# Curated reverse engineering resources · Page 48

> Page 48 of 52, entries 4,701–4,800. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/48/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/48/index.md>

## Protocols (100)

- [AK820 Pro Modder: reconstructing keyboard HID control on macOS](https://awesomerea.org/resources/ak820-pro-modder-case/index.md): Case study · AK820 Pro Modder implements macOS control of the Epomaker and Ajazz AK820 Pro keyboard through a Rust HID protocol library shared by a Tauri app and CLI. Its protocol notes distinguish two firmware families and document commands for lighting, keymaps, macros, the TFT display, and device settings.
- [dj-midi-sender: reconstructing Pro DJ Link tempo exchange](https://awesomerea.org/resources/dj-midi-sender-case/index.md): Case study · dj-midi-sender reconstructs the Pioneer Pro DJ Link tempo exchange and bridges it to MIDI clock. A shared C++ parser and state machine read beat and status packets, track the tempo master and drive a 24 PPQN clock on desktop or ESP32-S3 hardware. The repository includes packet captures, protocol offsets and replay tools.
- [Wellue O2Ring-S: reconstructing the OxyII BLE protocol](https://awesomerea.org/resources/o2ring-s-protocol-case/index.md): Case study · A protocol study and Python client reconstruct the OxyII Bluetooth LE link used by the Wellue O2Ring-S T8520 pulse oximeter. It documents GATT characteristics, framing, CRC-8 and commands for device information, live SpO2 and heart rate, and stored-file transfer.
- [Blackmacro-lib: reconstructing the Speed Editor USB HID exchange](https://awesomerea.org/resources/blackmacro-lib-case/index.md): Case study · Blackmacro-lib reconstructs the Blackmagic Speed Editor USB HID exchange in reference MicroPython firmware. It documents report sequences and authentication research, enabling a HID-capable microcontroller to present Speed Editor controls to DaVinci Resolve.
- [libfprint Goodix SPI Driver: reconstructing GDIX51C0 support](https://awesomerea.org/resources/libfprint-goodix-spi-case/index.md): Case study · libfprint Goodix SPI Driver reconstructs support for the Goodix GDIX51C0 fingerprint sensor on Linux. It combines SPI transport, session and capture handling with a native ChicagoHS host-side biometric matcher, integrated through libfprint and fprintd patches. The source includes protocol research, algorithm comparison tools and deterministic tests.
- [Insta360 GO Ultra: reconstructing its Wi-Fi camera protocol](https://awesomerea.org/resources/insta360-go-ultra-sdk-case/index.md): Case study · A Python toolkit and protocol study reconstruct Insta360 GO Ultra control over Wi-Fi TCP port 6666. The protocol notes document length-prefixed protobuf command packets and H.265 video frames; the repository includes scripts for live preview and packet probing.
- [Chuwi CoreBook X: recovering the left-speaker audio path on Linux](https://awesomerea.org/resources/chuwi-corebook-x-left-speaker-case/index.md): Case study · A Linux userspace daemon restores the Chuwi CoreBook X left speaker by configuring its AW88298 amplifier over I2C and mirroring the Conexant SN6180 HDA stream. The investigation documents the hidden I2S route, register behavior, volume mirroring and suspend recovery.
- [LIBREPODS-RS: rebuilding AirPods AAP control in Rust](https://awesomerea.org/resources/librepods-rs-case/index.md): Case study · LIBREPODS-RS implements the AirPods Apple Accessory Protocol in Rust over Bluetooth L2CAP. Its core parses and builds AAP packets and decodes BLE advertisements, while Linux and Windows backends support battery status, noise modes, ear detection, and media actions; the project credits LibrePods as an inspiration and protocol reference.
- [Blue Star AC → ESPHome: reconstructing the Wi-Fi port protocol](https://awesomerea.org/resources/blue-star-ac-esphome-case/index.md): Case study · Blue Star AC → ESPHome reconstructs the UART protocol of Blue Star smart-ready air conditioners and implements local control on an ESP32-C3. Its ESPHome component completes the Tuya MCU handshake, exchanges Blue Star DP101 key/value records and exposes climate controls to Home Assistant for tested IE518TNUR and IA318MXU models.
- [Intel NUC M15 Light Bar Control for Linux: reconstructing WMI lighting commands](https://awesomerea.org/resources/intel-nuc-m15-lightbar-linux-case/index.md): Case study · Intel NUC M15 Light Bar Control for Linux reconstructs the WMI commands used to set the laptop's front RGB light bar. A kernel helper invokes the F351 WMI transport, while Python tools send 0x0603 packets and expose named lighting states. The research notes map packet bytes to function, state, speed and brightness fields.
- [libfprint-microarray: reconstructing the MAFP fingerprint reader USB protocol](https://awesomerea.org/resources/libfprint-microarray-mafp-case/index.md): Case study · libfprint-microarray reconstructs the USB control workflow of the MicroarrayTechnology MAFP fingerprint reader as a Linux libfprint driver. Analysis of MicroarrayFingerprintDevice.dll and USB captures informs its handshake, image polling, fingerprint enrollment and verification commands. The author reports successful enrollment and verification on a physical 3274:8012 device.
