Support request, not getting any readings

[BertilJ]

Hi

First of all, this made my day when I found this, I've got a home built smoker and I've fiddled around with building also a esp-based thermometer, but I just don't get the readings stable enough, so I got a BT ready made 6 probe solution.

Challenge I have is that I get it to connect to the thermometer (and MQTT server), but I just don't get any readings. In the MQTT server I can just see a successful connection, no messages and checking the screen of my PI, I can only see that it's connected. (screenshot)

(edit, this is the screen even after a few hours of being connected)

Any pointer on where to troubleshoot is appriciated!

/Andreas

[gleeds]

Hi, are you using the Tenergy probe I test with or a different one?

[gleeds]

Also, if your probe has an indicator on the screen that it's connected, does that indicator stay connected for more than say 30-60 seconds, or does it go back to a ready for pairing state after a short time?

[BertilJ]

Answering both at the same time, not using Tenergy, but this one https://www.amazon.com/Thermometer-Cloud-BBQ-Bluetooth-Temperature/dp/B08FMC4RRX?th=1

There's no indication that it's connected or not on the probe, but sometimes when I connect, I can see on the screen a few tries, i.e paired - disconnected - paired a few times.

Also, I'm quite sure that the connection is there since as long as it's paired through the pi, the mobile app won't connect and the other way around, so looks like it's only allowing one at a time.

Is the received readings shown in the terminal or only in the MQTT messages?

[BertilJ]

Correction,

There is a indicator, I just haven't seen it before, but it is only visible when connected to the phone, not when it says paired on the pi.

So I guess this is the issue, it doesn't pair properly, any ideas how I could play around with other pairing keys? Or should I just drop this, I'm not specially skilled in decrypting BLE communication, so I'm shooting blank.

[gleeds]

Pairing key not being the same for this brand would be my first guess as to the issue (assuming it is actually based on the same white label chip/software that most of these generic brands repackage). Easiest way to get the key if you don't have a bluetooth sniffer device is to get a copy of the Android APK file, and run it through a decompiler.

I see 2 apps in the Play Store with the same name that look identical but have different publishers, do you know which is the right one if you are on Android? https://play.google.com/store/apps/details?id=com.bobwen.ble.ieasybbq&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.bobwen.ble.cloudbbq&hl=en_US&gl=US

[BertilJ]

No, I don't own a sniffer device, would be interesting to get one, but then it's also about finding the time to learn something new. 😕

It's the second app I'm using.

[gleeds]

So your device is definitely in the same family as mine, but the App is newer than min and decompiles even messier, but I do think that the values are different for both the autoPairKey and startTempUpdates,

I think autoPairKey is:

 autoPairKey:() =>{
        var buffer = new Buffer(8)
        buffer.writeInt8(33,0)
        buffer.writeInt8(101,1)
        buffer.writeInt8(67,2)
        buffer.writeInt8(33,3)
        buffer.writeInt8(0,4)
        buffer.writeInt8(0,5)
        buffer.writeInt8(0,6)
        buffer.writeInt8(33,7)
        return buffer
    }

and startTempUpdates could be one of 3 values:

startTempUpdates:()=>{
        var buffer = new Buffer(8)
        buffer.writeInt8(36,0)
        buffer.writeInt8(0,1)
        buffer.writeInt8(0,2)
        buffer.writeInt8(0,3)
        buffer.writeInt8(0,4)
        buffer.writeInt8(0,5)
        buffer.writeInt8(0,6)
        buffer.writeInt8(36,7)
        return buffer
    }

If 36 doesn't work, try 37 or 39 for that first and last value.

[gleeds]

As an aside, if you ever do decide to get a BLE sniffer, I'd recommend buying one of these two dongles and flashing the Nordic BLE Sniffer firmware on it: https://www.nordicsemi.com/Products/Development-hardware/nrf52840-dongle https://wiki.makerdiary.com/nrf52840-mdk-usb-dongle/

That said, I don't recommend BLE sniffing unless you are a real masochist. Nordic microcontrollers are so much harder to work with than Espressif just to get the firmware flashed on there in the first place. Then you have to learn to pick a needle in a haystack out with Wireshark. Finally, if any of the traffic is using encryption you need to get luck and hope that your sniffer was channel hopping on the right BLE frequency when the key exchange happens between your devices or you have to delete the paring and try again until you get lucky. You can read about another device I sniffed here: https://gregleeds.com/reverse-engineering-sony-camera-bluetooth/

[BertilJ]

I really appriciate your effort! It's clear that my skills in this topic clearly is behind. :)

I've tried all three values for StartTempUpdates and it doesn't seem to do the trick. Same behavior as earlier, the thermometer lights up when the pi is trying to pair, but the pairing fails (I assume since I cannot see the connection on the display and there are no readings).

[BertilJ]

I tried the other app as well and that didn't connect at all.

[BertilJ]

Final comment, did one last try and when switching on the themometer after starting the the bridge, I actually get the connection symbol on the display, but still no readings. (tried with all three values for start temp updates)

This also applies for the original pairing key (went back to that to see if the same behavior was there), so unfortunatly I don't think it makes we any wiser.

[gleeds]

Just realized the 39 command wasn't all 0's, so here's one more option to try for startTempUpdates:

startTempUpdates:()=>{
        var buffer = new Buffer(8)
        buffer.writeInt8(39,0)
        buffer.writeInt8(6,1)
        buffer.writeInt8(0,2)
        buffer.writeInt8(0,3)
        buffer.writeInt8(0,4)
        buffer.writeInt8(0,5)
        buffer.writeInt8(0,6)
        buffer.writeInt8(39,7)
        return buffer
    }

[BertilJ]

Cool, I will give this a shot as soon as I have some time. I did try with 39 as well, but not with buffer.writeInt8(6,1).