Add support for 1byone scale

[dinki]

I'm writing in hopes that you can add 1byone BT scale (https://www.amazon.com/1byone-Bluetooth-Wireless-Bathroom-Visceral/dp/B01FHELB56/) to your list of supported devices. I received this as a gift from my wife but it is tied to a proprietary app that leaves much to be desired.

While I am much more of a hacker than a programmer, I am pretty sure that this is possible as someone has written some software that pulls the information from the scale:

https://github.com/ec1oud/qt-ble-weightscale

Further, I was able to use BT Snoop to pull the log where the scale connects and passes the information on to the phone. You can see the same type of information listed at the above repo here:

https://github.com/ec1oud/qt-ble-weightscale/blob/master/doc/notes.txt

Here's what it looks like:

Frame 13693: 32 bytes on wire (256 bits), 32 bytes captured (256 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Event - LE Meta
    Event Code: LE Meta (0x3e)
    Parameter Total Length: 29
    Sub Event: LE Advertising Report (0x02)
    Num Reports: 1
    Event Type: Connectable Undirected Advertising (0x00)
    Peer Address Type: Public Device Address (0x00)
    BD_ADDR: TexasIns_2a:8d:a6 (f0:c7:7f:2a:8d:a6)
    Data Length: 17
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x0
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x0)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x0)
            .... .1.. = BR/EDR Not Supported: true (0x1)
            .... ..0. = LE General Discoverable Mode: false (0x0)
            .... ...1 = LE Limited Discoverable Mode: true (0x1)
        16-bit Service Class UUIDs (incomplete)
            Length: 3
            Type: 16-bit Service Class UUIDs (incomplete) (0x02)
            UUID 16: Unknown (0xfff0)
        Manufacturer Specific
            Length: 9
            Type: Manufacturer Specific (0xff)
            Company ID: Ericsson Technology Licensing (0x0000)
            Data: f0c77f2a8da6
    RSSI (dB): -60

Frame 13694: 33 bytes on wire (264 bits), 33 bytes captured (264 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Event - LE Meta
    Event Code: LE Meta (0x3e)
    Parameter Total Length: 30
    Sub Event: LE Advertising Report (0x02)
    Num Reports: 1
    Event Type: Scan Response (0x04)
    Peer Address Type: Public Device Address (0x00)
    BD_ADDR: TexasIns_2a:8d:a6 (f0:c7:7f:2a:8d:a6)
    Data Length: 18
    Advertising Data
        Device Name: Electronic Scale
            Length: 17
            Type: Device Name (0x09)
            Device Name: Electronic Scale
    RSSI (dB): -60

Frame 13721: 14 bytes on wire (112 bits), 14 bytes captured (112 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Write Request (0x12)
        0... .... = Authentication Signature: False
        .0.. .... = Command: False
        ..01 0010 = Method: Write Request (0x12)
    Handle: 0x0015 (Unknown: Unknown: Client Characteristic Configuration)
        [Service UUID: Unknown (0xfff0)]
        [Characteristic UUID: Unknown (0xfff4)]
        [UUID: Client Characteristic Configuration (0x2902)]
    Characteristic Configuration Client: 0x0001, Notification
        0000 0000 0000 00.. = Reseved: 0x0000
        .... .... .... ..0. = Indication: False
        .... .... .... ...1 = Notification: True
    [Response in Frame: 13722]

Frame 13722: 10 bytes on wire (80 bits), 10 bytes captured (80 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Write Response (0x13)
        0... .... = Authentication Signature: False
        .0.. .... = Command: False
        ..01 0011 = Method: Write Response (0x13)
    [Handle: 0x0015 (Unknown: Unknown: Client Characteristic Configuration)]
        [Service UUID: Unknown (0xfff0)]
        [Characteristic UUID: Unknown (0xfff4)]
        [UUID: Client Characteristic Configuration (0x2902)]
    [Request in Frame: 13721]

Frame 1965: 28 bytes on wire (224 bits), 28 bytes captured (224 bits)
Bluetooth
    [Source: TexasIns_2a:8d:a6 (f0:c7:7f:2a:8d:a6)]
    [Destination: AsustekC_7e:22:04 (50:46:5d:7e:22:04)]
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Handle Value Notification (0x1b)
    Handle: 0x0014 (Unknown: Unknown)
    Value: cf01adaa0404015b1e026c1301cd0599

cf01adaa 0414 015e 1c02 7013 01ca059c
104.4 kg, fat 35%, water 45.8%, muscle 62.4kg, bone 2.8kg

cf01adaa 0406 015b 1e 026d 13 01cd 0599
103.0 kg, fat 34.7%, water 46.1%, muscle 62.1kg, bone 3.0kg, BMR 1433 kcal

0x0406: 1030  kg
0x015b: 347 fat
0x1e: 30 bone
0x026d: 621 muscle
0x13: 19 visceral fat
0x01cd: 461  water
0x0599: 1433  BMR

I am certainly willing to do testing on this if someone can decrypt the handshake and add the functionality to openScale.