- [ntrig-calib: reconstructing Surface Pro 3 digitizer calibration](https://awesomerea.org/resources/ntrig-calib-surface-pro-3-case/index.md): Case study · ntrig-calib reconstructs the Surface Pro 3 N-Trig digitizer's calibration exchange as a Linux Python script. The project describes Ghidra analysis of CalibG4.exe and NCPTransportInterface.dll, including NCP framing, START_CALIB and GET_STATUS commands and HID report transport. The author reports a working fix on one device while documenting uncertain response behavior and calibration longevity.
- [even-utils: experimenting with Even Realities G1 dashboard messages](https://awesomerea.org/resources/even-utils-g1-case/index.md): Case study · even-utils explores the Even Realities G1 glasses protocol through an Android app. It builds custom Dashboard Map images and News source, text, creation and deletion messages, with BLE packet classes for these exchanges; navigation and standalone connection maintenance remain future work.
- [Opel Insignia A: investigating LIN control of the Climatronic panel](https://awesomerea.org/resources/opel-insignia-climatronic-lin-case/index.md): Case study · The Opel Insignia A Climatronic panel project investigates control of a 2015 facelift climate panel over LIN. It records the panel's connector pinout, identifies its LIN transceiver and provides STM32G431KB code and an image of observed LIN frames. The author describes the approach as brute force and based on an earlier panel investigation.
- [Opel Insignia climatronic panel: reconstructing LIN control with STM32](https://awesomerea.org/resources/lin-bus-insignia-climatronic-panel-g431kb-case/index.md): Case study · An STM32G431KB project investigates LIN bus control of a 2009 Opel Insignia climate-control panel. The author describes a brute-force approach without prior LIN frame ID information; the repository includes controller firmware, panel photographs and a frame image.
- [Peugeot 3008 II: investigating CAN control of the air-conditioning unit](https://awesomerea.org/resources/peugeot-3008-ii-air-conditioning-case/index.md): Case study · Peugeot 3008 II air conditioning unit investigates CAN control of the vehicle's climate module using brute-force frame-ID exploration. An STM32G431KB project drives the module's flaps and includes notes on its TJA1055 transceiver, sensors and actuators. The author reports testing a unit marked 9811039380.
- [BMW E92 CAN Live Data: decoding ECU telemetry](https://awesomerea.org/resources/e92-can-livedata-case/index.md): Case study · BMW E92 CAN Live Data investigates CAN and OBD-II messages from a 2007 BMW E92 335d with an EDC16CP35 ECU. Using an ESP32 and TJA1050 CAN transceiver, the project sniffs CAN traffic and sends Mode 01 and Mode 22 PID requests; the author reports readings for coolant temperature, RPM, airflow and boost pressure.
- [Simplesoft RP5-TY-101: mapping Toyota CAN interface messages](https://awesomerea.org/resources/simplesoft-rp5-ty-101-can-case/index.md): Case study · Simplesoft RP5-TY-101 documents the function IDs and payload layouts used by a Toyota CAN interface box for aftermarket head units. Its tables cover responses such as door, tire-pressure, climate and radar state, plus head-unit requests for data and air-conditioning controls. A Python decoder is also present.
- [BMW G08 blower: probing LIN payload fields](https://awesomerea.org/resources/bmw-g08-blower-lin-case/index.md): Case study · The BMW G08 heater blower project uses an STM32G431KB LIN master node to investigate which payload fields track blower drive voltage, current and fan speed. The repository includes controller firmware and images of the blower setup and serial monitor.
- [brscanner: a client for Brother DCP-1512E USB scanning](https://awesomerea.org/resources/brscanner-case/index.md): Case study · brscanner implements a Go USB client for scanning with the Brother DCP-1512E from an investigated device protocol. It provides a CLI for resolution, scan area and JPEG output, plus a Wireshark filter for examining USB captures.
- [SC75823: mapping the H-Buster HBD-2300MP display](https://awesomerea.org/resources/sc75823-hbd2300mp-case/index.md): Case study · SC75823 reconstructs Arduino control of the H-Buster HBD-2300MP front-panel display. It maps 156 individually addressable display bits to segments and symbols, and documents routines for seven-segment digits, fourteen-segment text and display-state updates.
- [Gree-Wired-Proto: mapping the XK19 wired controller bus](https://awesomerea.org/resources/gree-wired-proto-case/index.md): Case study · Gree-Wired-Proto maps the RS-485 exchange between a Gree air-conditioner indoor unit and an XK19 wired controller. It records 1200-baud 8N1 serial settings, a 7E 7E header, source and destination bytes, body lengths, XOR checksum and observed message examples.
- [Nuga library: reconstructing NuPhy BYK916 keyboard control](https://awesomerea.org/resources/nuga-lib-case/index.md): Case study · Nuga library implements Go control of BYK916 NuPhy keyboards through a reconstructed USB HID protocol. It reads and sets lighting effects and brightness, while its protocol notes map HID reports, response fields and custom per-key backlight colors.
- [Razer Nari Battery Level: recovering a USB battery-voltage exchange](https://awesomerea.org/resources/razer-nari-battery-level-case/index.md): Case study · Razer Nari Battery Level implements a USB HID exchange to read the headset's reported battery voltage through its dongle. The author captured SET_REPORT and GET_REPORT traffic and infers that two response bytes encode battery voltage in millivolts. A C program using libusb sends the requests and decodes those bytes.
- [Pix Backpack Go: reconstructing PIX display control over BLE](https://awesomerea.org/resources/pix-backpack-go-case/index.md): Case study · Pix Backpack Go reconstructs local BLE control of PIX Backpack LED displays as a Go library and CLI. Its protocol notes and code cover GATT commands, RGB palettes, image and animation upload, live updates and scrolling text, drawing on app materials and local BLE experiments.
