Thread | Brutkey

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

Bluetooth is done over BLE and no auth or pairing is done.

There is a little hamburger menu for some reason opens up an text input for "password".

Without knowing the password. It would be impossible to go any further.

android screenshot showing input password box.

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

after starting from 0, I worked my way up. 1, 2, 3,... 9998, 9999. Jackpot.

I kid, I just used apk2gold to decompile the app and searched for "password".

Two passwords exist. 9999 and 736263.

Screenshot of decompiled code showing the two passcodes in plain.

1.3.6.1.4.1.61513
@xssfox@cloudisland.nz

The 736263 passcode seems to allow setting the device name.

9999 is more scary and seems to set a lot of the BMS parameters. I'm not sure if these are sanity checked by the BMS but I don't think it would be hard to put the BMS into an unsafe state with this control.