift II LCD-C in a Rust library. It documents a DES-CBC command envelope and commands for JPEG and PNG display layers, brightness, rotation, pump and fan control, and TinyUZ-compressed RGB animations.
- [N2Elite-ng: reconstructing N2 Elite dongle control](https://awesomerea.org/resources/n2elite-ng-case/index.md): Case study · N2Elite-ng reconstructs control of the N2 Elite / Amiiqo USB dongle in a Python CLI and Tkinter GUI. Its protocol reference describes the CP2102 serial bridge to an MFRC522 NFC frontend, while the client reads NTAG215 tags and manages banks on an unlocked N2 disc.
- [Huawei MateBook 13 · Linux: Goodix fingerprint protocol and Linux driver](https://awesomerea.org/resources/huawei-matebook-13-linux-case/index.md): Case study · Huawei MateBook 13 · Linux reconstructs communication with the Goodix GXFP51A0 fingerprint reader and provides a Linux libfprint driver for it. Its research notes describe SPI packet framing, acknowledgement and response handling, and static analysis of Goodix FP Windows driver versions; the repository also manages MX250 power on the target laptop.
- [TP2-Y Label Studio: reconstructing Bluetooth label printing](https://awesomerea.org/resources/tp2y-label-studio-case/index.md): Case study · TP2-Y Label Studio implements direct label printing to the TP2-Y thermal printer over Bluetooth Classic RFCOMM. Its protocol notes describe captured frame structure and print-job commands; the Windows Python client provides a local web designer and command-line printing.
- [Halo Home for Home Assistant: reconstructing local Avi-on mesh control](https://awesomerea.org/resources/halo-home-home-assistant-case/index.md): Case study · Halo Home for Home Assistant controls Eaton HALO Home Bluetooth mesh lights locally and targets other Avi-on lights using the same protocol. Its CSRmesh protocol document describes GATT characteristics, encrypted packet delivery and passphrase-based key derivation for on/off, brightness and color-temperature controls.
- [foobot-local: local Foobot service and reconstructed protocols](https://awesomerea.org/resources/foobot-local-case/index.md): Case study · foobot-local reconstructs Foobot communication so the air-quality monitor can send readings to a local service. It documents MQTT topics, a UDP AT configuration channel and Wi-Fi provisioning recovered from the official APK; the Python service decodes readings and computes a pollution index.
- [noirm1: reconstructing NOIR M1 mouse settings](https://awesomerea.org/resources/noirm1-mouse-protocol-case/index.md): Case study · noirm1 reconstructs the NOIR M1 mouse's wired USB HID settings protocol from disassembly of the vendor's Windows utility and device checks. The Rust CLI writes polling rate, DPI and lighting settings through hidraw; protocol notes record packets and EEPROM fields.
- [PetMarvel C1: reconstructing local litter-box control](https://awesomerea.org/resources/petmarvel-c1-local-case/index.md): Case study · PetMarvel C1 Local reconstructs the litter box's cloud-facing TLS and MQTT exchanges in a router-hosted Go broker. Protocol notes describe topics, TLV commands and status fields; Home Assistant patches connect to the local broker.
- [omen-lcd: reconstructing HP OMEN cooler LCD control](https://awesomerea.org/resources/omen-lcd-hp-cooler-case/index.md): Case study · omen-lcd reconstructs the USB HID control exchange for the HP OMEN AIO cooler's LCD and implements a Linux driver. Its protocol notes describe identification, 480×480 JPEG frames and brightness messages captured from OMEN Gaming Hub.
- [QCY Control for macOS: implementing MeloBuds Pro BLE controls](https://awesomerea.org/resources/qcy-control-macos-case/index.md): Case study · QCY Control for macOS implements a Swift menu-bar client for QCY MeloBuds Pro using the documented QCY BLE GATT protocol. It controls noise modes, EQ, gaming mode and touch mappings, and lists UUIDs and example command frames.