- [VFS495 fingerprint reader on Linux: reconstructing capture and login](https://awesomerea.org/resources/vfs495-linux-case/index.md): Case study · VFS495 fingerprint reader on Linux reconstructs capture and login support for the Validity USB 138a:003f sensor. It documents USB and secure-session behavior, descrambles captured images, and bridges the vendor-driven capture path to libfprint virtual_image, fprintd and PAM.
- [VTech VM901: reconstructing camera authentication and media access](https://awesomerea.org/resources/vtech-vm901-home-assistant-case/index.md): Case study · VTech VM901 reconstructs the camera's authentication and media workflow for a Home Assistant bridge. The Go and C implementation uses TUTK/Kalay transport, performs the documented X25519 and ChaCha20-Poly1305 exchange, decrypts H.264 and G.711 media, and publishes streams through go2rtc.
- [KATASYMBOL E12 Lab: reconstructing BLE label printing](https://awesomerea.org/resources/katasymbol-e12-lab-case/index.md): Case study · KATASYMBOL E12 Lab reconstructs BLE printing for E12-class label makers in Python. It combines a protocol library, command-line printer, Tkinter GUI and raw command harness, documenting GATT characteristics, 0x7E 0x5A command frames and compressed 512-byte raster frames.
- [GE Opal 2: ice maker hardware and I2C interface research](https://awesomerea.org/resources/ge-opal-2-research-case/index.md): Case study · GE Opal 2 research maps the ice maker's connectors, nominal voltages, plumbing and front-panel I2C communication to support an Arduino-based replacement control board. The repository includes protocol notes, a prototype schematic and firmware code. The author identifies incomplete connector documentation and unexamined front-panel and RGB behavior.
- [magicJack HOME: a Linux phone system from USB and SIP protocol research](https://awesomerea.org/resources/magicjack-home-linux-phone-case/index.md): Case study · magicJack HOME is investigated through its vendor macOS driver, USB register interface and captured SIP traffic to build a Linux-controlled analog phone endpoint. Python tools drive line power, ringing, hook detection and DTMF over hidraw, while baresip and a bridge connect the handset to a self-hosted PBX. The author reports live two-way calls on the resulting setup.
- [PyKS2: reconstructing the Pentax K-S2 Wi-Fi API](https://awesomerea.org/resources/pyks2-case/index.md): Case study · PyKS2 reconstructs the Pentax K-S2 camera's undocumented Wi-Fi HTTP and WebSocket interface as a Python library, CLI and camera simulator. Its protocol notes map endpoint groups, request behavior, live view and event streams, backed by captured responses from firmware 01.10.
- [ESPHome — Maytronics Air Cover BLE: reconstructing pool-cover control](https://awesomerea.org/resources/maytronics-aircover-esphome-case/index.md): Case study · ESPHome — Maytronics Air Cover BLE recreates pool-cover control through a BLE GATT profile observed in the official Android app. Its ESPHome configuration sends open, close and stop payloads and reads position and motor-state notifications for Home Assistant.
- [RevCar CLI: reconstructing WowWee car BLE control](https://awesomerea.org/resources/revcar-cli-case/index.md): Case study · RevCar CLI is a Python controller for WowWee RevCar toys built from BLE command observations. Its notes identify GATT handles for notifications and commands, describe the handshake and driving payloads, and include a captured HCI exchange.
- [Open Steigen: documenting an appliance's local protocol](https://awesomerea.org/resources/open-steigen-protocol-case/index.md): Case study · Open Steigen documents the local control protocol of Steigen Automatic Laundry Systems, including readable and writable data points for rack movement, lights, fan and heater. Its pairing notes describe the appliance's Wi-Fi setup exchange; the author reports testing the Solar model with protocol v3.3.
- [Tchibo 287717: decoding a wireless weather-sensor signal](https://awesomerea.org/resources/tchibo-287717-weather-signal-case/index.md): Case study · The Tchibo 287717 investigation decodes its weather sensor's 433.85 MHz OOK transmissions. Captures and display comparisons support a pulse-distance message layout with repeated frames and mapped temperature and humidity fields.
- [BPM: USB data access for the Aponorm blood pressure monitor](https://awesomerea.org/resources/bpm-aponorm-usb-case/index.md): Case study · BPM documents a study of USB communication with the Aponorm Blutdruckmessgerät Oberarm Professionell blood pressure monitor and provides a Python reader for backing up measurements on Linux. The reader sends a serial command, parses cycle records containing timestamps and blood pressure values, and stores measurements in SQLite.
- [deco-network-optimize: reconstructing Deco Network Optimization commands](https://awesomerea.org/resources/deco-network-optimize-case/index.md): Case study · deco-network-optimize implements the TP-Link Deco app's private TMP/App-V2 Network Optimization sequence for a Deco X20-DSL. It opens an SSH direct-tcpip channel to tmpsvr, sends scan and poll commands, and requests channel optimization when the device reports an optimizable state. The accompanying protocol notes document framing, checksum and the recovered command opcodes.
- [LEGO SPIKE medium motor: reconstructing its UART handshake](https://awesomerea.org/resources/lego-spike-medium-motor-u545re-case/index.md): Case study · An STM32U545RE project reconstructs the LEGO SPIKE medium motor's UART startup exchange from observations of the original hub. It reproduces the handshake and heartbeat so the motor sends speed, single-turn position and accumulated angle frames at 115200 baud.
