1

I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.

I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and went through the pairing procedure in the app. I first press "Pair" on the scale, and the display on the scale shows a "Pairing" symbol, I then click "Pair" in the app. Using Wireshark, I see that the following interactions between the phone and the scale while pairing:

(1) Phone -> Scale: Sent Write request to Handle 0x0011, Value: 0100

(2) Scale -> Phone: Rcvd Write Response, Handle 0x0011

(3) Phone -> Scale: Sent Read Request, Handle 0x0011

(4) Scale -> Scale: Rcvd Read Response, Handle 0x0011

(5) Phone -> Scale: Sent Write Command, Handle 0x0013, Value: 0000000e000c00106a321f3b6a330031140b

(6) Scale -> Phone: Rcvd Handle Value Notification, Handle 0x0010

(7) Phone -> Scale: Sent Write Command, Handle 0x0013, Value 000000060004002000db

By this point the scale the display stops showing the pairing symbol and shows me "0.0 kg". If I stand on it, it will notify the measured values through handle 0x0010.

I would now like to replicate the actions of the app using my computer (Arch Linux), such that I am able to be notified on Handle 0x0010. But I am not sure about how to replicate the pairing step. When I try to pair, I am not able to get rid of the pairing logo.

If I connect to the scale via "bluetoothctl", I can see the following characteristics:

[NEW] Primary Service (Handle 0x8ff1)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0008
        00001801-0000-1000-8000-00805f9b34fb
        Generic Attribute Profile
[NEW] Primary Service (Handle 0x8ff1)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009
        273e5100-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a
        273e510f-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0xa280)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a/desc000c
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000d
        273e5108-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f
        273e510e-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0xa320)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f/desc0011
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0012
        273e5107-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014
        273e510d-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0x9e20)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014/desc0016
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration

None of these characteristics have the handle 0x0011 or 0x0013.

If instead I connect to the scale using btgatt-client, I can see the same services and characteristics, but with different handles:

service - start: 0x0001, end: 0x0007, type: primary, uuid: 00001800-0000-1000-8000-00805f9b34fb
          charac - start: 0x0002, value: 0x0003, props: 0x02, ext_props: 0x0000, uuid: 00002a00-0000-1000-8000-00805f9b34fb
          charac - start: 0x0004, value: 0x0005, props: 0x02, ext_props: 0x0000, uuid: 00002a01-0000-1000-8000-00805f9b34fb
          charac - start: 0x0006, value: 0x0007, props: 0x02, ext_props: 0x0000, uuid: 00002a04-0000-1000-8000-00805f9b34fb

service - start: 0x0008, end: 0x0008, type: primary, uuid: 00001801-0000-1000-8000-00805f9b34fb

service - start: 0x0009, end: 0xffff, type: primary, uuid: 273e5100-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x000a, value: 0x000b, props: 0x10, ext_props: 0x0000, uuid: 273e510f-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x000c, uuid: 00002902-0000-1000-8000-00805f9b34fb
          charac - start: 0x000d, value: 0x000e, props: 0x04, ext_props: 0x0000, uuid: 273e5108-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x000f, value: 0x0010, props: 0x10, ext_props: 0x0000, uuid: 273e510e-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x0011, uuid: 00002902-0000-1000-8000-00805f9b34fb
          charac - start: 0x0012, value: 0x0013, props: 0x04, ext_props: 0x0000, uuid: 273e5107-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x0014, value: 0x0015, props: 0x10, ext_props: 0x0000, uuid: 273e510d-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x0016, uuid: 00002902-0000-1000-8000-00805f9b34fb

Here I can see that the handle 0x0011 is the handle for the descriptor with uuid. 00002902-0000-1000-8000-00805f9b34fb

If I write "write-value 0x0011 01 00", and then "read-value 0x0011", I can see that I have successfully written 01 00 to 0x0011 (step 1).

After this, I am trying to replicate step (5) by sending a write command with the value "000000060004002000db" to handle 0x0013, but I am not able to do this. If I try to send a write command, I get an error:

write-value -w 0x0013 000000060004002000db

Invalid value byte: 000000060004002000db

I am not sure about how to proceed. At this point, I have not been able to get the scale to respond, it continues showing the "Pairing" logo. How can I find out the commands that I have to use?

1
  • Have you tried to decompile the Android? If the code for sending the Bluetooth data is in the DEX code part of the app (not in a native .so file) then looking at the code how the app communicated with the scale may be easier to understand instead of only interpreting the snoop log.
    – Robert
    Nov 25 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.