Step-by-step guide on how to build an integration for an unsupported Bluetooth device

Share your Projects!
, , , ,
#1

Hey guys,

I’m sorry if this is not the place to post this - let me know, and I’ll move it somehwere else. I have made a video-guide on my channel on how to reverse engineer the Bluetooth protocol of a studio light, and then to implement a basic Light entity in Home Assistant to control it from automations, scenes, and generally from the Home Assistant dashboard.

I’d really appreciate it if you would watch it, and let me know what did you think.

Here it is - part 1, how to reverse engineer a Bluetooth device:

Part 2 - writing a Home Assistant integration for it

Thank you.

10 Likes
#2

Yeah it’s not the right place. Community guides are a wiki format that anyone can edit to keep them up to date. We can’t edit your videos. So I’ve moved your post to Share Your Projects.

1 Like
#3

This is a timely tutorial for me. I have a fiber optic light engine that is bluetooth and RF only and it’s the only remaining device I have yet to get into HA. I mapped my bluetooth controller today and I’m waiting on the debugging report now. I’ll work on it this week but so far, all your steps have been spot on. Thanks

1 Like
#4

Very good tutorial thanks to you. I have a question. I have mi box s 4k with bluetooth remote control. When device sleep, i cant reach device anymore. Can i use it for open / close mi box ?

#5

Thank you! I was thinking of posting it in the “Share Your Project” section, or “Social”.

#6

love and hate how this is so easy for you…crazy stuck trying to go from gatt to python…

nvm got it with

import pygatt
import time
adapter = pygatt.GATTToolBackend()
adapter.start()

device = adapter.connect('34:85:18:6A:52:52')

adapter.sendline('char-write-cmd 0x0030 a500000800536f0e000310010212010aff01209a')

time.sleep(0.5)
adapter.stop()

i have been watching your video for past month on a loop tho, Thank you for sharing your knowledge!

#7

Hi David,

I’m having a issue figuring out checksum of the return commands…Using your guides i was able to reverse engineer some new controllers to use in my home assistant. tho i cant figure out the checksum so i can code it into an integration.

Could you provide any guidance with this matter? Thank you for everything you have shared with the community it has progressed my abilities leaps and bounds!

@nethunter

shell_command:
a500000800536f0e000310010212010aff01209a
a5000008009c47ad000310010111010aff0100a8
a50000080104762d0003100101110100ff01c769
a5000008010fc7460003100101110101ff01f059
a5000008017c89b20003100101110102ff01a909
a50000080190b5100003100101110103ff019e39
a500000801a4c3c70003100101110104ff011ba9
a500000801b7e1950003100101110105ff012c99
a500000801ca4eaf0003100101110106ff0175c9
a500000801dd2c790003100101110107ff0142f9
a500000801fa78fc0003100101110108ff016ec8
a5000008020db2570003100101110109ff0159f8
a500000800536f0e000310010111010aff01209a
a50000080104762d0003100102120100ff01c769
a5000008010fc7460003100102120101ff01f059
a5000008017c89b20003100102120102ff01a909
a50000080190b5100003100102120103ff019e39
a500000801a4c3c70003100102120104ff011ba9
a500000801b7e1950003100102120105ff012c99
a500000801ca4eaf0003100102120106ff0175c9
a500000801dd2c790003100102120107ff0142f9
a500000801fa78fc0003100102120108ff016ec8
a5000008020db2570003100102120109ff0159f8
a500000800536f0e000310010212010aff01209a

a500000 is common
80 command structure / where it should go
next 8 incrementing values
00310010212010a - commands to device 212 is on / 111 off (end value tells speed
last 8 seem to increment in value as well

#8

@nethunter I sent this in a reddit chat, but in case this is the better platform:

Hello sir! Quick question about your video reverse-engineering bluetooth. When I open btsnooz_hci.log into wireshark, I get the error:

The capture file appears to be damaged or corrupt. (btsnoop: File has 3077636096-byte packet, bigger than maximum of 262144)

When I do a bugreport without the bluetooth sniffer enabled on my Galaxy Tab S7 Plus, Wireshark can open the log just fine, but as soon as I enable it, the resulting bug report has a file that’s “corrupt”.

I tried editcap -s to limit packet size, but get:

editcap: The file "btsnooz_hci.log" appears to be damaged or corrupt.
(btsnoop: File has 3077636096-byte packet, bigger than maximum of 262144)

Any ideas?