Reverse-engineering the Haicen / Chiptrip 12 V LiFePO4 BMS over BLE
How we decoded the Modbus-over-BLE protocol used by the HC BMS Android app, including the GATT layout, the six polling requests, frame formats, and the OTA bootloader trap that almost bricked our session.