Just got a Controller 69 and am looking to try and wade into this. @hivemind do you have any details as to how you were able to discover and pair with this in gattool or bluetoothctl? [edit: turns out my bluetooth stack was blown up, sudo systemctl restart bluetooth.service got me back up and running]
I’ve gone and run the current Android APK through a couple of analysis/decompilation tools and have dropped the results here.
Great idea, the definitions there could be enough to get this working.
Did you manage to send any commands? I can still only make it crash.
Also got the 69 controller & bluetooth adapter. Following this thread!
Perhaps we should all push this as a feature request as a lot of other Bluetooth integrations being updated at the moment?
I think we could have some success there with reading sensor values, but if we want to also send payloads like new temp/hum set points then I’m guessing it will quickly become out of scope.
I believe there is enough info in this thread and the definitions that @luma has provided to get this working. The strings we are getting back from the vendor specific attributes address should be the sensor and variable values and writing to 0x001d seems to be triggering something on the controller side. At first glance it appears that perhaps entire config is sent as an array each time a change is made.
Is anyone aware of any BLE integration contributors or resources we could pull in for a quick review? Sorry to tag you again @bjeanes, in your opinion, has any of the additional info in this thread the past couple of months bought us any closer to a solution?
Happy to contribute funds to send a controller to someone who can help 
I’m sure there is gold in that APK, though it is definitely pretty thick. I’d try to find the code paths that set/read a value and follow it down to the actual BLE characteristics it is using. I can’t help more than that, sorry.
Would also happily contribute to send a controller to someone who can help
I am interested. I think I have a type 69. Just got some other BT sensors online to monitor plants and temp. This would be great!
found this but not sure it will do anything for you here
Welcome to the thread @ssams - that link you posted is from @luma a few posts up.
No progress on my side, I am unlikely to have the chance to dig much further so I think it is just a matter of waiting for a person with the right skills to pick up one of these units and take over where this thread has left off.
I think basic communication and functionality is probably only a day or two work for a suitable dev, a full-blown integration would require a few weeks part-time for a beta I am guessing.
Haven’t yet seen any evidence yet that it is encrypted or otherwise impossible, so I’m hopeful we will get there.
oops - sorry about that post. missed that. hopefully one of these bright minds will take it on. until then i will patiently wait ;). i have seen a few who just override controller and use a nodemcu but I don’t feel like tearing mine apart. i will work on my peristaltic pumps first. tired of mixing nutrients every other day.
thanks!
Does the 2022.9 release which includes a lot more Bluetooth (Bluetooth Proxy) functionality make this integration more achievable? Sorry if this sounds like a dumb question - new to HA, and playing catchup.
Following. I want to buy their controller only if we find a way of connecting and managing it with HA
To close the loop, I’ve tested controlling this with an ESP32 and a transistor and it works great. I’m going to get a PCB built to do this.
@poldim What did you test? Were you able to report temp or control the fan? Why do you need a PCB if it’s just Bluetooth? Apologies for the questions, I’m just trying to figure out if I should upgrade my controller.
@hivemind unable to gatt into the controller to send commands but could you do me a favor and dump the primary readout of uuid’s here please? i want to try match up some codes on this end
70d51002-2c7f-4e75-ae8a-d758951ce4e0 seems to be the main one, it has write and notify (0x2902) on it.
