C3MA/bulltron-ble-commands
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document BullTron live BLE capture

Browse Source
This commit is contained in:
acidburns
2026-07-10 19:01:42 +02:00
parent 5b6fdf764b
commit 0a1d7cff6e
4 changed files with 248 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7
View File
@@ -96,6 +96,11 @@ The expected live-data response has byte count `0x7C`, meaning 124 bytes / 62
D203 7C <62 words> CRC
```
This workflow has now been confirmed in a real Android HCI snoop capture. The
capture shows the app using handle `0x0015` (`fff2`) for `D203` command writes
and handle `0x0012` (`fff1`) for `D203` notifications. The observed server MTU
is `247` after the app requests `517`.
## Live Telemetry Map
The main read command reads registers `0x0000..0x003D`:
@@ -137,6 +142,8 @@ if register 0x002F == 2:
and value derivation.
- `docs/command-catalog.md` - services, characteristics, frame formats, observed
commands, and telemetry register map.
- `docs/live-capture.md` - Android HCI snoop confirmation of handles, commands,
response byte counts, and decoded live telemetry.
- `evidence/apk-info.md` - APK/XAPK provenance, hashes, signer info, and
decompilation notes.
- `tools/bulltron_frame.py` - helper for building read/write frames with the