# Curated reverse engineering resources · Page 49

> Page 49 of 52, entries 4,801–4,900. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/49/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/49/index.md>

## Protocols (100)

- [PreSonus StudioLive 16.0.2 USB: documenting mixer control messages](https://awesomerea.org/resources/presonus-studiolive-16-0-2-usb-case/index.md): Case study · PreSonus StudioLive 16.0.2 USB documents control messages exchanged between the digital mixer and Universal Control software. Based on Wireshark captures, the notes describe vendor USB requests, response chunking, split-nibble values and commands for status, MIDI settings, channels and system controls.
- [DJI Mic Mini Monitor: decoding the receiver's USB status stream](https://awesomerea.org/resources/dji-mic-mini-monitor-case/index.md): Case study · DJI Mic Mini Monitor reads transmitter battery and charging state from the receiver's USB status stream on Windows. Its Python reader uses WinUSB, while protocol notes describe MI_06 bulk endpoints, frame boundaries, CRC checks and status offsets; the author reports checking those details against a local receiver.
- [baseus-cli: reconstructing Baseus Bass BS1 NC control](https://awesomerea.org/resources/baseus-cli-case/index.md): Case study · baseus-cli controls Baseus Bass BS1 NC earbuds on Windows through a reconstructed Classic Bluetooth RFCOMM protocol. Its Python client reads and changes ANC, spatial audio, EQ, bass boost and other settings; a protocol map and research scripts document frame opcodes and state-difference experiments.
- [hxoctkl: reconstructing HyperX Alloy Origins Core profile writes](https://awesomerea.org/resources/hyperx-origins-core-tkl-rgb-case/index.md): Case study · hxoctkl reconstructs USB HID profile control for the HyperX Alloy Origins Core tenkeyless keyboard and writes persistent per-key RGB animations from Linux. Its protocol notes specify 64-byte reports, command opcodes, colour-buffer packing and the upload and commit sequence. The research used device queries and one NGENUITY USB capture, and builds on OpenRGB's earlier findings about colour-buffer packing.
- [Wireless Doorbell Clone: reconstructing a Grundig QH-831A remote frame](https://awesomerea.org/resources/wireless-doorbell-clone-case/index.md): Case study · Wireless Doorbell Clone reconstructs the Grundig QH-831A doorbell remote's transmitted data frame and implements transmitters in Arduino and MicroPython. The notes give the bit sequence and 475 µs and 1435 µs pulse lengths, while the repository includes captured radio data.
- [Lucci Air Homey App: reconstructing two fan handset RF protocols](https://awesomerea.org/resources/lucci-air-homey-app-case/index.md): Case study · Lucci Air Homey App reconstructs the 433 MHz control protocols of USB-C and CR2032 Lucci Air fan handsets from recorded transmissions. Its Homey drivers learn a handset address and send fan and light commands; separate protocol documents describe frame layouts, command codes and observed hardware behavior.
- [Taktil: reconstructing AULA F99 HID control](https://awesomerea.org/resources/taktil-case/index.md): Case study · Taktil implements wired AULA F99 control through a Rust HID adapter and a Tauri desktop interface. Its protocol study uses static analysis of the vendor driver and KB.ini to document report layouts, keymaps, macros and per-key RGB commands, marking observed and inferred behavior separately.
- [MG330 Studio: reconstructing SPCP6651B mouse configuration](https://awesomerea.org/resources/mg330-studio-case/index.md): Case study · MG330 Studio recreates configuration control for the 2E Gaming MG330 RGB mouse on macOS using the SPCP6651B HID feature-report protocol recovered from its Windows driver. It reads and writes the device's 2 KB configuration, covering RGB zones, DPI, polling rate and effect slots; protocol notes map report IDs, offsets and checksums.
- [qutie: reconstructing PRT Qutie Bluetooth printing](https://awesomerea.org/resources/qutie-printer-case/index.md): Case study · qutie implements Linux printing for the PRT Qutie label printer using a recovered Bluetooth Classic RFCOMM protocol. Its notes document handshake, session XOR, status responses and LZO raster commands derived from printer observation and HerePrint app analysis; a Python library, CLI, CUPS components and Qt designer use the protocol.
- [Hush: reconstructing WH-1000XM6 headset control](https://awesomerea.org/resources/hush-wh1000xm6-case/index.md): Case study · Hush is a macOS menu-bar and command-line client for Sony WH-1000XM6 headphones using their MDR protocol over Bluetooth RFCOMM. It documents frame escaping and request sequencing, and implements noise control, equalizer settings, battery reporting and DSEE; WH-1000XM6-specific ambient and equalizer behavior is described.
- [Aromatic BLE bridge: reconstructing AF300 Smart diffuser control](https://awesomerea.org/resources/aromatic-ble-esphome-case/index.md): Case study · The Aromatic BLE bridge connects an AF300 Smart scent diffuser to Home Assistant through an ESP32 running ESPHome. Its BLE protocol was derived from Android-app analysis and device probes; the bridge reads and writes power, fan and schedule settings, while protocol notes document GATT characteristics, login frames and commands.
