The application initiates BLE scanning to detect BLE devices within range by calling BuetoothAdapter.LeScanCallback The advertised device name is is checked to see if it matches to three different strings: Re implementing the decryption using the hardcoded key and first encrypted BLE message received, we can verify that our decrypted value is the same as what the hooked decrypt() function in Frida returned: #!/usr/bin/python3 import asyncio import sys from bleak import BleakClient import binascii from Crypto.Cipher import AES from datetime import datetime key = bytearray([(b&255) for b in [108,101,97,103,101,110,100,-1,-2,49,56,56,50,52,54,54]]) char = "0000fff4-0000-1000-8000-00805f9b34fb" async def main(address, char): async with BleakClient(address, char) as client: print("[+]…