- [BTHackers: reconstructing the AIREC recorder’s BLE protocol](https://awesomerea.org/resources/bthackers-airec-case/index.md): Case study · BTHackers documents the AIREC voice recorder’s BLE GATT service and command protocol from captured sessions. Its protocol reference maps characteristic handles and the 55 aa command and aa 55 response frames. The repository includes capture parsers, a Python client, and a Flutter app; the author lists connection fixes and the file-download command as open work.
- [MacBook ALS: mapping five HID color channels](https://awesomerea.org/resources/macbook-als-spectral-case/index.md): Case study · MacBook ALS maps the 122-byte HID report of an Apple Silicon MacBook ambient-light sensor. Python scripts read five raw channels, lux and color temperature, while recorded CSV runs and colored-light tests support the reported field positions and channel responses.
- [SteelSeries Apex 3: reconstructing RGB control over USB HID](https://awesomerea.org/resources/apex3-rgb-controller-case/index.md): Case study · The SteelSeries Apex 3 RGB Controller uses recovered USB HID reports to set the keyboard’s lighting colors from Linux. Its technical notes identify the device interface, a 32-byte report, color opcode 0x0B, and RGB values for ten zones. The repository includes a command-line program for sending color settings.
- [rfserver: reconstructing a 433 MHz light remote](https://awesomerea.org/resources/rfserver-light-remote-case/index.md): Case study · rfserver implements Raspberry Pi Pico W firmware for controlling LED lights through a decoded 433 MHz remote signal. It sends commands over RF, tracks changes made by the physical remote and exposes HTTP endpoints for commands and state.
- [ro: a client for the LB-Link BL-WR2000 repeater](https://awesomerea.org/resources/ro-bl-wr2000-case/index.md): Case study · ro is a Rust command-line client for controlling the LB-Link BL-WR2000 repeater through its HTTP interface. It sends login and goform requests to scan for Wi-Fi networks, connect to a network, read status, reboot and reset the repeater.
- [dvf3060: reconstructing Kenwood DVF-3060 front-panel control](https://awesomerea.org/resources/dvf3060-front-panel-case/index.md): Case study · dvf3060 implements control of the Kenwood DVF-3060 DVD player's front panel through its PT6311 SPI controller. A TM4C123G driver displays characters and icons and polls key states; the source separates hardware access, controller commands and display logic.
- [galaxy-buds-plus: controlling Buds Plus through RFCOMM](https://awesomerea.org/resources/galaxy-buds-plus-perl-case/index.md): Case study · galaxy-buds-plus implements a Perl client for Samsung Galaxy Buds Plus settings through the headset's RFCOMM serial interface. The author developed it by probing the undocumented device protocol on Linux; some messages and options remain undecoded.
- [DT No.1 F2: reconstructing smartwatch communication](https://awesomerea.org/resources/dt-no1-f2-watch-protocol-case/index.md): Case study · DT No.1 F2 reconstructs the Bluetooth LE exchange between the smartwatch and its Android companion. The project documents GATT handles, message framing and commands, and implements a Python framework and replacement Android app.
- [Maia Ds2: Bluetooth control command findings](https://awesomerea.org/resources/maia-ds2-bluetooth-socket-case/index.md): Case study · The Maia Ds2 investigation documents Bluetooth serial commands for controlling the amplifier. A command list and Python example show how to connect and send a channel-selection message.
- [fifine-ampligame-d6: reconstructing the D6 USB control interface](https://awesomerea.org/resources/fifine-ampligame-d6-case/index.md): Case study · fifine-ampligame-d6 reconstructs USB control of the Fifine AmpliGame D6 macro pad in a Python macOS driver. Its documentation describes vendor library disassembly, report formats, display wake behavior and LCD slot mapping; the code also bridges the device to Bitfocus Companion Satellite.
- [PS5 pela rede: rebuilding PS5 discovery and wake control](https://awesomerea.org/resources/ps5-pela-rede-case/index.md): Case study · PS5 pela rede provides a Node command-line client for checking whether a PS5 is on or resting and for waking or resting it over a home network. It implements DDP discovery on UDP port 9302 and WAKEUP from documented packet behavior, while registration and rest commands use playactor.