- [Teclado RGB via USB HID: reconstructing Redragon K552-M lighting commands](https://awesomerea.org/resources/teclado-rgb-usb-hid-case/index.md): Case study · Teclado RGB via USB HID reconstructs the Redragon K552-M keyboard's lighting commands from captures of its official software. The author identifies a vendor-specific HID interface, 64-byte reports, color frames and a heartbeat; PowerShell tools send captured frames and adjust lighting effects.
- [wibox-daemon: reconstructing Fermax Wi-Box control and media transport](https://awesomerea.org/resources/wibox-daemon-case/index.md): Case study · wibox-daemon reconstructs Fermax Wi-Box IDS7938 communication in a Go service for door control and media access. Its protocol reference describes cloud userauth XML, UST MQTT discovery, an RB-UDP tunnel and local QUII. The daemon exposes HTTP controls and outputs H.264 video with optional G.711A audio.
- [MousePods: reconstructing AirPods 3 RemoteHID motion access](https://awesomerea.org/resources/mousepods-airpods-remotehid-case/index.md): Case study · MousePods reconstructs AirPods 3 RemoteHID motion access and uses it for Linux cursor control. Its protocol reference specifies AACP transport, RTBuddy framing, device announcements and reports; capture files document the receive-MTU difference that exposes motion sensors. The project also describes a SensorDataWX path for AirPods Pro 2.
- [FitFace Studio: reconstructing Galaxy Fit3 watch-face editing and delivery](https://awesomerea.org/resources/fitface-studio-case/index.md): Case study · FitFace Studio reconstructs Galaxy Fit3 watch-face editing and Bluetooth delivery in an Android app. It parses and rewrites the face's binary container, validates its size and content, and documents the RFCOMM transfer sequence used to send it to an SM-R390 watch. The editor supports backgrounds, widgets and styles while retaining projects on the phone.
- [fretwire: reconstructing Line 6 HX USB control](https://awesomerea.org/resources/fretwire-case/index.md): Case study · fretwire reconstructs the Line 6 HX family’s USB control protocol for an independent Linux editor. Its Rust code covers device sessions, message encoding, preset parsing, and a graphical editor; protocol notes describe captured MI_00 frames and request-response behavior. Model and control data are imported from the user’s HX Edit or POD Go Edit installation.
- [Kreo Hive 65: reconstructing USB HID RGB control](https://awesomerea.org/resources/kreo-hive65-rgb-case/index.md): Case study · Kreo Hive 65 RGB Control reconstructs the keyboard's USB HID lighting exchange and implements Linux command-line, desktop and WebSocket controls. Its protocol document specifies the vendor interface, feature report 6 and a 520-byte per-LED RGB frame derived from descriptor analysis, usbmon capture and live probing.
- [Cavium SNIC10E: reconstructing a PCIe shared-memory NIC datapath](https://awesomerea.org/resources/cavium-snic10e-datapath-case/index.md): Case study · The Cavium SNIC10E project reconstructs a PCIe BAR2 shared-memory datapath for the CN6640-SNIC10E card. Host and card drivers exchange packets through per-port rings, with PIO transmit and DPI DMA receive, while boot tooling loads OpenWrt into card RAM. The author reports bidirectional traffic on two 10 GbE ports and documents unstable simultaneous load.
- [Deadband: reconstructing GameSir and Logitech device configuration](https://awesomerea.org/resources/deadband-case/index.md): Case study · Deadband reconstructs configuration exchanges for GameSir controllers and the Logitech G502 X LIGHTSPEED mouse in a Linux GUI. Its research notes connect USB identities, hidraw and evdev probing, USB captures and device registers to controls for lighting, profiles, remapping, curves and macros.
- [Pocket Libre: reconstructing Pocket recorder transfer over BLE](https://awesomerea.org/resources/pocket-libre-case/index.md): Case study · Pocket Libre reconstructs the Pocket AI recorder's BLE command and audio-transfer behavior in a Python client. Its protocol notes map APP commands, MCU responses, GATT characteristics and MP3 streaming from HCI captures; the client downloads recordings and offers local transcription and speaker identification.
- [Open Apollo: reconstructing Linux support for Apollo audio interfaces](https://awesomerea.org/resources/open-apollo-case/index.md): Case study · Open Apollo reconstructs Linux control of Universal Audio Apollo Thunderbolt and USB audio interfaces through hardware and driver analysis. It provides a Thunderbolt kernel driver, USB initialization stack, mixer daemon and native console, with device setup drawing needed files from the user's UAD installation.
- [attack-shark-x11-driver: a client for the Attack Shark X11 HID settings protocol](https://awesomerea.org/resources/attack-shark-x11-driver-case/index.md): Case study · attack-shark-x11-driver reconstructs Attack Shark X11 mouse configuration over USB HID as a TypeScript client. It provides DPI, profile, button, macro, lighting and polling-rate controls, plus device-state reads. Its protocol notes draw on USBPcap and Wireshark captures, HID feature reports, official software analysis and firmware investigation.
- [Hisense/Hitachi H-NET-Protocol: investigating heat-pump bus signaling](https://awesomerea.org/resources/hisense-h-net-protocol-case/index.md): Case study · Hisense/Hitachi H-NET-Protocol investigates the H-NET bus used by Hi-Therma and Air H₂O 400 heat pumps. Its documentation maps controller connections on an AHZ-080HCDS1 unit and describes the two-wire HBS signaling, frame fields and checksums.
