Just curious if anyone has tried or succeeded at controlling an ac infinity Bluetooth controller with home assistant. Any info or links would be greatly appreciated.
3 Likes
This I need this lol… I’ve seen my sensors in HA but not sure how they showed up… currently they are “down” not reading anything
2 Likes
so that is promising… You own this unit, and it has shown in HA?
1 Like
I too am looking for help with this.
I have gotten HA to “see” the bluetooth device(controller 67) by using the bluetooth tracker.
That is not much use to me but I needed a place to start.
So when I plug in the controller it is recognised as being “home” and when I unplug the controller it is reported by HA as “away”.
The hard part That I am very unfamiliar with is how to send commands to the controller from HA>
I was able to connect to the controller in Terminal and got this:
But I am not sure where to go from here. Any help would be appreciated.
1 Like
Did you get any further with this?
I managed to connect to it using nRF Connect android app - the output is mostly the same as you received from gattool. If I then fire up the AC Infinity app and bond it to the device, that 70d51002 characteristic gets a property of NOTIFY and the value starts updating every 1 second.
Also if I then tap into the graph tab of the ac infinity app, i get huge strings for the value here, updating very quickly - so I guess that is the historic information too.
I think a similar approach to this is needed here - ESPHome definition to pick up readings from the PH-260BD water PH/EC/TDS/Temp sensor - https://www.aliexpress.com/item/1005002707585119.html / https://www.aliexpress.com/item/4001143771176.html · GitHub
Maybe we can sniff the packets required to initiate this characteristic then get the sensor data broadcasting without the app also running. It does look like all the required pieces exist for this to happen, including writing data back for setting fan speeds.
I would be interested to hear from @itzyoungen about how your sensor data may have ended up in HA - guessing you had a bluetooth tracker of some sort running and opened the ac infinity app?
Not sure if any of this is useful, I’ll prod at it a little more tomorrow and attach a wireshark trace of what the app is up to.
1 Like
There are two ways that I am aware of for this – see if you can decompile the android apk app to control this device or if you actually have an Android, use the HCI dev logs and WireShark. Good video I came across recently on this: How To Reverse Engineer A Bluetooth Device - YouTube
Unfortunately I don’t have one of these fans to test it with (my fan has physical dial which I am hoping I can replace with an ESP doing PWM but haven’t looked into it yet)
Thanks @bjeanes that has helped.
I seem to be making some progress, a gatttool command like
gatttool -b C9:E4:CE:XX:XX:XX -t random --char-write-req --handle=0x0020 --value=0012 --listen
then
char-write-req 0x001d a5000008001327ca00120000000100000001ced0
seems to turn the fan off briefly ( on closer inspection it seems to be crashing it )
I also have a list of btatt.opcode.method values that my android app was sending that I’m trying to decipher
a50000 0200 0e2397 00 0120 308345
a50000 0300 01e548 00 01313233f0ea
a50000 0300 01e548 00 01313233f0ea
a50000 0300 05a5cc 00 01313233f0ea
a50000 0300 0b4402 00 01313233f0ea
a50000 0300 10e758 00 01313233f0ea
a50000 0300 087461 00 0111121354a8
a50000 0300 0d24c4 00 0111121354a8
a50000 0400 04307d 00 0110020320a0b7
a50000 0400 04307d 00 0110020320a0b7
a50000 0400 0cb175 00 0110020320a0b7
a50000 0800 07757f 00 01101112131415 1617713e
a50000 0800 0994b1 00 1200 0000 01 00 00 00 00 def1
a50000 0800 c3ecb7 00 1200 0000 01 00 00 00 00 def1
a50000 0800 0aa4d2 00 1200 0000 01 00 00 00 01 ced0
a50000 0800 c58c71 00 1200 0000 01 00 00 00 01 ced0
a50000 0900 0302cb 00 030107 16 05 11 03 01 07 1a b4 af
a50000 0e00 06d7fe 00 1116051016111f 00 00 27d3 0000 d208 72f6
a50000 0e00 0f46d7 00 1116051016111f 00 00 27d5 0000 d208 bf73```Any idea how to get past the “Failed to pair” “AuthenticationFailed”?
With gatttool? Try using -t random when you connect
gatttool -I -t random -b C9:E4:CE:XX:XX:XX
just managed to connect to the ACI-Controller and was able to list the attributes.
