Very interesting, I've not yet ventured in to the BLE protocol world yet. I'd love to see what the Fitbit protocol looks like, they require a special USB dongle just to connect to Macs that already have BLE built-in, yet iOS hardware works on its own. Strange.
My first opportunity to reverse engineer undocumented hardware was Ubiquiti Networks Airview2 900MHz/2.4GHz spectrum analyzer USB sticks, the cheap $39 ones that hit the market back when Wi-Spy sticks were really the only comparable hardware and were quite a bit more expensive. They have an undocumented serial protocol for controlling the device and getting RF power level readings (and the proper info to parse it).
Once I got the basic command set figured out I wrote up documentation and a Python library[1]. Without reverse engineering the device firmware or the original software it was basically blind guessing (and later automated guessing). Finding a new command and being able to put more and more of the puzzle pieces together to see the big picture is really fun :)
My first opportunity to reverse engineer undocumented hardware was Ubiquiti Networks Airview2 900MHz/2.4GHz spectrum analyzer USB sticks, the cheap $39 ones that hit the market back when Wi-Spy sticks were really the only comparable hardware and were quite a bit more expensive. They have an undocumented serial protocol for controlling the device and getting RF power level readings (and the proper info to parse it).
Once I got the basic command set figured out I wrote up documentation and a Python library[1]. Without reverse engineering the device firmware or the original software it was basically blind guessing (and later automated guessing). Finding a new command and being able to put more and more of the puzzle pieces together to see the big picture is really fun :)
[1] http://infincia.github.io/pyairview/