ProjectsOctober 18, 2026

JBL Wave Buds 2 Firmware Research

Evidence & reproducibility

Integrity 67% · 4/6 evidence signals

GOODPARTIALLY VERIFIED

The repository documents a byte-identical OTA repack and owner-reported successful delivery of a one-byte-modified image. Normal operation was observed afterward, but the modified byte was not read back and its execution remains unverified.

Machine-readable checks

✓ Pinned source revision and research documentation reviewed
✓ Byte-identical OTA repack documented in the research repository
◇ Modified-byte execution confirmed by device readback

Evidence

docs/02-ota-container-format.md: eight-stream OTA format and repack verification
docs/04-security-model.md: inspected OTA checks and unresolved bootloader boundary
docs/PROVENANCE.md: build-specific findings and evidence classes
docs/VALIDATION.md: reproducibility and hardware validation boundary

Environment

target: JBL Wave Buds 2 / Bestechnic BES1306 / PID 2100
builds: April 2025 analyzed ELF and September 2026 OTA package 2.9.0
method: Static analysis, OTA container reconstruction, app-side analysis, and owner-reported device observations

Last verified: 2026-10-18Verified commit b2603b40 ↗

Reproduction

Supply a legally obtained 2.9.0 package; use tools/ota_unpack.py to inspect it and tools/ota_repack.py make-test to produce the one-byte test modification. See docs/VALIDATION.md for checks and hardware limits.

Scope

Firmware and OTA reverse engineering of the JBL Wave Buds 2, covering the Bestechnic BES1306 platform, flash layout, update container, BLE/GATT commands, and app-side delivery.

Research target

• JBL Wave Buds 2• Bestechnic BES1306• Product ID 2100• OTA package 2.9.0

Research path

The analysis compares an April 2025 ELF build with the September 2026 distribution package. It documents an eight-stream OTA container, CRC-32 checkpoints, the BES TOTA v2 encrypted transport, and a build-specific factory command catalogue.

OTA research workflow

Owner-supplied package
Unpack and inspect
Minimal byte change
Repack and verify
Document device observations

The repository includes Python unpacking and repacking tools, a flash map, address and provenance ledgers, and reproducibility notes. Semantic recovery is deepest in the OTA, flash, CRC, and factory subsystems; the wider function catalogue does not imply complete understanding of every function.

Main findings

The inspected application OTA handler uses CRC-32 integrity checks; no firmware signature verification was identified in that path. This finding does not establish whether the ROM bootloader enforces secure boot. The work also distinguishes the app's anti-counterfeit RSA verifier from firmware signing, maps the staged update flow, and documents the client-side key derivation used by TOTA v2. Factory-console reachability over the air remains unresolved.

Hardware result and limits

A minimal test changes the final digit of an RTX version marker in one decompressed byte and recomputes the container CRC. The owner reported a successful update, reboot, and normal earbud operation afterward. The modified marker was not read back from the device, so update success is not proof that the changed image executed. Staged downloading also does not establish a recovery path after activation of a broken image.

Source and reproduction

The repository distributes research and tooling, without JBL firmware or a ready-to-flash image. Reproduction requires an owner-supplied package and the documented validation steps. Read the research and tooling on GitHub. Review the validation boundary.

Related projects

Prestige Client Security Research

Research

Reverse EngineeringWindows PEYARAMalware AnalysisSecurity Research

★ 0 stars⑂ 0 forks◌ 2 commits◉ 0 issues

ShellUpdated Aug 16, 2026

Evidence-driven static analysis of the Prestige Client loader and injection chain, documenting unsigned remote payload execution, process injection, and the boundary between proven findings and unverified claims.

Read case study View project

Samsung Odyssey G5 Firmware Research

Research

PythonSPARC V88051FirmwareReverse Engineering

★ 33 stars⑂ 0 forks◌ 21 commits◉ 0 issues

PythonUpdated Oct 17, 2026Release v1.0.0

Reverse engineering and reproducible tooling for the Samsung Odyssey G5 G55C firmware, including a minimal patch that exposes an existing hidden factory page.

Read case study View project