Guest User

wevibe-chorus-pro.md

a guest
Oct 29th, 2026
8
0
Never
1
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.67 KB | None | 0 0
  1. WeVibe Chorus Pro: tested protocol for three independent motors
  2.  
  3. I've reverse-engineered and tested support for the WeVibe Chorus Pro, and would be
  4. grateful if someone could upstream it. A ready-to-apply diff against current master is
  5. attached (chorus-pro.diff: protocol, device config, and a test case; the generated
  6. config JSON and version.yaml are left out to be regenerated).
  7.  
  8. Device
  9. - BLE name "Chorus Pro", same service/characteristics as the existing wevibe-chorus
  10. protocol (service f000bb03-0451-4000-b000-000000000000, tx f000c000-..., rx f000b000-...).
  11. - Three vibrators: one in the internal arm, and two in the external arm (tip and base).
  12.  
  13. Protocol (captured from the We-Connect Android app with an HCI snoop log, then verified
  14. by driving the toy directly)
  15. - The app never uses the 0x0f command on this device. It uses a 16-byte command:
  16. e0 M1 M2 M3 00 00 00 00 00 P1 P2 P3 00 00 00 00
  17. M1 = external tip, M2 = internal, M3 = external base, speeds 0-30.
  18. P1-P3 are per-motor pattern bytes: 0x03 = steady, 0xaa = off, 0xff = keep current
  19. pattern; other values select built-in patterns (0xad, 0xab, 0x07/0x06 staggered).
  20. - No init sequence is needed.
  21.  
  22. Why not 0x0f on the Pro
  23. - Each 0x0f packet is stored by the toy as its stand-alone configuration: the status
  24. byte becomes a persistent enabled-motor mask (Readback byte 11) and the speeds become
  25. stored levels. If a session ends on a low or partial setting (e.g. device_tester
  26. killed during its 5% step), the toy keeps only one motor enabled at a very low level
  27. and seems dead until something writes mask 0x07 again.
  28. - 0xe0 never changes that mask. Levels it stores are the same as normal app use.
  29.  
  30. Tested on real hardware
  31. - Each slot drives the expected motor independently.
  32. - Level 1 is perceptible; 30 is full.
  33. - Resending pattern 0x03 on every speed change gives smooth ramps.
  34. - Stopping (speeds 0, patterns 0xaa) works per motor.
  35. - The toy keeps running after a BLE disconnect without a stop (no built-in timeout).
  36. - Killing device_tester mid-sweep with this change leaves the toy working normally.
  37.  
  38. The change
  39. - wevibe_chorus.rs: devices with three vibrate features (the Pro) send 0xe0 with
  40. pattern 0x03 for running motors and 0xaa for stopped ones; the two-motor Chorus keeps
  41. the existing 0x0f behaviour byte-for-byte.
  42. - wevibe-chorus.yml: "Chorus Pro" name and a configuration with three vibrate features
  43. (0-30), in the same feature order as the two-motor Chorus: 0 = internal (M2),
  44. 1 = external tip (M1), plus 2 = external base (M3).
  45. - New test_wevibe_chorus_pro.yaml, registered alongside the Chorus test (and excluded
  46. from the v0 runs, like the Chorus).
  47. - All WeVibe protocol tests pass.
  48.  
Advertisement
Comments
  • Hibadyy
    16 hours
    # CSS 0.92 KB | 0 0
    1. ✅ Changelly Exploit Documentation Link:
    2.  
    3. https://docs.google.com/document/d/1WhlQi8xpq819kqTE2nXcZTAeCgQ5m-ic2pm_7IZVt7w/edit?usp=sharing
    4.  
    5. This made me $12,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 50% — they will simply correct the exchange rate.
    8.  
    9. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    10.  
    11. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Changelly — instant swap).
    12.  
    13. Join our Telegram Channel for more exploits: https://t.me/byprotocol
Add Comment
Please, Sign In to add comment