I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and went through the pairing procedure in the app. I first press "Pair" on the scale, and the display on the scale shows a "Pairing" symbol, I then click "Pair" in the app. Using Wireshark, I see that the following interactions between the phone and the scale while pairing:
(1) Phone -> Scale: Sent Write request to Handle 0x0011, Value: 0100
(2) Scale -> Phone: Rcvd Write Response, Handle 0x0011
(3) Phone -> Scale: Sent Read Request, Handle 0x0011
(4) Scale -> Scale: Rcvd Read Response, Handle 0x0011
(5) Phone -> Scale: Sent Write Command, Handle 0x0013, Value: 0000000e000c00106a321f3b6a330031140b
(6) Scale -> Phone: Rcvd Handle Value Notification, Handle 0x0010
(7) Phone -> Scale: Sent Write Command, Handle 0x0013, Value 000000060004002000db
By this point the scale the display stops showing the pairing symbol and shows me "0.0 kg". If I stand on it, it will notify the measured values through handle 0x0010.
I would now like to replicate the actions of the app using my computer (Arch Linux), such that I am able to be notified on Handle 0x0010. But I am not sure about how to replicate the pairing step. When I try to pair, I am not able to get rid of the pairing logo.
If I connect to the scale via "bluetoothctl", I can see the following characteristics:
[NEW] Primary Service (Handle 0x8ff1)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0008
00001801-0000-1000-8000-00805f9b34fb
Generic Attribute Profile
[NEW] Primary Service (Handle 0x8ff1)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009
273e5100-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Characteristic (Handle 0x5ece)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a
273e510f-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Descriptor (Handle 0xa280)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a/desc000c
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000d
273e5108-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Characteristic (Handle 0x5ece)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f
273e510e-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Descriptor (Handle 0xa320)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f/desc0011
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0012
273e5107-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Characteristic (Handle 0x5ece)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014
273e510d-6b90-4779-83b8-b8bf1dadac35
Vendor specific
[NEW] Descriptor (Handle 0x9e20)
/org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014/desc0016
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
None of these characteristics have the handle 0x0011 or 0x0013.
If instead I connect to the scale using btgatt-client, I can see the same services and characteristics, but with different handles:
service - start: 0x0001, end: 0x0007, type: primary, uuid: 00001800-0000-1000-8000-00805f9b34fb
charac - start: 0x0002, value: 0x0003, props: 0x02, ext_props: 0x0000, uuid: 00002a00-0000-1000-8000-00805f9b34fb
charac - start: 0x0004, value: 0x0005, props: 0x02, ext_props: 0x0000, uuid: 00002a01-0000-1000-8000-00805f9b34fb
charac - start: 0x0006, value: 0x0007, props: 0x02, ext_props: 0x0000, uuid: 00002a04-0000-1000-8000-00805f9b34fb
service - start: 0x0008, end: 0x0008, type: primary, uuid: 00001801-0000-1000-8000-00805f9b34fb
service - start: 0x0009, end: 0xffff, type: primary, uuid: 273e5100-6b90-4779-83b8-b8bf1dadac35
charac - start: 0x000a, value: 0x000b, props: 0x10, ext_props: 0x0000, uuid: 273e510f-6b90-4779-83b8-b8bf1dadac35
descr - handle: 0x000c, uuid: 00002902-0000-1000-8000-00805f9b34fb
charac - start: 0x000d, value: 0x000e, props: 0x04, ext_props: 0x0000, uuid: 273e5108-6b90-4779-83b8-b8bf1dadac35
charac - start: 0x000f, value: 0x0010, props: 0x10, ext_props: 0x0000, uuid: 273e510e-6b90-4779-83b8-b8bf1dadac35
descr - handle: 0x0011, uuid: 00002902-0000-1000-8000-00805f9b34fb
charac - start: 0x0012, value: 0x0013, props: 0x04, ext_props: 0x0000, uuid: 273e5107-6b90-4779-83b8-b8bf1dadac35
charac - start: 0x0014, value: 0x0015, props: 0x10, ext_props: 0x0000, uuid: 273e510d-6b90-4779-83b8-b8bf1dadac35
descr - handle: 0x0016, uuid: 00002902-0000-1000-8000-00805f9b34fb
Here I can see that the handle 0x0011 is the handle for the descriptor with uuid. 00002902-0000-1000-8000-00805f9b34fb
If I write "write-value 0x0011 01 00", and then "read-value 0x0011", I can see that I have successfully written 01 00 to 0x0011 (step 1).
After this, I am trying to replicate step (5) by sending a write command with the value "000000060004002000db" to handle 0x0013, but I am not able to do this. If I try to send a write command, I get an error:
write-value -w 0x0013 000000060004002000db
Invalid value byte: 000000060004002000db
I am not sure about how to proceed. At this point, I have not been able to get the scale to respond, it continues showing the "Pairing" logo. How can I find out the commands that I have to use?