- [BudsCtl: reconstructing SoundPEATS earbud controls](https://awesomerea.org/resources/budsctl-case/index.md): Case study · BudsCtl reconstructs SoundPEATS Air4 Pro GAIA V2 controls for a macOS menu bar app that changes noise mode and reads each earbud's battery level. Its documentation identifies the BLE service, command framing, and response behavior; a separate Samsung RFCOMM implementation draws on a cited protocol reference.
- [Babyface Pro FS: reconstructing its proprietary USB mode on Linux](https://awesomerea.org/resources/babyface-pro-linux-case/index.md): Case study · A Linux ALSA driver reconstructs the RME Babyface Pro FS proprietary USB mode from Windows captures. It handles interrupt-endpoint PCM streaming, mixer controls and front-panel input, with protocol and calibration notes plus USB capture-analysis tools.
- [wolfmix-automation: reconstructing W1 project files and USB control](https://awesomerea.org/resources/wolfmix-automation-case/index.md): Case study · wolfmix-automation reconstructs the Wolfmix W1 .wpj project format and USB control protocol from controlled editor changes, owned project files, and device observations. It publishes a byte-level specification and Python tools to inspect, diff, round-trip, compile, and generate project files, plus a USB client.
- [Mammotion RTK 3: reconstructing the mower's LoRa correction link](https://awesomerea.org/resources/mammotion-rtk-lora-case/index.md): Case study · This study reconstructs the receive side of the LoRa link from a Mammotion RTK 3 station to a Luba mini AWD 800H mower. It documents frequency hopping and an RTCM3 container, with SX1276 receiver firmware and Python tools that analyse captures and extract corrections.
- [DingTalk A1 Local Toolkit: reconstructing BLE recording access](https://awesomerea.org/resources/dingtalk-a1-local-toolkit-case/index.md): Case study · DingTalk A1 Local Toolkit reconstructs the recorder's BLE authentication and recording-transfer exchange for local access from Windows or Linux. Its Python tools read device status and recording indexes, download recordings, and convert BABA/DTYJ Opus containers to Ogg/Opus.
- [Remote for Apple TV: rebuilding Companion Link control on Android](https://awesomerea.org/resources/apple-tv-remote-android-case/index.md): Case study · Remote for Apple TV implements Apple TV control on Android through Kotlin modules for Companion Link pairing, encrypted OPACK commands, and an MRP-over-AirPlay media tunnel. Its protocol module and desktop CLI cover discovery, remote keys, text entry, and now-playing data; the project credits pyatv for protocol values and reference vectors.
- [panelbeater: reconstructing ScanSnap iX1500 panel control](https://awesomerea.org/resources/panelbeater-case/index.md): Case study · panelbeater lets a Linux host respond to the Scan button on a ScanSnap iX1500 over Wi-Fi or USB. Over Wi-Fi it registers the host with the scanner; over USB it scans without registration. Its protocol notes document discovery, registration, document transfer and USB behavior, while the client assembles scanned pages into PDFs and can add an OCR text layer when ocrmypdf is installed.
- [VT-Ragnaros: reconstructing Redragon SS552 USB control](https://awesomerea.org/resources/vt-ragnaros-case/index.md): Case study · VT-Ragnaros implements a Linux driver and daemon for the Redragon SS552 Ragnaros USB control deck. It reconstructs commands and input reports from the vendor's SDLibrary1.dll, sending JPEG frames in 1024-byte USB packets and decoding key, knob, and touch-strip events for configurable profiles.
- [PixMob Wave2: reconstructing RF wristband commands for Flipper Zero](https://awesomerea.org/resources/pixmob-wave2-flipper-zero-case/index.md): Case study · A Flipper Zero signal set and Python generator reproduce PixMob Wave2 and Waveband 2 group-0 RF commands for European 868.415 MHz wristbands. Protocol notes describe OOK timing, 6b/8b field encoding, CRC-12, wake frames and persistent color or OFF packets.
