Magicband+ Pairing Details

MagicBand+ Pairing Reverse Engineering Notes

Last updated: 2026-05-15 These notes summarize MagicBand+ BLE pairing and command behavior observed from the MagicBand Workbench experiments done on stream on May 15, 2026. The focus is on facts we have directly observed, plus clearly marked hypotheses for areas still under investigation.

Scope

This page covers:

• MagicBand+ BLE advertisement and service discovery behavior.
• The FE03/Amazon Gadget-like session used by MagicBand+.
• Commands observed or successfully sent during pairing/session setup.
• The protobuf command envelope used for Disney custom commands.
• The working custom animation payload format.
• Known unknowns around gestures, alerts, assets, tokens, and per-band/session values.

Hardware / Test Context

Observed device:

• MagicBand+ named like: MagicBand+ B28C
• Example serial seen in command payloads: xxxxxxxxB28C
• Example DeviceStatus identity-like field: xxxxa2e

Important caution:

• A second MagicBand+ paired with the workbench, but initially did not play custom animations when hardcoded command serials were used.
• This strongly suggests that at least the serial field, and possibly other tokens, need to match the currently connected band/session.
• The workbench now captures the live 12-character serial from incoming FE03 traffic and uses it in generated commands.

BLE Advertisement

MagicBand+ advertises an Amazon Gadget-like service UUID:

• FE03

Known advertisement clues:

• MagicBand+ pairing advertisements may include a local name containing MagicBand+.
• Manufacturer data often begins with 7101041380.

MagicBand+ B28C
RSSI: -31 to -63 in observed tests
Services: FE03
Manufacturer: 7101041380a3f15da26e

GATT Services and Characteristics

After connection, observed services include:

• FE03
• FD98
• 1D14D6EE-FD63-4FA1-BFA4-8F47B42119F0

Observed FE03 characteristics:

Service	Characteristic	Properties	Notes
FE03	F04EB177-3005-43A7-AC61-A390DDF83076	write	Primary write path used successfully for handshake and commands.
FE03	2BEEA05B-1879-4BB4-8A2F-72641F82420B	notify	Primary notification path. Most observed FE03 traffic arrives here.
FE03	74F996C9-7D6C-4D58-9232-0427AB61C53C	write	Additional FE03 write path discovered. Not the main successful path so far.
FE03	B32E83C0-FECE-47C1-9015-53B7E7F0D2FE	notify	Secondary notification path. Deferred in minimal session. May matter for gesture/event experiments.