Saagar Jha

My new hobby is going to Amazon and buying random Bluetooth junk that requires signing up for an account; then, handing the app to an LLM to oneshot its protocol to use it locally

Anyway if you have a Wyze Scale S I made the only app you'll ever need: https://github.com/saagarjha/Unwyze
3 replies →
3 replies

old man and the cbowns

(replying to Saagar Jha)

@saagar I’m about to reverse the LE protocol for this truly comical UX disaster we use in our van conversion, and this is precisely the news I was hoping for.
apps.apple.com/us/app/switch-p

Saagar Jha

(replying to old man and the cbowns)
@cbowns Looking at the UI for this app I am sure it will figure it out in like 5 seconds

kikeenrique

(replying to Saagar Jha)

@saagar Nice work, I thought about doing the same about the Withings app for the body+ scale. What are the steps? Unencrypt the ipa, hand it to llm to reverse engineered it?
I'm sure something critical I miss.

Saagar Jha

(replying to kikeenrique)
@kikeenrique Nope you basically have to gist of it. I used Android APKs because they’re easier to obtain and arguably have better automated tools to analyze them but it’s basically just this. Letting it debug as you do various things with the device is also very helpful

Saagar Jha

(replying to Saagar Jha)
@kikeenrique One thing I’ll note which is probably less relevant here but might be useful in the future: I lied a little bit and “pre-selected” the device to buy to increase the chances of things working before I spent money on hardware. If you’re flexible it makes things easier

Saagar Jha

(replying to Saagar Jha)
@kikeenrique For example, for my scale, I specifically looked for Bluetooth-only devices to avoid a flow where it basically gets my home network credentials and does everything behind my back without app involvement (which means I have much less influence on what it can do)

Saagar Jha

(replying to Saagar Jha)
@kikeenrique Also, you don’t usually see it on cheap hardware, but some of the larger companies do it sometimes where they obfuscate the app which might not be insurmountable but will waste your time and tokens. So I try not to engage with those if I can avoid it

Saagar Jha

(replying to Saagar Jha)
@kikeenrique Here, I had a little scare because I asked the LLM before buying if it understood how the protocol works, and it seemed simple so I pulled the trigger on the purchase. But when I got the hardware and asked it to reverse again it said something was different

Saagar Jha

(replying to Saagar Jha)
@kikeenrique It was briefly convinced I had to make an account because it was provisioning keys from the OEM server. But (I didn’t look closely) eventually it figured out that flow was not relevant, I think it might have been for another model, and figured it out

Saagar Jha

(replying to Saagar Jha)
@kikeenrique Of you already have your thing and have sold your soul to the company by setting it up “the right way” I’m sure handing it real communication logs would help but I refused to do that since I had a new device

Emory Dunn :tiny_cart:

(replying to Saagar Jha)

@saagar This is very relevant to my interests. Someone was just asking me about the possibility of doing this, didn't think about chucking the whole thing over to an LLM

Saagar Jha

(replying to Saagar Jha)
What’s really funny is that I basically only had the LLM touch the “library” file (to be clear, I deslopped it) and wrote everything else essentially by hand. Despite being a supposed iOS engineer who has done this before many times it took far longer to do that part

Saagar Jha

(replying to Saagar Jha)
Protocol RE 1 hour
Deslopping 0.25 hours
Fixing CI 2 hours
Writing SwiftUI 5 hours
Removing hallucinations 0.5 hours
someone who is good at productivity please help me budget this. my family is dying