Hi Guys, so happy so much progress has been made here. At this point is there any step-by-step guide for people like myself that understand controlling these lights without the BRMESH app is possible to get going with a new solution? My end goal is to have a wall control unit (multiple hopefully) as I am using it in an AirBNB down in Cabo and everyone is drunk and cannot figure the lights out.
1 Like
On a side note, maybe easier, am I understanding this thread correctly that this starter kit is compatible with the MELPO lights BroadLink BLE Smart Home Starter Kit-Broadlinkåčęŗč½ and will solve my issue immediately?
I would love to see a step-by-step too. This has been an evolving implementation and I am having a hard time trying to work out what (if any) additional hardware I need to obtain to control the 8 lights I want to have remote control over by Christmas 
A list of prerequisites and a list of steps to take would be awesome.
Thank you everyone for the contributions that got this off the ground.
Hey, jjumping on this to make it to progress a bit (vulgarisation I mean).
Thanks a lot to @ArcadeMachinist who did an amazing job here !
My plan : Usage of this code from a Raspberry PI 3, to mimic the RGB led got from an external source.
Just starting, Iām already beyond getting the key with adb logcat, trying to send a command via the rasp to check if in the internal chip of the rasp is compatible
Leeting you know my progresses
Bon, voilĆ hereās where I am : (not yet working tough)
Gateway running and connected to MQTT, to achieve this, I did the following steps :
- download files from github on my raspberry
- place the file bluez-brmesh.conf in the folder /etc/dbus-1/system.d/
- issue the command ā$ idā to get ID of the user who needs to run the process
- change the bluez-brmesh.conf with the right user id (1000 was the right one in my case)
- reboot rasp
- changing the mqtt2brMesg.py file to put the right message key, right ip addresses for the mqtt server
I then simple launched the python code by issuing the following command :
$ python3 mqtt2brMesh.py
Gateway connected to MQTT, and I see the message :
python3 mqtt2brMesh.py
Connected with result code 0
Got message
brMesh b'2/TRE'
Got message
brMesh b'3/set { "state": "OFF" } '
Got message
brMesh b'/3/set { "state": "ON", "color_temp": 500 }'
Got message
showing the gateway runs well, I still need to search how I can verify how the Bluetooth sends well the message.
I forgot to tell that I check, and btmgmt is well accessible by the concerned user (1000)
I need to run for a couple of hours, and Iāll continue later, but, here are my biggest unknowns :
- I didnāt managed to run btmgmt directly, so I installed the gateway in Python, as I know Python, to try if I could progress
- unsure what this part : āPlace bluez-brmesh.conf in /etc/dbus-1/system.d/ and replace 1000 with uid of the user you would be running the gateway under.ā does exactly, should be clarified a bit
In summary : I donāt know, yet, how to really debug and see where it does not work, so need to place intermediaries logs or monitoring hooks to make sure we can easily follow what goes well and what goes wrong
To run python version of the gateway you need custom-compiled BlueZ, please see the readme.
JS version runs without it and just pipes the ready made packets to ābtmgmtā thru exec()
I mean placing one conf file is not enough.
You need to download Linux kernel sources, Bluez, build tools.
Then patch the sources, specifically this file:
https://github.com/bluez/bluez/blob/e126cf204907bb98f8b60d23bcb3dfa46064b9a3/src/shared/ad.c
With the supplied patch. Recompile and install new Bluez.
1 Like
ok, perfect thanks for the update @ArcadeMachinist.
So, on a raspberry PI, to get the sources, I simply run this command
sudo apt-get build-dep bluez
This download the required dependencies, then I need to download thesources.
This is done via this command 
git clone https://github.com/bluez/bluez.git
I then need to patch the sources before compiling it.
cd bluez
./bootstrap
Context added after finding my mistake
For the next ones who will read, you should not launch the bootstrap before applying the patch, that was my error. You need first to apply the patch.
I added the 10 lines of the patch manually in the source of the file src/shared/ad.c
Trying to apply the patch (I put all your file in ā¦/python) gives me an error, the patch seems to not correspond to the same version of the sources that you used, which one did you downloaded ?
