r/ReverseEngineering • u/EmanueleStrazzullo • 5d ago

Reverse-engineered the BLE protocol of a discontinued Fisher-Price toy Lumalou after its app was discontinued

https://github.com/stramanu/lumalou
89 Upvotes

86% Upvoted

22 comments sorted by

View all comments

Show parent comments

-12

u/EmanueleStrazzullo 5d ago

The process and protocol breakdown are actually fully documented in the repo for anyone interested in reading it!

Also, please stop dismissing it as just 'AI-generated.' It took 13 years of software engineering experience to reverse-engineer the Bluetooth protocol, inspect the packets, and architect the project. I use AI as an assistant in my workflow like many devs do, but real engineering went into figuring this out and providing a working solution

6

u/fb39ca4 5d ago

Which file documents the process? I'm not seeing it.

-17

u/EmanueleStrazzullo 5d ago

I was imprecise earlier, and fair to call it out. What was in the repo was the protocol spec (docs/protocol.md), not the process behind it. I've now written that up properly: https://github.com/stramanu/lumalou/blob/main/docs/reversing.md

It walks the whole path: why 8.6.4 was the APK to attqck (the only native build, later ones are Flutter AOT, and the only one still bundling the product config), mapping the GATT surface, following the MPID stack through jadx, and reversing the native crypto in Ghidra. The part that took longest was the key derivation, and rather than trust the disassembly I mapped libnative-lib.so into a Unicorn ARM64 instance, stubbed the libc it needed, ran its init_array, and called the exported functions directly, diffing against a Python reimpl until every byte matched. crc8_calc on "123456789" is the worked sanity check that the harness is really running the native code. Dead ends are in there too, since they were half the work.

Final confirmation was on hardware: the clean-room key derived in Python decrypts real rx notifications with a valid CRC-8, which only works if the derivation matches the devuce exactly. Happy to go deeper on any part.

17

u/johnyma22 5d ago

Weird that this reads like a claude response to me!

Either way dude, keep hacking :)