I was gonna go to the hackspace and finish my hat, then bodies happened.

Instead, I'm doing some light Sunday reading.

I have a pair of chinese rave glasses that can display scrolling text, bitmaps, or animations. They also make you look way too cool for school.

They speak Bluetooth to a shady APK, I've put it on a disconnected phone and I'm reverse engineering the protocol. queer.af/media/kPpwoBGP0l_uV41

Show thread

The protocol looks simple enough; it exposes a GATT service:

/org/bluez/hci0/dev_FF_FF_2A_00_52_DF/service0001/char0002/desc0004

char0002 has flags: read, write-without-response and notify, the device has no manufacturer info, and all the UUIDs are generic

Show thread

Here's the catch: the GATT collection only includes a single descriptor (0004), and it's not writable.

Wireshark shows that the app, when you toggle them off and on, sends a GATT Command write (0x52) to handle 0x0003, with value: 01 00 02 06 09 02 05 03.

I'm not sure how to coerce BlueZ to let me do this.

Show thread

Currently trying to figure out how to capture Bluetooth data with Wireshark, my bluetooth adapter isn't showing up as a capture source :(

Show thread

What I can figure out of Bluetooth semantics right now: you can ask it eg. "what services do you have?", the response has UUIDs for what kind of service this is, and "handles" for referring to it.

These are global, shared between all types of objects, and what you use to execute commands.

Show thread

The dump I have starts with an exchange of:

- what services do you have?
- handle 1 is an fff0 service
- include declarations(?)?
- none
- characteristics?
- handle 2 is a fff1 one, handle 3 is its value(I think?)
- what about handle 4
- it's an attribute

Show thread

I've been informed that this is not, in fact, Bluetooth, but Bluetooth Low Energy, which actually has very little to do with Bluetooth

That does explain a thing or two

Show thread

These threads are my attempt to publicly shame myself into finishing projects, and hopefully they're also somewhat interesting

Advanced ADHD survival tricks

Show thread

This has now been derailed into me having to patch the NixOS libpcap package to have Bluetooth support, which unfortunately creates a circular dependency because iptables depends on libpcap and bluez somehow has iptables as a dependency??

Show thread

Currently trying to find a BTLE library that doesn't do error handling by Box<dyn ::std::error::Error>, I can't even stuff that in error_chain >__>

Show thread

clearly, the answer is to just rewrite it in a language that only has Box<dyn ::std::error::Error>

github.com/liclac/eyesemoji is now in Go, and has a lil' CLI :3

Show thread

"Any project embr works on will eventually evolve to contain a command shell, or be one"
-- Erin

Show thread

Got it!

Images are bitmaps, 1 byte = 1 column, 1 bit = 1 row on/off, there's a header whose meaning yet eludes me, and for some reason every other byte appears to do noting at all

0xAA, 0x00, 0x55, 0x00, 0xAA, 0x00 queer.af/media/q0UGM6krRm5NE3M

Show thread

because the universe is conspiring against me, I've not only lost my notes on the protocol to a drive failure, my dev phone is bricked

thankfully, I can recover the most important bit from this screenshot w

Show thread

before I lose it again: it can display a 9x64 scrolling bitmap, FF80 (0b11111000) lights a full column

packet sequence for filling the whole thing with a pattern, with FF80s on each side - the 03 at the end is seemingly ignored:

0paste.com/44338

Show thread
Follow

@embr posting the bee movie script but tiny? That'd valid

Β· Β· 0 Β· 0 Β· 0
Sign in to participate in the conversation
Girlcock.club

Gc.c is an instance by trans women for trans folk and strives to keep the security and enjoyment of our users in mind.