Bluetooth Firmware
Look a little deeper.
STATIC ANALYSIS / 2026A tiny device can hide a surprisingly complex system.
I performed offline static analysis of eight commercial TWS earbud firmware images across the JieLi AC710N and BES2300 families. I wrote a custom unpacker for one proprietary container, imported application code into Ghidra for ARM/Thumb and vendor-DSP analysis, and traced AVDTP, RFCOMM, SDP, and SPP paths. I also used JADX to map BLE/GATT and OTA behavior in a companion Android app; two findings were checked in a second independent static-analysis pass.
Unpack what the vendor packed.
A custom unpacker exposed code from one proprietary container. Ghidra analysis covered ARM/Thumb and vendor-DSP/Pi32v2 instructions across eight images.
Follow the protocol path.
I traced AVDTP, RFCOMM, SDP, and SPP code, including an in-image heap-overwrite condition from an undersized SPP event. Companion-app analysis mapped BLE/GATT transport and OTA handling.
State the evidence boundary.
These are confirmed application-code behaviors in offline static analysis, not demonstrated remote exploits. No device was flashed, and no live radio traffic was sent.
