Chef iQ Smart Wireless Meat Thermometer

[dproffer (David Proffer)]

Nothing like shopping at Costco and running across something for sale with an FCC ID that contains :

ESP32WROVERE

I mean, wow, what more could you ask your significant other for for a Christmas or Holiday present?

[finity]

Have you busted it open to see how to flash it yet?

[dproffer (David Proffer)]

Thought never crossed my mind…

[rob121 (Rob Alfonso)]

Any luck? I literally had it in my hand last night and put it down thinking I didn’t need another project to reverse engineering Bluetooth, but this might be way easier!

[sergeantbort]

Definitely programming ports there, not clearly marked so could be fun to figure out which is which… And then going into programming there with all the functionality could be fun… I have the 3 probe one showing up soon (was out of stock at sams until just a couple dayz ago so its an iou Christmas present ) and definitely would love to get it into my dashboard

[willman3755 (Willem)]

Hi everyone! I’m new here. I just bought this at Costco as well and figured out some stuff:

BLE reverse engineering

When removed from the base, they show up on BLE under the name “CQ60” and broadcast a BLE message with GAP data type 0xFF (“manufacturer specific”).

• There are two separate types of messages: one starts with 0x01 0x40 0x??, and the other with 0x03 0x40 0xD9

• The next byte of the 0x01 0x40 0x?? message seems to be degrees C of the probe (0x14 or 20C for all my example messages below). Unclear what the rest of the message is… but it does look like some kind of slow-moving data possibly loosely related to temp - perhaps battery voltage or ambient temp or something?? Looking at the app, you can pull the following info from the probe so all this stuff is likely encoded elsewhere in this or other messages:

  • Serial #: PR8P-CT0162342-006186
  • MAC address: D9:38:36:2E:33:73
  • HW version: v22.0.0
  • FW version: v2.0.0
  • HVIN: CQ60-QPR-01
  • Probe temp
  • Ambient temp
  • Battery charge level

Here’s a few random complete messages if someone wants to try to figure out more.

0xCD0501405A11AB00B200B200B300B300AB008A5E
0xCD0501405813BB00C000C000C100C100BB007657
0xCD0501405812B300B800B800B900B900B3000552

0xCD050340D938362E3373E74B
^ looks like the MAC is in there, but not much else…

Hardware reverse engineering

• There’s really not much in this box. A single 18650 cell, battery charge circuitry, ESP32, speaker and speaker drive circuitry, and the probe interface circuitry.
• Probe interface is two contacts. PCB has layout for 3x probe interfaces but only 2 are populated here. Each consists of a TS5A3159 analog switch IC (“JAR” marking), an LN1132 voltage regulator (“HRZP” marking), and another unknown IC marked “9A2NC”, package SC70-6, that appears to likely be a current sense amplifier (pinout but not the markings of INA212) to sense probe charging current.
  • LN1132 is likely being used and possibly abused (somewhat) as a charge IC. The datasheet indicates it has a current-limit function but it isn’t clear how this works. Based on the HRZP marking, this is the 3.0V version. Perhaps the sense resistor is also being used to limit charging current as well. I wonder what batteries they’re using in the probes…
  • Analog switch is being used to switch between comms and charging. Unknown what the comms are.
• Speaker interface is an NS4168. Already supported by ESPHome: I²S Audio Media Player — ESPHome
• There’s a TCA9534 I2C port expander that drives the analog switch IC control pins, and possibly other things.
• Unknown chip: 1B438J, rectangular QFN-16 package. Maybe some kind of 1-wire controller or otherwise related to probe communication?

I haven’t dug into the separate charge board yet. For now, this is all back together and I’m using it with the original app, which is surprisingly decent actually.

The easiest thing to do here will be to set up the BLE passive monitor integration with this new sensor type. Then if you really wanted, you could reflash the ESP32 in the base as a BLE proxy (support for this sensor would need to added there, separately as well) but before you do that you might want to figure out how the probe communication works as pairing probes in the app is pretty slick. I’m guessing the probes shout their MAC or something similar.

Apparently since I’m a new user I can only attach one image… too bad. I’ve got more.

[dproffer (David Proffer)]

Welcome!

Outstanding! Great start, hoping we are all ready for summer BBQ’s! Have a fun home automation 2024!

[willman3755 (Willem)]

BLE monitor issue opened for this here: [New Sensor]: CQ60 Chef iQ wireless meat thermometer · Issue #1279 · custom-components/ble_monitor · GitHub

[Ernst]

Hi all, I’m the developer of BLE monitor. Should be possible to add this. Will look into it.

Edit: First findings

data: 15ffcd0501406313c000c900c900ca00cb00c0008d11
15 = length
ff = manufacturer data
cd05 = Manufacturer id 05CD
0140 = not sure, possibly a device ID
63 = 99 = 99% (battery?)
13 = 19 (temperature?)
c000 = 00C0 = 192 → 19.2 (temperature probe 1?)
c900 = 00C9 = 201 → 20.1 (temperature probe 2?)
c900 = 00C9 = 201 → 20.1 (temperature probe 3?)
ca00 = 00CA = 202 → 20.2 (temperature probe 4?)
cb00 = 00CB = 203 → 20.3 (temperature probe 5?)
c000 = 00C0 = 192 → 19.2 (temperature probe 6?)
8d11 = 118d = 4493 → could be humidity 44.93%???

[Ernst]

I have created BLE monitor 12.8.0-beta to test. I named the sensors as described above. I hope you can tell me which sensor is what? It can also be temperature alarms, or min/max values or … Please report back your findings (on github), such that I can name the sensors properly. You can install beta’s by clicking the three dots in the top right corner of the BLE monitor card in HACS and select download again. Next, enable the slider to see beta updates.

[willman3755 (Willem)]

Wow! there is more going on here than expected! I played around with an ice bath and lighter and these do in fact have 5 individual temp sensors internally. Now you can access them all to see a real thermal gradient!

[willman3755 (Willem)]

Just stumbled across some internal pics under the FCC filing: CQ60-QPR-01/ CQ60-QPR-02/ CQ60-QPR-03

[dproffer (David Proffer)]

Interesting. Amazing that the components in the probe can survive inside a ‘smoker/bbq’ or air fryer. Prior to finding this device, all the cooking temperature monitoring devices I had seen were either a ‘open the cooker, get the temperature, remove the thermometer’ or a thermocouple on the end of a metal mesh wire that need a hole in the cooker to route the cable thru.

[Ernst]

Added in BLE monitor 12.8.0. Explanation of the sensors is in the BLE monitor documentation of the sensor.

[willman3755 (Willem)]

And it is working great. Here’s some ribs reheating for dinner.

[jeffh0821]

@willman3755 - did you ever get a chance to play with the hub hardware any more? Are there pins for a UART or other connection to be able to flash the ESP32 on the hub with ESPHome or other 3rd party firmware. I’m enamored with this little device and, as much as having the probes on a BLE gateway is nice, I’d really love to mess with the on-board ESP32 and see if I can make it into a BLE gateway itself - and maybe see what I can do with the speaker.

[willman3755 (Willem)]

Unfortunately I have not. Definitely a doable weekend project, I think the programming pins are pretty accessible

BLE Proxy and the speaker with ESPHome would be awesome.