I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control the speaker’s advanced features.
I have tried to connect to the port using a terminal app, using various baud rates and sending it ?<CR><LF>
and AT?<CR><LF>
, respectively—to no avail. The speaker will not return a single bit of data.
A web search on the most common terms did not return any useful information on the protocol used.
Is there any information out there on the protocol used by the Megaboom? Or does anyone know of any attempts at decoding it?
I now have some captured traffic from the official app. BTW, if another device is holding the serial port connection, the app will not recognize the speaker, corroborating my suspicion that SPP is the control channel.
In two captures I see that initially the app sends 02 00 06
(hex) over the SPP connection, to which the speaker responds with <CR><NUL><BEL>MEGABOOM
(three control characters followed by the product name as a string).
When I connect to the speaker’s SPP and send these three characters (using moserial, sending input as hex), the speaker does not respond at all. Any ideas?