BLE reverse engineering a Fellow Stagg EKG Pro kettle

Hey folks,

I saw this post about reverse engineering the regular Fellow Stagg EKG kettle: https://www.reddit.com/r/homeassistant/comments/ek47k2/ble_reverse_engineering_a_fellow_stagg_ekg_kettle/

I’m trying to use this as base GitHub - levi/stagg-ekg-plus-ha: Stagg EKG+ Home Assistant Integration (it’s for the plus model)

I want to do the same with my Pro version but I’m stuck. The Fellow app only updates the kettle and doesn’t control it, so I can’t easily capture the commands.

I’ve got a BLE sniffer and Wireshark, and I’m using nRFconnect on iOS to connect to the kettle.

Anyone got experience with BLE reverse engineering who can point me in the right direction? Really want to get this working with my home automation setup.

Thanks!

1 Like

Ok, semi good news. I figured out how to establish a read and write connection. I’m able to read the temperature, the unit type and how to restart the kettle. I’m also able to change the temperature and change the unit type.

However the most important thing is to be able to toggle between stand-by mode. I tried to read the commands after factory reset and also looking into the commands of the schedule functionality. As that toggles the stand-by into heating. However, I’ve not been successful yet.

Anyone else has idea on how to fetch the standby-toggle?

FYI, pressing the big button to toggle stand-by does not provide any data. The device does not share any commands that I can see with my ble sniffer in wireshark.

I’m starting to think that the physical button might be independent of the BLE system (a direct hardware control), which would explain why I haven’t found a way to toggle standby via BLE.

Update: I can turn on and off the heating. However, I have not figured out yet how to switch the display mode from stand-by to heating. This means when I turn on the heating it still shows the stand-by mode. The other problem is that the command that I found doesn’t consider the set temp and will always boil to max heat.

Without a clear ble command to toggle the standby, there’s no real use-case to create an add-on. Pausing my search for now.

@ clemmiewho have you discovered anything on turning on/off the kettle? (From stand-by to heating?)

In the meantime I have made some progress.

I’m able to turn on the kettle from standby to heating. However I’m using the ‘schedule’ command approach. The downside of this is that this affects the time on the kettle which is problematic for other reasons. Next to that, to toggle back to ‘stand-by’, the only thing I found is sending the ‘reset’ text command, which works but does disconnect the kettle for a bit.

Overal I’m trying to dissect the schedule command and see if I can find out what byte/value activates the heating mode without affecting other settings.

cc/
Dvvarf

I’m about a step behind you at the moment. I came to that same conclusion–that the scheduling method is the only way to get around the physical button dilemma–though now that I’m playing with it today, I’m not having the same success sending commands that I was last weekend. Last weekend, I could easily change the unit system, hold time, chime volume, target temperature… :woman_facepalming:

Ok, it was nothing a little coffee couldn’t fix. I’m an idiot. Anyway, I’m working on capturing the previous state of the kettle when I change the schedule to turn the kettle on, that way I can restore the previous schedule after I manage a cup of tea. Still not sure how to go back to standby gracefully though. That’s next on my list.

To go back to stand-by you can send ‘reset’ text command. But yes, that’s a pretty blunt solution. I’m currently trying to throw a bunch of text commands against it and see if anything sticks. Kind of out of option atm

Those I have, happy to share. However non of this in my mind makes any different If you can’t toggle from stand-by to heating.

I’ll take what you’ve got!

As it stands, I’m relatively satisfied with the scripts I’ve got going. I identified what most of the bytes are responsible for so I can manipulate them. I ended up going with the schedule workaround—when I press a button on my dashboard, it schedules the kettle for one minute after the current time with a hold time of 30 min, and it starts a 30 min countdown. It also takes note of the kettle’s current settings (I’ve got an esp32 polling the kettle regularly) so it can restore the actual schedule after I’ve had my tea. The 30 min wait isn’t really necessary. I could probably send it right away but :woman_shrugging:t3:

After the countdown is over, HA sends a command with the previous schedule/temp/etc back to the kettle. It’s clunky, it saves me a trip to the kitchen to turn it on—I only have to go once the kettle is hot.

I could send the reset command to turn the kettle off, then follow that up with the “Restore Snapshot” script I guess. I might add that so it feels like I’ve got both on and off commands, as wonky as both may be.

1 Like

Can you share the scripts or throw them on GitHub? Looking to continue working on this on my own kettle

1 Like

Sure. Let me tidy it up and I’ll get back to you!

I asked Fellow (here is their email [email protected]) about the Stagg EKG PRO if they plan to add full control of the kettle via smartphone, they replied:

At this time, we have no plans to add remote control to the kettles, but I appreciate your feedback and I have passed it on to our Product team!

If they don’t make control from a smartphone, it will not be possible to fully integrate this kettle into HA ?

Even without full control of the kettle, I can still see some use cases where status information would be useful.

Any update/way to see the code you guys have used thusfar? Same boat and would be cool to work together and benefit off each other’s progress rather than have nothing to start from. I think i could contribute to it well too, but don’t wanna start from scratch if you guys have the legwork put in already. Let me know! Thanks.

Not so much. I have tried to extract all ble commands but non of them were able to find the command to turn on / off the kettle safely. This for me is essential.

Hey Guys! I have made a python library for configuration of this kettle over BLE:
https://codeberg.org/breiflabb/ekg-pro-ble-lib
Basically I found out, (with inspiration from this forum), that the kettle exposes some (not all) of the menu options over BLE.
Looking at the HACS integration for the EKG+: https://github.com/levi/stagg-ekg-plus-ha/blob/c3e540d37d8a002f9af6553421deb076fa22f8b8/custom_components/fellow_stagg/const.py, it appears to unlock realtime control via a magic unlocking sequence. There might be one for this kettle also, but that has yet to be discovered. Feel free to fork or use this library :D! Hopefully someone discovers realtime unlocking like on the EKG+!