- [BLE Blood Pressure Monitor: analysing BC54 measurement packets](https://awesomerea.org/resources/ble-blood-pressure-bc54-case/index.md): Case study · An ESP32 client investigates the BC54 blood-pressure monitor's BLE exchange and parses measurements from the Blood Pressure Service. Its notes map the measurement flags, pressure values and optional fields and describe bonded, encrypted pairing.
- [LD2410S: investigating radar buses and firmware](https://awesomerea.org/resources/ld2410s-reverse-engineering-case/index.md): Case study · The LD2410S investigation documents the I2C and SPI traffic between a Hi-Link FMCW radar board's components and examines its Puya controller firmware. It includes Saleae captures, oscilloscope images, an interpreted Range FFT frame, firmware strings and an interrupt vector map. The author labels the investigation as work in progress.
- [MiniToo Pixeldeck: Divoom display protocol and input research](https://awesomerea.org/resources/minitoo-pixeldeck-case/index.md): Case study · MiniToo Pixeldeck implements and documents the Divoom MiniToo's Bluetooth Classic display exchange. Its Python driver frames and uploads JPEG or optional Zstandard RGB pixel data, while research notes record observed media-button input paths and their limits. The toolkit includes interactive pixel demonstrations and protocol diagnostics.
- [fnb58-ble-logger: FNB58 Bluetooth measurement protocol](https://awesomerea.org/resources/fnb58-ble-logger-case/index.md): Case study · fnb58-ble-logger reconstructs the FNIRSI FNB58's Bluetooth LE measurement exchange and logs voltage, current and power to daily CSV files. Its Linux daemon writes the stream-start commands, reassembles notification frames and decodes type 04 measurements; the repository documents the observed GATT layout and frame format.
- [KBM TG700 Control: Linux keyboard settings from USB protocol analysis](https://awesomerea.org/resources/kbm-tg700-control-case/index.md): Case study · KBM TG700 Control reconstructs the USB HID settings protocol of KBM! GAMING TG600 and TG700 keyboards from analysis of their Windows software. Its Linux GTK4 app sets lighting, macros and key mappings through hidraw, and the protocol document records report fields and command codes. Hardware testing is reported for the TG700.
- [ssmouse: a client for the Rival 3 Wireless HID protocol](https://awesomerea.org/resources/ssmouse-case/index.md): Case study · ssmouse implements a client for the SteelSeries Rival 3 Wireless HID protocol recovered from SteelSeries GG. Its Rust tray app and CLI read battery and device events and set DPI, polling, lighting, buttons and power options; the repository documents report framing and commands.
- [KuKirin G2 Master: decoding the display-controller UART protocol](https://awesomerea.org/resources/kukirin-g2-master-uart-case/index.md): Case study · KuKirin G2 Master UART protocol documents the single-wire link between the display and Lenzod controller of a late-2025 Version C scooter. It identifies inverted 230400-baud signalling, 66 66 frame headers, CRC-16/MODBUS and fields for controls, speed and battery voltage. Python tools decode logic-analyser captures and display live values.
- [RJ Connect: Ruijie campus authentication protocol research](https://awesomerea.org/resources/rj-connect-case/index.md): Case study · RJ Connect documents Ruijie campus-network authentication at the packet, field, cryptographic and state-machine levels. Its Zig library implements the studied macOS 1.35 and MentoHUST 0.3.1 wired EAP-MD5 profiles, including private tail fields and session transitions. PEAP and Direct paths remain internal research modules.
- [aula-hero68-protocol: reconstructing AULA HERO 68 HE RGB control](https://awesomerea.org/resources/aula-hero68-protocol-case/index.md): Case study · aula-hero68-protocol documents the HID lighting protocol of the AULA HERO 68 HE keyboard. It specifies the 64-byte output report, checksum, lighting commands and per-key payloads, and includes a key map calibrated by lighting and pressing individual keys. Capture parsers and a device test script accompany the protocol notes.
- [MCHOSE V9 Turbo+: reconstructing headset RGB control](https://awesomerea.org/resources/mchose-v9-protocol-case/index.md): Case study · MCHOSE V9 Turbo+ protocol research reconstructs the headset's USB HID RGB control exchange. It documents the 65-byte Windows write buffer, lighting fields, ACK draining and a 0x07 status query that reads back color values. C# and Python probes exercise the commands against the device.
- [sindri-led: reconstructing K671 Sindri lighting control](https://awesomerea.org/resources/sindri-led-case/index.md): Case study · sindri-led reconstructs the K671 Sindri keyboard's HID lighting controls from study of the Windows software and device responses. The Linux Rust CLI changes effects, brightness and lit keys through feature reports, while protocol notes record report IDs and field layouts. A separate map links report positions to physical keys on one Latin ISO keyboard.
- [clevo-wmi-rgb: reconstructing Clevo keyboard backlight control](https://awesomerea.org/resources/clevo-wmi-rgb-case/index.md): Case study · clevo-wmi-rgb documents the WMI commands used to control keyboard backlighting on a Colorful X15 AT23 laptop with a Clevo NP50SNE chassis. Its protocol notes describe CLEVO_GET.SetKBLED color packing, zone values, power and brightness commands; PowerShell scripts probe the interface and register its WMI class.