When i enable notifications on this I get an update every 1 second (looks to be just timestamp incrementing)
| I | 10:52:26.505 | Notification received from 70d51002-2c7f-4e75-ae8a-d758951ce4e0, value: (0x) A5-10-00-05-01-0B-C1-C9-00-01-20-01-01-30-00-F8-CB |
|---|---|---|
| A | 10:52:26.505 | (0x) A5-10-00-05-01-0B-C1-C9-00-01-20-01-01-30-00-F8-CB received |
| I | 10:52:28.570 | Notification received from 70d51002-2c7f-4e75-ae8a-d758951ce4e0, value: (0x) A5-10-00-05-01-0C-B1-2E-00-01-20-01-01-30-00-F8-CB |
| A | 10:52:28.570 | (0x) A5-10-00-05-01-0C-B1-2E-00-01-20-01-01-30-00-F8-CB received |
| I | 10:52:30.630 | Notification received from 70d51002-2c7f-4e75-ae8a-d758951ce4e0, value: (0x) A5-10-00-05-01-0D-A1-0F-00-01-20-01-01-30-00-F8-CB |
yea i dug into the bt snooplog a bit and pulled some information from them, just before killing bluetooth on my raspi machine…somewhere in the sap… and havent been able to use hci or gatt to hack away at the signal coming from the controller atm…
wireshark dump
handshake controller to system
Frame 1716: 12 bytes on wire (96 bits), 12 bytes captured (96 bits)
Encapsulation type: Bluetooth H4 with linux header (99)
Arrival Time: Nov 19, 2022 13:49:46.147242000 EST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1668883786.147242000 seconds
[Time delta from previous captured frame: 0.000449000 seconds]
[Time delta from previous displayed frame: 0.000449000 seconds]
[Time since reference or first frame: 17306.238112000 seconds]
Frame Number: 1716
Frame Length: 12 bytes (96 bits)
Capture Length: 12 bytes (96 bits)
[Frame is marked: False]
[Frame is ignored: False]
Point-to-Point Direction: Received (1)
[Protocols in frame: bluetooth:hci_h4:bthci_acl:btl2cap:btatt]
Bluetooth
[Source: f0:74:59:49:c0:45 (f0:74:59:49:c0:45)]
[Destination: f8:28:fb:e7:1f:24 (f8:28:fb:e7:1f:24)]
Bluetooth HCI H4
[Direction: Rcvd (0x01)]
HCI Packet Type: ACL Data (0x02)
Bluetooth HCI ACL Packet
.... 0000 0001 0000 = Connection Handle: 0x010
..10 .... .... .... = PB Flag: First Automatically Flushable Packet (2)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 7
Data
[Connect in frame: 1708]
[Source BD_ADDR: f0:74:59:49:c0:45 (f0:74:59:49:c0:45)]
[Source Device Name: ]
[Source Role: Unknown (0)]
[Destination BD_ADDR: f8:28:fb:e7:1f:24 (f8:28:fb:e7:1f:24)]
[Destination Device Name: CP10]
[Destination Role: Unknown (0)]
[Current Mode: Unknown (-1)]
Bluetooth L2CAP Protocol
Length: 3
CID: Attribute Protocol (0x0004)
Bluetooth Attribute Protocol
Opcode: Exchange MTU Request (0x02)
0... .... = Authentication Signature: False
.0.. .... = Command: False
..00 0010 = Method: Exchange MTU Request (0x02)
Client Rx MTU: 247
first time the system tells controller anything
Frame 1808: 27 bytes on wire (216 bits), 27 bytes captured (216 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
.... 0000 0001 0000 = Connection Handle: 0x010
..00 .... .... .... = PB Flag: First Non-automatically Flushable Packet (0)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 22
Data
[Connect in frame: 1708]
[Source BD_ADDR: f8:28:fb:e7:1f:24 (f8:28:fb:e7:1f:24)]
[Source Device Name: CP10]
[Source Role: Unknown (0)]
[Destination BD_ADDR: f0:74:59:49:c0:45 (f0:74:59:49:c0:45)]
[Destination Device Name: ]
[Destination Role: Unknown (0)]
[Current Mode: Unknown (-1)]
Bluetooth L2CAP Protocol
Length: 18
CID: Attribute Protocol (0x0004)
Bluetooth Attribute Protocol
Opcode: Write Command (0x52)
0... .... = Authentication Signature: False
.1.. .... = Command: True
..01 0010 = Method: Write Request (0x12)
Handle: 0x001d (Unknown: Unknown)
[Service UUID: 70d510002c7f4e75ae8ad758951ce4e0]
[UUID: 70d510012c7f4e75ae8ad758951ce4e0]
Value: a50000030000f5690001313233f0ea
Frame 2060: 26 bytes on wire (208 bits), 26 bytes captured (208 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
.... 0000 0001 0000 = Connection Handle: 0x010
..00 .... .... .... = PB Flag: First Non-automatically Flushable Packet (0)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 21
Data
[Connect in frame: 1708]
[Source BD_ADDR: f8:28:fb:e7:1f:24 (f8:28:fb:e7:1f:24)]
[Source Device Name: CP10]
[Source Role: Unknown (0)]
[Destination BD_ADDR: f0:74:59:49:c0:45 (f0:74:59:49:c0:45)]
[Destination Device Name: ]
[Destination Role: Unknown (0)]
[Current Mode: Unknown (-1)]
Bluetooth L2CAP Protocol
Length: 17
CID: Attribute Protocol (0x0004)
Bluetooth Attribute Protocol
Opcode: Write Command (0x52)
0... .... = Authentication Signature: False
.1.. .... = Command: True
..01 0010 = Method: Write Request (0x12)
Handle: 0x001d (Unknown: Unknown)
[Service UUID: 70d510002c7f4e75ae8ad758951ce4e0]
[UUID: 70d510012c7f4e75ae8ad758951ce4e0]
Value: a5000002003e15c4000120308345
from tablet to controller
hopefully ill be able to get it up and going again after work… should be able to compile the uuids and the commands into vs code and start sending to controller to see what it responds with
ive found a few more that indicate notifications
yours which is
70d51002-2c7f-4e75-ae8a-d758951ce4e0
also
8ec90003-f315-4f60-9fb8-838830daea50
generic attribute service changed :
00002902-0000-1000-8000-00805f9b34fb
I have both the wifi and bluetooth control units; if someone gets a working integration or set of commands, happy to test it out.