- [YenKeyControl: decoding the Yenkee YKB3700 Rogue keyboard protocol](https://awesomerea.org/resources/yenkeycontrol-case/index.md): Case study · YenKeyControl reconstructs the Yenkee YKB3700 Rogue keyboard's USB HID configuration protocol and implements Python commands for RGB effects, per-key colors and key remapping. Its protocol notes specify packet layouts, command values, checksums and sequencing derived from captured USB traffic and parameter tests.
- [Deye Battery Serial Bus: decoding battery CAN frames](https://awesomerea.org/resources/deye-battery-serial-bus-case/index.md): Case study · Deye Battery Serial Bus maps CAN frames from a Deye battery system and reads RS485 cell-voltage data. Its frame reference associates identifiers with inverter, battery and BMS fields; a .NET service exposes readings through API endpoints and includes Grafana dashboard definitions.
- [Bonaparte: reconstructing the Napoleon eFIRE Bluetooth control protocol](https://awesomerea.org/resources/bonaparte-efire-case/index.md): Case study · Bonaparte implements a Python client for Napoleon eFIRE fireplace controllers and documents their Bluetooth LE control protocol. Its reference specifies GATT characteristics, request and response packet fields, XOR checksums, and commands for settings such as power, thermostat, and night-light level.
- [skyrcUSB: reading skyRC chargers through a reconstructed protocol](https://awesomerea.org/resources/skyrcusb-case/index.md): Case study · skyrcUSB implements a Python client for a reverse-engineered skyRC charger protocol. Its Charger API reads cell voltages, charger settings and live charge data; the author reports testing it with a D100V2 and limits the library to read operations.
- [mqtt-energi: reconstructing myenergi device traffic](https://awesomerea.org/resources/mqtt-energi-case/index.md): Case study · mqtt-energi investigates myenergi device-to-device Ethernet traffic and bridges decoded readings to MQTT. Its documentation records multicast frames with ethertype 0x88b5 and packet layouts, while a Python decoder extracts voltage, power, energy and heater state from Eddi V2.1 messages.
- [RedFIS: reconstructing the Audi A3 8P display protocol](https://awesomerea.org/resources/a3-8p-redfis-case/index.md): Case study · RedFIS investigates the Audi A3 8P dashboard Driver Information System protocol and implements an alternative display controller on ESP32. Its source covers CAN communication, VWTP handling, display decoding and wiring for supported instrument clusters.
- [GalaxyBuds-rs: implementing the Galaxy Buds Bluetooth protocol](https://awesomerea.org/resources/galaxybuds-rs-case/index.md): Case study · GalaxyBuds-rs implements Galaxy Buds Bluetooth messages as a Rust library. It receives status, touch, voice-wakeup and debug updates and sends controls for noise reduction, equalizer, touchpad settings, muting and finding earbuds, with examples that connect using a device address.
- [ETEKCITY Smart Nutrition Scale: mapping the ESN00 BLE packets](https://awesomerea.org/resources/metekcity-case/index.md): Case study · ETEKCITY Smart Nutrition Scale research maps the ESN00 scale’s Bluetooth Low Energy characteristics and packet payloads. A TypeScript package parses and serializes identified commands and measurements for units, tare, automatic shutoff and scale state; the documentation lists packet types still under investigation.
- [mi-scale-2: decoding Mi Smart Scale 2 weight messages](https://awesomerea.org/resources/mi-scale-2-case/index.md): Case study · mi-scale-2 decodes Xiaomi Mi Smart Scale 2 BLE weight data and publishes the readings to MQTT. Its format notes identify unit, stabilized, and weight-removed bits in the first byte and a little-endian weight value in the next two bytes.
- [PSA VAN Bus: documenting Peugeot and Citroën packet formats](https://awesomerea.org/resources/psa-van-bus-packets-case/index.md): Case study · PSA VAN Bus documents vehicle bus packets researched chiefly on a Peugeot 307 and described as applicable to listed Peugeot and Citroën models. The repository stores packet descriptions in JSON files and displays them through an HTML page; it reviews earlier VAN findings and adds observations.
- [Apple Wi-Fi Password Sharing: reconstructing the sharing protocol](https://awesomerea.org/resources/apple-wifi-password-sharing-case/index.md): Case study · Apple Wi-Fi Password Sharing reconstructs grantor and requestor behavior for Apple's Wi-Fi password-sharing protocol on macOS. Its Swift code handles BLE discovery and pairing, while a Python GATT relay on Linux supports the requestor role.
- [Schellenberg 21009: investigating a USB smart-home protocol](https://awesomerea.org/resources/schellenberg-qivicon-usb-case/index.md): Case study · Schellenberg USB protocol research documents communication with the 21009 Magenta SmartHome dongle through its USB serial interface. The reference lists operating modes, command responses, message fields, device identifiers and commands for paired Schellenberg devices, with receive and send examples.
- [433home: reconstructing REV power-switch radio commands](https://awesomerea.org/resources/433home-case/index.md): Case study · 433home reconstructs the 433 MHz control signals of REV wireless power sockets. The author measured remote-control output with a receiver and logic analyzer, documented pulse timings and 25-bit on/off commands for three sockets, and implemented an ESP8266 web frontend that transmits those sequences.
