I Reverse Engineered Snapchat Spectacles 2 and Built My Own iPhone App

I had a pair of Snapchat Spectacles 2 sitting around that I wanted to use again.

The hardware still worked perfectly fine. The problem was the software.

So I decided to figure out how the glasses actually communicate with a phone and build my own client.

The result is Malibu: an open-source iPhone app that can pair directly with Spectacles 2 and import their videos without a Snapchat account or cloud service.

GitHub: https://github.com/Cynostial/malibu

It started as a Windows probe

I didn't start by building an iOS app.

The first goal was simply to understand what the glasses were doing.

Bluetooth advertisements exposed a pairing marker, and looking at the GATT services revealed a BLE service with UART-like characteristics. From there, I started capturing packets and figuring out the command framing.

Eventually I found that the protocol wasn't just a simple collection of Bluetooth commands.

There was an actual pairing and authentication protocol underneath it.

Reverse engineering the pairing protocol

After inspecting the old client and comparing it with packet captures, I found that Spectacles 2 use protobuf messages for commands and media metadata.

The pairing process includes an X25519 key exchange, a proof exchange, and an AES-GCM encrypted session.

Getting this right was probably the most interesting part of the project.

It wasn't enough to identify the cryptography being used. Things like nonce ordering, message layout, key inputs, and byte ordering all had to match what the glasses expected exactly.

I reproduced the protocol in Python first so I could test it independently before trying to implement everything inside an iPhone app.

Once I could reliably authenticate with the glasses, the rest of the system started opening up.

Bluetooth is only half of it

Spectacles don't actually transfer the videos over Bluetooth.

BLE handles things like:

• discovery
• pairing
• authentication
• controlling the glasses
• starting their Wi-Fi network

For the actual media transfer, the glasses create their own private Wi-Fi access point.

The iPhone joins that network and talks directly to a media service running on the glasses. Malibu can then retrieve the media catalogue, thumbnails, and MP4 data.

So the basic architecture looks like this:

iPhone
  |
  | Bluetooth LE
  | pairing / authentication / Wi-Fi control
  v
Spectacles 2
  |
  | private Wi-Fi
  | thumbnails / MP4 data
  v
Malibu
  |
  v
Photos / Files

Everything happens locally.

There is no Malibu server in the middle and no account required.

Making it feel like a normal iPhone app

Reverse engineering the protocol was one problem.

Making the result pleasant to actually use was another.

I didn't want the workflow to be:

1. Open Settings.
2. Manually connect to some Wi-Fi network.
3. Return to the app.
4. Import.
5. Repeat every time.

On modern iOS, Malibu uses Apple's AccessorySetupKit to authorize the Spectacles as a Bluetooth and Wi-Fi accessory.

After the first pairing, Malibu can authenticate with the glasses, ask them to start their saved private network, join it, and begin importing videos automatically.

If a connection drops in the middle of a download, the app can establish a new encrypted media session and resume the partial transfer rather than downloading the entire video again.

Imported videos can be stored inside Malibu, accessed through Files, and optionally copied into Photos.

The fun part

There's something very satisfying about taking hardware that has become difficult to use because of its original software and making it useful again.

The camera was still there.

The Bluetooth radio was still there.

The Wi-Fi radio was still there.

The glasses could still record video.

They just needed something that understood how to talk to them.

Now they do.

Malibu is open source

The project is still experimental. I've currently verified it with a 2018 Spectacles 2 Sapphire unit, so I'd especially love to hear from anyone who still owns another Spectacles 2 model or firmware version and wants to test it.

I've also documented the reverse-engineered protocol, including the message framing, pairing flow, cryptographic derivation, media protocol, and the parts I still don't understand.

If you're interested in Bluetooth, iOS, reverse engineering, abandoned hardware, or just making old gadgets useful again:

https://github.com/Cynostial/malibu

Feedback and contributions are very welcome.