Hopefully this is helpful to someone more knowledgeable than myself:
[ACI-UniversalController]# list-attributes
Primary Service (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a
00001801-0000-1000-8000-00805f9b34fb
Generic Attribute Profile
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a/char000b
00002a05-0000-1000-8000-00805f9b34fb
Service Changed
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a/char000b/desc000d
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Primary Service (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e
0000180a-0000-1000-8000-00805f9b34fb
Device Information
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char000f
00002a29-0000-1000-8000-00805f9b34fb
Manufacturer Name String
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0011
00002a24-0000-1000-8000-00805f9b34fb
Model Number String
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0013
00002a27-0000-1000-8000-00805f9b34fb
Hardware Revision String
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0015
00002a26-0000-1000-8000-00805f9b34fb
Firmware Revision String
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0017
00002a28-0000-1000-8000-00805f9b34fb
Software Revision String
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0019
00002a23-0000-1000-8000-00805f9b34fb
System ID
Primary Service (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
70d51000-2c7f-4e75-ae8a-d758951ce4e0
Vendor specific
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
70d51001-2c7f-4e75-ae8a-d758951ce4e0
Vendor specific
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
70d51002-2c7f-4e75-ae8a-d758951ce4e0
Vendor specific
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Primary Service (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
0000fe59-0000-1000-8000-00805f9b34fb
Nordic Semiconductor ASA
Characteristic (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
8ec90003-f315-4f60-9fb8-838830daea50
Vendor specific
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Here are the Vendor specific attributes I was able to read using gatt in the submenu of bluetoothctl and using “attribute-info”
[ACI-UniversalController:/service0021/char0022]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
[ACI-UniversalController:/service001b]# read
Unable to read attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
[ACI-UniversalController:/service001b]# attribute-info
Service - Vendor specific
UUID: 70d51000-2c7f-4e75-ae8a-d758951ce4e0
Primary: yes
[ACI-UniversalController:/service001b]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
[ACI-UniversalController:/service001b/char001c]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c Value:
a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee .......d........
a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee .......d........
[ACI-UniversalController:/service001b/char001c]# attribute-info
Characteristic - Vendor specific
UUID: 70d51001-2c7f-4e75-ae8a-d758951ce4e0
Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
Value:
a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee .......d........
Flags: write-without-response
Flags: write
MTU: 0x00f7
[ACI-UniversalController:/service001b/char001c]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
[ACI-UniversalController:/service001b/char001e]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e Value:
a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06 ......'.........
15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9 .............a.
a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06 ......'.........
15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9 .............a.
[ACI-UniversalController:/service001b/char001e]# attribute-info
Characteristic - Vendor specific
UUID: 70d51002-2c7f-4e75-ae8a-d758951ce4e0
Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
Value:
a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06 ......'.........
15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9 .............a.
Notifying: no
Flags: notify
MTU: 0x00f7
[ACI-UniversalController:/service001b/char001e]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
[ACI-UniversalController:/service001b/char001e/desc0020]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020 Value:
00 00 ..
00 00 ..
[ACI-UniversalController:/service001b/char001e/desc0020]# attribute-info
Descriptor - Client Characteristic Configuration
UUID: 00002902-0000-1000-8000-00805f9b34fb
Characteristic: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
Value:
00 00 ..
[ACI-UniversalController:/service001b/char001e/desc0020]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
[ACI-UniversalController:/service0021]# read
Unable to read attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
[ACI-UniversalController:/service0021]# attribute-info
Service - Nordic Semiconductor ASA
UUID: 0000fe59-0000-1000-8000-00805f9b34fb
Primary: yes
[ACI-UniversalController:/service0021]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
[ACI-UniversalController:/service0021/char0022]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
[ACI-UniversalController:/service0021/char0022]# attribute-info
Characteristic - Vendor specific
UUID: 8ec90003-f315-4f60-9fb8-838830daea50
Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
Notifying: no
Flags: write
Flags: indicate
MTU: 0x00f7
[ACI-UniversalController:/service0021/char0022]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
[ACI-UniversalController:/service0021/char0022/desc0024]# attribute-info
Descriptor - Client Characteristic Configuration
UUID: 00002902-0000-1000-8000-00805f9b34fb
Characteristic: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
Value:
00 00 ..
[ACI-UniversalController:/service0021/char0022/desc0024]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024 Value:
00 00 ..
00 00 ..
[ACI-UniversalController:/service0021/char0022/desc0024]#
I saw this fan online and wondered if it’s HA compatible…few seconds later found this thread. Have any of you figured out a way to control it through HA without the cloud?
1 Like
Is there a way of doing this with the cloud?
Just got a Controller 69 and am looking to try and wade into this. @hivemind do you have any details as to how you were able to discover and pair with this in gattool or bluetoothctl? [edit: turns out my bluetooth stack was blown up, sudo systemctl restart bluetooth.service got me back up and running]
I’ve gone and run the current Android APK through a couple of analysis/decompilation tools and have dropped the results here.
Great idea, the definitions there could be enough to get this working.
Did you manage to send any commands? I can still only make it crash.
Also got the 69 controller & bluetooth adapter. Following this thread!
Perhaps we should all push this as a feature request as a lot of other Bluetooth integrations being updated at the moment?
I think we could have some success there with reading sensor values, but if we want to also send payloads like new temp/hum set points then I’m guessing it will quickly become out of scope.
I believe there is enough info in this thread and the definitions that @luma has provided to get this working. The strings we are getting back from the vendor specific attributes address should be the sensor and variable values and writing to 0x001d seems to be triggering something on the controller side. At first glance it appears that perhaps entire config is sent as an array each time a change is made.
Is anyone aware of any BLE integration contributors or resources we could pull in for a quick review? Sorry to tag you again @bjeanes, in your opinion, has any of the additional info in this thread the past couple of months bought us any closer to a solution?
Happy to contribute funds to send a controller to someone who can help 
I’m sure there is gold in that APK, though it is definitely pretty thick. I’d try to find the code paths that set/read a value and follow it down to the actual BLE characteristics it is using. I can’t help more than that, sorry.
Would also happily contribute to send a controller to someone who can help