- [fcp-stuff: mapping the FirstClass TCP protocol](https://awesomerea.org/resources/fcp-stuff-case/index.md): Case study · fcp-stuff documents the FirstClass client-server protocol over TCP. Its notes cover command constants, packet structures, login, encryption, and the Docedit document format; the repository also contains JavaScript proxy code.
- [Orthoplay: reconstructing OD-11 speaker WebSocket commands](https://awesomerea.org/resources/orthoplay-re-case/index.md): Case study · Orthoplay records a reconstructed WebSocket exchange for the OD-11 speaker. It identifies development and production endpoints and supplies JSON messages for session join, remote registration, periodic ping, and group volume changes.
- [Chsmartbulb: reconstructing Bluetooth bulb controls](https://awesomerea.org/resources/chsmartbulb-led-bulb-speaker-case/index.md): Case study · Chsmartbulb documents Bluetooth control of a combined RGB bulb and speaker sold as BL08A. The author captured traffic from an Android phone and provides a script that replays color-control sequences; the findings identify SPP over Bluetooth EDR as the app's color-control channel.
- [mf4700-print-scan: reconstructing Canon MF4700 print and scan protocols](https://awesomerea.org/resources/mf4700-print-scan-case/index.md): Case study · mf4700-print-scan reconstructs printing and scanning for Canon MF4700-series devices in a macOS app. Its C encoder emits UFR II LT jobs based on differences observed in Canon driver output, while an MFNP client registers the Mac and retrieves scanned pages. A format reference records CPCA packets, job structure and print-data encoding.
- [Kenwood KNS: documenting ARCP-590G radio communication](https://awesomerea.org/resources/arcp-590g-kns-case/index.md): Case study · Kenwood KNS documents the ARCP-590G client's communication with a TS-590SG radio over serial and KNS TCP connections. The investigation compares Wireshark captures with CAT commands and records UTF-16LE encoding, connection sequences, cleartext authentication, and keepalive traffic.
- [truemove3-re: mapping a gaming mouse sensor's SPI interface](https://awesomerea.org/resources/truemove3-re-case/index.md): Case study · truemove3-re records an investigation of the TrueMove3 gaming mouse sensor's SPI interface. It lists the pinout, bus settings, register addresses, and a startup exchange observed from a Rival-310, while leaving differences from the PMW3360 unresolved.
- [Aqara G410: reconstructing doorbell cloud and P2P access](https://awesomerea.org/resources/aqara-g410-protocol-case/index.md): Case study · Implements access to the Aqara G410 doorbell through cloud calls and a P2P connection reconstructed from the Aqara Home app. The macOS client provides live view, talkback and event history, while a notifier sends motion media to Matrix. Protocol notes record request signing, login, event queries, media decryption and the P2P handshake.
- [crowdstrike-cloudproto: reconstructed Falcon Sensor cloud protocol](https://awesomerea.org/resources/crowdstrike-cloudproto-case/index.md): Case study · crowdstrike-cloudproto reconstructs the cloud protocol used between Falcon Sensor and its TS event and LFO file services as an asynchronous Rust crate. It implements common packet framing, TS event exchange, and LFO file downloads; the protocol notes describe Protobuf event payloads, acknowledgments, and LFO request and response packets.
- [BA-KEY Menu: reconstructing Basike keyboard HID control](https://awesomerea.org/resources/ba-key-menu-protocol-case/index.md): Case study · Reconstructs the Basike BA-KEY308 keyboard's HID configuration protocol from the vendor's Windows app and implements it in a macOS menu-bar app and CLI. The protocol notes cover Feature reports, command classes and Bluetooth, USB and 2.4 GHz receiver transport. The app controls lighting, per-key colors and profiles.
- [KC Control: Keychron M6 profile switching over a recovered HID protocol](https://awesomerea.org/resources/kc-control-case/index.md): Case study · KC Control implements Keychron M6 profile switching over a reconstructed HID command exchange. A Windows tray app watches the foreground program and selects an onboard mouse profile; its protocol reference documents report IDs, framing and commands derived from the Launcher web bundle and a live device capture.
- [Xiaomi Whale Spout bidet: reconstructing its RF remote protocol](https://awesomerea.org/resources/whale-spout-bidet-protocol-case/index.md): Case study · Reconstructs the 433 MHz RF remote protocol of the non-Wi-Fi Xiaomi Whale Spout bidet seat and implements it in ESPHome on an ESP32 with a CC1101 radio. The project documents 2-FSK timing, 32-bit packets, settings fields and checksum behavior, then exposes control and remote-state monitoring through Home Assistant.
- [skypsu: reconstructing the STP2S3010E22 Modbus register map](https://awesomerea.org/resources/skypsu-case/index.md): Case study · skypsu reconstructs the Modbus RTU register map of the SKY TOPPOWER STP2S3010E22 laboratory power supply. It provides a Python driver, read-only register scanner, local web interface and live plot. The documented map covers output control, measurements, setpoints and status flags; the author reports checking it on two units.
- [Smart-AC-Modernizer: decoding Haier YRW02 infrared control](https://awesomerea.org/resources/smart-ac-modernizer-case/index.md): Case study · Smart-AC-Modernizer documents the Haier YRW02 air conditioner's infrared control format and implements an ESP32 bridge for it. The author identifies a 112-bit NEC-variant state packet, captures remote signals with a TSOP4838 receiver, and sends decoded commands through a transistor-driven IR LED.