can anyone use nRF connect to write to unkown service
70d51001-2c7f-4e75-ae8a-d758951ce4e0
sending these values to test results with controller
a50000020001d278000120308345
a5100005000153b200012001003000cffb
a5000009000212ea00030107160b1704103214c759
a51000020002e64100030100eea1
a5000008000335fb00011011121314151617713e
a510002e000305c7000110010211010a12010013070f4e1a4917463f1404000007081504â\200\246
a50000030004b5ed000102032078e9
a510001100049cb400010205060a201e7803050000000000200100e1e6
a50000030005a5cc000102032078e9
a510001100058c9500010205060a1d1e14030500000000002001008cc8
a50000020006a29f000120308345
a51000050006235500012001003000cffb
a50000030007858e000102032078e9
a51000110007acd700010205060a1d1e14030500000000002001008cc8
a500000300087461000102032078e9
a510001100085d3800010205060a1f1e1403050000000000200100060e
a500000200095370000120308345
a51000050009d2ba00012001003000cffb
a5000003000a5423000102032078e9
a5100011000a7d7a00010205060a201e1403050000000000200100fc80
a5000003000b4402000102032078e9
a5100011000b6d5b00010205060a1f1e1403050000000000200100060e
a5000002000c03d5000120308345
a5100005000c821f00012001003000cffb
a5000003000d24c4000102032078e9
a5100011000d0d9d00010205060a1f1e1403050000000000200100060e
a5000003000e14a7000102032078e9
a5100011000e3dfe00010205060a1f1e1403050000000000200100060e
a5000002000f33b6000120308345
a5100005000fb27c00012001003000cffb
a50000030010e758000102032078e9
a51000110010ce0100010205060a201e1403050000000000200100fc80
a50000030011f779000102032078e9
a51000110011de2000010205060a201e1403050000000000200100fc80
a50000020012f02a000120308345
a5100005001271e000012001003000cffb
a50000030013d73b000102032078e9
a51000110013fe6200010205060a221e14030500000000002001007646
a5000002001490ec000120308345
a51000050014112600012001003000cffb
a50000030015b7fd000102032078e9
a510001100159ea400010205060a201e1403050000000000200100fc80
a50000030016879e000102032078e9
a51000110016aec700010205060a221e14030500000000002001007646
a50000020017a08f000120308345
a51000050017214500012001003000cffb
a500000300186650000102032078e9
a510001100184f0900010205060a231e14030500000000002001003325
a500000300197671000102032078e9
a510001100195f2800010205060a231e14030500000000002001003325
a5000002001a7122000120308345
a5100005001af0e800012001003000cffb
a5000003001b5633000102032078e9
a5100011001b7f6a00010205060a221e14030500000000002001007646
a5000009001ce11500030107160b1704103225e12b
a5100002001c15be00030100eea1
a5000002001d01c5000120308345
a5100005001d800f00012001003000cffb
a5000002001e31a6000120308345
a5100005001eb06c00012001003000cffb
a5000009001fd17600030107160b170410322a10c4
a5100002001f25dd00030100eea1
a50000030020d10b000102032078e9
a51000110020f85200010205060a261e140305000000000020010073eb
a50000020021f61a000120308345
a5100005002177d000012001003000cffb
a50000030022f149000102032078e9
a51000110022d81000010205060a231e14030500000000002001003325
a50000030023e168000102032078e9
a51000110023c83100010205060a221e14030500000000002001007646
a50000090024564e00030107160b170410322d6023
a51000020024a2e500030100eea1
a50000020025b69e000120308345
a51000050025375400012001003000cffb
a5000002002686fd000120308345
a51000050026073700012001003000cffb
a5000002002796dc000120308345
a51000050027171600012001003000cffb
a500000200286733000120308345
a51000050028e6f900012001003000cffb
a500000200297712000120308345
a51000050029f6d800012001003000cffb
a5000002002a4771000120308345
a5100005002ac6bb00012001003000cffb
a5000002002b5750000120308345
a5100005002bd69a00012001003000cffb
a5000002002c27b7000120308345
a5100005002ca67d00012001003000cffb
a5000002002d3796000120308345
a5100005002db65c00012001003000cffb
a5000002002e07f5000120308345
a5100005002e863f00012001003000cffb
