What was done
Desmond Opoku Mends and Claude Sonnet 5.5 decoded the Jieli RCSP protocol Oraimo's app uses from a phone's Bluetooth log, giving a command-line and terminal tool to remap earbud gestures and read the battery.
Desmond Opoku Mends built a tool to remap the tap gestures of Oraimo Spacebuds Neo earbuds and read their battery, together with Claude Sonnet 5.5 in Claude Code. He reverse engineered the earbuds' protocol from a phone's Bluetooth HCI log.
How it was done
The earbuds use a Jieli AC69xx chip and talk Jieli's RCSP protocol over Bluetooth RFCOMM, the same one the Oraimo app uses. The protocol was worked out from the HCI capture and written up in docs/protocol.md, which says what is and is not verified. The link-authentication cipher is a port of code from Jieli's own published repository. The tool runs from the command line, a terminal UI in WSL and a tmux battery segment. Tests run against a simulated earbud plus two challenge and response pairs captured from real hardware.
Results
The tool reads battery and gesture tables and sets single, double and triple tap actions per earbud, with a reset to factory gestures. Writes touch only the small gesture table and nothing flashes firmware. It was verified on one pair of earbuds with firmware v1.0. Which earbud is 1 or 2 and the battery byte layout are inferred from one capture, and two of the app's function codes remain unknown.