- [pyidotmatrix: researching and implementing iDotMatrix BLE control](https://awesomerea.org/resources/pyidotmatrix-protocol-case/index.md): Case study · Implements the iDotMatrix BLE display protocol as a typed Python SDK while documenting findings from vendor APK analysis and hardware probes. Packet builders cover images, GIFs, text, effects and native display modes; a bundled CLI decodes Android btsnoop captures into annotated traffic. The project records feature status against a reference 32×32 panel.
- [Skannerz Commander: reconstructing the toy's trade protocol](https://awesomerea.org/resources/skannerz-commander-trade-protocol-case/index.md): Case study · Skannerz Commander trade research reconstructs the electronic toy's three-pin exchange protocol from a 200 kHz logic-analyzer capture and controlled hardware experiments. Its documentation covers clock phases, handshake, frames and monster payload fields; an Arduino slave emulator implements the exchange, which the author reports using in real trades.
- [AUKEY KM-G15 RGB Control: decoding keyboard USB HID commands](https://awesomerea.org/resources/aukey-km-g15-rgb-case/index.md): Case study · AUKEY KM-G15 RGB Control reconstructs the keyboard's USB HID lighting protocol and supplies a Go command-line client. Its protocol notes define 64-byte SET_REPORT packets, a checksum and START–command–END transactions; the client changes lighting modes, brightness, profiles and polling rate.
- [SonyBridge: reconstructing second-generation Sony headset control](https://awesomerea.org/resources/sonybridge-v2-headphones-case/index.md): Case study · SonyBridge extends a desktop Sony headset client to handle a second generation of its Bluetooth RFCOMM control protocol. It documents frame boundaries, service UUID families, the v2 initialization handshake, host acknowledgments, and commands for battery, equalizer, and DSEE data. The app offers controls on macOS, Windows, and Linux.
- [HP Laser 1008a: reconstructing SPL3 printing on macOS](https://awesomerea.org/resources/hp-laser-1008a-spl3-case/index.md): Case study · The HP Laser 1008a project reconstructs the SPL3/QPDL printing path for HP Laser 1003, 1006, and 1008 devices on Apple Silicon macOS. The author compares HP and SpliX streams, documents the page and band records, and patches a page-header size mismatch. A native CUPS filter and IOKit backend send the resulting output over USB.
- [BMW iDrive: interpreting F44 controller CAN messages](https://awesomerea.org/resources/bmw-idrive-can-case/index.md): Case study · BMW iDrive Controller CAN Bus Interpreter decodes controls from an F44 iDrive controller using an ESP32-C3 and TJA1441A/B CAN transceiver. It reports knob rotation, joystick directions, button and touch states, and brightness commands at 500 kbps. The README also records unresolved touchpad decoding and CAN wake-up behavior.
- [ESP32 Controller for Charlton & Jenrick Fireplace: reconstructing remote control](https://awesomerea.org/resources/esp32-fireplace-controller-case/index.md): Case study · ESP32 Controller for Charlton & Jenrick Fireplace recreates remote commands by transmitting captured RF payloads through a CC1101 module. Its firmware provides iRange 2-FSK and non-iRange ASK/OOK profiles, with controls exposed through a web interface, MQTT and Home Assistant.
- [GMK87 Configurator: reconstructing Zuoya keyboard USB HID control](https://awesomerea.org/resources/gmk87-configurator-case/index.md): Case study · GMK87 Configurator reconstructs the Zuoya GMK87 keyboard's USB HID control exchanges from captures of its official application. It documents 64-byte report framing and image-upload sequences, and provides desktop, CLI and Node.js controls for display images, RGB lighting and clock synchronization.
- [Ajazz AK820 Pro: reconstructing keyboard lighting control on Linux](https://awesomerea.org/resources/ajazz-keyboard-software-linux-case/index.md): Case study · Ajazz AK820 Pro Linux Software reconstructs lighting control for the Ajazz SONiX AK820 Pro keyboard from USB traffic captured with Wireshark and PCapUSB. It includes a PCAP packet parser and a Linux HID application; individual LED control, macros and LCD images remain planned.
- [OPUS-QUAD Pro DJ Link Reverse Engineer Packet Analysis: mapping device traffic](https://awesomerea.org/resources/opus-quad-pro-dj-link-analysis-case/index.md): Case study · OPUS-QUAD Pro DJ Link Reverse Engineer Packet Analysis documents how the Pioneer DJ OPUS-QUAD exchanges Pro DJ Link packets. It describes UDP announcements on port 50000, status traffic and metadata requests on port 50002, alongside a Node.js example that relays status packets to a WebSocket server.
- [MiraBox StreamDock: reconstructing USB device control](https://awesomerea.org/resources/mirabox-streamdock-node-case/index.md): Case study · MiraBox StreamDock reverse-engineer is a TypeScript demonstration of direct USB control derived from the device's packets. It reads firmware versions and key presses, controls screen state and brightness, and sends key and boot images through a replaceable USB backend.
- [SiriRemote-Linux: decoding Siri Remote Bluetooth input](https://awesomerea.org/resources/siriremote-linux-case/index.md): Case study · SiriRemote-Linux decodes Apple TV Siri Remote Bluetooth input for use on Linux. Its Python code connects to the remote and emits media, volume, and pointer controls, while the documentation maps GATT characteristics, battery notifications, button bits, and touch coordinates. Microphone data remains unexplored in the implementation.
