Le Smart Classic Bluetooth? 🤔

• Bluetooth Low Energy ⇒ Bluetooth LE ⇒ BLE

• “Bluetooth 4.2” / “Bluetooh 5.0” sometimes

• The “S” in Bluetooth LE stands for “Security”

• Everything is just “Bluetooth” as of 5.0!

Bluetooth LE Profiles

Bluetooth LE Service Structure

Every item has a UUID

• “Short” UUID (0x1800) - approved by Bluetooth Special Interest Group (SIG)
  • Short-form based on Bluetooth SIG Base UUID:
    0x1800 = 00001800-0000-1000-8000-00805F9B34FB
• “Long” (random!) UUID - vendor-specific, collision-resistant

Challenge Levels

Gadget	Name	Properties	Level
	Fnirsi IR40 Laser Distance Meter	React Native. Unauthenticated NOTIFY with distance in mm, WRITE to start continuous measurement (webtool)	★☆☆☆☆
	Colmi P80	Obfuscated Java. Simple WRITE and NOTIFY, >60 commands, sub-, sub-sub-commands, opaque (Moyoung)	★★☆☆☆
	SurpLife SMART LED Curtain	Flutter binary app 🤐. Simple WRITE commands for single-color fill, complex image format for bitmaps (code)	★★★☆☆
	Xiaomi S400 Body Scale	Obfuscated Java. Encrypted, authenticated, requires online login and cloud token extraction	★★★★☆
	SpportsTech ES600	Unobfuscated Java. Simple protocol, BUT: Requires pedaling the bike to connect	🥵🥵🥵🥵

Arming the Androids

On the Phone

1. Developer Mode: “Settings” ➤ “Software” ➤ “Build Number” ➤ 7x 🖕

2. Bluetooth Logging: “Developer Settings” ➤ “Bluetooth HCI Snoop”

3. nRF Connect for Mobile (Google Play)

4. Install your gadget’s app

On the PC

1. Install adb and Android USB drivers ➤ obtain HCI log files

2. Install Wireshark ➤ read HCI log files

3. Install jadx-gui ➤ decompile Android APKs

4. Bonus level: install apk-mitm + Zed Attack Proxy ➤ 🐒 Monkey-in-the-Middle

Am I the first?

Xavax 7W E27 RGB Light

Downloading HCI Logs

At first ensure that you are recording logs, and can fetch them!

Real Rooted Android (LineageOS)

$ adb root
$ adb pull /data/misc/bluetooth/logs/btsnoop_hci.log

Original ROM + Root

$ adb shell su -c "tar c -C/data/log/bt/ btsnoop_hci.log" |tar xvv

Kinder-Android

$ adb bugreport bugreport-2026-03-15-mygadget.zip
... ⌛ ... 🥱 ... ☕ ... (2 minutes later)
$ unzip bugreport-2026-03-15-mygadget.zip FS/data/log/bt/btsnoop_hci.log
$ file FS/data/log/bt/btsnoop_hci.log
FS/data/log/bt/btsnoop_hci.log: BTSnoop version 1, HCI UART (H4)

Recording Useful HCI Logs

🤔 What exactly did I do, in which order? 🤔

1. Take the time (Seconds precision! On your Android!)

2. Start the “original” app

3. Make notes or screenshots (or a screen recording)

   • Timestamp (“17:23:42” - it’s in the screenshot filename!)
   • Exact action (“set wakeup time”)
   • Exact parameters (“09:30 AM”)

4. Remember if you screenshotted before or after the action

5. Download HCI log and start digging

Wiresharking the log

Wireshark: Filters

• bluetooth.addr==DE:AD:CA:FE:BA:BE (from/to gadget)
• btatt (Bluetooth ATT payloads)
  • btatt.opcode values: 0x0b=READ ··· 0x1b=NOTIFY ··· 0x52=WRITE

Getting the APK

Obtaining the Package Name

• “Share” from the Play Store listing ➤ URL query parameter
• Needle in the haystack: adb shell cmd package list packages | grep title
• From the APK: SDK/build-tools/36.1.0/aapt dump badging shitty.apk | head -1

