AwesomeREA.org

Case study

ScooterLink: reconstructing Honda RoadSync’s handlebar-button protocol

Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. The author documents the dash’s BLE services, key exchange, button registration and event bytes, reportedly worked out from the official Android app and logged traffic. Results are author-reported on one PCX125, and the protocol notes separate confirmed from unverified parts.

Requirements and limitations

  • The reviewed commit follows the v1.2 release and changes only one README link. It targets a Honda PCX 2025 with the TFT dash and RoadSync support; README reports testing on a PCX125 2025 and calls other RoadSync models untested. Select and Back map to play/pause and Next/Previous to track changes, and the app reconnects at ignition and switches the dash to phone mode. Now-playing text, speed and volume control are unavailable, and no Android version exists.
  • No Honda software is needed at runtime, but RoadSync’s phone pairing must first be deleted on the dash, which keeps one phone key. The protocol was reportedly derived from the official RoadSync Android app and logged traffic; source comments cite decompiled Android app version 26.8.10 and a findings file, but the app, decompiled code, captures and that file are not in the repository.
  • Building needs a Mac with Xcode 16+, XcodeGen and the user’s own signing team and bundle ID; the app targets iOS 17, and the prebuilt v1.2 IPA must be sideloaded with a personal or developer Apple ID. Controlling other apps’ playback relies on Apple’s private MediaRemote framework, which README says rules out App Store distribution.
  • docs/PROTOCOL.md marks key exchange, per-connection validation, button registration, the phone-screen request and button events as confirmed on a real PCX125 2025, and dash drawing as unverified. A Mac-run Swift self-test checks CRC values, a simulated key exchange, validation parsing and registration and screen byte layouts; this review ran neither the tests nor the app. README reports that experimental colour slots and a drawn screen left the dash refusing phone mode until re-pairing, keeps that code switched off and warns never to write to the firmware-update service.
  • MIT covers the project code. README says the project is independent of Honda and contains no Honda code or files, only original code and a description of the Bluetooth messages written for interoperability; Honda, PCX and RoadSync remain trademarks of their owners. The author’s post credits Claude with the reverse engineering, but the repository does not document that workflow, and no REA use is established.

About this entry

Type
Case study
Category
Independent reconstruction cases
Relationship
Independent reconstruction project
Targets
App · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. docs/PROTOCOL.md GitHub · gdorgian/ScooterLink · Revision a089f62
  2. README.md GitHub · gdorgian/ScooterLink · Revision a089f62
  3. App/Sources/SABProtocol.swift GitHub · gdorgian/ScooterLink · Revision a089f62
  4. App/Sources/SABCrypto.swift GitHub · gdorgian/ScooterLink · Revision a089f62
  5. App/Sources/SABClient.swift GitHub · gdorgian/ScooterLink · Revision a089f62
  6. App/Sources/ButtonActions.swift GitHub · gdorgian/ScooterLink · Revision a089f62
  7. App/Tests/main.swift GitHub · gdorgian/ScooterLink · Revision a089f62
  8. App/project.yml GitHub · gdorgian/ScooterLink · Revision a089f62
  9. LICENSE GitHub · gdorgian/ScooterLink · Revision a089f62