- [ZydDash: decoding ePowerFun scooter telemetry for an ESP32 dashboard](https://awesomerea.org/resources/zyddash-case/index.md): Case study · ZydDash builds an ESP32 dashboard for an ePowerFun ePF-1 scooter from decoded Zydtech BLE telemetry. Its notes map Bluetooth characteristics, a 115200-baud display bus, MODBUS-like command frames and registers, while Python examples read and interpret scooter telemetry.
- [catlink-local: reconstructing CATLINK Open X local control](https://awesomerea.org/resources/catlink-local-case/index.md): Case study · catlink-local reconstructs the CATLINK Open X litter box's login and MQTT exchanges for local Home Assistant use. Python services answer its login request, decode heartbeats and visits, and bridge state to Mosquitto; protocol notes distinguish confirmed fields from hypotheses.
- [Aurora: reconstructing EvoFox Blaze mouse configuration](https://awesomerea.org/resources/aurora-evofox-blaze-case/index.md): Case study · Aurora reconstructs EvoFox Blaze mouse configuration through its Linux hidraw interface. A CLI and terminal UI read and change polling, DPI, lighting, button and profile settings, with writes checked against the device's returned state.
- [CR-BYOB: reconstructing the Creality Scan Bridge](https://awesomerea.org/resources/cr-byob-case/index.md): Case study · CR-BYOB reconstructs Creality Scan Bridge behavior in an Android app, letting Creality Scan discover a USB-connected scanner over a network. Its Java source handles scanner capture, bridge discovery and streams, with documentation for the communication paths and device compatibility.
- [HappyLighting-py: reconstructing LED-controller BLE communication](https://awesomerea.org/resources/happylighting-py-case/index.md): Case study · HappyLighting-py reconstructs BLE communication for HappyLighting-compatible LED controllers from analysis of the original APK. Its Python app changes color, mode and speed, enables the integrated microphone and drives color from screen input.
- [pd-usb: reconstructing Playdate USB commands](https://awesomerea.org/resources/pd-usb-case/index.md): Case study · pd-usb implements Playdate USB communication in a JavaScript WebSerial library using commands recovered through packet sniffing. It reads device status, controls and screen data, sends bitmaps, and exposes command and compiled-Lua payload operations.
- [GlanceClock: reconstructing its BLE command protocol](https://awesomerea.org/resources/glance-clock-ble-case/index.md): Case study · GlanceClock documents the wall clock's BLE command protocol for building a local bridge. The reference identifies its GATT service and characteristic, protobuf payloads, pairing flow and commands for notifications, scenes, settings and timers.
- [prolink-connect: implementing Pioneer PROLINK exchanges](https://awesomerea.org/resources/prolink-connect-case/index.md): Case study · prolink-connect implements Pioneer PROLINK network exchanges in TypeScript for DJ equipment. It discovers devices through UDP announcements, joins as a virtual CDJ, receives player status and queries track metadata from Rekordbox-formatted media or a Rekordbox link.
- [Open Remote Start: reconstructing the Fortin antenna data-link](https://awesomerea.org/resources/open-remote-start-case/index.md): Case study · Open Remote Start investigates the antenna data-link protocol of Fortin remote starters and alarm systems. Its Particle firmware implements an interface that can monitor the link and serve as a cellular or Wi-Fi remote, with an EVO-One port pinout and wiring schematic.
- [PythonWifiBulb: reconstructing MagicLight bulb commands](https://awesomerea.org/resources/pythonwifibulb-case/index.md): Case study · PythonWifiBulb reconstructs MagicLight Wi-Fi bulb control from captured phone-to-bulb traffic. The Python class sends RGB and warm-white commands over TCP, while its notes describe port 5577, message bytes and a checksum helper.
- [Laser Drift: reconstructing Carrera infrared slot-car control](https://awesomerea.org/resources/laser-drift-case/index.md): Case study · Laser Drift emulates the infrared controllers of Carrera Digital 132/124 slot cars. A Python game loop synchronizes with the IR tower, encodes player state into controller packets and accepts speed and lane-change commands from a TCP server.
- [mx3000control: reconstructing Perixx MX-3000 HID settings](https://awesomerea.org/resources/mx3000control-case/index.md): Case study · mx3000control configures the Perixx MX-3000 mouse on Linux using HID feature reports recovered from its Windows driver. The C tool sets DPI, sensitivity, LED behavior, buttons and macros; a development log documents analysis of the mouse communication.
- [jeep-canbus: decoding the Jeep Grand Cherokee CAN-B bus](https://awesomerea.org/resources/jeep-canbus-case/index.md): Case study · jeep-canbus documents byte-level meanings of observed CAN-B frames in a Jeep Grand Cherokee WH. The repository combines capture-based ID maps with an ATmega328 radio gateway and an ESP32 dashboard that receives and interprets vehicle data.
- [Samsung Galaxy Book4 Edge: reconstructing EC communication for Linux](https://awesomerea.org/resources/galaxy-book4-edge-ec-case/index.md): Case study · Samsung Galaxy Book4 Edge Linux Research & Support investigates the ENE KB9058 embedded controller and its I2C mailbox communication. The author describes static analysis of the ARM64 EC2.sys driver and provides EC probing scripts, protocol notes and a Linux battery module for the laptop.
