ring-modstoolsprobes

Web Bluetooth · operator-driven

R12 probes.

Choose the ring on this phone. Read its live identity, then run one fixed glyph-table test. No saved desktop identifier is required.

Read-only: no firmware or RAM writes. Exact stock identity is required. A successful read should not change the screen or LEDs. BLE “notifications” are packets in the log below—not Android notifications or a pairing popup.

idle

R12 glyph-table canary

Choose the R12 to read its identity first.

Selected device
Not selected
Connection
Firmware · read live
Not read
Hardware · read live
Not read
Inspect the exact gate and packet

Only RT11CR_1.00.08_250514 and RT11CR_V1.0 are accepted. There is no override for a similar version. Identity is re-read on the same connection immediately before the request.

TX · address 0x2085e5, length 10, checksum included

c0002085e50000000a00000000000054

Expected RX · 16 bytes, including zero padding and checksum

c03f065b4f666d7d077f6f00000000f4

No BF writes, raw streaming, clock changes, reboot, OTA controls or OTA-service permission are exposed. C0 is written to RXTX to ask for a read; enabling GATT notifications also configures the connection. “Read-only” means no memory, firmware, clock or sensor-mode writes—not an absence of all BLE traffic. A matching DIS string is not a full-image hash attestation.

Local diagnostics

Watch each stage.

Logs stay in this tab. The last 100 entries are retained; unrelated notifications are logged but cannot count as a successful read.

Saves JSON on your phone; nothing is uploaded. The report omits the browser’s private device identifier. Export before choosing again: a new attempt clears the previous result.

Run it on your phone.

  1. Use Chrome on Android, on this HTTPS page. Open it directly, not inside another app’s browser. Chrome on iPhone/iPad generally does not provide Web Bluetooth; the support notice above is authoritative for the browser you are using.
  2. Release the R12’s other connection. Disconnect this ring in QRing, the ring app, a desktop client or another flasher tab. Rings often accept only one central connection. Leave unrelated Bluetooth devices alone; start without resetting or unpairing the ring.
  3. Keep the charged ring close and awake, then tap Choose ring. Chrome should open its device chooser. Android may also ask for Nearby Devices/Bluetooth permission. Select your physical R12—not an unrelated device just to continue.
  4. Check the two identity rows. Only the exact stock baseline unlocks the probe. Missing or different values stop the test without sending C0. Save the report rather than changing the gate.
  5. Tap Read glyph table once. The page subscribes to RXTX, sends the fixed request, collects replies for three seconds and validates command, length, checksum, glyph bytes and padding. It then disconnects its own link, whether the result passes or fails.
  6. Save the report. A green result confirms the read path. No reply, a malformed/duplicate frame or a disconnect remains unverified. Do not follow a failure with arbitrary addresses, RAM writes or flashing.

If the ring is missing or quiet.

No chooser at all

Check the browser-support notice, HTTPS, and that you actually tapped Choose ring. A GATT notification does not cause a permission popup. This page never requests phone notification permission.

Chooser opens, R12 absent

This is discovery, not a C0 result. Check that the ring is advertising and not already connected elsewhere. The chooser does not reuse the Mac’s saved UUID.

Selected, but connection fails

Keep the ring near the phone and release any competing ring client. Save the stage/error log. There is no automatic reconnect loop and no hidden setup-command sequence.

Identity matched, no valid C0 reply

Stop and save the report. That is a useful distinction from a scan failure, but it does not by itself prove why the read failed. The next experiment should be chosen from the evidence.

Chrome’s Web Bluetooth documentation ↗ · What the offline R12 audit established →