All right, guys.
So here we have now our Furby together with our smartphone.
And I would suggest let's simply start hacking this.
So the first thing we need to do is we need to wake this Furby up because after waking up, the shop
is advertising itself to this area over here and we can pick it up.
Okay, so let's do this.
Okay, so I'm just pressing a button on this Furby and the Furby becomes quite loud.
I hope it's not that horrible.
Otherwise I have to pick up a separate microphone.
So let's see.
Okay.
So the Furby is now waking up and we can now connect this Furby to a mobile application.
And fortunately this mobile application is also not available anymore.
But that's not a big deal because some people have reverse engineered this whole protocol and have created
their own app, which can talk to this Furby, even if this Furby is talking all the time in the background.
Yes.
Okay.
So let's switch back to the desktop and have a look into this mobile app.
All right.
So let's log in here.
We have it right now.
So that's mobile app.
You can find this on J Stone, dot GitHub, dot IO.
So the whole Furby communication hack has been identified by a German student.
Which nickname is Cha Cha?
But some people have extended the things he has discovered and yeah, have written some awesome apps.
For example, this one over here.
So now we are clicking connect by the way, this just in Chrome browser, but the Chrome browser is
also able to to do Bluetooth low energy.
And we can see we've got an Furby over here.
Awesome.
Let's pair with this one.
And there we go.
So now we are paired and we can see.
Yes, the antenna colors of this Furby has have changed quite often.
So now we've got this mobile app and we can now change the antenna color over here.
For example, two red, green, blue and white.
Red, green, blue and white.
Red, red, red, red, red, red.
Okay.
So I guess we have we have enough data right now.
Let's disconnect from this Furby.
Let's put him asleep.
Let's put him asleep once again that it's not that annoying anymore.
All right.
And now let's fetch the data from the smartphone and analyze it within BioShock.
Okay, so let's switch back to the desktop.
Okay.
And now open a new terminal.
ATP Back report.
Furby.
Once again, this report will fetch all the data, not just the data related to Bluetooth low energy,
but sometimes this this file is not accessible on smartphone.
And I would like to provide you an solution that works all the time.
Afterwards, we will have an look into the Wireshark dump and we will try to identify the concept behind
this antenna color.
And then I will show you some really awesome things that we can do with this.
Furby.
All right.
Okay.
Do not get fooled by 93%.
This will take quite a while.
So I will see you in just a moment.
Okay.
So here we have it right now.
So let's put this on the left.
I guess we can close this right now.
All right.
And let's investigate this.
So here's our Furby sip.
Let's extract it.
Within Ef-s data, misc, Bluetooth locks we've got now the Bluetooth, the BT Snoop HD log and this
one, this is the last lock.
So the last time we have we have used this one.
So let's open the new terminal, right click, open the new terminal and open this file in Wireshark.
Guys.
Sometimes it takes a while until you realize that the camera is blocking all the important stuff you
just wanted to show right now.
So therefore, let's have a look into this file.
Once again, we're still talking about the Bluetooth low energy capture between the smartphone and the
Furby application.
So we have changed the antenna color from red to to what was it?
Bright green, blue and white, this, I guess, a couple of times.
And then at the end, we have changed it to red a few more times, right?
Absolutely.
Okay.
So let's have a look.
The good thing is we can still ignore everything between host and controller so we can scroll down.
Okay.
We have to scroll down quite a lot.
And here we have it.
So let's grow up again.
Yes.
So here we can see how the last three bites of the Mac address.
This is our pixel two device.
And here we have now the full Mac address.
So if Apple is broadcasting its name, this is awesome because now we definitely know this is the Furby
device, but the vendor of this Mac address is not known to Wireshark.
I mean, it's not a big deal.
We have already identified this device and I guess there isn't another connection in there, so we can
be sure that this is our third device.
All right.
Let's have a look into this one.
Once again, the smartphone is sending a request and asking for the generic attribute profile of this
Furby.
And here the verb is responding with this one.
Yes, here we can see generic x is profile.
So the smartphone is simply asking the Furby, hey, Furby, what services do you offer?
And the Furby is simply responding with a list of characteristics and services the Furby offers, for
example, the antenna color.
Okay, so let's see if we can find this package regarding to the antenna color and let's grow it down
a little bit because we have seen the exchange of information.
It takes quite a few pictures.
Okay.
So what I'm looking for are packages right now from the smartphone to the Furby.
So let's see.
Yes.
I guess here we've got a bunch of packages which comes from the smartphone.
Okay, let's let's investigate this.
So here we've got now the pixel two device and our Furby.
And we can see we have in right command.
This sounds absolutely interesting because the smartphone is telling the Furby to change the color of
the antenna.
