From 9491228a53884a658bd8b1643d6aefab977414e2 Mon Sep 17 00:00:00 2001 From: OliE Date: Thu, 15 Jun 2017 09:37:19 +0200 Subject: [PATCH] Updated Home (markdown) --- Home.md | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/Home.md b/Home.md index 2530a2b..bc54770 100644 --- a/Home.md +++ b/Home.md @@ -10,6 +10,10 @@ *openScale is an open source app to keep a log of your weight, body fat, water percentage and muscle percentage.* +## Reversed Engineered scales in openScale + +_Please select a scale for further information_ + @@ -23,9 +27,51 @@ image missing
Xiaomi Bluetooth 4.x Mi Scale + + + + + + + + +
+ +image missing
+Medisana BS444 scale +		 +image missing
+Sanitas SBF70
-******_Please select a scale for further information_****** +## How to reverse engineer a Blueeoth 4.x scale +The general procedure of reverse engineering a Bluetooth 4.x scale is as follow: + +#### 1. Acquiring some Bluetooth traffic +1. Delete first on your smartphone any old `btsnoop_hci.log` +2. Turn on the `Bluetooth HCI Snoop Log` developer option on the smartphone +3. Weight yourself with the original app and note down the corresponding exact true date/time with all other information (e.g. weight, water percentage, bone mass and so on). +4. Turn off the `Bluetooth HCI Snoop Log` developer option +5. Save the `btsnoop_hci.log` with a meaningful filename +6. Do step 1-5 at least three times again but with different weights (e.g. weight yourself while holding a crate of beer) + +#### 2. Find out the Bluetooth services and characteristic +1. Install [BLE Scanner App](https://play.google.com/store/apps/details?id=com.macdom.ble.blescanner) by Bluepixel Technology LLP +2. Scan and connect to the scale with this app +3. Note down all UUID numbers of services and characteristic which are not `Device Information`, `Generic Access` and, `Generic Attribute` +4. Additionally note down for every characteristic UUID if it readable (R), writeable (W) and/or have an indication flag (I) + +#### 3. Analyse the Bluetooth protocol +1. Open your first `btsnoop_hci.log` with wireshark version > 1.10 +2. Search for the true values in the log files. A good starting point is to search for the weight + * Convert your [decimal weight into a hex value](http://www.binaryhexconverter.com/decimal-to-hex-converter) (ignore any comma. The value is divided by 100 or 10 afterwards) for example if the weight is `75,3 kg` then the hex value is `02F1` in big-endian or `F102` in little endian + * Look for the weight value in little endian format which is send from the scale to the app (source should be `remote()` and destination `localhost()`) +3. If you have found a value string that contains the weight try to find in this string other values as well (e.g. water percentage and date/time) + * Decoding the date/time is the most difficult part because the format is unknown. It could be a unix time stamp or something different. A good free tool to help you to identify the used time format is [DCode](http://www.digital-detective.co.uk/freetools/decode.asp) by digital detective +4. Next we have to find out which steps are needed for the scale configuration to trigger the scale to send us the values + * Search in wireshark for the first data package from the scale which contains your weight value + * Now analyse previous data packages and see and note down what values was written to which characteristic UUID (source should be `localhost()` and destination `remote()`) + * Note also down which UUID notification flag or indication flag was set enabled \ No newline at end of file