- [Osmo+ Studio: reconstructing DJI Osmo+ Wi-Fi control and streaming](https://awesomerea.org/resources/osmo-plus-studio-duml-case/index.md): Case study · Osmo+ Studio reconstructs DJI Osmo+ camera control and live video transport over Wi-Fi in Python. Its DUML parser and probes document frame checksums, gimbal and zoom commands, exposure settings, and the H.264 stream handshake and sequence acknowledgements. The desktop app routes the camera feed to OBS Virtual Camera.
- [cherry-mx-lighting-mac: reconstructing Cherry MX 10.0N RGB lighting control](https://awesomerea.org/resources/cherry-mx-lighting-mac-case/index.md): Case study · cherry-mx-lighting-mac reconstructs lighting control for the Cherry MX 10.0N RGB keyboard in a macOS menu bar app. The author observed Cherry Utility's USB HID traffic and documented a five-report sequence, including bytes for effect, brightness, speed and RGB colour; the app also remaps keys through hidutil.
- [labelibre: direct SUPVAN T50M Pro printing over a reconstructed BLE protocol](https://awesomerea.org/resources/labelibre-supvan-case/index.md): Case study · labelibre implements direct Bluetooth printing to the SUPVAN T50M Pro using protocol knowledge from community analysis of the Katasymbol app. It parses Labelife AML labels into one-bit images, compresses print buffers with LZMA and sends data frames through a BLE transport from a macOS app or CLI.
- [synaptics-009b-fprintd: reconstructing Linux support for Synaptics 06cb:009b](https://awesomerea.org/resources/synaptics-009b-fprintd-case/index.md): Case study · synaptics-009b-fprintd reconstructs Linux support for the Synaptics Prometheus 06cb:009b fingerprint sensor. Its Rust modules handle USB transport, encrypted frame capture and host-side matching, while a D-Bus service presents the device through fprintd interfaces.
- [STRIDE: a replacement NordicTrack console using the FitPro protocol](https://awesomerea.org/resources/stride-fitpro-treadmill-case/index.md): Case study · STRIDE reconstructs the FitPro motor-board interface for a replacement Android console app on a NordicTrack treadmill. Its protocol notes document the USB HID transport, message frames and commands derived from traffic analysis and software examination. The app communicates with the board over USB and can publish treadmill telemetry through MQTT.
- [TonePush: reconstructing Line 6 HX editing over USB](https://awesomerea.org/resources/tonepush-case/index.md): Case study · TonePush reconstructs the Line 6 HX USB editor protocol in reusable Rust crates, a CLI and a desktop editor. Captures from HX Edit and an HX Stomp informed packet framing, preset documents, backups, settings and impulse-response transfers. The same interface also supports StompStation PRO through its separately documented device protocol.
- [ESP32Drop: rebuilding AirDrop and AWDL on ESP32-S3](https://awesomerea.org/resources/esp32drop-case/index.md): Case study · ESP32Drop reimplements Apple Wireless Direct Link and AirDrop on an ESP32-S3 from observed traffic. Its Arduino library and example sketches receive files from, or send a file to, nearby Macs and iPhones over a direct wireless link. The implementation includes AWDL framing and AirDrop transfer components with host tests based partly on captured traffic.
- [Valeton GP-50 Editor: live preset editing over reconstructed SysEx](https://awesomerea.org/resources/valeton-gp50-editor-case/index.md): Case study · Valeton GP-50 Editor controls GP-50 and GP-5 guitar pedals through a reconstructed MIDI SysEx protocol. Its browser interface uses WebMIDI to inspect and edit presets, reorder blocks, rename slots and convert GP-5 and GP-50 .prst files. The repository also includes protocol tooling and findings about the vendor's NAM-to-SnapTone conversion path.
- [r8link: reconstructing Uniden R8w Bluetooth telemetry](https://awesomerea.org/resources/r8link-uniden-r8w-case/index.md): Case study · r8link reconstructs the Uniden R8w radar detector's Bluetooth LE data exchange as a Python client and protocol reference. The author used JADX on the R/Tach Android app and captured live traffic, then implemented parsing for alerts, frequency, signal strength, direction, device telemetry, and stored camera points.
- [esphome-panasonic-erv: local control through a reconstructed CN12 protocol](https://awesomerea.org/resources/esphome-panasonic-erv-case/index.md): Case study · esphome-panasonic-erv replaces a Panasonic ERV's optional module with an ESP32-S3 that speaks the reconstructed CN12 serial protocol. Logic-analyzer captures underpin its frame decoder, command builder and ESPHome component for power, mode and fan control. It exposes state to Home Assistant, which can make the controls available through its HomeKit Bridge. The author reports physical testing on FY-25ZDP1C.
- [EdgeLine: investigating Corsair Xeneon Edge control and touch interfaces](https://awesomerea.org/resources/edgeline-xeneon-edge-case/index.md): Case study · EdgeLine investigates the Corsair Xeneon Edge display's Linux control interfaces and provides a panel control app. Its notes record the vendor HID report layout and separate touch-controller descriptors, while the app uses HID for brightness, ddcutil for picture settings and xinput for touch modes. The HID command table distinguishes observed behavior from candidate commands.
- [FreeMicro: decoding Codex Micro's USB and Bluetooth control protocol](https://awesomerea.org/resources/freemicro-codex-micro-case/index.md): Case study · FreeMicro implements Codex Micro key input and LED output through the device's vendor HID protocol, linking six keys to Claude Code project states. Its protocol notes describe different USB and Bluetooth LE report framing, device commands, and observed input events, with Python code for device control.
