Carrera HYBRID BLE Controller

Control Carrera HYBRID RC cars (by Sturmkind) via BLE. Use when user wants to drive, steer, control lights, write text with, or reverse-engineer Carrera HYBR...

Control Sturmkind Carrera HYBRID RC cars via BLE from any Linux machine with Bluetooth.

Requirements

• Python 3.10+, bleak (BLE), bless (MITM proxy)
• Linux with BlueZ and a BLE-capable adapter
• Install: pip install bleak bless

Protocol

20-byte packets sent every ~50ms via Nordic UART TX (6e400002-b5a3-f393-e0a9-e50e24dcca9e):

BF 0F 00 08 28 00 [GAS] [STEER] 86 00 72 00 02 FF [LIGHT] 00 00 00 00 [CRC8]

Byte	Function	Values
6	Gas	0xDF=idle, higher=forward (wraps 0xFF→0x00→0x11=max), lower=reverse
7	Steering	0x00=center, 0x01-0x7F=right, 0x81-0xFF=left
14	Light	0x82=on, 0x80=off
19	CRC-8	Poly=0x31, Init=0xFF over bytes 0-18

Scripts

scripts/carrera_drive.py — Drive Controller

# Basic commands
python3 scripts/carrera_drive.py forward [gas] [duration_ms]
python3 scripts/carrera_drive.py back [gas] [duration_ms]
python3 scripts/carrera_drive.py left [gas] [duration_ms]
python3 scripts/carrera_drive.py right [gas] [duration_ms]
python3 scripts/carrera_drive.py spin [gas] [duration_ms]
python3 scripts/carrera_drive.py light_on
python3 scripts/carrera_drive.py light_off
python3 scripts/carrera_drive.py demo

• gas: 1-50 (default 40)
• duration_ms: milliseconds (default 3000)
• Edit ADDRESS in script to match your car's BLE address

Telegram Remote Control

Send inline button messages for interactive control:

⬆️ Vorwärts  |  ⬇️ Rückwärts
↩️ Links      |  ➡️ Rechts
🔄 Spin!      |  🏁 Demo
💡 Licht AN   |  🌑 Licht AUS

On callback car_forward, car_back, etc. → run the corresponding carrera_drive.py command.

Calibration

At Gas=20, Steer=80: one full circle ≈ 7100ms. Adjust timing for your surface/car.

Finding Your Car

python3 -c "
import asyncio
from bleak import BleakScanner
async def scan():
    devices = await BleakScanner.discover(5)
    for d in devices:
        if 'HYBRID' in (d.name or ''):
            print(f'{d.name} @ {d.address}')
asyncio.run(scan())
"

Protocol Details

See references/protocol.md for full reverse-engineering notes and MITM capture analysis.