mirror of
https://git.churchofmalware.org/leviathan/OVERWATCH
synced 2026-09-24 08:35:03 +00:00
KaraZajacandClaude Fable 5.1
d8c916f25c
Extends the GLASSES family of the COMMERCIAL source from the identifier set curated by Nearby Glasses (Yves Jeanrenaud, github.com/yjeanrenaud/ yj_nearbyglasses, AGPL-3.0). What is taken is the project's published identifiers — facts about the radio protocol — not its code, and every company id was re-verified against the Bluetooth SIG assigned-numbers registry (4,035 entries) before landing. New coverage: - HeyCyan-SDK primary service UUID 7905FFF0-B5CE-4E99-A40F-4B1E122D00D0, which identifies the Nilox Smart AI Glasses (ALDI/Hofer) and other HeyCyan-based frames. It is fixed on the software side, so it survives the randomised MACs and unstable names that defeat most glasses detection. - Service UUIDs are now read from advertised service-data keys as well as the service list; HeyCyan frames have been seen carrying it either way. - Case-insensitive name tokens rayban / ray-ban / ray ban / heycyan, kept separate from the case-sensitive hint list so short generic words stay strict. - The HeyCyan and Echo AVS service UUIDs join the screen-off ScanFilter set, ahead of the company ids, so glasses can be caught with the phone in a pocket. COMPANY_IDS is reordered glasses-first for the same reason: with the 16-slot cap, what falls off the end is now a fixed home speaker, not a body-worn camera. Verified on Android 16: 19 filters trim to 16, no scan failures. Deliberately not taken: 0x05D6 (Zhuhai Jieli). Nearby Glasses lists it for the Rogbird VisionPro and Rollme VistaView, but it is the id of the Jieli JL70xx Bluetooth chipset found in a huge share of cheap earbuds and speakers; matching it would label every one of them "Smart glasses". Same rationale as the existing TCL exclusion. Documented in MicTargets, README and SOURCES.md. Also fixes a pre-existing mislabel surfaced by the registry check: 0x05A7 is Sonos Inc, not "Yingxin / cheap-spy-cam". It was mapped to HIDDEN_CAM and would have tagged a Sonos speaker as a hidden camera. Sonos stays in scope (the Era/One lines carry always-on microphones) under a new SONOS family that reads "Sonos speaker". Credit added to README (reference repos), SOURCES.md §3.7 and the showcase site. Two small upstream notes recorded for passing back: the CSV's Snap row carries 0x0D53 (Luxottica; the project's code has Snap correctly as 0x03C2), and its scanner reads only the first manufacturer-data entry. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