- [Mittzon Standing Desk: decoding the LIN bus for Home Assistant control](https://awesomerea.org/resources/mittzon-homeassistant-case/index.md): Case study · The Mittzon Standing Desk project investigates the LIN bus between an IKEA Mittzon desk controller and its handset. Its ESPHome configuration reads position frames through an ESP32 and controls the desk by electrically emulating panel buttons, exposing height and movement controls to Home Assistant.
- [zenvision-linux: reconstructing ASUS ZenVision OLED control over USB](https://awesomerea.org/resources/zenvision-linux-case/index.md): Case study · zenvision-linux reconstructs USB control of the ASUS ZenVision lid OLED on the Zenbook 14X OLED Space Edition. Its Python driver sends 256×64 grayscale frames through a documented command handshake and bulk endpoint, supporting images and animations on Linux.
- [orba-protocol: reconstructing Artiphon Orba 2 control messages](https://awesomerea.org/resources/orba-protocol-artiphon-orba-2-case/index.md): Case study · orba-protocol reconstructs the Artiphon Orba 2 control protocol across USB-MIDI and BLE-MIDI. Its specification maps SysEx framing, codec, CRC and device registers, while Python and JavaScript libraries decode messages and build commands for device settings. The author reports comparing the implementation with captured traffic and live responses.
- [TrikiEmu: reconstructing the Żabka Triki BLE controller](https://awesomerea.org/resources/trikiemu-zabka-triki-case/index.md): Case study · TrikiEmu recreates the Żabka Triki motion controller's BLE behavior on ESP32 firmware. It reproduces advertising identity, a Nordic UART Service profile and 14-byte IMU frames using findings from TrikiScope and Android HCI captures; PC tools feed keyboard, CSV or recorded motion to the emulator. The author reports that Żappka connects and reacts to movement on M5StickC Plus2.
- [TrikiScope: decoding the Żabka Triki BLE motion stream](https://awesomerea.org/resources/trikiscope-zabka-triki-case/index.md): Case study · TrikiScope investigates the Żabka Triki controller with a Python BLE terminal inspector. It inventories GATT services, decodes 14-byte gyroscope and accelerometer frames, identifies a button flag and LED control bit, and provides diagnostic probes and CSV recording.
- [G2CC: a replacement Even G2 client built from Bluetooth traffic analysis](https://awesomerea.org/resources/g2cc-even-g2-client-case/index.md): Case study · G2CC reconstructs communication with Even Realities G2 smart glasses through a replacement Android BLE client and a PC-side display compositor. Its protocol documentation describes captured Bluetooth frames and the display, input and battery exchanges used by the client.
- [Melitta Barista & Nivona: reconstructing coffee-machine BLE control](https://awesomerea.org/resources/melitta-barista-nivona-ha-case/index.md): Case study · Melitta Barista & Nivona for Home Assistant implements Bluetooth LE control of supported coffee machines through their shared Eugster/Frismag protocol. Its reference maps GATT characteristics, the HU handshake, encrypted frames, and status and brew commands. The integration exposes machine state and settings; Melitta models also have recipe and maintenance controls. Nivona support is in alpha.
- [OpenHX: rebuilding Line 6 HX preset control over USB](https://awesomerea.org/resources/openhx-case/index.md): Case study · OpenHX implements selected Line 6 HX and Helix preset controls in a Rust CLI and includes an early GUI. USB captures between HX Edit and an HX Stomp XL informed its bulk-transfer transport, session handshake and preset operations. The published protocol notes cover packet sequences, MessagePack preset data and device quirks.
- [BunATV: reconstructing Apple TV control protocols in TypeScript](https://awesomerea.org/resources/bunatv-apple-tv-protocol-case/index.md): Case study · BunATV reconstructs Apple TV control protocols as a Bun and TypeScript library with a companion CLI. It implements Companion pairing and remote input, MRP playback and state messages, and AirPlay transport layers, exposing messages close to their wire format. The author credits PyATV research and reports finding additional MRP messages through Ghidra analysis of Apple frameworks.
- [Ember Mug: decoding the on-device drink-log stream](https://awesomerea.org/resources/ember-mug-drink-log-case/index.md): Case study · The Ember Mug app decodes the undocumented fc540013 Bluetooth LE statistics stream from an Ember Mug 2 into a drink log. Its format notes describe notification fragments, record fields, timestamps, and the device's backlog behavior; the macOS menu-bar app combines decoded records with its own live readings.
- [PreSonus Quantum Linux: investigating Quantum 2626 control for Linux audio](https://awesomerea.org/resources/presonus-quantum-linux-case/index.md): Case study · PreSonus Quantum Linux documents control and audio behavior of the Quantum 2626 Thunderbolt interface while developing Linux support. Its research records channel routing and the recovered TCI protocol, with an in-house driver retained as a fallback beside builds of a separately authored upstream RFC driver. The author reports bounded playback and capture tests and unresolved stability issues.
- [Berbel Remote Emulator: reconstructing kitchen-hood BLE controls](https://awesomerea.org/resources/berbel-remote-emulator-case/index.md): Case study · Berbel Remote Emulator recreates BFB 6bT, 8bT and 7bT remote commands on ESP32 firmware for Berbel kitchen hoods. It decodes hood status frames and exposes controls through MQTT and Home Assistant. The protocol research uses BLE captures and a Linux fake hood that pairs with real remotes to record button notifications and test status frames.