(sorry raspberry CLI is in frecnh)
git apply --check ../python/hack-ble-flags.patch
error: le patch a ƩchouƩ : src/shared/ad.c:535
error: src/shared/ad.c : le patch ne s'applique pas
Within the sources, I found this function, I think itās the one you patched, without certitude
uint8_t *bt_ad_generate(struct bt_ad *ad, size_t *length)
{
struct iovec iov;
if (!ad)
return NULL;
*length = calculate_length(ad);
if (*length > ad->max_len)
return NULL;
iov.iov_base = malloc0(*length);
if (!iov.iov_base)
return NULL;
iov.iov_len = 0;
serialize_service_uuids(ad->service_uuids, &iov);
serialize_solicit_uuids(ad->solicit_uuids, &iov);
serialize_manuf_data(ad->manufacturer_data, &iov);
serialize_service_data(ad->service_data, &iov);
serialize_name(ad, &iov);
serialize_appearance(ad, &iov);
serialize_data(ad->data, &iov);
return iov.iov_base;
}
Ok, think I found my mistake, I did the bootstrap while I should have waited first to apply the patch, now the code is the same. Iāll then correct the sequence in my explanation for the next people who will read this.
then configuration of the source with this command
./configure --prefix=/usr --mandir=/usr/share/man --sysconfdir=/etc --localstatedir=/var
I then compile with the usual āmakeā and install the new bins with āmake installā
make && make install
ok, the gateway is working, on the recompiled drivers 
An interesting journey starts now with Bluetooth and btmon to understand whatās goināon
Thanks for your help to get it to work, honestly. While Itā still not working tough lol
Iām planning to integrate this with Openhab via MQTT as soon as it works.
@ArcadeMachinist : A last question - What might be the easiest way to check if it works with the internal BLE chipset of the raspberry ? Shall I see it somewhere in a log ? Iāve no error so far, so I guess an issue in my understanding of the keys & payload of your gateway.
Thanks.
And, should you have some time, hereās the ouptut of both the gateway & btmon on the raspberry 
get_rf_payload
------------------------
addr: c1c2c3
data: e836001a1a3235353834353538343535
inverse_offset: 15
inverse_offset addr.len + 3: 21
Adv-Cmd : btmgmt add-adv -d 02011a1bfff0ff6db64368931dbb05d8a0823a11fe03c84496cc615dfa51ec 1
Init adv
Advertising for 0.1 seconds...
GetAll
returning props
@ MGMT Command: Add Extended Advertising Parameters (0x0054) plen 18 {0x0001} [hci0] 4.967294
Instance: 1
Flags: 0x00000001
Switch into Connectable mode
Duration: 0
Timeout: 0
Min advertising interval: 0.000 msec (0x0000)
Max advertising interval: 0.000 msec (0x0000)
TX power: 0 dbm (0x00)
@ MGMT Event: Command Complete (0x0001) plen 7 {0x0001} [hci0] 4.967340
Add Extended Advertising Parameters (0x0054) plen 4
Status: Success (0x00)
Instance: 1
TX power: 127 dbm (0x7f)
Available adv data len: 31
Available scan rsp data len: 31
@ MGMT Command: Add Extended Advertising Data (0x0055) plen 42 {0x0001} [hci0] 4.967538
Instance: 1
Advertising data length: 31
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
Company: not assigned (65520)
Data: 6db64368931dbb05d8a0823a11fe03c84496cc615dfa51ec
Scan response length: 0
< HCI Command: LE Set Advertising Data (0x08|0x0008) plen 32 #1 [hci0] 4.967643
Length: 31
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
Company: not assigned (65520)
Data: 6db64368931dbb05d8a0823a11fe03c84496cc615dfa51ec
> HCI Event: Command Complete (0x0e) plen 4 #2 [hci0] 4.968490
LE Set Advertising Data (0x08|0x0008) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Advertising Parameters (0x08|0x0006) plen 15 #3 [hci0] 4.968974
Min advertising interval: 1280.000 msec (0x0800)
Max advertising interval: 1280.000 msec (0x0800)
Type: Connectable undirected - ADV_IND (0x00)
Own address type: Public (0x00)
Direct address type: Public (0x00)
Direct address: 00:00:00:00:00:00 (OUI 00-00-00)
Channel map: 37, 38, 39 (0x07)
Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #4 [hci0] 4.969641
LE Set Advertising Parameters (0x08|0x0006) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1 #5 [hci0] 4.969728
Advertising: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0] 4.970205
LE Set Advertise Enable (0x08|0x000a) ncmd 1
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0001} [hci0] 4.970286
Add Extended Advertising Data (0x0055) plen 1
Status: Success (0x00)
Instance: 1
Advertisement registered
@ MGMT Command: Remove Advertising (0x003f) plen 1 {0x0001} [hci0] 5.042485
Instance: 1
< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1 #7 [hci0] 5.042635
Advertising: Disabled (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #8 [hci0] 5.043484
LE Set Advertise Enable (0x08|0x000a) ncmd 1
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0001} [hci0] 5.043585
Remove Advertising (0x003f) plen 1
Status: Success (0x00)
Instance: 1
Advertisement unregistered
I ordered the broadlink BLE starter kit and it DOES work with the MELPO lights that use BRMESH app and nothing else by default. In summary using the broadlink Gateway (GW4C) and 4-button switch (SC4B4) I am able to save four scenes into pushbutton control for the various melpo recess and flood lights and can additionally control them with Alexa now.
Far from me the idea of insisting, but do you have maybe an advice ?
