Reverse engineering Zhiyun Crane/Evo rage gimbal bluetooth commands

How to capture and analyze Bluetooth Low Energy traffic from an Android app to reverse engineer and replay gimbal control commands.

Bluetooth reverse engineering tutorial using android phone banana Pi usb bluetooth 4 module wireshark and Windows 10 PC. This tutorial includes how to: Capture Bluetooth traffic between Android phone and Bluetooth device. Analyzing packets using Wireshark Connecting and sending data to Bluetooth device using Pi computer and USB Bluetooth 4 dongle Commands used in the tutorial: hciconfig apt-get install bluez bluez-tools hcitool lescan gatttool -I connect MAC_ADDRESS_OF THE_GIMBAL char-desc 0x002c 0x002c (UP) char-write-cmd 0x002c 0610010e89c2bc061002080031eb char-write-cmd 0x002c 061003080006db0610010e89c2bc (Down) char-write-cmd 0x002c 061003080006db0610010176cc72 char-write-cmd 0x002c 0610010176cc72061002080031eb (right) char-write-cmd 0x002c 061002080031eb0610030dd9a37a char-write-cmd 0x002c 061002080031eb0610030e082d75 char-write-cmd 0x002c 061002080031eb0610030c863b51 char-write-cmd 0x002c 061002080031eb0610030dfdc79c char-write-cmd 0x002c 061002080031eb0610030e14fec8 (left) char-write-cmd 0x002c 061002080031eb0610030176a212 (Reset and lock) char-write-cmd 0x002c 0601270000b8670681270002451d (release) char-write-cmd 0x002c 061003080006db0681270001757e (Reset to landscape) char-write-cmd 0x002c 06010700003ea106c1210000b963 Android apps used zy play evo gimbals nRF Connect