F-Fetch accomplished study into the Ellume COVID-19 Home Take a look at with the plot of finding counterfeit a COVID take a look at end result. This machine became chosen namely thanks to the Bluetooth machine that is used as the analyzer for checking out a nasal sample. As for the end result of this study, F-Fetch became suitable in falsifying a COVID take a look at end result, and received a certificate verifying the COVID take a look at end result.

This article will trudge over the technical exiguous print of how this study became accomplished.

The analyzer itself became a personalised board and an unheard of Lateral Float take a look at, with the customized board figuring out if the patron became COVID particular or negative. This decision is in line with what the “two lines” see like on the Later Float take a look at strip. The analyzer would then uncover the companion mobile app if the patron became COVID particular or negative.

On the board is some LEDs to illuminate the take a look at strip and some lens to study the take a look at strip end result lines. A gap on the case itself would be used to place the nasal sample on the take a look at strip.

The Android application contained an un-exported project referred to as “com.ellumehealth.homecovid.android/com.gsk.itreat.activities.BluetoothDebugActivity”. Whenever you happen to possess root level get entry to to your machine, potentialities are you’ll perhaps well additionally launch this project to abet interact with the analyzer over Bluetooth.

The utilize of this project, F-Fetch deduced that there possess been two forms of Bluetooth traffic that possess been more than likely to blame of informing the mobile app if the patron became COVID particular or negative:

• STATUS
• MEASUREMENT_CONTROL_DATA

Below is an example STATUS message:

64,-102,4,13,-119,85,0,11,4,1,0,1,0,-1,127,-19,13,103,-122

Breaking down the above traffic, the next files would be considered (the important thing to converting STATUS traffic to human readable files became chanced on within the Android app, class “au.com.ellume.estick_sdk.messaging.comms.payloads.StatusPayload”):

Array[0-1]     64, -102              commence of traffic

Array[2]       4                     the form of traffic (4 = STATUS)

Array[3]       13                    length of files in need of bytes

Array[4-7]     -119, 85, 0, 11       routine ID in unsigned byte values

Array[8]       4                     pickle of the take a look at

Array[9]       1                     algorithm pickle

Array[10]      0                     take a look at end result

Array[11-12]   1, 0                  measurement count

Array[13-14]   -1, 127               time till end result in unsigned byte values

Array[15-16]   -19, 13               time till the take a look at is regarded as to be failed

Array[17-18]   103, -122             crc price in unsigned byte values

Below is an example MEASUREMENT_CONTROL_DATA message:

64,-102,12,24,-119,85,0,11,-98,0,-128,7,-81,36,0,4,80,24,0,0,62,2,0,19,25,-124,26,-119,-66,-43

Breaking down the above traffic, the next files would be considered (the important thing to converting MEASUREMENT_CONTROL_DATA traffic to human readable files became chanced on within the Android app, class “au.com.ellume.estick_sdk.messaging.comms.payloads.MeasurementControlDataPayload”):

Array[0-1]     64, -102              commence of traffic

Array[2]       12                    the form of traffic (12 = MEASUREMENT_CONTROL_DATA)

Array[3]       24                    length of files in need of bytes

Array[4-7]     -119, 85, 0, 11       routine ID in unsigned byte values

Array[8-9]     -98, 0                sequence number unsigned byte values

Array[10-11]   -128, 7               timestamp in unsigned byte values

Array[12-14]   -81, 36, 0            measurement of line 1

Array[15]      4                     algorithm pickle

Array[16-18]   80, 24, 0             measurement of line 2

Array[19]      0                     hardware pickle

Array[20-21]   62, 2                 darkish frequency number in unsigned byte values

Array[22]      0                     take a look at end result

Array[23-24]   19, 25                c1 price in unsigned byte values

Array[25-26]   -124, 26              c2 price in unsigned byte values

Array[27]      -119                  checksum of measurement files in unsigned byte price

Array[28-19]   -66, -43              crc price in unsigned byte price

// if query is MEASUREMENT_CONTROLDATA

//     checksum price calculated from bArr[4-27]

//     crc price calculated from bArr[0-(length-2)]

// if query is STATUS

//     crc price calculated from bArr[0-(length-2)]

public static int b(byte[] bArr) {

    int yayintyay = 0;

    for (byte b : bArr) {

        for (int i = 0; i < 8; i++) {

            boolean z = ((b >> (7 - i)) & 1) == 1;

            boolean z2 = ((yayintyay >> 15) & 1) == 1;

            yayintyay <<= 1;

            if (z ^ z2) {