- [Goodix 55a4: reconstructing a Linux fingerprint driver](https://awesomerea.org/resources/goodix-27c6-55a4-fingerprint-case/index.md): Case study · The Goodix 55a4 project reconstructs Linux support for the 27c6:55a4 fingerprint sensor through a libfprint patch. Its research combines USB captures with examination of the vendor's Windows driver to document command behavior, image acquisition and host-side matching. Installation scripts provision the sensor key and configure fprintd.
- [allmiibo-sync: reconstructing Pixl.js Bluetooth file synchronization](https://awesomerea.org/resources/allmiibo-sync-case/index.md): Case study · allmiibo-sync reconstructs the Pixl.js and AmiiboLink Bluetooth LE virtual filesystem protocol to synchronize folders with NFC emulator devices. Its browser app compares local and device trees, plans transfers and deletions, and uses VFS commands documented from official web clients and checked against firmware.
- [EBO for Home Assistant: reconstructing Enabot cloud control](https://awesomerea.org/resources/ha-enabot-case/index.md): Case study · EBO for Home Assistant reconstructs the EBO HOME cloud exchange to control Enabot robots from Home Assistant. Its add-on logs in with the user's account, discovers robots, sends commands through Agora RTM and converts Agora RTC video to an RTSP camera feed. The repository includes request-signing and message-routing tests.
- [iM.Master SDK: reconstructing the robot's BLE control protocol](https://awesomerea.org/resources/im-master-sdk-case/index.md): Case study · iM.Master SDK reconstructs the iM.Master toy robot's BLE advertising commands and exposes them through a Python control API. Its protocol notes describe a 14-byte manufacturer payload under company ID 0x53A6, recovered from vendor-app captures, while the driver streams frames through Linux raw HCI to move the robot.
- [PumpSaver Plus: decoding the relay's infrared broadcast](https://awesomerea.org/resources/pumpsaver-ir-protocol-case/index.md): Case study · A protocol reference and Python decoder reconstruct the baseband infrared register broadcast of SymCom and Littelfuse PumpSaver Plus pump-protection relays. It maps 32-bit words to voltage, current, power, settings, counters and fault history, with sample captures and decoder tests.
- [Mazda MX-5 ND3: mapping OBD-II PIDs and responses](https://awesomerea.org/resources/mazda-mx5-nd3-obdii-case/index.md): Case study · Mazda MX-5 ND3 OBD-II PID Research maps diagnostic responses from a 2025 MX-5 RF Club. It records Mode 01 and manufacturer-specific Mode 22 PIDs, decoding formulas, observed values and range-scan results gathered through an OBDLink MX+ adapter.
- [QUII Helper: reconstructing Qualvision intercom communication](https://awesomerea.org/resources/quii-helper-case/index.md): Case study · QUII Helper reconstructs communication with QUII and Qualvision video intercoms in a Python client for snapshots, video, RTSP forwarding, device inspection, and door commands. Its protocol notes map LAN TCP setup, encrypted play, media handling, and cloud preview flow to behavior found in inspected app builds.
- [KlipschRemote: reconstructing Klipsch speaker control and update protocols](https://awesomerea.org/resources/klipschremote-case/index.md): Case study · KlipschRemote implements Bluetooth LE control of Klipsch The Fives, Sevens and Nines speakers through desktop, CLI, Python and browser clients. Its protocol documentation describes the shared GATT control service and an investigation of the Fives Updater Android app that maps a separate GAIA/RFCOMM firmware-update exchange. The client controls volume, inputs, equalization and device settings.
- [AirMini Sync: reconstructing ResMed AirMini telemetry sync](https://awesomerea.org/resources/airmini-sync-case/index.md): Case study · AirMini Sync reconstructs the ResMed AirMini telemetry exchange in an Android client that retrieves and exports sleep records as JSON. Its protocol reference describes Bluetooth Classic RFCOMM transport, a Diffie-Hellman pairing exchange, encrypted JSON-RPC requests and notifications, and therapy log streams.
