Reverse‑Engineering the WIZPR Ring BLE Protocol

The article details the reverse‑engineering of the WIZPR Ring’s undocumented BLE protocol. The ring exposes a single BLE service with seven characteristics; characteristic 00000007 handles commands such as CLICK, MIC_PRE_ON, MIC_ON, MIC_OFF, BATTERY, and GET_VERSION, while 00000001 streams audio. The audio stream uses IMA ADPCM 4‑bit, 16 kHz mono, 224 bytes per packet (28 ms), requiring a continuous decoder state across packets. There is no pairing, authentication, or session handshake, and the ring has no vibration motor or haptic feedback. The author used bleak on macOS, a PySide6 UI, and a named pipe daemon to capture and decode the stream. The reverse‑engineering effort uncovered the full command set, the audio codec, and the lack of security features, enabling developers to build custom applications that interact with the ring.

Key takeaways include the simplicity of the protocol, the need for continuous decoder state, and the absence of authentication, which could be a security concern. The article also provides a detailed protocol diagram and sample code snippets for connecting, sending commands, and decoding audio.

This work demonstrates how to turn a proprietary wearable into an open‑source platform for developers and hobbyists.