Ricoh GR WORLD Android app analysis notes for understanding how the app pairs with Ricoh GR cameras, enables camera WLAN, and what data is still needed before implementing the same BLE workflow on an ESP32 board.
| Path | Purpose |
|---|---|
apk/e64af40c-14d1-428e-9fff-4b2ee026e42c.apk |
Original APK under analysis. |
docs/ |
Task brief, Claude Code analysis, Codex review, and ESP32-oriented protocol notes. |
tools/apk-reverse/ |
Local reverse-engineering helper scripts and usage notes. Downloaded jars/zips and installed tool distributions are intentionally ignored. |
work/ |
Local apktool/jadx/dex2jar output. Ignored because it is large and reproducible from the APK. |
Confirmed from static analysis:
- The app package is
com.ricohimaging.grworld. - BLE operations go through FlutterBluePlus on Android via
flutter_blue_plus/methods. - The Java BLE layer is mostly a generic bridge for scan, connect, MTU, bond, service discovery, read/write, descriptor writes, and notifications.
- Wi-Fi connection uses Android
WifiNetworkSpecifierandConnectivityManager.requestNetwork. - After Wi-Fi is available, the app writes camera network parameters to
http://192.168.0.1/v1/params/device.
Not confirmed yet:
- Actual Ricoh GR BLE advertising name/prefix.
- Complete GATT service/characteristic UUID mapping.
- Pairing security mode and whether GR IV requires bonding in every connection path.
- Exact hex payloads for WLAN ON, Wi-Fi credential reads, notify responses, and initialization commands.
Important correction: the string 30-GR-0 should not be treated as a verified camera BLE name prefix. It appears in a group of country-code-like strings and is likely a false positive for Greece (GR), not Ricoh GR camera discovery.
Before writing an ESP32 implementation that controls the camera, capture the real BLE session:
- Enable Android Bluetooth HCI snoop log or use a BLE sniffer.
- Pair/connect the official app to the camera.
- Export advertising data, GATT table, ATT write/read/notify packets, CCCD writes, and security/bonding events.
- Build an ESP32 NimBLE central prototype that first scans and dumps GATT data without sending unknown camera-control writes.
See docs/codex-review-ble-analysis.md for the detailed review and ESP32 data checklist.