diff --git a/sniffer/decompile_kaiyu.ps1 b/sniffer/decompile_kaiyu.ps1
new file mode 100644
index 0000000..d99c287
--- /dev/null
+++ b/sniffer/decompile_kaiyu.ps1
@@ -0,0 +1,97 @@
+# decompile_kaiyu.ps1 - Download jadx, pull KAIYU APK, decompile to Java source
+#
+# Run from D:\HereMyHope\hh-bt-controller:
+#   powershell -ExecutionPolicy Bypass -File sniffer/decompile_kaiyu.ps1
+
+$BaseDir   = "D:\Claude\HH-BT-Controller\decompile"
+$JadxDir   = "$BaseDir\jadx"
+$JadxZip   = "$BaseDir\jadx.zip"
+$ApkPath   = "$BaseDir\kaiyu.apk"
+$OutputDir = "$BaseDir\kaiyu_src"
+$Adb       = if (Test-Path "D:\platform-tools\adb.exe") { "D:\platform-tools\adb.exe" } else { "adb" }
+$Pkg       = "com.qunyu.kaiyu"
+
+New-Item -ItemType Directory -Force -Path $BaseDir | Out-Null
+
+Write-Host "============================================" -ForegroundColor Cyan
+Write-Host "  KAIYU APK Decompiler" -ForegroundColor Cyan
+Write-Host "============================================" -ForegroundColor Cyan
+
+# 1. Download jadx
+if (-not (Test-Path "$JadxDir\bin\jadx.bat")) {
+    Write-Host "`n[1/4] Downloading jadx 1.5.0..." -ForegroundColor Yellow
+    $url = "https://github.com/skylot/jadx/releases/download/v1.5.0/jadx-1.5.0.zip"
+    try {
+        Invoke-WebRequest -Uri $url -OutFile $JadxZip -UseBasicParsing
+        Write-Host "      Downloaded ($([math]::Round((Get-Item $JadxZip).Length/1MB,1)) MB)"
+        Expand-Archive -Path $JadxZip -DestinationPath $JadxDir -Force
+        Remove-Item $JadxZip -Force
+        Write-Host "      jadx ready." -ForegroundColor Green
+    } catch {
+        Write-Host "[ERROR] Download failed: $_" -ForegroundColor Red
+        Write-Host "  Download manually: $url"
+        Write-Host "  Extract to: $JadxDir  then re-run."
+        Read-Host; exit 1
+    }
+} else {
+    Write-Host "`n[1/4] jadx already present." -ForegroundColor Green
+}
+
+# 2. Pull APK
+if (-not (Test-Path $ApkPath) -or (Get-Item $ApkPath).Length -lt 1MB) {
+    Write-Host "`n[2/4] Pulling APK from phone..." -ForegroundColor Yellow
+    $pmOut = & $Adb shell "pm path $Pkg" 2>&1
+    if ($pmOut -notmatch "package:") {
+        Write-Host "[ERROR] KAIYU not found on device. Is phone connected?" -ForegroundColor Red
+        & $Adb devices; Read-Host; exit 1
+    }
+    $apkOnDevice = ($pmOut -split "`n" | Where-Object { $_ -match "package:" } |
+                    Select-Object -First 1).Replace("package:","").Trim()
+    Write-Host "      Device path: $apkOnDevice"
+    & $Adb pull $apkOnDevice $ApkPath
+    if (-not (Test-Path $ApkPath)) {
+        & $Adb shell "cp '$apkOnDevice' /sdcard/kaiyu_tmp.apk"
+        & $Adb pull /sdcard/kaiyu_tmp.apk $ApkPath
+        & $Adb shell "rm /sdcard/kaiyu_tmp.apk" 2>&1 | Out-Null
+    }
+    if (-not (Test-Path $ApkPath)) {
+        Write-Host "[ERROR] APK pull failed." -ForegroundColor Red; Read-Host; exit 1
+    }
+    Write-Host "      APK: $([math]::Round((Get-Item $ApkPath).Length/1MB,1)) MB" -ForegroundColor Green
+} else {
+    Write-Host "`n[2/4] APK already pulled ($([math]::Round((Get-Item $ApkPath).Length/1MB,1)) MB)." -ForegroundColor Green
+}
+
+# 3. Decompile
+Write-Host "`n[3/4] Decompiling with jadx (1-3 min)..." -ForegroundColor Yellow
+$jadxBat = Get-ChildItem -Path $JadxDir -Recurse -Filter "jadx.bat" |
+           Select-Object -First 1 -ExpandProperty FullName
+if (-not $jadxBat) {
+    Write-Host "[ERROR] jadx.bat not found in $JadxDir" -ForegroundColor Red; Read-Host; exit 1
+}
+if (Test-Path $OutputDir) { Remove-Item -Recurse -Force $OutputDir }
+
+& $jadxBat --deobf --show-bad-code -d $OutputDir $ApkPath
+
+$count = (Get-ChildItem -Recurse -Filter "*.java" -Path $OutputDir -ErrorAction SilentlyContinue).Count
+Write-Host "      $count Java files decompiled." -ForegroundColor Green
+
+# 4. Analyse
+Write-Host "`n[4/4] Analysing for BLE protocol..." -ForegroundColor Yellow
+$analysePy = @(
+    "sniffer\analyse_jadx.py",
+    "D:\Claude\HH-BT-Controller\sniffer\analyse_jadx.py"
+) | Where-Object { Test-Path $_ } | Select-Object -First 1
+
+if ($analysePy) {
+    python $analysePy --src $OutputDir
+} else {
+    Write-Host "analyse_jadx.py not found - run it manually:"
+    Write-Host "  python sniffer\analyse_jadx.py --src $OutputDir"
+}
+
+Write-Host "`n============================================" -ForegroundColor Green
+Write-Host "  Source at: $OutputDir" -ForegroundColor Green
+Write-Host "  Browse:    code $OutputDir" -ForegroundColor Green
+Write-Host "============================================" -ForegroundColor Green
+Read-Host "`nPress Enter to exit"