Reverse engineering the way they do it is very satisfying and time consuming. If you want the same results but without the sweat, LLMs are the way to go now. They eat this kind of stuff for lunch. You could literally ask one for a table with all the CAN bus messages and it would figure it out.
replyI wrote a blog posts where I first did it the traditional way and then, a few months later, the lazy way: https://tomverbeure.github.io/2026/04/12/AMIQ-License-Key-Ge....
LLMs are fun until you have to break up a devices that use encrypted firmware files and non-documented interfaces.. that you are back in the past ;-)
replyBut for the rest: Yes. They will be eaten alive by the latest generation of LLMs. I use DS-Flash 4.1 a lot for this. A big helper.
Clearly you are in the past. I have reverse engineered some very difficult undocumented things. I can not go in to details but these were heavily hardened hardware. Custom SoC. of course without datasheets, involved multiple different levels of encryption and architectures of connected devices, broke all of it. All that is left is cryptocell pwn.
replyWith very little steering from me
eta: passive aggressive winky face
Take it one step at a time. I’ve had a fun time just intercepting the Bluetooth communication part for little devices.
replyMost of the time the protocols are not locked down, and if it’s a popular device chances are someone else already did it for you.
You can get help by decompiling the Android app for the device which should give more info about the content of the Bluetooth messages.
That’s the level I’m at right now. Oscilloscopes and all that look intimidating to me too!