When connecting to Renpho ‎ES-CS20M-RD app chrashews.

oliexdev / openScale

Open-source weight and body metrics tracker, with support for Bluetooth scales

GNU General Public License v3.0

1.68k stars 292 forks source link

When connecting to Renpho ‎ES-CS20M-RD app chrashews. #991

Open kambancode opened 1 year ago

kambancode commented 1 year ago

Describe the bug When connecting to Renpho ‎ES-CS20M-RD app chrashews.

To Reproduce Steps to reproduce the behavior:

open app
start scale
app reports connectiong to scale
app crashes

Debug log Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2023-09-10 11:51:57 Device: HUAWEI CLT-L29 OS version: Android 10 (SDK 29)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:900) at android.os.Handler.dispatchMessage(Handler.java:103) at android.os.Looper.loop(Looper.java:219) at android.app.ActivityThread.main(ActivityThread.java:8668) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:513) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1109)

iamstevedavis commented 12 months ago

Adding my logs as well. Scale: Renpho ES-CS20M

Build version: 2.5.2 
Build date: 1981-01-01 01:01:02 
Current date: 2023-09-13 17:41:01 
Device: Google Pixel 6a 
OS version: Android 13 (SDK 33) 

Stack trace:  
java.lang.NullPointerException: no valid characteristic provided
    at j$.util.Objects.requireNonNull(Unknown Source:5)
    at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291)
    at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612)
    at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210)
    at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464)
    at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210)
    at android.os.Handler.handleCallback(Handler.java:942)
    at android.os.Handler.dispatchMessage(Handler.java:99)
    at android.os.Looper.loopOnce(Looper.java:201)
    at android.os.Looper.loop(Looper.java:288)
    at android.app.ActivityThread.main(ActivityThread.java:7918)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)
3m

floriansto commented 11 months ago

I can confirm this, too.

kiers commented 10 months ago

I too have ES-CS20M from amazon. The app crashes on bluetooth approach to scale. I have allowed Bluetooth permission in app settings. Here is my log

Build version: 2.5.2 Build date: [1981-01-01 01](tel:1981-01-01 01):01:02 Current date: [2023-10-17 22](tel:2023-10-17 22):46:44 Device: Samsung SM-G991U1 OS version: Android 12 (SDK 31)

iff7378 commented 9 months ago

Same scale, same problem:

Why is it still listed as compatible in the wiki??

Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2023-12-11 18:09:37 Device: Google Pixel 6 Pro OS version: Android 14 (SDK 34)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:958) at android.os.Handler.dispatchMessage(Handler.java:99) at android.os.Looper.loopOnce(Looper.java:205) at android.os.Looper.loop(Looper.java:294) at android.app.ActivityThread.main(ActivityThread.java:8194) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:552) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:971)

iff7378 commented 8 months ago

The SDK for this scale is here (and all scales that show up as QN Scale): https://github.com/YolandaQingniu/qnscalesdkX

I wish I had the dev skills to help implement this but I'm not a software person. I'd really like to see this fixed.

@oliexdev If there's other ways I can help get this issues fixed, I'm all ears.

antoinebou12 commented 6 months ago

Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2024-03-08 15:58:55 Device: Google Pixel 6a OS version: Android 14 (SDK 34)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:959) at android.os.Handler.dispatchMessage(Handler.java:100) at android.os.Looper.loopOnce(Looper.java:232) at android.os.Looper.loop(Looper.java:317) at android.app.ActivityThread.main(ActivityThread.java:8501) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:552) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:878)

tsteven4 commented 5 months ago

It looks like the expected service does not support the expected characteristic on the QN-Scale ES-CS20M-RD. BluetoothQNScale.java:111 writeBytes(WEIGHT_MEASUREMENT_SERVICE, CUSTOM3_MEASUREMENT_CHARACTERISTIC, ffe3magicBytes); leads to BluetoothCommunication.java:303 btPeripheral.writeCharacteristic(btPeripheral.getCharacteristic(service, characteristic), bytes, noResponse ? WriteType.WITHOUT_RESPONSE : WriteType.WITH_RESPONSE); getCharacteristic will return null if the characteristic is not found, which will trip the nonnull check in writeCharacteristic: https://github.com/weliem/blessed-android/blob/eb3f852532b62b669844e278fe37b4bf6f05d2b6/blessed/src/main/java/com/welie/blessed/BluetoothPeripheral.java#L1228-L1229

Can someone with an ES-CS20M-RD follow the directions cited below and submit the debug log? https://github.com/oliexdev/openScale/wiki/How-to-reverse-engineer-a-Bluetooth-4.x-scale#2-find-out-the-bluetooth-services-and-characteristic

rfdrake commented 1 month ago

I believe this is where the problem is (from https://yolandaqingniu.github.io/en/flow/ble_scale_custom_connect.html)

Our scale uses two sets of services, and one device will only contain one set. The APP needs to traverse all services to find one set of service IDs. If one set is found, the feature values that need to be called back are enabled according to the feature values in the following table.

The driver for QN-Scale uses FFE0. The other service ID is FFF0. The characteristic UUIDs are different.

Here is the mentioned table for characteristics of FFF0:

FFF1    Notify  Data callback feature value
FFF2    Write   Data write characteristic value
2A19    Read    Charging scale electric quantity characteristic value

So the question would be how to query the scale for the service ID it wants. And if there would be a place to store it so that it doesn't need to probe on every connection. Finally, I wonder if it would be better to split into two different drivers because the changes might be extensive and confusing.

This is all theory right now. I have not yet recompiled with the new values to see if it fixes the crash on my scale. I'm not even sure how the new values would work because they're missing several parts of the state machine. I suspect they may have simplified the scale to use less round trips, but sniffing the official apps bluetooth connection may be the only way to really know how to deal with it.

I haven't jumped through the hoops to try the official app yet, but if I do I'll post the snoop log.

rfdrake commented 1 month ago

I recompiled and tried it using the other service ID and characteristic and it no longer crashes. It doesn't log the weight either, but I suspect that is because I'm not doing the right thing with the results. I'll need to run a packet capture to get a better idea of what to do next.