Модератор: immortal
выводит help gatttool.gatttool --device=0C:B2:B7:02:3C:3F --adapter=hci0 --listen
Код: Выделить всё
pi@dmsserver:~$ sudo hcitool lescan
LE Scan ...
49:54:1A:7B:6C:3A (unknown)
49:54:1A:7B:6C:3A (unknown)
A4:C1:38:C7:0C:A3 QN-Scale
49:54:1A:7B:6C:3A (unknown)
49:54:1A:7B:6C:3A (unknown)
A4:C1:38:C7:0C:A3 QN-Scale
A4:C1:38:C7:0C:A3 QN-Scale
A4:C1:38:C7:0C:A3 QN-Scale
49:54:1A:7B:6C:3A (unknown)
49:54:1A:7B:6C:3A (unknown)
Код: Выделить всё
gatttool -b A4:C1:38:C7:0C:A3 -t random -I 
https://github.com/oliexdev/openScale/w ... -4.x-scaleThe general procedure of reverse engineering a Bluetooth 4.x scale is as follow:
1. Acquiring some Bluetooth traffic
Delete first on your smartphone any old btsnoop_hci.log
Turn on the Bluetooth HCI Snoop Log developer option on the smartphone
Weight yourself with the original app and note down the corresponding exact true date/time with all other information (e.g. weight, water percentage, bone mass and so on).
Turn off the Bluetooth HCI Snoop Log developer option
Save the btsnoop_hci.log with a meaningful filename
Do step 1-5 at least three times again but with different weights (e.g. weight yourself while holding a crate of beer)
2. Find out the Bluetooth services and characteristic
Install BLE Scanner App by Bluepixel Technology LLP
Scan and connect to the scale with this app
Note down all UUID numbers of services and characteristic which are not Device Information, Generic Access and, Generic Attribute
Additionally note down for every characteristic UUID if it readable (R), writeable (W) and/or have an indication flag (I)
3. Analyse the Bluetooth protocol
Open your first btsnoop_hci.log with wireshark version > 1.10
Search for the true values in the log files. A good starting point is to search for the weight
Convert your decimal weight into a hex value (ignore any comma. The value is divided by 100 or 10 afterwards) for example if the weight is 75,3 kg then the hex value is 02F1 in big-endian or F102 in little endian
Look for the weight value in little endian format which is send from the scale to the app (source should be remote() and destination localhost())
If you have found a value string that contains the weight try to find in this string other values as well (e.g. water percentage and date/time)
Decoding the date/time is the most difficult part because the format is unknown. It could be a unix time stamp or something different. A good free tool to help you to identify the used time format is DCode by digital detective
Next we have to find out which steps are needed for the scale configuration to trigger the scale to send us the values
Search in wireshark for the first data package from the scale which contains your weight value
Now analyse previous data packages and see and note down what values was written to which characteristic UUID (source should be localhost() and destination remote())
Note also down which UUID notification flag or indication flag was set enabled
Код: Выделить всё
$cmd='/home/pi/rtl_433_rcswitch/build/src/rtl_433 -f 433920000 -s 250000 -F json|mosquitto_pub -h localhost -t /home/rtl_433 -l';
$answ=shell_exec($cmd);
echo $answ;Код: Выделить всё
01030c00Код: Выделить всё
pi@dmsserver:~$ gatttool --device=A4:C1:38:C7:0C:A3 --char-write-req --handle=0x0017 --value=01030c00 --listen
connect error: Device or resource busy (16)