Reverse engineering a Beyblade launch tracker

A Beyblade X enthusiast investigates how Takara Tomy’s Beybattle Pass records launches and communicates with a phone. The accessory attaches to a compatible launcher, where a lever pressed by an installed top switches it on and activates a sensor. The launcher contains a rotating black-and-white disc whose speed changes with the pull; the investigator suspects an infrared sensor reads that rotation to calculate “Shoot Power,” essentially the top’s launch RPM. Rather than dismantling an expensive device, the investigation relies on hands-on tests and Bluetooth Low Energy traffic captured with diagnostic tools, without needing the official app.

The captured data arrives first as a short status message and, after a launch, as a larger packet divided into tagged pages. Comparing repeated captures reveals a launch counter in the header and identifies the repeated device-address bytes. The launch measurements appear in the B pages as two-byte values; interpreting them in BLE’s little-endian order turns otherwise implausible numbers into realistic RPM readings, such as 3,234 and 3,477. A higher value, 4,194, matches the device’s distinctive orange-red-green light sequence and is stored as a personal high score. Tests also show that attaching a top and dropping or detaching it without launching produce different status messages and LED behavior, helping distinguish a completed launch from an unsuccessful attempt.