Lab
Reverse engineering·
How the protocol was recovered in a day: the APK, an HCI snoop of the vendor app, and a Python client — a reproducible recipe.
In 10 seconds
No datasheet, no SDK, no FCC filing. Three sources had to agree — the decompiled app (what the phone sends), an HCI snoop of the vendor app talking to a ring (what really crosses the air), and our own client (what the ring answers). One day, four agents in parallel lanes. A claim is [LIVE] only with a JSONL line behind it.
The recipe·
| step | do | it gives you | it cannot tell you |
|---|---|---|---|
| 1 · APK, static | adb pull LoraFit base.apk → jadx; find JY RING log tag → BLEProtocolManager (hy7, every builder + parser) and JiangYunRingDevice (hr7, what the app does with replies) |
header, ~40 cmd ids, payloads, connect sequence, pacing, Opus params, no auth | header field order (both compile), what this hardware answers, what the firmware pushes that the app ignores |
| 2 · APK, dynamic | Pixel HCI snoop socket on, drive every LoraFit screen, mark taps, decode ATT — Live capture | header order, the connect burst, 0x19 and 0x44 the parser does not know, which screens never touch the ring |
anything LoraFit never sends |
| 3 · our client | bleak on a Mac, one command at a time: ring-cli gatt · raw 37 · listen 60; every frame → evidence/*.jsonl |
the chip (SUOTA FEF5 = Dialog), unprompted pushes, echo-acks byte for byte, 28 ✅ rows |
— |
Rules that kept it honest: settings acks are echoes, so compare bytes; never send deviceOperation, unbind or
anything on FEF5; a ✅ needs a line in evidence/.
Things that bit us — seven traps and what they really were
| trap | truth |
|---|---|
| "the ring vanished" | macOS bonded it as a Mouse and hid it from every scanner — system_profiler SPBluetoothDataType → macOS transport |
| a person on the charger | HR 80–103 and 31 °C in the cradle look like a body |
| 13 bytes of "corruption" after device info | the advertising data replayed on the link |
| header order | wrong in the first draft; only the 1522-packet audio stream proved total before index |
| duration = speech | a 6-minute memo held 30 s of talking; local Whisper called it silence |
| the FCC id on listings | no filing exists; the chip came from the GATT table |
| Android | re-enables Bluetooth by itself minutes after svc bluetooth disable; a stack restart kills the snoop socket |
Ethics and scope·
Interoperability, on rings we bought, so their owner can read their own data. Nothing here bypasses a protection — there is none — and the destructive operations are documented so nobody sends them by accident. Another brand speaking this protocol? Add it to the FAQ. Where it went from here: Hardware · Live capture · Lanes.