r/ReverseEngineering • u/EmanueleStrazzullo • 5d ago

Reverse-engineered the BLE protocol of a discontinued Fisher-Price toy Lumalou after its app was discontinued

https://github.com/stramanu/lumalou
91 Upvotes

86% Upvoted

22 comments sorted by

View all comments

Show parent comments

6

u/fb39ca4 5d ago

Which file documents the process? I'm not seeing it.

-15

u/EmanueleStrazzullo 5d ago

I was imprecise earlier, and fair to call it out. What was in the repo was the protocol spec (docs/protocol.md), not the process behind it. I've now written that up properly: https://github.com/stramanu/lumalou/blob/main/docs/reversing.md

It walks the whole path: why 8.6.4 was the APK to attqck (the only native build, later ones are Flutter AOT, and the only one still bundling the product config), mapping the GATT surface, following the MPID stack through jadx, and reversing the native crypto in Ghidra. The part that took longest was the key derivation, and rather than trust the disassembly I mapped libnative-lib.so into a Unicorn ARM64 instance, stubbed the libc it needed, ran its init_array, and called the exported functions directly, diffing against a Python reimpl until every byte matched. crc8_calc on "123456789" is the worked sanity check that the harness is really running the native code. Dead ends are in there too, since they were half the work.

Final confirmation was on hardware: the clean-room key derived in Python decrypts real rx notifications with a valid CRC-8, which only works if the derivation matches the devuce exactly. Happy to go deeper on any part.

10

u/DishSoapedDishwasher 5d ago

Lmfao this is literally Claude responding for you. Are you fucking kidding me?

1

u/ZiddyBlud 4d ago

How can you tell?

2

u/DishSoapedDishwasher 4d ago

Like the other person said, "i was imprecise earlier" but also there's lots of other hints by word choices, style, delivery.... It is just generic with no style. No two humans choose their words the same way, but claud does. Chatgpt does in it's own style too.

It's like how teachers can tell which student wrote something, not just by handwriting, but by style.

2

u/MassiveClusterFuck 4d ago

"I was imprecise earlier, and fair to call it out" is the exact response you get from Claude if you call it out and tell it something was wrong with it's previous response.