Let me know what you think!

Thanks

[oliexdev]

I need more information. What is the Bluetooth device name? You have to do step 1 and 2 in the wiki! Thanks to @ec1oud step 3 has been already analysed.

[dinki]

Roger. Will provide soon. Thanks for the info and your time.

[dinki]

Here's three files for part one: 82.4 pounds / 37.37601 kg https://www.dropbox.com/s/exc8lndzddqw8o2/824btsnoop_hci.log?dl=0

92.6 pounds / 42.00265 kg https://www.dropbox.com/s/5rx6u91psujh7vd/926btsnoop_hci.log?dl=0

87.8 pounds / 39.82541 kg https://www.dropbox.com/s/xv21yiuclcz179i/878btsnoop_hci.log?dl=0

Here's an Imgur gallery with the information for part two: https://imgur.com/a/sV8tC

I couldn't figure out how to export this as text.

Please let me know how I can assist further. Thanks again for your time. This is a pretty good scale at a really good price so I'd imagine quite a few people would fine this a useful addition of openScale as the 1byOne app is not too good.

Thanks!

[Dododappere]

From your screenshots it seems it has the Body Composition Service ! You don't see that a lot!

So at least there shouldn't be any issues reading the body composition values (fat, bodywater etc)...and it seems to match the byte array you found.

[dinki]

Great news. Can I do anything to help with anything? I know having things as images makes it impossible to copy/paste. Do you guys need me to transcribe any of this?

[oliexdev]

@dinki I implemented a first try. Please try out the latest development version. Is openScale connected to the scale? Do you receive anything? (a toast message should be shown)

[dinki]

Thanks for spending time on this!

To be clear, it's the APK at https://github.com/oliexdev/openScale/releases/tag/travis-dev-build right? Will download and try this evening.

[oliexdev]

@dinki that is correct

[dinki]

Just tried and I could not get it to connect. I went to settings Bluetooth and tried selecting device. It went to a white screen and nothing happened. No error message just a white screen. Any ideas?

[oliexdev]

Then your scale is still connected to the vendors app or not active. But you have a white screen? At least a message should shown with "Searching for Bluetooth scales"

[dinki]

I tried again and did notice the searching message for a split second before it went to the white screen. The 1byone app requires you to open the app before it will attempt to sync so I doubt that it was causing any connection issues. To be sure, however, I force closed it before trying with openScale.

I'm running v1.7-dev_5dd254f7 (1516984585) with bluetooth options search for scale on startup. Device Type shows up as '-'

[oliexdev]

That's weird, because what openScale does when you click on the settings->bluetooth->device is that it only searches for every nearby Bluetooth device and list them in the App with their name and address. But openScale can only see devices which are not connected to anything else.

Do you see the device in the Android Bluetooth settings?

[dinki]

I do not see it there. I tried to scan from Android Bluetooth settings and it showed up as 'Health Scale'. I tried connecting/pairing but it failed.

I ensured that the bluetooth symbol on the scale was flashing when trying to connect/scan using openScale. I'm not sure what else I could do. Any thoughts? Thanks

[oliexdev]

Sorry I have no other idea. As I wrote openScale doesn't do anything else beside scanning for active Bluetooth devices and list them if you click in the openScale settings->bluetooth->device. If they can't even been seen there then the scale is hidden or paired somehow?! I don't know if it even possible to disable the scale visibility in Bluetooth 4.x.

As long if you can't fix this problem I will close this issue.

[dinki]

Understood. The scan doesn't show any bluetooth devices. Not just the scale. Should I be able to see any and all bluetooth and bluetooth le devices I have there or does it somehow limit to only scales?

My phone is a Samsung S4. I do realize that it is old but it does what I need. Could this be the problem?

[oliexdev]

openScale should list all Bluetooth 4.x devices.

I don't know if you smartphone is the problem. If you can try out another tablet or smartphone, you could test it. But I doubt that because it did work with the vendors app didn't it?

I changed the implemented Bluetooth search algorithm in openScale which use now the new Android API so please test it with the latest development version.

[dinki]

Thanks for doing this. I'm at work but just downloaded the dev version. I went to Device Type and now it is showing nearby BT devices so this looks promising. Will update when I get home this evening and can try with the scale.

[oliexdev]

Please download again the latest development version I changed again something.

[itsmegb]

I have this same scale, but it doesn't display as 'Health Scale' it gets detected as 'ExcelvanCF369BE', but when i check on BluetoothLE Scanner, its device name shows as 'Electronic Scale'.

