Close to a year ago, I stumbled upon the Kekz Headphones, which seemed like an interesting approach on the whole digital audio device space. They claimed to work without any internet connection and all of the content already on the headphones itself. They are On-Ear Headphones, which work by placing a small chip (I call them “Kekz” or “Cookie”) into a little nook on the side and it plays an audio story. I was intrigued, because there were some speculations going around, how they operate with those “Kekz”-Chips.

I invite you to join me on a journey into the inner workings of those headphones. We will talk about accessing the encrypted files on the device, breaking the crypto and discovering disclosure of data from customers.
. . .
Open Questions

- What is the full functionality of the Jieli-Chip? These chips are strange and challenging to identify. I only guessed which Chip it could be and got lucky with the HID Interface through the Windows Application

- What does the other Jieli-Chip on the other PCB Do?

- A full application to create a custom SD Card with a content manager to not only support the content already present on the Kekz Headphones, but furthermore all non-taken directories.

- Are there more HID commands?

- How good is the Geolocation Data sourced from a Laptop, which is probably triangulated Wifi Signals? Do the 30m-500m from the privacy policy hold up, or can it be narrowed down?

- What is this PII Data in the Azure cosmos database?

On October 20, the original author of the Fernflower Java decompiler, Stiver, passed away after a long fight against glioblastoma.
. . .
Twenty years ago, he developed a deep professional interest in Java virtual machine internals. You may remember his research blog posts, like this one (in Russian) from 2006 about how to tweak the Java class hierarchy using Unsafe when Java 1.5 was just released. Around 2008, Stiver became fascinated by Java decompilation.
. . .
Stiver decided to write his own decompiler as a side project. To overcome the weaknesses of existing alternatives, he took a different approach. After reading the bytecode, he constructed a control-flow graph in static single-assignment form, which is much better to express the program semantics abstracting the particular shape of bytecode. At the beginning of this project, Stiver knew little about static analysis and compiler design and had to learn a lot, but the effort was worth it. The resulting decompiler produced much better results than anything available at that time. It could even decompile the bytecode produced by some obfuscators without any explicit support.
. . .
Stiver did the main development himself between 2008 and 2010. The first public version became available in May 2009 as a web service. A user could upload an individual CLASS file or a whole JAR file and get the decompiled result. The decompiler quickly gained popularity – during the first four months, users decompiled more than half a million Java classes. There was no public standalone version, but Stiver sent it privately to a few Beta testers.
. . .
In 2013, JetBrains approached Stiver with a suggestion to include Fernflower in IntelliJ IDEA. Part of the deal was making Fernflower open source. Everything went well, and the contract was signed. On July 11, 2014, the early access version of IntelliJ IDEA 14 was released, including the decompiler for the first time. You can still see the initial import of the Fernflower source code in the IntelliJ IDEA Git history, on March 4, 2014.
. . .
As Fernflower became open source, many other tools in the Java world used it – you can find a number of forks on GitHub. The Java team at JetBrains is constantly improving Fernflower, but it’s still mainly Stiver’s code. 
. . .
Thank you, Stiver! We are deeply saddened by the loss of such a brilliant pioneer whose work and dedication had such a lasting and profound impact.