- [KuKirin G4: decoding BLE ride-mode notifications](https://awesomerea.org/resources/kukirin-g4-ble-mode-case/index.md): Case study · The KuKirin G4 BLE Mode Monitor parses observed FFF2 notifications from a scooter and prints changes between ECO, SPORT, and RACE modes. Its Python client validates frame length and a gate byte before decoding the mode field; the documented mapping comes from one scooter and firmware combination.
- [Mutant Brain: mapping its SysEx configuration format](https://awesomerea.org/resources/reveng-mutantbrain-case/index.md): Case study · Mutant Brain's SysEx configuration format is mapped through comparisons of generated presets. The repository records message boundaries, four-byte configuration chunks, object IDs for inputs and CV or gate outputs, and parameter IDs for settings such as channel, pitch bend and trigger mode. Sample .syx mappings accompany the findings.
- [TBBT A9 mini camera: reconstructing PPPP video login](https://awesomerea.org/resources/tbbt-a9-pppp-ha-case/index.md): Case study · The TBBT A9 mini camera investigation reconstructs the camera's PPPP login and video-start exchanges over UDP/32108. It documents command framing, plain-text login and the raw session ticket, then patches aiopppp; the author reports MJPEG streaming through Home Assistant.
- [loxone-link-dotnet: implementing Loxone Link NAT-over-CAN devices](https://awesomerea.org/resources/loxone-link-dotnet-case/index.md): Case study · loxone-link-dotnet implements the Loxone Link NAT protocol over CAN in a .NET 8 library. It models extensions and Tree devices, handles framed messages and challenge flows, and includes device simulators plus a CAN capture harness informed by prior Loxone research.
- [Polycab PSIS-3K-SM1: recovering Bluetooth telemetry for MQTT](https://awesomerea.org/resources/polycab-solar-inverter-to-mqtt-case/index.md): Case study · Polycab Solar Inverter to MQTT reads Bluetooth telemetry from a PSIS-3K-SM1 inverter using values the author says were recovered from its Android monitoring app. A Python service publishes solar power, voltage, current, temperature and energy readings to a Mosquitto MQTT broker.
- [aquacomputer-quadro-control: reconstructing Quadro USB configuration](https://awesomerea.org/resources/aquacomputer-quadro-control-case/index.md): Case study · aquacomputer-quadro-control reconstructs USB configuration access for the Aquacomputer Quadro fan controller. Its Linux client reads saved settings and changes fan, sensor and RGB values; accompanying captures document packet offsets, checksum placement and a usbmon capture workflow.
- [HT2000Lib: reconstructing an HT2000 logger's USB HID interface](https://awesomerea.org/resources/ht2000lib-case/index.md): Case study · HT2000Lib implements a C# client for the HT2000 CO2 logger using a USB HID interface recovered by monitoring the manufacturer's Windows application at runtime. It documents status and historical log reports; the author reports that its native Windows backend reads current sensor state and dumps stored measurements.
- [ASUS XG34WCDG: mapping DDC/CI monitor controls](https://awesomerea.org/resources/asus-xg34wcdg-protocol-case/index.md): Case study · The ASUS XG34WCDG reference maps DDC/CI controls for display modes, colour, HDR, OLED care, proximity sensing and Aura effects. It correlates VCP values with on-screen changes and reports observed write and readback behavior on one unit, while separately describing the USB Aura interface from host records and published sources.
- [MSI Optix G27C2: mapping its DDC/CI monitor controls](https://awesomerea.org/resources/msi-optix-g27c2-protocol-case/index.md): Case study · The MSI Optix G27C2 reference maps the monitor's DDC/CI controls from Windows API reads and writes on one unit. It records VCP codes for brightness, contrast, colour presets and input selection, along with I2C pacing, ignored writes and EDID data.
- [QCYbutMOD: a QCY earbuds client built from reconstructed BLE commands](https://awesomerea.org/resources/qcybutmod-case/index.md): Case study · QCYbutMOD is an Android client built from reverse engineering of the BLE GATT commands used by QCY earbuds with Wuqi WQ7033 and WQ7034 chips. It reads separate earbud and case battery values from characteristic 0008, sends a command to mute firmware voice prompts, and reads back gesture mappings. Device test notes record command acknowledgments and unanswered multipoint queries.
- [Lian Li UNI HUB SL V2: mapping fan and lighting USB commands](https://awesomerea.org/resources/lian-li-uni-hub-sl-v2-protocol-case/index.md): Case study · The Lian Li UNI HUB SL V2 reference reconstructs the controller's USB HID commands for fan duty, RPM reporting, LED effects and motherboard passthrough. It compares an L-Connect 3 USB capture with independent tests on one hub and records report layouts, command sequences and timing.
- [SAC9010QC/SAC12010QC: reconstructing an air-conditioner IR protocol](https://awesomerea.org/resources/sac9010qc-sac12010qc-ir-case/index.md): Case study · SAC9010QC/SAC12010QC reconstructs the IR control format of a HomeFit Living or Alaska air-conditioner remote from captured signals. A protocol reference maps its 36-bit command fields, while an ESP8266 or ESP32 web server sends AC settings through a REST endpoint.