So it's most probably in right command this one.
So we can see, yes, we are sending this to the Furby right.
Command on this handle.
Let's open this one.
And this is now the service uid and this one is the characteristics uid so I guess they are different
once again.
So we are writing to this uid this value 14 f0000.
Okay, let's have a look into the next package.
What is also interesting over here is that the right command does not await in response.
So we are just simply sending a command to this Furby, but we are not awaiting the defer Furbys answering
to this one.
So we can see we've got a bunch of requests over here, but none of them has as source the Furby in
here.
So we are just sending requests from the smartphone to this Furby.
Okay.
Now I would suggest let's have a look into the other packages and let's observe how the value over here
changes.
So let's take this package.
Och.
It stays the same.
Also the same.
All right.
And let's go up a little bit.
What we have here.
And same.
Now it changes.
All right.
It changes from 50000 to all FS this one.
Oh, it changes once again.
0000f this one.
Once again, 00400.
Okay.
So we already got a good feeling that this one is related to the antenna color.
And if we if you think of these steps we have done and let's open this one.
So we have sent the antenna color red, green, blue, white, red, green, blue, white, maybe once
again, not true about this one.
Red, green, blue, white.
But then then we did send red, red, red, red, and then we didn't disconnect.
So the last pictures in our connection regarding to a handle which has been requested quite often before
should be our antenna color red.
Right.
And let's see.
Okay.
So here we are having the handlers zero 0 to 6.
Okay.
This is now the value 2006.
Okay.
And let's see.
This one is a 14 f0000.
Let's go up a little bit.
14 ff00 14 f f f 14 f f.
Okay, so this one seems to be the code for changing the antenna color to red and now it's up to you.
Can you already figure out how this code is being constructed that, for example, we can send an antenna
color which is not included over here?
Let's choose an antenna color like yellow.
All right.
Think about this for just a moment, and then I will provide you an additional hint.
All right, in case if you could already solve this.
Perfect.
This is how you analyze Bluetooth low energy connections and also play around with this one.
So to identify patterns and reconstruct what these bits and bytes could mean in case if you couldn't
figure it out already.
Absolutely no problem.
We have just observed one package, but I mean, we have access to many packages.
So let's see before we change to red, we have used wide, which means the package when it changes,
it should be the representation regarding to the color code white.
And let's see when this happens.
Okay.
Here?
Nope.
There we have it.
Okay.
Here changes.
Right now, the value, which means this is now the representation of white.
So maybe one more package.
If this one is white, the package before should have been blue.
Let's see.
All right.
And I guess with this information, it might be clear right now.
So we've got the 14 in front.
Okay.
And then we are having three bites regarding to the colour.
Might this be Archie be so red, green, blue?
I guess it is.
Let's see if this one is blue.
Then before we had green, which means if those two bites are red, then you should have 00f for green.
Zero zero.
Let's see.
Perfect.
So it's simply just in color code in RCB format.
The 14 in front means the the addressing of the intended color.
Because the last package we have seen over here.
It's regarding to the same handle but hasn't completely different structure.
All right.
Okay.
So our task right now would be sending something which is not included in this application.
For example, the code regarding to yellow.
So do you know which bytes we need to send to this characteristics?
So to this uuid.
So how these bytes should look like.
And think about this for just a moment and then you will do the solution.
But I guess you already figured it out.
So let's see.
Okay.
So here we are back right now.
So if you want to send the color code for yellow, we have to use red and green, which means the package
should look like as follow 14 f f for red.
F F for green, yes and zero zero for blue.
So it's sometimes a little bit hard to to memorize all these color stuff.
But yes, a 14 ffff00 should be the color code for yellow.
And I mean, this one is not being included in this application.
So if this works, we have we have additional features which has not been implemented over here.
Absolutely.
Awesome.
Right.
And this is how we analyze the Bluetooth low energy connection.
I mean, those service utilities and also those characteristics are now well documented and we could
look them up.
But this is something you can do afterwards if you want to play around with this one.
I mean, you have to get refurbished, but this is something which gets super fast, absolutely annoying.
So therefore, I'm not sure if you want to have this.
All right.
Right now, let's try this out.
Let's figure out how we can enumerate those characteristics on the Furby and most importantly, how
to send data to this one.
Are you ready for this?
Then let's go.
Let's finally start hacking this Furby.
Okay, so the application we need or I recommend is the application from Nordic.
So this one over here, I will also provide you a link regarding to this one.
NAF Connect let's open this one.
We can see it's immediately starting scanning if Bluetooth is enabled of course.
And we can also see here we've got our Furby.
Perfect.
Let's connect to this Furby.
And see.
We can see we've got client and also server right now.
