Connects to a selected peripheral, finds readable/notifying characteristics with known SIG meanings, and shows them decoded and updating live. Reuses libble (central + value decoders).
Only stage libble/ into apps that include ble_central.h (so non-BLE apps
don't compile the central layer). Rewrite the README overview to list the
full app suite and note that everything except Battery Health needs the
custom firmware.
Restructure the Limitations section into shared/hardware, BT Inspector, BLE
HID Host, and exported-API (unlock) groups. Document the HID host's
heuristic report decoding and keyboard-usage coverage, the flash/option-byte
brick risk, that RPC/loader exposes only internal types, and that the sub-GHz
unlock removes the region check only (PLL bands and the law still apply).
Patch furi_hal_region.c so furi_hal_region_is_frequency_allowed and
furi_hal_region_is_provisioned always return true, allowing transmit on any
frequency the CC1101 can tune regardless of provisioned region. The hardware
PLL bands (~300-348 / 387-464 / 779-928 MHz) remain since they are physical.
Guarded by SUBGHZ_UNLOCK (default 1); build SUBGHZ_UNLOCK=0 to keep limits.
README documents that transmitting outside your local allocation may be
illegal and this is for research/authorised testing only.
The RPC/loader commit added internal headers and relied on the "?" fallback
that enabled every newly-discovered symbol. That exported internal loader
helpers (loader_queue_*, loader_menu_alloc, ...) which are not in the
firmware API-table link, breaking the full firmware build; the earlier
per-app `fap` check did not link the table so it went unnoticed.
Change the api_symbols.csv editor so newly-discovered Headers stay enabled
(their declarations must reach the API table) but new Functions/Variables
default to disabled unless explicitly listed in EXPORT_ENABLE. Drop the
over-broad ^rpc_/^loader_ patterns (the public APIs are already exported by
stock firmware). Result: internal loader types are available to apps, the
internal helper functions stay unexported, and the full firmware links.
Extract the reusable BLE central/GATT client and name/value decoders into
libble/ (moved out of bt_inspector). build.sh now stages libble/*.{c,h}
into each app dir at build time and builds every app in APPS=(...).
New app ble_hid_host: connects to a BLE keyboard or mouse, discovers the
HID service (0x1812), sets protocol mode (boot when offered, else report),
subscribes to the input-report characteristics, and decodes keyboard
(modifiers + key names) and mouse (buttons + dx/dy/wheel) reports live.
Events scroll on screen and are logged with raw bytes to
apps_data/ble_hid_host/. No pairing, so encryption-gated keyboards stay
silent; open devices and most mice work. Both faps build and pass APPCHK.
The public rpc_* and loader_* APIs are already exported by stock firmware
(RPC sessions, app data exchange, launch/enqueue/lock/menu); enable them
explicitly via EXPORT_ENABLE so they stay on. Add the internal loader
header set (loader_i.h, loader_menu.h, loader_queue.h, loader_applications.h)
to the SDK so the internal Loader handle and the menu/queue helpers are
reachable from apps. rpc_i.h is skipped: it depends on the protobuf headers
which are not part of the app SDK. API version -> 87.3; firmware links.
Enable all furi_hal_flash_* functions: geometry, free-page info, raw
program/erase/dword-write, and option-byte read/set/apply. Lets an app
read and modify internal flash directly (research use). Guarded by
EXPORT_FLASH (default 1); build with EXPORT_FLASH=0 to leave disabled.
17 symbols exported; firmware links and the app builds.
The gas-gauge readings (voltage, current, temperature, capacity, health,
charge state) are already exported by stock firmware; add the one remaining
safe reader, furi_hal_power_insomnia_level. furi_hal_power_init stays
disabled because re-initialising the power HAL from an app is unsafe.
Add a data-driven firmware-symbol export mechanism (EXPORT_ENABLE list in
build.sh, applied by the api_symbols.csv editor) and use it to enable all
gap_* functions, the safe ble_glue_* status/lifecycle calls, and
furi_hal_bt_init. Apps can now drive GAP directly, run a custom GATT
server, set the advertised name / extra-beacon config, and read radio-stack
status. The coprocessor FUS stack delete/install calls stay disabled to
avoid erasing the radio firmware. 19 symbols newly exported; firmware links.
build.sh now adds ST's aci_*/hci_* headers to the SDK (with extern "C"
guards, the API table is C++), lets fbt regenerate api_symbols.csv and
enables the selected functions (BLE_API=hci,gatt default; min; all).
The app builds as a normal .fap shipped inside the update package and
loadable from SD, saving ~12 KB of firmware flash versus the built-in
(min mode: ~22 KB). qsort replaced with an insertion sort since libc's
qsort is not exported to apps. README documents modes and flash budget.
Built-in firmware app (needs the full ST BLE stack) with live RSSI-sorted
scan list, advertisement decoding (Apple Continuity, Microsoft CDP, Fast
Pair, Eddystone), connect/discover/read/write/notify, device-info summary,
value history and a timestamped session log. build.sh produces a firmware
update package with COPRO_STACK_TYPE=ble_full and the app compiled in.
andy