Beginner experiences in reverse engineering a BLE protocol

The speaker, a self-described beginner, wanted to control the RGB lighting on an electroluminescent helmet decoration without the vendor's phone app. After the company declined to publish its protocol, the speaker set out to capture and analyze the Bluetooth Low Energy traffic instead.

The capture setup relied on the Mirage tool, which needs specific low-cost development boards whose radio chip has a known hardware quirk. The speaker built a three-module rig with serial adapters, since the initial connection negotiation can start on any of three channels and a single module gives a poor chance of catching it. The early captures were mostly binary noise. Reading the GATT documentation helped identify which packets carried payloads, and these turned out to be a simple ASCII serial-style protocol. Replaying and modifying commands revealed pattern numbers and valid color values, which the speaker scripted in Python with the Bleak library.

Because the device stops advertising after a disconnect and needs a reboot to reconnect, the speaker wrote a background service to keep the connection alive, plus a command-line front end that accepts colors in ordinary HSV ranges. A live demo showed pattern and brightness changes, though camera problems limited what the audience could see. The main takeaways were that the hardware cost roughly fifty euros, that small embedded protocols are approachable for newcomers, and that keeping detailed notes makes the work repeatable.