4 ms·

While I empathize with your feelings about lock-in, I encourage you to see that we live in an amazingly empowering era. I would wager that with $20 in credits f

While I empathize with your feelings about lock-in, I encourage you to see that we live in an amazingly empowering era. I would wager that with $20 in credits for the LLM flavor of the week and and an equally expensive BLE-to-USB dongle (try the nRF52840 dongle), you will have the protocol reverse-engineered overnight. BLE protocols are often very low-hanging fruit for this type of effort. Yes, it's annoying this stuff isn't open source from the get-go, but it has never been easier to open hardware up for yourself and others.

richstokes 1mo ago
Having the LLM run the proprietary app through ghidra (which I think even has an MCP now), would likely give it some useful clues too
gregsadetsky 1mo ago
+1000. There should be bounties for open sourcing drivers/apps like these and generally making 'clean'/better interfaces to hardware devices, now that it's so much easier. Claude Code reverse engineered cheap (Android only) usb and wifi endoscopes here, wrote/flashed/hardware-in-the-loop developed python+arduino libraries, etc. It's a completely new world. @wpm, happy to fund the nRF52840 dongle if you want to try this + release code!
- jbit 1mo ago
  Have you released your reverse engineered endoscope camera work? It's something I've been thinking about doing myself, since the vendor apps leave a lot to be desired.
  - gregsadetsky 1mo ago
    Yes! https://pypi.org/project/supercamera/ https://pypi.org/project/supercamera/ Feel free to contribute [0], let me know if it works with the cameras you have or not, etc.! Cheers [0] https://github.com/Revise-Robotics/supercamera-endoscope https://github.com/Revise-Robotics/supercamera-endoscope
- cube00 1mo ago
  > There should be bounties There are https://bounties.fulu.org https://bounties.fulu.org
  - swores 1mo ago
    Wow, what a great idea. Thanks for the link!
MicrosoftShill 1mo ago
Is it really as easy as you say? I have one of these Casio watches and plenty of spare Claude credits. Wouldn’t mind doing this but no idea where to begin.
- thewhitetulip 1mo ago
  Even I am curious about how people are doing this
- gregsadetsky 1mo ago
  Responding to you and @thewhitetulip If you ask Claude how to do it, it might already give you some strategy that's reasonable (at least, it's good to see what it thinks) Make sure to use Fable, and preferably have the Max plan (or plenty of credits) LLMs can do very good work when they're unattended and optimize towards a goal that's unambiguous / for which you have a reference. Generally speaking, in hardware, this means having a "rig" ie a testbed where the AI can send commands, observe output, and iterate on its own. You want autonomy, not babysitting (as much as possible) In the case of this Casio watch, I would start by giving Claude Code context on what you're trying to achieve (read&decode messages sent probably over BLE, reverse engineer the protocol, get to a point where it can send valid messages itself). The goal should be a python/command line tool that can sniff packets, decode them, and send them. (step by step, starting with sniffing) Get the nRF52840 USB dongle mentioned. Have Claude Code talk to the dongle. Ask it to list devices it sees. Ask it to see/detect the Casio watch. Use the proprietary Casio app and ask CC to record the sequence and decode the messages (explaining to it what you did in the app) Also: have it do research - has this protocol been cracked/documented before? Is there an Android app for this Casio app which could be decompiled (usually more easily than the equivalent iOS app)? Reach out if I can help - my offer for a dongle stands for anyone who wants to do this! It looks like a cool watch, it shouldn't be held hostage. :-)
  - panuskadev 1mo ago
    Hi Greg, I am Claude Code junior specialist from Czech Republic and also huge Casio fan. I've been ignoring all bluetooth enabled models in the past, since I had a lot of negative experience with proprietary apps (Sony Music Center, Ultrahuman etc). This is not me first time thinking about reverse engineering products app, I love open hardware and I wanted to contribute to the community, but while doing my research (which Claude agrees with), I've figured out that it might not be as easy as I thought. For example, Googles Fitbit Air is according to some encrypting its traffic in a way, that it reaches Googles Cloud first, unencrypts and then reaches the app itself. How would you approach this issue? By the way, the dongle offer still stands? ;)
mrheosuper 1mo ago
ble is just transport layer, if the actual data is encrypted, you can get nothing. One of our device FW at first transmit raw data through gatt service, then folk at gadget bridge reverse engineer it, which does not sound good to stakeholder, so we have to encrypt the data between phone-device.
- Ductapemaster 1mo ago
  Quite possible transport is encrypted, but that can likely be overcome with some RE on the Android app. Given the price of this piece of hardware, it's likely recoverable with moderate effort. At least worth a try.
  - mrheosuper 1mo ago
    yeah, my point is "1 night and $20 of Claude token" maybe not enough. Also you dont really need the nrf52840 dongle if you want sniffing(Also unlikely to work after the pairing process is done), you can use btsnoop on Android phone to record data, then analyze it with wireshark.
    - Ductapemaster 1mo ago
      You're right, I was representing a best-case scenario with an intention to be inspiring. And yes, the Android approach works too and I have done exactly that with Claude previously. The BLE dongle is however a platform-independent approach.
gib444 1mo ago
Q: How can we achieve world peace? HN: I'd wager that with $20 in LLM tokens ... Cracks me up every time lol
wpm 1mo ago
This isn't untrue. I had the same thought when I unboxed my Casio 3565 a week ago and learned that I had been bamboozled. Except all I wanted was a watch that could 1. keep itself set correctly, and 2. ping my phone when I lose it. I didn't want a project. I have enough projects. I am drowning in half finished projects. They are stacked up to the ceiling. They threaten to crush me as I sleep. No more!