Iām still stuck with Bluetooth, in the sense that I donāt know how to make sure the newer drivers are being used, I did the installation correctly (four times) with the recompile. Iāve the logs (shared in the previous message) but I donāt know how I can check if the payload is exact.
Tried already to compare with the logs from my smartphone, but ibvisouly, the results are not the sameā¦ 
Thanks already.
Iāve definitely been following this and recently purchased some Fastcon and Melpo lights.
Is it feasible to convert to a HACS integration?
3 Likes
I have brmesh RGB down lights and would love to see this as a HACS plugin please!
2 Likes
I managed to use the info in this and related threads to write an ESP32 firmware to act as a controller for these lights. It uses MQTT to talk to Home Assistant, and broadcasts the commands to the lights. I have four lights all individually controllable in HomeAssistant. Thanks to @ArcadeMachinist and @Jueff for the Bluetooth code!
Itās not quite plug-and-play, but if you want to give it a shot, Iāve quickly documented it here: GitHub - millskyle/BRMesh_homeassistant: ESP32 interface for interfacing BRMesh lights to HomeAssistant using MQTT
4 Likes
Hi there @millskyle
I tried your firmware and it works just fine, thanks for your work!
Just one thing, I use Spots and have 15 of them.
Just only 5 are created after turning on the ESP, even with your code changed to 15 and the adverticed places. Do you know any more points at the code that may have to be changed?
As I saw in your screenshot that theres also only 5 (Flood 1 two times).
BR
1 Like
This was my first post here and I thought I would receive email notifications of responses, but I did not; sorry that Iām just seeing this now.
I am not sure why only 5 would be showing up. You changed all three things: numLights, mylights, and mylightnames?
Here are some thoughts off the top of my head:
- I would check the BRMesh app to make sure that all lights have the same encryption key. I suppose itās possible that the app assigns keys in groups of 5.
- I am not an expert with Arduino, but I know there are memory limitations using strings. Try renaming the lights to something shorter: perhaps āAā, āBā, āCā, etc. If this was the problem, Iād expect compilation/flashing errorsā¦just brainstorming here.
- The Arduino HomeAssistant library docs mention a default limit of 6 device types. Thatās the only limit I see mentioned. I doubt itās relevant, but see here how to raise it to 12: Device types - ArduinoHA
Do you have a process for someone with an iphone?
I have 6 BRMesh lights that I want to add to Home Assisstant, Iām not a programmer, but Iāve got a pretty cool dashboard. Iām not very experienced in anything other than HACS though. Is there a step by step to get these lights into HA?
My hope is to try to add a the string of BR Mesh lights to the living room window.
Just signed up so I could say thankyou for this fantastic bit of work.
Iām planning on attempting some modifications to the ESP32 code to allow for auto-discovery of lights.
Question for @ArcadeMachinist, in your example code did you change your key to a fake one for security (would make sense to I suppose!)? Only, I have suspicion that all the key codes are of the format: 3X3X3X3X
Looking at a decompiled version of the brmesh APK I have found a reference to a āBLEDeviceInfoā object, which has its own ākeyā variable, and in associated code the key is run through āparseStringToByteā.
If Iām right this means our 3X3X3X3X formatted keys are as the result of initial 4 character keys which have been converted to their byte representation.
e.g. 1234 when converted to bytes becomes 31323334
Meaning in reality thereās only 10,000 possible key combinations - 0000 to 9999
1 Like
Quick update - I found the code that generates the key (pulled the functions out of their classes and simplified here):
public static String getRandomString(int len) {
Random r = new Random();
StringBuilder sb = new StringBuilder();
for(int i = 0; i < len; ++i) {
sb.append("0123456789".charAt(r.nextInt(10)));
}
return sb.toString();
}
public static String stringToHexString(String s) {
char[] c = "0123456789ABCDEF".toCharArray();
StringBuilder sb = new StringBuilder();
byte[] bytes = s.getBytes();
int len = bytes.length;
for(int i = 0; i < len; ++i) {
byte b = bytes[i];
sb.append(c[(b & 0xf0) >> 4]);
sb.append(c[b & 0xf]);
}
return sb.toString().trim();
}
ctrlKey = stringToHexString(getRandomString(8)).substring(0, 8).toLowerCase();
They made a mistake in the key generation so itās definitely always a 4 digit number (0000 to 9999).
First they create a random 8 digit number, letās say: 12345678
Convert it to bytes: 313233343536373839
Take the first 8 chars: 31323334 - (losing half of the original key)
My code to automatically scan and add lights is nearly ready. The lights themselves seem to be able to take any 4 byte key, so I can at least restore that level of (still quite low) security.
Hereās my version of the ESP32 code that auto-adds lights and makes them available over MQTT: GitHub - dsclee1/BRmesh-esp32-mqtt
2 Likes