M30 Security Lab
What can an old phone teach you about the systems underneath it?
I turned my own Samsung Galaxy M30 into a bounded Bluetooth research lab using an Android app and Linux fixtures. A supervised path reached the SCSC controller from Linux, supporting LE scanning and L2CAP echo across three Android-to-Linux-to-Android handoffs. A 100/100 echo run was corroborated with a second phone’s HCI log. Each experiment has hard caps, and an evidence ledger separates observed behavior from inference.
A measured handoff.
Three Android-to-Linux-to-Android transitions preserved the path to the controller. The instrumented L2CAP echo run delivered 100/100 replies, checked against a second phone’s HCI log.
Bounded by design.
The app and fixtures stop scans after 30 seconds or 500 records. Every claim in the research ledger is marked observed, inferred, or unsupported.
Follow the missing protocol.
I traced absent RFCOMM registration to a commented kernel Makefile entry and studied the vendor HAL in Ghidra. A separate kernel-diff project documents the later flashed research image.