I wonder if this is to do with device hardware/firmware versions, my scale is has the following:

• Firmware: v1.0
• Hardware: B0002
• Software: wechat&&SPS_v1.0

@dinki What are the values for your scale shown under device information?

[dinki]

@oliexdev I have some definite progress to report. I was able to scan for devices and find my scale. I went to the main menu and clicked the bluetooth icon and it attempted and successfully connected to the scale. I weighed myself with the scale connected to the app but it did not download the data. I did not get any kind of message at all.

@itsmegb I'm not near my scale but I'll see if I can grab that and post it later.

[oliexdev]

@dinki I tried to analysed @ec1oud source code and implemented his magic bytes and also set on UUID notification on. Please try again the latest development version. Can you install Android Studio and compile the source code? Do you have any programming experience. Would make the much easier.

@itsmegb That is strange that your scale has a different Bluetooth name. Are you sure you have a 1byone scale?

[dinki]

@oliexdev Unfortunately that did not work either. Are there any logs that might shed light on what is actually happening? In regards to being a programmer, I am not. I'm much more of a hacker than anything.

[oliexdev]

@dinki if you don't see any toast message then you don't receive any data from the scale. To figure out what is going on is difficult if you don't have the scale. You have to analyse the scale behaviour via a try and error process. Sorry, I can't do that here. Try out @ec1oud qt program and see if that is working. Maybe it has something to do with the magic bytes!? Maybe the key to success is to understand the magic bytes which are send to the scale.

[oliexdev]

@dinki maybe you don't see any toast because you have the same problem as #187 . Try to debug the app in Android Studio.

I will remove this try in the master repository until we get working version.

For reference the latest implementation in the mater repository was BluetoothOneByone.java.

[dinki]

I'm finally getting around to looking at this. Apologies. Do you have a guide for debugging/building with Android Studio? I'm pretty technical but I have never done this before so a general guide would help. Also, what do I need to install? Is Android Studio a standalone package or do I need to add certain modules etc?

Thanks again for the help. Just a little push and I'll be happy to try and experiment on this end.

EDIT I got Android Studio installed and have imported the current github project and am viewing the file you mentioned. Just need a bit of help figuring out how to proceed. Do I need to set breakpoints?

[oliexdev]

you could set breakpoints or you could just simple add some Log.d(...) statements.

See https://developer.android.com/studio/debug/index.html

[dinki]

Thanks.. so these would go near the bottom where the variables are assigned? Like around scaleBtData.setWeight(weight); ?

[oliexdev]

wherever you want. For example if you want to inspect what is in the weight variable just set there a breakpoint or write directly above the following code snippet:

Log.d("MY VARIABLE", "Weight value :" + weight);
scaleBtData.setWeight(weight); 

[dinki]

Thank you for your help and your patience. So once I make these changes do I need to build the APK and put it on the phone and try a reading? I'm guessing these values will be sent to a log file somewhere. How do I find and read this log file?

[oliexdev]

see https://developer.android.com/training/basics/firstapp/running-app.html how to run the app. No the values are not send to a log file it will display in the logcat tab (see the bottom tabs) in the Android Studio.

[dinki]

Oh that's really cool. Thanks.. I'll give it a shot soon.

[dinki]

@oliexdev I plugged in my phone last night and did not get what was listed in the guide. I am not running Android v8. Far from it. My phone is an old Samsung S4. It serves me just fine for my day-to-day needs, but perhaps can't be used with the instructions given?

Is there another way to test? Is there a way to perhaps build and APK that can write to a physical file on the phone and view that log file?

[simon6162]

Sorry from writing on a closed issue.

weight_scale_trace.zip

I've attached a frontline ble sniffer trace of a transaction from the stock app, you might / might not find it useful. For me the device is names "electronic scale" the name is in the scan response. The connect request is at frame 3037, the scales MAC is 0x010203040769. You are probably better looking at the advert with the manufacturer specific data to make the connection and not the name.

See https://github.com/ec1oud/qt-ble-weightscale/issues/1 for how the magic numbers work.

You must write the control characteristic, and enable notifications to get the data, the notification are send twice before the unit powers off (no disconnection is seen in the sniffer logs ever!)

[erijo]

Reopen so it can be looked at.

[erijo]

What happens if you, using the dev version, try to connect to the scale @simon6162?

[simon6162]

It connects just fine for me and pulls back the weight OK - FYI the scales only advertise when you stand on them (which is what most do that i've seen) so you need to do that to find the device.

The body fat is way off though, which is to be expected given what i worked out in https://github.com/ec1oud/qt-ble-weightscale/issues/1

From looking at BluetoothOneByone.java - where did magicBytes come from, i've not noticed that in the air trace only magicBytes2

[erijo]

I only have a Beurer BF710 and that scale can be found without having to stand on it.

