The Sonicare app lets you download the latest firmware blob. So all you'd do is intercept it and find the function responsible for generating the password.
The app has the firmware embedded in it (resources/assets/firmware), not sure if it actually downloads a newer one or if it updates with the app. It does seem to be encrypted or compressed somehow tho.
It does seem to be for the more expensive diamondclean series tho I guess the brush checking would be similar. Didn't find any decryption in the APK, it just transfers it as is. Must be hidden inside the firmware as well. I don't think there's any way to get the firmware except dump it from the chip :/