- [hydrao-dump: decoding Hydrao shower-head Bluetooth data](https://awesomerea.org/resources/hydrao-dump-case/index.md): Case study · hydrao-dump investigates the Bluetooth exchanges between Hydrao shower heads and their phone app, with packet captures, a Wireshark dissector and an MQTT receiver for Home Assistant. The author identifies shower volume, color thresholds, firmware and hardware versions, and device IDs while leaving temperature and flow fields unresolved.
- [LibreConga: investigating the Conga 5490 communication protocol](https://awesomerea.org/resources/libreconga-5490-case/index.md): Case study · LibreConga investigates the Cecotec Conga 5490 robot vacuum's communication protocol through captured app traffic. Its notes describe frame lengths, identifiers and sequence fields for ping and login exchanges, with a separate table of observed command opcodes.
- [FT017TH: decoding wireless thermometer and hygrometer transmissions](https://awesomerea.org/resources/ft017th-signal-case/index.md): Case study · The FT017TH study decodes transmissions from a wireless thermometer and hygrometer. It documents Manchester encoding, repeated messages, field positions and formulas for estimating temperature and humidity from captured data and displayed readings.
- [mg6250_mqtt: decoding Paradox MG6250 serial events](https://awesomerea.org/resources/mg6250-mqtt-protocol-case/index.md): Case study · mg6250_mqtt reconstructs part of the Paradox MG6250 alarm console's serial event protocol. It documents frame lengths, event fields and CRC-16/MODBUS checksums, and provides a Python test client plus an ESP8266 sketch that forwards decoded events to MQTT.
- [Tanzmaus Sysex Parser: decoding MFB Tanzmaus bank dumps](https://awesomerea.org/resources/tanzmaus-sysex-parser-case/index.md): Case study · Tanzmaus Sysex Parser investigates MFB Tanzmaus MIDI SysEx bank dumps. It decodes the 7-bit transport encoding into pattern payloads, maps step, mute, flam, knob and LFO fields, and supplies scripts for extracting and comparing individual patterns.
- [avea: controlling the Elgato Avea bulb through its BLE protocol](https://awesomerea.org/resources/avea-bulb-protocol-case/index.md): Case study · avea implements Python control of the Elgato Avea bulb using a BLE protocol investigated through an Android btsnoop log and Wireshark. Its documentation maps the control characteristic and color, brightness and name commands; the library discovers bulbs and reads or sets their state through Bleak.
- [Cetus3D: reconstructing printer status messages](https://awesomerea.org/resources/cetus3d-status-case/index.md): Case study · Cetus3D reconstructs status communication between UP Studio and a Cetus3D printer using Wireshark captures and experiments. Python and Arduino implementations discover the printer and query print progress, layer, remaining time and temperature; the capture notes describe network message exchanges.
- [LILO: reconstructing BLE control for the Prêt à Pousser LILO](https://awesomerea.org/resources/lilo-case/index.md): Case study · LILO reconstructs Bluetooth Low Energy control of the Prêt à Pousser LILO device in JavaScript. It identifies a service and separate characteristics for lighting and time, with methods to read and write those settings and a map of lighting modes.
- [helix: investigating DNA 75 USB HID control](https://awesomerea.org/resources/helix-dna75-case/index.md): Case study · helix investigates USB HID communication with the DNA 75 vaporizer controller while prototyping configuration from Linux. It records the device's USB descriptors and describes capturing transfers through usbmon and Wireshark after triggering actions in a Windows virtual machine.
- [Ha-Kake: decoding Nissan Leaf CAN signals for a telemetry dashboard](https://awesomerea.org/resources/ha-kake-leaf-can-case/index.md): Case study · Ha-Kake documents how Nissan Leaf CAN and OBD-II signals were identified and decoded for a local vehicle dashboard. The repository pairs signal byte tables and an eight-chapter investigation guide with a Python reader, vehicle profiles, replay tools and a simulator.
- [Ökoboiler: decoding the water heater's internal UART bus](https://awesomerea.org/resources/oekoboiler-uart-case/index.md): Case study · The Ökoboiler study reconstructs the single-wire UART exchange between a heat-pump water heater's display and control boards. It documents 32-byte frames, XOR masking, CRC-16/Modbus and fields for tank temperature, operating mode and PV state, with a Python decoder and an ESPHome sensor configuration.
- [Ritto 7630: reconstructing intercom bell and door signals](https://awesomerea.org/resources/ritto-esp-case/index.md): Case study · ritto-esp investigates the Ritto 7630 TwinBus intercom's board signals with oscilloscope captures, distinguishing apartment and street bell events by their chime and apartment-line behavior. An ESP32-C6 running ESPHome exposes separate bell sensors and a door-open command to Home Assistant through optocoupled inputs and output.
- [ha-c14: reconstructing the C14 ventilator bus protocol](https://awesomerea.org/resources/ha-c14-case/index.md): Case study · ha-c14 documents the C14 RS-485 bus between a COMPIT AERO 3B ventilator and Nano Color CTP room panel and implements an ESPHome bridge for ESP32. Its protocol notes describe 30-byte frames, master cycles and device roles; the YAML package parses frames and exposes controls and sensors to Home Assistant.
- [Homiq Rescue: reconstructing the Homiq control protocol](https://awesomerea.org/resources/homiq-rescue-case/index.md): Case study · Homiq Rescue documents the ASCII frame protocol used by older Homiq home-automation systems through a Moxa NE-4110S serial-to-TCP bridge. Its toolbox sniffs and sends frames, extracts backup data to JSON, and supplies Node-RED flows and a TCP emulator for integration work.