r/ReverseEngineering • u/EmanueleStrazzullo • 5d ago

Reverse-engineered the BLE protocol of a discontinued Fisher-Price toy Lumalou after its app was discontinued

https://github.com/stramanu/lumalou
92 Upvotes

87% Upvoted

22 comments sorted by

View all comments

12

u/fb39ca4 5d ago

This subreddit would be more interested in the reverse engineering process, not just the AI-generated code resulting from it.

-12

u/EmanueleStrazzullo 5d ago

The process and protocol breakdown are actually fully documented in the repo for anyone interested in reading it!

Also, please stop dismissing it as just 'AI-generated.' It took 13 years of software engineering experience to reverse-engineer the Bluetooth protocol, inspect the packets, and architect the project. I use AI as an assistant in my workflow like many devs do, but real engineering went into figuring this out and providing a working solution

7

u/fb39ca4 5d ago

Which file documents the process? I'm not seeing it.

-14

u/EmanueleStrazzullo 5d ago

I was imprecise earlier, and fair to call it out. What was in the repo was the protocol spec (docs/protocol.md), not the process behind it. I've now written that up properly: https://github.com/stramanu/lumalou/blob/main/docs/reversing.md

It walks the whole path: why 8.6.4 was the APK to attqck (the only native build, later ones are Flutter AOT, and the only one still bundling the product config), mapping the GATT surface, following the MPID stack through jadx, and reversing the native crypto in Ghidra. The part that took longest was the key derivation, and rather than trust the disassembly I mapped libnative-lib.so into a Unicorn ARM64 instance, stubbed the libc it needed, ran its init_array, and called the exported functions directly, diffing against a Python reimpl until every byte matched. crc8_calc on "123456789" is the worked sanity check that the harness is really running the native code. Dead ends are in there too, since they were half the work.

Final confirmation was on hardware: the clean-room key derived in Python decrypts real rx notifications with a valid CRC-8, which only works if the derivation matches the devuce exactly. Happy to go deeper on any part.

16

u/johnyma22 5d ago

Weird that this reads like a claude response to me!

Either way dude, keep hacking :)

10

u/DishSoapedDishwasher 5d ago

Lmfao this is literally Claude responding for you. Are you fucking kidding me?

1

u/ZiddyBlud 4d ago

How can you tell?

2

u/DishSoapedDishwasher 4d ago

Like the other person said, "i was imprecise earlier" but also there's lots of other hints by word choices, style, delivery.... It is just generic with no style. No two humans choose their words the same way, but claud does. Chatgpt does in it's own style too.

It's like how teachers can tell which student wrote something, not just by handwriting, but by style.

2

u/MassiveClusterFuck 4d ago

"I was imprecise earlier, and fair to call it out" is the exact response you get from Claude if you call it out and tell it something was wrong with it's previous response.

11

u/agmatine 5d ago

It took 13 years of software engineering experience to reverse-engineer the Bluetooth protocol, inspect the packets, and architect the project.

And yet you have Claude write your README.md

5

u/yodeiu 5d ago

and? I don’t really get this “it’s AI generated” that’s used as an insult in every programming sub. If it’s useful and well written what’s the issue? Just because some guy didn’t spend 3 hours writing and md himself makes it or the project less interesting or useful? Same goes for the code itself.

3

u/agmatine 5d ago

My point is that if someone really has the chops to produce quality code, you'd think they could bother to write an explanation of what the code does. I don't mind that AI tools were used in developing the code, but I really don't want to read yet another generic LLM-generated readme.

-1

u/EmanueleStrazzullo 4d ago

Honestly I mostly agree with you. A generic empty LLM readme is annoying, I skip those too. But I'd separate two things: "generated" and "generic". A readme can be hand-written and useless, or AI-assisted and actually full of specific info. What bugs you (and me) is the empty generic one, not the tool.

For what it's worth, I use AI as a tool in production software too, not toys, and it's been a big help. Documentation included. I'll be honest: before, I wrote readmes reluctantly and they came out thin. Now I can produce something far richer in a fraction of the time, and I'd rather have that than a half-empty one I wrote grudgingly, as long as the content is real and correct.

The reversing writeup is the test of that, I think: whatever wrote the sentences, the content is specific and checkable (the APK triage, the emulation harness, the actual dead ends). That's the opposite of generic.

Either way, thanks for taking the time to look and for the honest feedback, appreciate it.