Jjdb210: Created page with "= MagicBand+ Pairing Reverse Engineering Notes = ''Last updated: 2026-05-15'' These notes summarize MagicBand+ BLE pairing and command behavior observed from the MagicBand Workbench experiments done on stream on May 15, 2026. The focus is on facts we have directly observed, plus clearly marked hypotheses for areas still under investigation. == Scope == This page covers: * MagicBand+ BLE advertisement and service discovery behavior. * The FE03/Amazon Gadget-like session u..."

2026-05-15T13:54:00Z

Created page with "= MagicBand+ Pairing Reverse Engineering Notes = ''Last updated: 2026-05-15'' These notes summarize MagicBand+ BLE pairing and command behavior observed from the MagicBand Workbench experiments done on stream on May 15, 2026. The focus is on facts we have directly observed, plus clearly marked hypotheses for areas still under investigation. == Scope == This page covers: * MagicBand+ BLE advertisement and service discovery behavior. * The FE03/Amazon Gadget-like session u..."

New page

= MagicBand+ Pairing Reverse Engineering Notes =
''Last updated: 2026-05-15''
These notes summarize MagicBand+ BLE pairing and command behavior observed from the MagicBand Workbench experiments done on stream on May 15, 2026. The focus is on facts we have directly observed, plus clearly marked hypotheses for areas still under investigation.
== Scope ==
This page covers:
* MagicBand+ BLE advertisement and service discovery behavior.
* The FE03/Amazon Gadget-like session used by MagicBand+.
* Commands observed or successfully sent during pairing/session setup.
* The protobuf command envelope used for Disney custom commands.
* The working custom animation payload format.
* Known unknowns around gestures, alerts, assets, tokens, and per-band/session values.
== Hardware / Test Context ==
Observed device:
* MagicBand+ named like: <code>MagicBand+ B28C</code>
* Example serial seen in command payloads: <code>xxxxxxxxB28C</code>
* Example DeviceStatus identity-like field: <code>xxxxa2e</code>
Important caution:
* A second MagicBand+ paired with the workbench, but initially did not play custom animations when hardcoded command serials were used.
* This strongly suggests that at least the serial field, and possibly other tokens, need to match the currently connected band/session.
* The workbench now captures the live 12-character serial from incoming FE03 traffic and uses it in generated commands.
== BLE Advertisement ==
MagicBand+ advertises an Amazon Gadget-like service UUID:
* <code>FE03</code>
Known advertisement clues:
* MagicBand+ pairing advertisements may include a local name containing <code>MagicBand+</code>.
* Manufacturer data often begins with <code>7101041380</code>.
<pre>
MagicBand+ B28C
RSSI: -31 to -63 in observed tests
Services: FE03
Manufacturer: 7101041380a3f15da26e
</pre>

== GATT Services and Characteristics ==
After connection, observed services include:
* <code>FE03</code>
* <code>FD98</code>
* <code>1D14D6EE-FD63-4FA1-BFA4-8F47B42119F0</code>
Observed FE03 characteristics:
{| class="wikitable"
! Service
! Characteristic
! Properties
! Notes
|-
| <code>FE03</code>
| <code>F04EB177-3005-43A7-AC61-A390DDF83076</code>
| write
| Primary write path used successfully for handshake and commands.
|-
| <code>FE03</code>
| <code>2BEEA05B-1879-4BB4-8A2F-72641F82420B</code>
| notify
| Primary notification path. Most observed FE03 traffic arrives here.
|-
| <code>FE03</code>
| <code>74F996C9-7D6C-4D58-9232-0427AB61C53C</code>
| write
| Additional FE03 write path discovered. Not the main successful path so far.
|-
| <code>FE03</code>
| <code>B32E83C0-FECE-47C1-9015-53B7E7F0D2FE</code>
| notify
| Secondary notification path. Deferred in minimal session. May matter for gesture/event experiments.
|}

Magicband+ Pairing Details - Revision history