I am stunned by the synchronicity... Just a week ago I embarked on a quest to reverse a small bluetooth printer, and your video is perfectly timed. I also like the tone and vibe of your explanations! Thanks for making the video.

Great description of the process of reverse engeneering BLE device. I would love to see you reverse engeneer a BLE enable scale!

Wow that was some amazing work, subscribed!

Great video David!

So glad this came across my feed, I am new to HA and love being able to "hack" other products to work together. Great step by step and video production, subscribed!

ok that was awesome. Keep the videos coming!

Thanks for this. I was able to reverse engineer a BLE lamp using this tutorial.

Great tutorial! Are you planning to cover Bluetooth mesh reverse engineering?

Wow, MEGA tutorial!

Great video! As I understand this is a BLE device. What about bluetooth classic devices? In my capture file I dont have btatt packets. However I see spme L2CAP packets (with the destination matching my target device) are those the ones I should be looking into?

Nice video, thanks! Just wondering how you get that "Value" column in Wireshark?

Thank you for keeping your intro music volume lower than your voice volume.

Very cool 😎👍

Thanks for this useful video. I have 2 devices that I am attempting to reverse engineer. The first device showed no ATT data when I looked at it in wireshark, but the second device is very similar to your video, with the commands being plain text readable. The first device looks almost like it might be somehow configured in bluetooth advertising mode in order to communicate. Does that sound at all possible? If I open bluetooth scan on my phone I'm unable to find the device, but if I open the app it just "works" without any pairing, etc. If I disable bluetooth on my phone the device stops working, so I'm pretty sure it is using bluetooth (aside from the box saying it's bluetooth). Do you have any ideas or resources or even names of what I can search for if my device is using advertising mode to communicate between the android phone and the bluetooth device?

Looking forward to your next video on integrating with Home Assistant. I'm just starting HA because i want to link a BT light to my work computer. I have the Home Assistant OS which has a different terminal. I thought add-ons were not available if not the OS was not installed but i don't know how to add gatttool to the HA OS. Would you please discuss HA OS vs how you installed HA? i brief overview of the steps required would be helpful.

Awesome 👍 I've been aiming to get my Danalock V3 Bluetooth only to integrate because there is no public API.

Thank you for your video. This is helpful. I was able to figure out how to change the brightness of a Bluetooth LED sign that I purchased from Amazon. Sending data to the LED sign is more complicated. Is there a way to monitor the Bluetooth HCI snoop log via Wireshark in real-time? It's tedious to send commands with the proprietary app, create a bug report, etc.

I'm going to try this... I really want to gain access to a Bluetooth device because the app hasn't been updated to work on newer versions of android and all I really want to do is turn it on and off and hopefully get data from it. Thanks!

Hi I like this video a lot it was very helpful. My only question is about the python script connecting and sending the command to the light. Does it have to be on a raspberry pi? Would there be any way to connect to the device just running the script and using the built-in bluetooth adapter in a Macbook or the android phone?

Hello! I loved this video. I was wondering, is there a way where you could take control of a device that has bluetooth capabilities, but does not have an app that it uses to control it? My specific case is portable light that sends out a bluetooth singal (it shows as a connectable device) and has features things such as color and blinking, but it does not have an app to control these things.

Awesome approach!! I was wondering if this is possible with internet connected devices like smart lights and etc. Are devices with this connection protected with some kind of encryptation?

This is brilliant! I'm trying to see if I can control a Nike Adapt (the self-lacing shoes that use Bluetooth)

Although the procedures are different on my Samsung S2 Tablet, I was able to find the btsnoop_hci.log file in the Android/data folder. Helped me a lot! Thank you very much!

Hey, great video! I would like to clone my firestick remote control. Is it also possible to collect bluetooth protocols, which are not send/recieved from/to the mobile phone?

Hey, I am trying to do this for my LED lights as the app that controls them is really unstable and sketchy, I'm just a bit confused at the CRC part. I don't know how to figure out mine. Is supposed to be the last 2 bits on the end of the value? (One of my values for my led light's controller was 5a0001ffffff006400a5) 0x5a001 is constant, 0xffffff is white since each set of 2 handles color, and then the last couple I believe I've figured out? 0x00 stays, but 0x64 handles brightness. But I don't know what the last 4 bytes are(0x00a5) as its one of the other constant things here.

Great video, looking for a solution to control a Bluetooth device like this for a long time. When do you plan to release part 2?

Can you please do more reverse engineering common hardware please

Very good tutorial. You show how to get the SDK tools but skip a step of how to launch the developer tools once downloaded.

Passive BLE Monitor integration in HACK does some stuff like this?

Nice video! I'm trying to reverse engineering an husqvarna automower which has only bt capabilities to make it work in HA, but I'm very stuck in wireshark trying to find any pattern without any clue...

Wow crazy !! So I can control any Bluetooth device I want with this step ? Low energy Bluetooth etc... , it will be great more more if you turn it to mobile app rather then respi?? By the way just subscribed ❤️👏🏽

Can you do this for a smart lock such as this one ultraloq pro ?

fucken perfect i needed this

Maybe could you show us how to do this with other devices and by using built in androiddump module to directly sniff from an android phone?(And analyse a live packet view)

Are you able to reverse engineer the Switchbot Lock? This is what I'm trying to do as it doesn't have a HA integration.

Hi, I dont have a lot of experience with all of this but I really need to connect my godox tl60 to my homeassistant... is there any way you could help me reverse engineer that? I am stuck at the wireshark step and have no idea what to look for and everything looks different 🤣

i have been having issues getting gattool on mac, can you help?

After adb pair, I needed to do adb connect in order to get my phone in the devices list.

where is the second video with home assistant ? send link. also my android don't have wireless debug I'll have to use USB I also just downloaded the full android studio chipmunk can you give a guide using that , I also use windows 10 PC . I would like to reverse engineer a smart lock I have so I can run the script via home assistant to lock and unlock my lock.

Hmm Try this with my Bluetooth Enable Bike but sadly doesn't find any ATT in log, find a lot of SPP, RFCOMM, and L2CAP.

My zip file does't have fs/data/misc/bluetooth folder. I have only one folder named recovery inside fd/data/misc. Kindly help.

Is it similar for WiFi devices?

How do I import it into wireshark

I can't get the 'value' collumn in the wireshark. Can someone help?

Why I'm getting a .curf file instead of .log file?

Can we log wifi packets like this ?

Tried two different phones, both dont produce the snoop log

how can I do ios?

Managed to get as far as the figuring out the command packets from WireShark. You lost me when you switched to Python. Not enough explanation about what you're actually doing as you're doing it. I give up.

Not seeing the btsnoop_hci.log file in the FS folder generated from my Samsung Galaxy Note 9. I only see a recovery folder. Any thoughts? I tried some google searches, and haven't found anything helpful. Thanks!