a5000002002f17d4000120308345
a5100005002f961e00012001003000cffb
a50000020030f40a000120308345
a5100005003075c000012001003000cffb
a50000020031e42b000120308345
a5100005003165e100012001003000cffb
a50000020032d448000120308345
a51000050032558200012001003000cffb
a50000020033c469000120308345
a5100005003345a300012001003000cffb
a50000020034b48e000120308345
a51000050034354400012001003000cffb
a50000020035a4af000120308345
a51000050035256500012001003000cffb
a5000002003694cc000120308345
a51000050036150600012001003000cffb
a5000002003784ed000120308345
a51000050037052700012001003000cffb
a500000200387502000120308345
a51000050038f4c800012001003000cffb
a500000200396523000120308345
a51000050039e4e900012001003000cffb
a5000002003a5540000120308345
a5100005003ad48a00012001003000cffb
a5000002003b4561000120308345
a5100005003bc4ab00012001003000cffb
a5000002003c3586000120308345
a5100005003cb44c00012001003000cffb
a5000002003d25a7000120308345
a5100005003da46d00012001003000cffb
a5000002003e15c4000120308345
a5100005003e940e00012001003000cffb
a5000002003f05e5000120308345
a5100005003f842f00012001003000cffb
a500000200408a9d000120308345
a510000500400b5700012001003000cffb
a500000200419abc000120308345
a510000500411b7600012001003000cffb
a50000020042aadf000120308345
a510000500422b1500012001003000cffb
a50000020043bafe000120308345
a510000500433b3400012001003000cffb
a50000020044ca19000120308345
a510000500444bd300012001003000cffb
a50000020045da38000120308345
a510000500455bf200012001003000cffb
a50000020046ea5b000120308345
a510000500466b9100012001003000cffb
a50000020047fa7a000120308345
a510000500477bb000012001003000cffb
a500000200480b95000120308345
a510000500488a5f00012001003000cffb
a500000200491bb4000120308345
a510000500499a7e00012001003000cffb
a5000002004a2bd7000120308345
a5100005004aaa1d00012001003000cffb
a5000002004b3bf6000120308345
a5100005004bba3c00012001003000cffb
a5000002004c4b11000120308345
a5100005004ccadb00012001003000cffb
a5000002004d5b30000120308345
a5100005004ddafa00012001003000cffb
a5000002004e6b53000120308345
a5100005004eea9900012001003000cffb
a5000002004f7b72000120308345
a5100005004ffab800012001003000cffb
a5000002005098ac000120308345
a51000050050196600012001003000cffb
a50000020051888d000120308345
a51000050051094700012001003000cffb
a50000020052b8ee000120308345
a51000050052392400012001003000cffb
a50000020053a8cf000120308345
a51000050053290500012001003000cffb
a50000020054d828000120308345
a5100005005459e200012001003000cffb
a50000020055c809000120308345
a5100005005549c300012001003000cffb
a50000020056f86a000120308345
a5100005005679a000012001003000cffb
a50000020057e84b000120308345
a51000050057698100012001003000cffb
a5000002005819a4000120308345
a51000050058986e00012001003000cffb
a500000200590985000120308345
a51000050059884f00012001003000cffb
a5000002005a39e6000120308345
a5100005005ab82c00012001003000cffb
a5000002005b29c7000120308345
a5100005005ba80d00012001003000cffb
a5000002005c5920000120308345
a5100005005cd8ea00012001003000cffb
a5000002005d4901000120308345
a5100005005dc8cb00012001003000cffb
a5000002005e7962000120308345
a5100005005ef8a800012001003000cffb
a5000002005f6943000120308345
a5100005005fe88900012001003000cffb
a50000020060aeff000120308345
a510000500602f3500012001003000cffb
a50000020061bede000120308345
a510000500613f1400012001003000cffb
a500000200628ebd000120308345
a510000500620f7700012001003000cffb
a500000200639e9c000120308345
a510000500631f5600012001003000cffb
a50000020064ee7b000120308345
a510000500646fb100012001003000cffb
a50000020065fe5a000120308345
a510000500657f9000012001003000cffb
a50000020066ce39000120308345
a510000500664ff300012001003000cffb
a50000020067de18000120308345
a510000500675fd200012001003000cffb
type or paste code here