A developer reverse-engineered the iOmeter Bridge's Bluetooth onboarding protocol to connect the device to a hidden Wi-Fi network that the official app can't handle. The app is Flutter-based, so blutter was used to reconstruct Dart AOT snapshot code, revealing a GATT service with HDLC/PPP framing (CRC-32), a gRPC-style RPC layer over BLE, and protobuf message schemas. A Python client using bleak was written to call ConnectWifi directly with a hidden SSID, bypassing the app's scan-picker UI limitation. The post also explores whether the Bridge can operate without the vendor cloud by pointing ConnectBackend at a local Mosquitto MQTT broker — the firmware accepted the request but cloud-free operation isn't yet confirmed end-to-end due to network isolation issues. The proof-of-concept client is available on GitHub.