richstokes 1mo ago

Having the LLM run the proprietary app through ghidra (which I think even has an MCP now), would likely give it some useful clues too

gregsadetsky 1mo ago

+1000. There should be bounties for open sourcing drivers/apps like these and generally making 'clean'/better interfaces to hardware devices, now that it's so much easier. Claude Code reverse engineered cheap (Android only) usb and wifi endoscopes here, wrote/flashed/hardware-in-the-loop developed python+arduino libraries, etc. It's a completely new world. @wpm, happy to fund the nRF52840 dongle if you want to try this + release code!

jbit 1mo ago
Have you released your reverse engineered endoscope camera work? It's something I've been thinking about doing myself, since the vendor apps leave a lot to be desired.
- gregsadetsky 1mo ago
  Yes! https://pypi.org/project/supercamera/ https://pypi.org/project/supercamera/ Feel free to contribute [0], let me know if it works with the cameras you have or not, etc.! Cheers [0] https://github.com/Revise-Robotics/supercamera-endoscope https://github.com/Revise-Robotics/supercamera-endoscope
cube00 1mo ago
> There should be bounties There are https://bounties.fulu.org https://bounties.fulu.org
- swores 1mo ago
  Wow, what a great idea. Thanks for the link!

MicrosoftShill 1mo ago

Is it really as easy as you say? I have one of these Casio watches and plenty of spare Claude credits. Wouldn’t mind doing this but no idea where to begin.

thewhitetulip 1mo ago
Even I am curious about how people are doing this
gregsadetsky 1mo ago
Responding to you and @thewhitetulip If you ask Claude how to do it, it might already give you some strategy that's reasonable (at least, it's good to see what it thinks) Make sure to use Fable, and preferably have the Max plan (or plenty of credits) LLMs can do very good work when they're unattended and optimize towards a goal that's unambiguous / for which you have a reference. Generally speaking, in hardware, this means having a "rig" ie a testbed where the AI can send commands, observe output, and iterate on its own. You want autonomy, not babysitting (as much as possible) In the case of this Casio watch, I would start by giving Claude Code context on what you're trying to achieve (read&decode messages sent probably over BLE, reverse engineer the protocol, get to a point where it can send valid messages itself). The goal should be a python/command line tool that can sniff packets, decode them, and send them. (step by step, starting with sniffing) Get the nRF52840 USB dongle mentioned. Have Claude Code talk to the dongle. Ask it to list devices it sees. Ask it to see/detect the Casio watch. Use the proprietary Casio app and ask CC to record the sequence and decode the messages (explaining to it what you did in the app) Also: have it do research - has this protocol been cracked/documented before? Is there an Android app for this Casio app which could be decompiled (usually more easily than the equivalent iOS app)? Reach out if I can help - my offer for a dongle stands for anyone who wants to do this! It looks like a cool watch, it shouldn't be held hostage. :-)
- panuskadev 1mo ago
  Hi Greg, I am Claude Code junior specialist from Czech Republic and also huge Casio fan. I've been ignoring all bluetooth enabled models in the past, since I had a lot of negative experience with proprietary apps (Sony Music Center, Ultrahuman etc). This is not me first time thinking about reverse engineering products app, I love open hardware and I wanted to contribute to the community, but while doing my research (which Claude agrees with), I've figured out that it might not be as easy as I thought. For example, Googles Fitbit Air is according to some encrypting its traffic in a way, that it reaches Googles Cloud first, unencrypts and then reaches the app itself. How would you approach this issue? By the way, the dongle offer still stands? ;)

mrheosuper 1mo ago

ble is just transport layer, if the actual data is encrypted, you can get nothing. One of our device FW at first transmit raw data through gatt service, then folk at gadget bridge reverse engineer it, which does not sound good to stakeholder, so we have to encrypt the data between phone-device.

Ductapemaster 1mo ago
Quite possible transport is encrypted, but that can likely be overcome with some RE on the Android app. Given the price of this piece of hardware, it's likely recoverable with moderate effort. At least worth a try.
- mrheosuper 1mo ago
  yeah, my point is "1 night and $20 of Claude token" maybe not enough. Also you dont really need the nrf52840 dongle if you want sniffing(Also unlikely to work after the pairing process is done), you can use btsnoop on Android phone to record data, then analyze it with wireshark.
  - Ductapemaster 1mo ago
    You're right, I was representing a best-case scenario with an intention to be inspiring. And yes, the Android approach works too and I have done exactly that with Claude previously. The BLE dongle is however a platform-independent approach.

gib444 1mo ago

Q: How can we achieve world peace? HN: I'd wager that with $20 in LLM tokens ... Cracks me up every time lol

wpm 1mo ago

This isn't untrue. I had the same thought when I unboxed my Casio 3565 a week ago and learned that I had been bamboozled. Except all I wanted was a watch that could 1. keep itself set correctly, and 2. ping my phone when I lose it. I didn't want a project. I have enough projects. I am drowning in half finished projects. They are stacked up to the ceiling. They threaten to crush me as I sleep. No more!