stpihkal
stpihkal copied to clipboard
Sex Toys Protocols I Have Known And Loved - Documentation of Reverse Engineered Protocols for Commercial Sex Hardware
BLE Name: HTK-BLE-BM001 BatteryRx Service UUID: 0000180f-0000-1000-8000-00805f9b34fb BatteryRx Characteristic UUID: 00002a19-0000-1000-8000-00805f9b34fb Tx Service UUID: 00001802-0000-1000-8000-00805f9b34fb Tx Characteristic UUID: 00002a06-0000-1000-8000-00805f9b34fb Commands: - DISCONNECT_COMMAND = 9; - INVERSION_MASSAGE_COMMAND = 14; - LEFT_MASSAGE_COMMAND...
# Normal mode BLE Name (carrot): PTVEA2601 (suspect this might be version specific) BLE Name (devil): PBT821 BLE Name (vibrator): PCS321 BLE Name (bean sprout): PHT321 At a glance this...
Since d960f7a the paths for the protocols are invalid.
Service UUID: 0000FFE5-0000-1000-8000-00805f9b34fb Tx char UUID: 0000FFE9-0000-1000-8000-00805f9b34fb Rx char UUID: 0000FFE2-0000-1000-8000-00805f9b34fb Names: * Aogu BLE Device * Aogu BLE 14582H Wildcarding after "Augo BLE" will probably work. Control: 0xAA 0xBB...
BLE name: ZALO-Queen Servive UUID: 0000fff0-0000-1000-8000-00805f9b34fb Tx Char UUID: 0000fff1-0000-1000-8000-00805f9b34fb Tx prorocol: 0xAA 0xBB 0xCC AA is mode: - 01 is manual control BB controls the oscillator at the tip...
Right now, this is copy/paste from Discord: KirbyCat12/31/2018 Alright, after fiddling around with it a bit I got the recompiled shockspot software to connect to the device. It looks like...
BLE Names: | ID | Name | OldID | Gen | Type | MinFirmware | MinSpeed | MaxSpeed | Speeds | |----|-----|----|--------------|-------|--|--|--|--| | pro|Pro||4|Theragun|2.1.6|0|0|3616| | elite|Elite||4|Theragun|2.1.6|0|0|3616| | prime|Prime|liv2|4|Theragun|2.0.4|0|0|3584| | fr01|Wave...
Turns out there's a few different Vibratissimo types: * KV Model * 1-KEY CH (I think this is the standard Vibratissimo models: 1 motor) * 2-KEY CH * 3-KEY CH...
**Bluetooth Name:** VorzePiston Protocol is same as Cyclone and UFO SA. 3 bytes, identifier value for the Piston is 3. This means the commands are in the following format: ```...
BLE Name: ROCKET UUID's identical other Vorze devices. Control is in the format: 0x07 0x03 0xZZ (0-100 intensity) Note the device_id (byte 0) is 7 and command_id (byte 1) is...