Tags: misc 

Rating: 4.0

This challenge provides a jpg file and a pklg file. The jpg is shown a part of string on LEGO EV3 device. Length of the string, I guess, might be **58**. EV3 is supported USB or Bluetooth connection. Bluetooth connection is hinted in the pklg file opened with Wireshark. Transmission is worked between two **RFCOMM** protocol entities. There are two types in all RFCOMM packages. Much attention should be focused on **Sent**, while the **Rcvd** packages are both same like each other.

There are three different length of packages: **32, 33, 34**. After analysising, I notice three key position, shown below (I called them in turn as: **Order in group, Group number, Data**):

![](https://img2018.cnblogs.com/blog/908031/201810/908031-20181022112309293-1629771090.jpg)

![](https://img2018.cnblogs.com/blog/908031/201810/908031-20181022112320517-1937176487.jpg)

![](https://img2018.cnblogs.com/blog/908031/201810/908031-20181022112330114-323771902.jpg)

if length == 32:

Order in group 0x81 Group number 0x84 Data
if length == 33:

0x81 Order in group 0x81 Group number 0x84 Data
if length == 34:

0x82 Order in group 0x00 0x81 Group number 0x84 Data

Sort them by Group number at first. If equal, sorted by Order in group.

h,0a 28 68
i,14 28 69
t,1e 28 74
c,28 28 63
o,32 28 6f
n,3c 28 6e
{,46 28 7b
m,50 28 6d
......

**hitcon{m1nd5t0rm_communication_and_firmware_developer_kit}**