The Perfect BLEnd: Reverse engineering a bluetooth controlled blender for better smoothies

The speaker's smart blender could only be controlled through a phone app. That app was last updated years earlier and no longer found the device on a newer phone, and there was no way to start the blender from a computer or to save custom blend timings. The talk sets out to learn how the phone and the blender communicate over Bluetooth Low Energy, where the blender acts as a peripheral exposing custom services and characteristics.

The first attempts used a dedicated BLE sniffer, which needed close range and often missed the connection. The approach moved to capturing the Bluetooth host controller traffic from an iPhone, then filtering for write requests from the phone to the blender. Comparing the written bytes against known blend durations suggested that one byte tracks run time and that the paired on and off steps form a sequence, with the speed stored in part of another byte. Decompiling the Android app's native library and reading its SQLite preset database helped confirm the layout. Some characteristics, such as those tied to a connected scale, were traced to publicly available code from other projects.

The speaker used a generated web Bluetooth app to send a custom three-step profile to the blender, and the demo ran it as written. The takeaways were that a vendor app being discontinued can strand working hardware, and that the blender's protocol had no pairing or authentication, so range was the only practical limit on who could send commands. A physical lid interlock still had to be engaged before the motor would run.