Potential download sources

1. Download from phone (adb)

$ adb shell pm path com.crrepa.band.colmi_fit
package:/data/app/~~9L5M7kslKekKaroB33ApYQ==/com.crrepa.band.colmi_fit-wx5dVrs6O5sbSG-SoFXlsA==/base.apk
package:/data/app/...../split_config.arm64_v8a.apk
package:/data/app/...../split_config.de.apk
package:/data/app/...../split_config.en.apk
package:/data/app/...../split_config.xxhdpi.apk
$ adb pull /data/app/~~9L5M7kslKekKaroB33ApYQ==/com.crrepa.band.colmi_fit-wx5dVrs6O5sbSG-SoFXlsA==/base.apk

2. Download from phone (APK Extractor)

3. Google them / Aurora Store / APKPure / QR code (Chinese apps)

Analyzing the App

Decompile with jadx

• jadx-gui base.apk ➤ open in interactive viewer
• jadx base.apk ➤ will extract into package_name/

Exploration and digging

1. Find the UUIDs / names / other things

• “Navigation” ➤ “Text Search” ➤ fff1 (UUID for SportsTech ES600)
  • BluetoothAdapter.LeScanCallback
  • BluetoothGattCallback
  • BluetoothGattCharacteristic

Device Under Test

“eHealth” app (2018)

Package name: com.yuedongsports.e_health - UUIDs fff1 and fff2

/* com.yuedongsports.e_health.service.UartService */
RX_CHAR_UUID = UUID.fromString("0000fff2-0000-1000-8000-00805f9b34fb");
TX_CHAR_UUID = UUID.fromString("0000fff1-0000-1000-8000-00805f9b34fb");

/* stripped irrelevant code, error handling, debug output */
public boolean writeRXCharacteristic(byte[] payload) {
    service = mBluetoothGatt.getService(RX_SERVICE_UUID);
    characteristic = service.getCharacteristic(RX_CHAR_UUID);
    characteristic.setValue(payload);
    mBluetoothGatt.writeCharacteristic(characteristic);
}

/* com.yuedongsports.e_health.util.BluetoothCommand */
public static boolean readUserInfo(UartService uartService) {
    L.e("readUserInfo...");
    byte[] payload = { 242, 194, 1, 0, 0 };
    payload[4] = BluetoothCalculatorUtils.checkOutSum(payload);
    return uartService.writeRXCharacteristic(payload);
}

Python Reimplementation with Bleak

(venv) $ python3 cli.py 68:9E:19:xx:xx:xx
Connecting...
Connected!
>> f2c000b2
>> f2c1050100000000b9
<< R_LINK_COMMAND len: 0 b'\xc2' 194 b''
>> f2c20100b5
<< R_MEMORY_COMMAND len: 12 b'\t' 9 b'010118000020000000000000'
<< UNK_210 len: 14 b'\xbe' 190 b'00001901003200a0000000000000'
...
EOFError

Further Examples

BLE Printers

• Reverse Engineering a Thermal Label Printer (“Pocket Printer”)
• Reverse Engineering Action’s Cheap Fichero Labelprinter (13€ label printer) - python code
• Thermal Printer BLE Protocol reverse engineering (“iPrinter”)
• Cat Printer for e.g. cat camera with cat ears and thermal printer (“BQ05”)

Other gadgets

• Fnirsi IR40 laser scanner webtool
• Heating Radiator Valve
• E27 RGBW Light Bulb
• Domyos EL500 elliptical trainer

Related material

• Taming the dragon: reverse engineering firmware with Ghidra

Zed Attack Proxy

Wireshark Dissectors

Lua runtime that will process a packet, converting it into a protocol tree

• Reference documentation: good
• Beginner documentation: 🤐🥵

Example: MOYOUNG / COLMI (high-level description, Lua dissector)

moyoung = Proto("MOYOUNG",  "MOYOUNG BLE Protocol")
moyoung.fields.uuid = ProtoField.uint16("moyoung.uuid", "DaFit UUID", base.HEX)
moyoung.fields.size = ProtoField.uint16("moyoung.size", "Size", base.DEC, nil, 0x1fff)

function moyoung.dissector(buffer, pinfo, tree)
    if buffer:len() > 4 and buffer(0, 2):uint() == 0xfeea then
        pinfo.cols.protocol = moyoung.name
        local subtree = tree:add(moyoung, buffer(), "MOYOUNG protocol message")
        subtree:add(moyoung.fields.uuid, buffer(0, 2))
        subtree:add(moyoung.fields.size, buffer(2, 2))
        local cmd = buffer(4, 1):uint()
        subtree:add(moyoung.fields.cmd, buffer(4, 1))
    end
end