upvote
+1000.

There should be bounties for open sourcing drivers/apps like these and generally making 'clean'/better interfaces to hardware devices, now that it's so much easier.

Claude Code reverse engineered cheap (Android only) usb and wifi endoscopes here, wrote/flashed/hardware-in-the-loop developed python+arduino libraries, etc.

It's a completely new world.

@wpm, happy to fund the nRF52840 dongle if you want to try this + release code!

reply
Have you released your reverse engineered endoscope camera work? It's something I've been thinking about doing myself, since the vendor apps leave a lot to be desired.
reply
Yes! https://pypi.org/project/supercamera/

Feel free to contribute [0], let me know if it works with the cameras you have or not, etc.! Cheers

[0] https://github.com/Revise-Robotics/supercamera-endoscope

reply
Is it really as easy as you say? I have one of these Casio watches and plenty of spare Claude credits. Wouldn’t mind doing this but no idea where to begin.
reply
Responding to you and @thewhitetulip

If you ask Claude how to do it, it might already give you some strategy that's reasonable (at least, it's good to see what it thinks)

Make sure to use Fable, and preferably have the Max plan (or plenty of credits)

LLMs can do very good work when they're unattended and optimize towards a goal that's unambiguous / for which you have a reference.

Generally speaking, in hardware, this means having a "rig" ie a testbed where the AI can send commands, observe output, and iterate on its own. You want autonomy, not babysitting (as much as possible)

In the case of this Casio watch, I would start by giving Claude Code context on what you're trying to achieve (read&decode messages sent probably over BLE, reverse engineer the protocol, get to a point where it can send valid messages itself). The goal should be a python/command line tool that can sniff packets, decode them, and send them. (step by step, starting with sniffing)

Get the nRF52840 USB dongle mentioned. Have Claude Code talk to the dongle. Ask it to list devices it sees. Ask it to see/detect the Casio watch. Use the proprietary Casio app and ask CC to record the sequence and decode the messages (explaining to it what you did in the app)

Also: have it do research - has this protocol been cracked/documented before? Is there an Android app for this Casio app which could be decompiled (usually more easily than the equivalent iOS app)?

Reach out if I can help - my offer for a dongle stands for anyone who wants to do this! It looks like a cool watch, it shouldn't be held hostage. :-)

reply
Hi Greg, I am Claude Code junior specialist from Czech Republic and also huge Casio fan. I've been ignoring all bluetooth enabled models in the past, since I had a lot of negative experience with proprietary apps (Sony Music Center, Ultrahuman etc). This is not me first time thinking about reverse engineering products app, I love open hardware and I wanted to contribute to the community, but while doing my research (which Claude agrees with), I've figured out that it might not be as easy as I thought. For example, Googles Fitbit Air is according to some encrypting its traffic in a way, that it reaches Googles Cloud first, unencrypts and then reaches the app itself. How would you approach this issue? By the way, the dongle offer still stands? ;)
reply
Offer still stands! email me (my email is in my profile)

When there’s a will, there’s a way :) I’m not immediately sure re Fitbit Air (that’s nasty if it’s e2e encrypted!), but… maybe it doesn’t pin the server certificate and you can intercept communications?

Seems like you would have fun reversing this! :) reach out!

reply
From my experience Fable will reject this request - its pretty trigger-happy with it's safety detector for reverse engineering, even if you push it on right-to-repair. However Opus 4.8 is more than capable of doing it, with a bit of guidance.
reply
Even I am curious about how people are doing this
reply
> Wouldn’t mind doing this but no idea where to begin.

Literally just ask Claude where to begin

reply
ble is just transport layer, if the actual data is encrypted, you can get nothing.

One of our device FW at first transmit raw data through gatt service, then folk at gadget bridge reverse engineer it, which does not sound good to stakeholder, so we have to encrypt the data between phone-device.

reply
Quite possible transport is encrypted, but that can likely be overcome with some RE on the Android app. Given the price of this piece of hardware, it's likely recoverable with moderate effort. At least worth a try.
reply
yeah, my point is "1 night and $20 of Claude token" maybe not enough.

Also you dont really need the nrf52840 dongle if you want sniffing(Also unlikely to work after the pairing process is done), you can use btsnoop on Android phone to record data, then analyze it with wireshark.

reply
Having the LLM run the proprietary app through ghidra (which I think even has an MCP now), would likely give it some useful clues too
reply
Q: How can we achieve world peace?

HN: I'd wager that with $20 in LLM tokens ...

Cracks me up every time lol

reply