Is it possible to post the sniffer logs in some other format? I don't have Frontline ble sniffer.

[simon6162]

It doesn't look like it does, you can get it from http://www.fte.com/support/download.aspx?demo=ComProbe+NFC&iid=1z&Product=16.5.10527.12085 assuming you are on windows - no need for the drivers if you don't have the sniffer. The web form It doesn't validate details ;)

Just looking at your code and the visfat should be /1 not /10. float visfat = (float)(((weightBytes[11] & 0xFF) & 0xFF)) / 1.0f; // %

This is my working python if you want to compare....

weight = int(value[4:6].hex(),16)/10.0 fat    = int(value[6:8].hex(),16)/10.0 bone   = int(value[8:9].hex(),16)/1.0 muscle = int(value[9:11].hex(),16)/10.0 v_fat  = int(value[11:12].hex(),16)/1.0 water  =  int(value[12:14].hex(),16)/10.0 bmr    =  int(value[14:16].hex(),16)

[erijo]

@simon6162: the magicBytes seems to come from the btsnoop logs posted by @dinki.

But I'm a little confused now as it seems there are two bluetooth drivers in openScale that look similar: OneByone and ExcelvanCF369BLE. Which one is used for your device @simon6162, i.e. what does it say when you scan for the scale in the settings?

If you test with the latest dev version, that it work for you then?

[erijo]

@dinki: can you try the latest dev version as well? I'm interesting in knowing what the name the device has, which can be seen after scanning for devices in the settings. If it isn't found you may have to stand on it.

Also, if it is found, can you get a measurement from it?

[simon6162]

Interesting. It shows up as ExcelvanCF369BLE

On Wed, 18 Apr 2018, 21:50 Erik Johansson, notifications@github.com wrote:

@simon6162 https://github.com/simon6162: the magicBytes seems to come from the btsnoop logs posted by @dinki https://github.com/dinki.

But I'm a little confused now as it seems there are two bluetooth drivers in openScale that look similar: OneByone and ExcelvanCF369BLE. Which one is used for your device @simon6162 https://github.com/simon6162, i.e. what does it say when you scan for the scale in the settings?

If you test with the latest dev version, that it work for you then?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/oliexdev/openScale/issues/159#issuecomment-382524970, or mute the thread https://github.com/notifications/unsubscribe-auth/AdUB7ZKRb_BATtXuCt9WVu13M3VztsY8ks5tp6ccgaJpZM4Rngi2 .

[erijo]

Does it work? Do you get the expected values? If not, what do you get?

[simon6162]

The body fat is 10% under what it should be, i haven't checked the other measurements. I'll try and grab a sniffer trace over the weekend and work out the issue.

On Thu, 19 Apr 2018, 22:37 Erik Johansson, notifications@github.com wrote:

Does it work? Do you get the expected values? If not, what do you get?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/oliexdev/openScale/issues/159#issuecomment-382888829, or mute the thread https://github.com/notifications/unsubscribe-auth/AdUB7X89g1Sn-wMp4NcrHazuUZs136QFks5tqQOkgaJpZM4Rngi2 .

[dinki]

@erijo Mine shows up as health scale. It says connecting but I do not get any readings. Tried uninstalling and reinstalling and it simply does not work.

[erijo]

@dinki : please try again with the latest dev version and let me know how it goes.

[erijo]

Also, @dinki and @simon6162, could you please post the model number/name as written under your scale (if there is a note there) so we can get some clarity in the naming confusion?

[dinki]

@erijo Good news and bad news. Good news is that the OS is getting weights now with latest dev version, ya!! Bad news is it isn't receiving any of the other data (fat %, muscle mass, etc).

I'll try and get the model number for you soon. Thanks again for working on this.

[erijo]

@dinki I only added weight support as I didn't know what the expected values for the other measurements were in the logs you posted earlier. To get the other values I need logs where you also include the values for all measurements.

Also note the age, sex, activity level etc. that you enter in the original app. Would be good with logs where you change these settings so we can figure out what the values that the app send means.

[dinki]

@erijo I'm not sure I follow what you're asking for. The logs I grabbed originally were independent of the app.

Also, I took a look for the model number but there was no tag on the scale outside of an FTC number:

https://photos.app.goo.gl/pmBbywCVkebhCxsp1

[erijo]

I need similar logs as you posted earlier but with all the other measurements noted as well (i.e. not just the weight as in the first logs).

I assumed you got the logs while using the original app as some data is sent to the scale to start measuring. To figure this part out you need to use the original app and change settings such as your age, sex, unit, etc. and do a measurement. Then attach logs together with the settings you used so we can figure out what all the bytes mean. Preferably only change one setting at a time.