Are BLE advertising tokens device or model specific?

[jack-webb]

The comment that spawned this: https://github.com/manymuch/Xgimi-4-Home-Assistant/issues/23#issuecomment-1712381909

The readme contains a list of BLE advertising tokens contributed by community members, in the hopes these tokens can be used by others, so they don't have to sniff their own token. However, I can't find any evidence of anyone successfully using these shared tokens on their beamer.

There's also reports of different tokens for the same model (which would go against the idea the token is shared between models). It's looking more likely to me the tokens are device specific, but I don't think this is enough evidence to say for certain.

Horizon 1080p [1] 33D731E3B22440FFFFFF3043524B544D [2] 839ACD5B9D1D60FFFFFF3043524B544D

Horizon Ultra [1] 0DFEDF8168E490FFFFFF3043524B544D [2] 9B511C4E68E490FFFFFF3043524B544D

Elfin [1] 12D7C7899B9F80FFFFFF3043524B544D (From Stack Overflow) [2] 38B4640F35F278FFFFFF3043524B544D

Critically, we need to test newly found tokens on other devices - that should give us a better idea.

[kataloo]

I've got to work H3 with the token 9317501A9B9F80FFFFFF3043524B544D which is also different from the one listed on Stack overflow (0xD1497DBDA42360FFFFFF3043524B544D). It looks like the first byte is so not important: I've sniffed poweron codes that differ only in the first byte.

[helgek]

I will add a comment on the StackOverflow thread that there are increasing indications for device specific codes so people should also consider looking up the manufacturer code themselves.

[manymuch]

I am considering removing the token list in the readme. And it is now clear that everyone need sniffering for their own token. For me I success with the ios App Bluetooth Smart Scanner App. I think next step is to provide multiple ways for sniffering and with minimum hardware requirements.

[helgek]

Probably you're right. I adjusted the StackOverflow answer, will leave the codes there for some more time as they might be useful for some further analysis of potential patterns in the code. Maybe the ESP32 based ESPHome Bluetooth Proxy device could be an approach to provide a reliable and consistent approach to sniff the manufacturer code with bluez. Maybe the scanned codes could be automatically filtered for company id 0×0046 and like this it could be possible to provide an easy and completely HA based way to find out the right manufacturer code. I don't know though how this special scenario described by muxa could be addressed where he talks about the Scan Response Data. I don't know if this can be retrieved through bluez as well.

[manymuch]

Updated the readme to guide users to try sniffering their own token directly.

Removed these collected token from readme and put here as backup.	model	token
H1S	0ED8822F811CBCFFFFFF3043524B544D
H5	4D4B17D86C27E0FFFFFF3043524B544D
H3	D1497DBDA42360FFFFFF3043524B544D
H3S	39BCA0F7A3ADB4FFFFFF3043524B544D
New Z4 Air	0917B18FCB2222FFFFFF3043524b544D
Z6X	12D7C7899B9F80FFFFFF3043524B544D
Halo+	143FCB9335F278FFFFFF3043524B544D
Elfin	12D7C7899B9F80FFFFFF3043524B544D
Horizon Pro 4K	1A7E0C743AEF18FFFFFF3043524B544D
Horizon (1080p)	33D731E3B22440FFFFFF3043524B544D

[asfasty]

Hello,

I get everything done, apart from a successful connection.

Horizon Pro (model GK03H) - token that I got from the ble sniffer tool on ios is 3D0D4A9A-BA3E-41A9-A01B-E11C1CF13E33. I receive failed to connect. I thought the BLE would not be necessary to get the integration to work, just turn on would require Ble. I have a standard Hassio Installation on a small device similar to a nuk. any idea what I am doing wrong? - Tried GUI and manuall installation method. Unfortunatly, I am not getting any further. Kind Regards, Annette

[helgek]

Hi Annette, I was never able to connect to my Elfin with the integration. I have the feeling it might have something to do with the region of the xgimi projector, e.g. China or international. But I've not investigated this further. To turn on your projector using the ble advertisement you can also achieve this by using a shell script which runs bluetoothctl commands. I also provided these commands in another thread. But did you already try to turn on the projector using e.g. https://play.google.com/store/apps/details?id=com.siliconlabs.bledemo&hl=en&pli=1 ? This seems to be the most reliable solution so far to test the manufacturer code.

[helgek]

Also check this thread: https://github.com/manymuch/Xgimi-4-Home-Assistant/issues/5

[Bergasha]

Anyway with Android to sniff the ble token for a H2 projector or does anyone already have the token? Cheers

[olehdutko]

Hello! My projector is -xgimi H1 and I have 2 RC for it. I sniffed tokens with Bluetooth Smart Scanner App and get: "460008e0 2f660022 22ffffff 3043524b 544d" "460014e0 2f660022 22ffffff 3043524b 544d"

As I understand, my tokens are: 08e02f66002222ffffff3043524b544d 14e02f66002222ffffff3043524b544d

But no one token works..... I can control projector but can not turn on/off 554 port is opened

[helgek]

@olehdutko did you test to turn on the projector with the Android app? https://github.com/manymuch/Xgimi-4-Home-Assistant/issues/31#issuecomment-1870319256

[olehdutko]

@olehdutko did you test to turn on the projector with the Android app? #31 (comment)

Finally, I scaned 3 tokens from 2 RC and no one is working even via Android App

[CHG] Device DC:A6:32:0B:23:36 ManufacturerData Key: 0x0046 [CHG] Device DC:A6:32:0B:23:36 ManufacturerData Value: a6 e0 2f 66 00 22 22 ff ff ff 30 43 52 4b 54 4d ../f.""...0CRKTM

[CHG] Device 00:02:5B:97:2C:8C ManufacturerData Key: 0x0046 [CHG] Device 00:02:5B:97:2C:8C ManufacturerData Value: a6 e0 2f 66 00 22 22 ff ff ff 30 43 52 4b 54 4d ../f.""...0CRKTM

[CHG] Device D0:10:56:E0:D5:7D ManufacturerData Key: 0x0046 [CHG] Device D0:10:56:E0:D5:7D ManufacturerData Value: 0c e0 2f 66 00 22 22 ff ff ff 30 43 52 4b 54 4d ../f.""...0CRKTM

[helgek]

@olehdutko You need to setup EFR connect like this: https://i.stack.imgur.com/4HLQs.jpg