- [OpenNord: reconstructing Nord Stage file and USB transfer formats](https://awesomerea.org/resources/opennord-case/index.md): Case study · OpenNord reconstructs Nord Stage program handling and USB transfer in a keyboard companion app. It reads Stage 2, 3 and 4 program files through a shared CBIN container and model codecs, and uses a recovered vendor bulk USB protocol to enumerate devices and transfer programs. Sample readers and a local library support inspection and playback.
- [OpenStrap research: reconstructing WHOOP 4.0 BLE data access](https://awesomerea.org/resources/openstrap-whoop4-research-case/index.md): Case study · OpenStrap research reconstructs WHOOP 4.0 BLE framing, history synchronization and sensor-record decoding. Its Python research client can scan and connect to a band, stream heart rate and motion, drain history, decode frames and replay saved captures.
- [fpdrv: reconstructing Synaptics 06cb:00e7 fingerprint communication](https://awesomerea.org/resources/synaptics-00e7-fpdrv-case/index.md): Case study · fpdrv reconstructs communication with the Synaptics 06cb:00e7 fingerprint sensor as a Linux userspace driver, libfprint TOD module and diagnostic CLI. It implements host pairing and a TLS-like encrypted session for on-chip enrollment and matching. Its protocol notes map USB endpoints and captured connection flows.
- [PixyPilot: reconstructing EMEET PIXY camera control on Linux](https://awesomerea.org/resources/pixypilot-case/index.md): Case study · PixyPilot implements Linux control of the EMEET PIXY camera using V4L2 ioctls and decoded vendor HID commands. Its research documents HID report layouts, captured commands, and UVC extension-unit investigation, while the app provides PTZ controls, preview, recording, and capture import.
- [Prismatic: reconstructing SteelSeries Arena 7 RGB control](https://awesomerea.org/resources/prismatic-arena7-case/index.md): Case study · Prismatic reconstructs the SteelSeries Arena 7 speaker lighting exchange in a macOS menu bar app. It sends USB HID output report 0x06 with commands and RGB values for four zones, using a layout recovered from SteelSeries GG USBPcap traffic. The app controls left and right colors, brightness and power.
- [superstrike-hits-linux: reconstructing Logitech HITS controls](https://awesomerea.org/resources/superstrike-hits-linux-case/index.md): Case study · A Linux Python CLI uses the reconstructed HID++ HITS feature of the Logitech G PRO X2 SUPERSTRIKE mouse to read and set per-button click haptics and actuation points. Protocol notes derive feature 0x1B0C and its report fields from G HUB USB captures and device probing.
- [AT2 HT: reconstructing Baofeng AT2 BLE control and messaging](https://awesomerea.org/resources/at2-ht-case/index.md): Case study · AT2 HT implements the Baofeng ALERVITES AT2 radio's BLE control and off-network messaging in an Android app. It supports channel programming, messages and PTT, and replaces voice encoding with OpenCORE-AMR MR475 and image processing with a Go implementation compared against the original library.
- [Empatica E4 wristband: decoding BLE telemetry](https://awesomerea.org/resources/empatica-e4-local-case/index.md): Case study · Empatica E4 wristband work reconstructs the device's BLE telemetry flow and provides a local recorder and decoder for accelerometer, skin temperature, electrodermal activity, and raw photoplethysmogram data. It documents GATT services and packet layouts, preserves raw packets, and writes decoded sensor readings to CSV.
- [Polylux: reconstructing ASUS ROG device control](https://awesomerea.org/resources/polylux-case/index.md): Case study · Polylux implements Windows control of ASUS ROG AniMe Matrix, LiveDash OLED, Ryujin LCD, Aura RGB, and fan hardware. It documents USB protocols decoded from Armoury Crate captures and combines direct device drivers with OpenRGB and LibreHardwareMonitor interfaces.