Reverse Engineering a Smart Lock

This technical research analyzes Guardtec KeyWe Smart Lock internals and demonstrates that weak key derivation (a partly predictable CommonKey), combined with reversible App/Door key generation and captured Bluetooth HCI traffic, allows an attacker with suitable access to perform a replay attack to unlock the device; the author reproduces the F‑Secure findings, uses Frida and btsnoop logs to extract keys and eKey material, and provides a proof‑of‑concept replay unlocking the lock while recommending app updates and firmware capability as mitigations.