Case study
bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol
Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.
- Targets
- Protocol
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
Requirements & limits
- Most research commits date from 2017 and 2018, with a few later fixes and a Docker setup added in March 2026. The README reports that large parts of the BLE protocol are understood, while the action list is incomplete, the update (DLC) format is only partly explored, and code execution, custom LCD animations and the sleep-mask connector remain untried.
- Requires a Furby Connect and a host with Bluetooth LE, built in or through a USB Bluetooth 4.0+ adapter. The repository contains no Hasbro update files or app code. The README warns that interfacing in unwarranted ways can brick the toy and will almost certainly void its warranty.
- fluffd needs Node.js 7.0 or later according to the README and pins @abandonware/noble 1.9.2-23. The README covers Linux, which needs libudev development files and a running BlueZ, and macOS, which needs xpc-connection, and also names FreeBSD and Windows. The Docker image uses node:16-bullseye, needs host networking for raw HCI access and supports Linux hosts only.
- The findings are the author's documented observations, made without opening the toy. The repository has no tests or CI.
- MIT (2017, Florian Euchner); the README's disclaimer says the information is for educational purposes only. Furby Connect, its companion app and Hasbro's content keep their own rights.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/bluetooth.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/generalplus.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/nordic.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/actions.md GitHub · Jeija/bluefluff · Revision 9e865c4
- fluffd/fluffd.js GitHub · Jeija/bluefluff · Revision 9e865c4
- fluffd/package.json GitHub · Jeija/bluefluff · Revision 9e865c4
- Dockerfile GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/docker.md GitHub · Jeija/bluefluff · Revision 9e865c4
- LICENSE.md GitHub · Jeija/bluefluff · Revision 9e865c4
More in Protocols
- pyatv: a reverse-engineered client for Apple TV and AirPlay protocols · Case study
- BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocol · Case study
- Even G2 protocol: reverse-engineering Even Realities G2 smart-glasses BLE traffic · Case study
- fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote control · Case study
- Gymnasticon: bridging proprietary exercise-bike data to standard cycling sensors · Case study
- garmin-ble: a Python client for Garmin's GFDI watch protocol · Case study