- [Bose-Reverse-Engineering: investigating the 321GS Series III SmartSpeaker link](https://awesomerea.org/resources/bose-321gs-smartspeaker-case/index.md): Case study · Bose-Reverse-Engineering investigates the SmartSpeaker link between a Bose 321GS Series III console and bass module. The author documents connector pinouts, probes a 4800-baud half-duplex UART exchange, and provides Arduino firmware and KiCad hardware for a replacement console.
- [Pioneer DJM-850: mapping mixer control and audio over USB](https://awesomerea.org/resources/pioneer-djm-850-usb-case/index.md): Case study · The Pioneer DJM-850 study maps USB exchanges between the mixer and its Windows driver and Setting Utility to inform Linux support. Captures and notes cover mixer input and output choices, ASIO settings, DVS timecode and music transfer, channel routing, sample rate and buffer behavior.
- [HyperX Pulsefire Dart Reverse Engineering: mouse control protocol](https://awesomerea.org/resources/hyperx-pulsefire-dart-reverse-engineering-case/index.md): Case study · HyperX Pulsefire Dart Reverse Engineering documents the mouse's USB control protocol from captured exchanges with NGenuity Beta and trial-and-error probing. It records 64-byte messages, settings commands, packet captures, a HIDAPI example and a work-in-progress Wireshark dissector.
- [Govee H6159: reconstructing direct Bluetooth light control](https://awesomerea.org/resources/govee-h6159-light-strip-case/index.md): Case study · Govee H6159 light-strip reverse engineer provides Linux shell scripts that send Bluetooth GATT commands directly to the H6159 light strip. The README documents device discovery, a characteristic write and basic commands for power and red, green or blue lighting.
- [Redragon RGB Controller: reconstructing keyboard and mouse HID color commands](https://awesomerea.org/resources/redragon-rgb-controller-case/index.md): Case study · Redragon RGB Controller sends recovered USB HID commands to set colors on Redragon Kala keyboards and Griffin mice. The author describes capturing the vendor software's USB exchanges with Wireshark and USBPcap, identifying command sequences, and implementing them in a Node.js CLI using node-hid.
- [Magenta Bridge: reconstructing Octavi IFR-1 HID control for MSFS 2024](https://awesomerea.org/resources/magenta-bridge-octavi-ifr1-case/index.md): Case study · Magenta Bridge implements direct HID communication with the Octavi IFR-1 flight-simulator panel in a Windows client for Microsoft Flight Simulator 2024. Its source handles panel input and SimConnect mappings for radios, autopilot and transponder controls; the author says the HID protocol was recovered through observation.
- [motospeedv40-re: decoding Motospeed V40 mouse HID commands](https://awesomerea.org/resources/motospeedv40-re-case/index.md): Case study · motospeedv40-re documents USB HID commands used by the Motospeed V40 mouse. The author captured Windows-driver traffic with Wireshark and records report sizes, initialization and settings commands, DPI byte values, and packet captures with diffs.
- [Exway X1 Pro: sniffing skateboard remote telemetry](https://awesomerea.org/resources/exway-x1-pro-radio-case/index.md): Case study · The Exway X1 Pro study investigates radio traffic between an electric skateboard and its remote. An Arduino sniffer using an nRF24L01+ transceiver listens to packets and exposes direction, gear and throttle readings; accompanying notes describe the remote hardware and radio investigation.
- [CoffeConnect: reconstructing DeLonghi ESAM 4000 panel control](https://awesomerea.org/resources/coffeconnect-esam-4000-case/index.md): Case study · CoffeConnect investigates the DeLonghi ESAM 4000 control-panel circuit and its clock, serial-input and strobe signaling. A Raspberry Pi sampling script supports protocol inspection, while an ESP8266 prototype generates panel signals and exchanges MQTT messages with an Android app.
- [Vibease: decoding the BLE vibration-control protocol](https://awesomerea.org/resources/vibease-ble-protocol-case/index.md): Case study · Vibease documents the BLE communication used by a Vibease vibrator. The author maps read and write characteristics, a device-supplied handshake key, XOR-based scrambling, Base64 encoding and fragmentation, and commands for fixed vibration and patterns; the repository also contains captures and Python utilities.
- [Mieo HA102: decoding a power meter's RF packets](https://awesomerea.org/resources/mieo-ha102-rf-case/index.md): Case study · The Mieo HA102 study reconstructs the power meter's 433.9 MHz FSK packet format from recorded signals. It maps current, cumulative consumption and battery fields, describes CRC16/SPI-FUJITSU checking, and supplies a Python decoder for live rtl_433 output or saved captures.
- [Midea IR tap: reconstructing a heat pump's inter-board commands](https://awesomerea.org/resources/midea-ir-tap-case/index.md): Case study · esphome-midea-ir-tap reconstructs the demodulated infrared commands carried between a Midea-built heat pump's display and control boards. It documents six-byte frame timing and checksum behavior, provides ESP32 capture and decoding tools, and uses ESPHome to expose local controls and state in Home Assistant.