If we go back to the client, then we can see we've got now generic access attributes and also unknown
services.
Let's let's enlarge this perfect here.
We can now see all those characteristics and we can also see, notify, read, write, no response,
notify and read and so on.
So the only thing we need to do is we need to identify the UUID, the A, B, nine one over here, and
then we need to write this value.
14 What was it, red and 14.
ffff00.
I guess this was the value.
So let's see, the first the hard part is identifying this because we have seen it could be only one
byte and making the difference between this UID and another one.
Okay.
So first of all, we can also navigate around because this upper arrow key means we can write to this
characteristics, so therefore we can already ignore things like this one.
Okay, so is it this one?
No, it's not this one.
Yes, I guess I have found it, so I would assume it's this one over here.
Let's see.
Okay.
Now we have to be very careful because we are writing now two in characteristic and we could damage
or break this Furby if we are not knowing what we are doing.
Okay, so I really hope you know what we are doing.
Let's see, 40 ffff00 and now let's observe the antenna color of this Furby.
Let's see if it turns yellow in 3 to 1.
Perfect.
Nice.
We can see this antenna color.
Whoops, this antenna color.
This way has turned yellow.
So this feature is not being enabled in the application over here.
But yeah, we have identified this on our own by analyzing the, the packages we have sent to this Furby,
it immediately turned off.
But I guess this is if you send it again, it should stay.
Let's see.
No, it should be fffff00 oc sent 3 to 1.
Yes, oc now it it stays active.
Not sure how long, but we can see.
Cool.
We can interfere with this furby and also.
Yeah.
Perform certain action that has not been defined in this way.
Nevertheless, cha cha already did an amazing job and has a lot of nice features found in this Furby.
For example, this one over here.
And let's get back to this application.
This, by the way, is not the application that cha cha cha has written.
Cha Cha Cha has written this in a blue fluff application, but this requires no chairs.
And this one can be this one can be used even with Chrome browser.
So let's see, let's connect back to the Furby.
Okay, let's connect to this one.
All right.
Besides those antenna colors, we've got some other amazing features.
For example, we've got Deepak.
And if we can, for example, turn off the eyes of the Furby.
3 to 1.
And we can also enable this once again.
But now the most amazing part within this, Furby, is the debug command, because this one, it's the
command DB.
We can also send this on our own and this one will print out an terminal interface on the eyes of this
Furby.
Sounds absolutely crazy, right?
And it is.
So therefore, let's zoom in a little bit, have them side by side, and then let's see how it looks
like.
Okay.
Now we have them side by side.
Let's see.
I'm pressing debug in 3 to 1.
There we have it.
Awesome.
Right.
So we can see and terminal screen appears on those eyes.
Let's zoom in a little bit more.
Awesome.
So we can see wellness fulness and things like this.
We can also cycle through this debug command and there we have it.
So now.
We are getting even more information.
So this is pretty cool, but it can be even cooler because besides this feature, we also got something
like actions and here we can see Legendary.
It's an predefined action which is already included in the Furby.
So the verbal is capable to do some animation in their eyes.
For example, regarding to in chili pepper or regarding to stars and melon and things like this.
This is a special file format which has been created by Hasbro.
So the window of the Furby and yeah, some people have reverse engineered and created their own files.
Before we go into this one, let's play the existing file.
So over here, let's do this in 3 to 1.
Furby, how is this course?
Legendary.
Absolutely.
So Furby screaming out that this quest is legendary.
And I'm pretty sure these are pre-defined actions which can be triggered by a Bluetooth low energy.
And now finally, let's flesh and custom file and custom DLC file to this Furby.
This file has been already created by some guys from the context company and I'm just reusing it.
So no credits to me or credits to context.
But this one, it's pretty nice.
So let's do this.
Let's zoom out a little bit.
There we go.
And now let's choose something really cool.
So this one, this one, it's a DLC file and custom one from the company context.
And this one, it's an animation, AI animation and also an audio file.
So let's do this.
And 3 to 1.
There we go.
Isn't this amazing?
So the firm is now displaying hacked and screaming some weird stuff.
And also those those motor rotations are being enabled.
So this is freaking awesome, right?
Absolutely.
Okay.
And this is also the end regarding to our Bluetooth low energy journey.
Those two videos have become quite long.
Yes, but I guess having this explanation helps quite a lot.
If you want to analyze some Bluetooth low energy connections, also the developer option, this high
block file is super helpful regarding to this whole process.
Okay, so thanks for all your patience and thanks for going through this.
In case if things are unclear, don't worry, you do not need to have this knowledge to move on in this
course.
This was some kind of bonus section regarding to Bluetooth low energy.
Alrighty.
Okay.
Therefore, I'm really looking forward to see you in the next video.