What was done
Assuero Morais audited the APK of his son's toy robot dog, read its Bluetooth protocol from Dalvik bytecode and rebuilt a privacy-friendly app in one day with Claude Code.
Assuero Morais bought a toy robot dog whose box pointed to an APK outside the Play Store. He audited it, reverse engineered its Bluetooth protocol and rebuilt the app from scratch in a single day, pairing with Claude Code. The README is in Portuguese with an English summary.
How it was done
The audit found a debug build that sent a child's voice to cloud speech services. The protocol came from reading Dalvik bytecode with dexdump, with no decompiler. A Python simulator rebuilt each model's command arrays from the bytecode. The robot does not use a GATT connection. Everything travels in Bluetooth LE advertisements with 11-byte packets, an anti-repeat counter and a checksum, and pairing is a handshake of advertisements. The work covers six models in two protocol families, and button names came from matching icons to command codes. The agent sped up bytecode analysis, implementation and tests, while the author directed the product and privacy decisions.
Results
The new Kotlin app has no internet permission, recognises voice commands offline with Vosk and has a kids' programming mode, with 52 unit tests. It also fixed a bug in the original app where one step triggered the claw on one model. It was tested on the FansiKids / UCC Life robot dog with claw. The protocol is documented for interoperability, and no code or assets from the original app were reused.