- [Tesvor X500: reconstructing local UART control and path data](https://awesomerea.org/resources/tesvor-x500-uart-case/index.md): Case study · The Tesvor X500/X500 Pro project reconstructs the robot vacuum's local UART control and path-point messages for its ESP8266/ESP-12S module. ESPHome firmware exposes cleaning commands to Home Assistant and publishes path data over MQTT for a Python writer and map viewer.
- [Bambu Lab P2S: reconstructing LAN printer control](https://awesomerea.org/resources/bambu-p2s-lan-case/index.md): Case study · The Bambu Lab P2S bridge reconstructs LAN control and monitoring for the printer from direct protocol probes. Its notes describe MQTT state deltas and commands, SSDP discovery, RTSPS H.264 video and FTPS session reuse; a TypeScript service and web client use those findings for local operation.
- [Beurer BM59 Unlocked: reconstructing direct BLE measurement transfer](https://awesomerea.org/resources/beurer-bm59-unlocked-case/index.md): Case study · Beurer BM59 Unlocked documents the BLE exchange used by a BM59 blood pressure monitor to transfer measurements. From Android HCI captures, the author maps Nordic UART handles, the time write and measurement indications, and provides a Python client using Linux L2CAP/ATT sockets.
- [PiBuddyCam: reconstructing Buddy3D camera cloud behavior](https://awesomerea.org/resources/pibuddycam-case/index.md): Case study · PiBuddyCam recreates the Prusa Buddy3D camera's cloud communication on a Raspberry Pi Zero 2 W using a protocol the author says was recovered from firmware. It registers with Prusa Connect, uploads snapshots, follows camera settings and answers WebRTC live-view requests; protocol documentation accompanies the implementation.
- [AirDrop for Windows: investigating iPhone discovery and AWDL reception](https://awesomerea.org/resources/airdrop-windows-case/index.md): Case study · AirDrop for Windows investigates how an iPhone discovers receivers and sends files over AWDL. Its .NET receiver implements mDNS announcements, AirDrop endpoints and archive extraction; logs and research notes document the missing Windows radio path.
- [PSA VAN-CAN protocol bridge: translating vehicle bus generations](https://awesomerea.org/resources/psa-van-can-protocol-bridge-case/index.md): Case study · PSA VAN-CAN protocol bridge converts vehicle messages from AEE2001 to AEE2004 or AEE2010, and from AEE2004 to AEE2010, so newer PSA head units and displays can work in older cars. Its ESP32 firmware handles VAN and CAN traffic, including steering controls, dashboard data and display messages. The repository documents VAN frame encoding, fields, checks and reply timing.
- [aioharmony: Logitech Harmony Hub protocol notes and client](https://awesomerea.org/resources/aioharmony-case/index.md): Case study · aioharmony documents Logitech Harmony Hub authentication and control messages while providing an asyncio client for the device. Its protocol notes describe remote ID discovery, session-token exchange, and XMPP IQ stanzas. The client exposes activity, configuration, and device-command operations over WebSockets or XMPP.
- [MQB-sniffer: decoding Golf MK7 CAN diagnostic exchanges](https://awesomerea.org/resources/mqb-sniffer-case/index.md): Case study · MQB-sniffer documents CAN diagnostic traffic on a 2016 Volkswagen Golf MK7 by capturing exchanges between an OBDeleven adapter and the car. It identifies request and response IDs and records examples for engine RPM, ambient light, selected gear and gearbox mode.
- [ktm-can: decoding KTM motorcycle CAN messages](https://awesomerea.org/resources/ktm-can-case/index.md): Case study · ktm-can documents and parses CAN messages observed on a 2020 KTM 690 Enduro R motorcycle. Its Python decoder maps message IDs to fields including engine speed, throttle, gear, wheel speed and brake pressure; scripts inspect live and captured traffic. The author confirmed the documented data on that motorcycle.
- [Xbox-Smartglass-Core: an Xbox One SmartGlass protocol client](https://awesomerea.org/resources/xbox-smartglass-core-python-case/index.md): Case study · Xbox-Smartglass-Core implements Xbox One SmartGlass communication in Python, including console discovery and control, media commands, Stump Live TV functions and title auxiliary streams. Its packet models, capture fixture and protocol documentation preserve details of the message exchanges.
- [Comet: reconstructing GOG Galaxy's game communication service](https://awesomerea.org/resources/comet-gog-service-case/index.md): Case study · Comet reimplements the game-facing GOG Galaxy Communication Service in Rust for use with alternative game launchers. It handles named SDK requests for library and authentication data, achievements, leaderboards, sessions, and overlay notifications. The project documents tracing Communication Service calls and identifies request types still pending.
- [PS3Sharp: reconstructing the PS3 TMAPI debug protocol](https://awesomerea.org/resources/ps3sharp-tmapi-case/index.md): Case study · PS3Sharp implements a cross-platform .NET client for PlayStation 3 memory access through TMAPI and other backends. The author reports reconstructing the SN Systems TMAPI debug protocol from Wireshark captures, enabling direct TCP access without Target Manager; the library also supports PS3MAPI, CCAPI and RPCS3.
- [PFire: reconstructing an XFire server from its messaging protocol](https://awesomerea.org/resources/pfire-case/index.md): Case study · PFire reconstructs an XFire server for client 1.127 using the service's messaging protocol. Its .NET implementation handles login, friends, status and chat, and the repository includes a specification of XFire message framing and attributes based on reverse-engineered protocol work.