Eufy Smart Scale T9140

[unlimitedbacon]

Eufy Smart Scale T9140 Product Page EufyLife (Vendor App)

Step 1: Read the general reverse engineer process

• [x] I have read the how to reverse engineer a Bluetooth 4.x wiki entry

Step 2: Acquiring some Bluetooth traffic Attach 3 log files with the corresponding true values, read here for further information.

1. Bluetooth HCI Snoop log file user settings in the vendors app:

   Sex: male
   Body Height: 6'3"
   Age: 30
   Activity Level: N/A

   measured true values in the vendors app for the 1. HCI Snoop log file:

   Weight: 76.0 kg
   Date: Sep 11 2021, 2:52 PM
   BMI: 20.8
   Body Fat %: 14.1%
   Water: 62.7%
   Muscle Mass %: 44.5%
   Bome Mass %: 8.4%
   BMR: 2857.6 kcal
   Visceral Fat: 3.4
   Lean Body Mass: 65.3 kg
   Body Fat Mass: 10.7 kg
   Bone Mass: 6.4 kg
   Muscle Mass: 33.8 kg

   --> Attach the 1. HCI Snoop log file here <-- hci_snoop_2021_09_11_14_52_23.cfa.zip

2. Bluetooth HCI Snoop log file user settings in the vendors app:

   Sex: male
   Body Height: 6'3"
   Age: 30
   Activity Level: N/A

   measured true values in the vendors app for the 2. HCI Snoop log file:

   Weight: 79.9 kg
   Date: Sep 11 2021, 3:53 PM
   BMI: 21.9
   Body Fat %: 16.4%
   Water: 61.0%
   Muscle Mass %: 43.5%
   Bome Mass %: 8.4%
   BMR: 2919.6 kcal
   Visceral Fat: 4.9
   Lean Body Mass: 66.8 kg
   Body Fat Mass: 13.1 kg
   Bone Mass: 6.7 kg
   Muscle Mass: 34.8 kg

--> Attach the 2. HCI Snoop log file here <-- hci_snoop_2021_09_11_15_52_14.cfa.zip

3. Bluetooth HCI Snoop log file user settings in the vendors app:

   Sex: male
   Body Height: 6'3"
   Age: 30
   Activity Level: N/A

   measured true values in the vendors app for the 3. HCI Snoop log file:

   Weight: 84.0 kg
   Date: Sep 11 2021, 4:23 PM
   BMI: 23.0
   Body Fat %: 18.7%
   Water: 59.4%
   Muscle Mass %: 42.6%
   Bone Mass %: 8.5%
   BMR: 2984.8 kcal
   Visceral Fat: 10.2
   Lean Body Mass: 68.3 kg
   Body Fat Mass: 15.7 kg
   Bone Mass: 7.1 kg
   Muscle Mass: 35.8 kg

   --> Attach the 3. HCI Snoop log file here <-- hci_snoop_2021_09_11_16_22_11.cfa.zip

Step 3: Discover Bluetooth services and characteristic Read here how to create the openScale debug file

--> Attach the openScale debug log file here <-- openScale_2021-09-11_16-27.txt

[particleflux]

I can add to this information, I did some reverse engineering a while back :) Didn't get around to look at the setup/initial connection process though.

Note that it also only measures weight and impedance on the scale itself, all the other metrics are calculated on the app or server side.

https://gist.github.com/particleflux/2a9b9255b07631989f2e7096b12c8485

[Quintasan]

Not sure if it's the same model, but I have T9146

btsnoop_hci.log

openScale_2021-12-03_18-04.txt

Can't say I could find my weight anywhere. I did look for the following values:

True value	Hexadecimal
78.9	0315
40.4	0194
38.6	0182
21.9	00DB

[MichelEhmen]

Are there any updates on this?

[Kreuger]

I have the T9147. I havent been able to get the snooping to work. But it shows up in the app saying its not supported. And I am able to see it with some details in my BLE Scan app (step 2)

[qimmiq]

i also tried to look through the log for my T9147 but wasn't able to find the weight value

will add files in a sec

[cbondurant]

I happened to do some reverse engineering work on this particular model a while back, unfortunately I cannot remember exactly where all my scattered notes are just at this moment.

What I was able to dig up was this https://git.sr.ht/~cbondurant/eufy-protocol-reversal/tree/main/item/src/main.rs attempt at connecting and reading the data off of the device live as it is activated.

I can do some more digging to try and recover some of the other things I had figured out if there might be someone who is interested in doing the implementation for openScale. I don't think I have the android or java knowledge needed to do so myself.

Main thing I can remember now was that line 35 of the linked code printed out the weight when I was running tests back then.