search

orlopau / ember-mug

Reverse engineered bluetooth protocol for Ember Mugs
MIT License
154 stars 12 forks source link

Discussion: Any idea what these other set characteristics do? #3

Closed GiridharKarnik closed 1 year ago

GiridharKarnik commented 1 year ago

Question

I noticed a bunch of other characteristics when playing around with ember mug 2, any idea what these do? I have tagged the ones which you have identified, but others remain a mystery to me.

LOG  service uuid: 00001800-0000-1000-8000-00805f9b34fb, service id: 1
 LOG  service uuid: 00001801-0000-1000-8000-00805f9b34fb, service id: 5
 LOG  service uuid: fc543622-236c-4c94-8fa9-944a3e5353fa, service id: 8
 LOG  service uuid: 00001530-1212-efde-1523-785feabcd123, service id: 30
 LOG  characteristic uuid: 00002a00-0000-1000-8000-00805f9b34fb, characteristic id: 2
 LOG  characteristic uuid: 00002a01-0000-1000-8000-00805f9b34fb, characteristic id: 3
 LOG  characteristic uuid: 00002a04-0000-1000-8000-00805f9b34fb, characteristic id: 4
 LOG  characteristic uuid: 00002a05-0000-1000-8000-00805f9b34fb, characteristic id: 6
 LOG  characteristic uuid: fc540001-236c-4c94-8fa9-944a3e5353fa, characteristic id: 9  - mug name
 LOG  characteristic uuid: fc540002-236c-4c94-8fa9-944a3e5353fa, characteristic id: 10 - current temperature
 LOG  characteristic uuid: fc540003-236c-4c94-8fa9-944a3e5353fa, characteristic id: 11 - target temperature
 LOG  characteristic uuid: fc540004-236c-4c94-8fa9-944a3e5353fa, characteristic id: 12 - temperature unit
 LOG  characteristic uuid: fc540005-236c-4c94-8fa9-944a3e5353fa, characteristic id: 13 - liquid level
 LOG  characteristic uuid: fc540006-236c-4c94-8fa9-944a3e5353fa, characteristic id: 14 - date and time zone
 LOG  characteristic uuid: fc540007-236c-4c94-8fa9-944a3e5353fa, characteristic id: 15 - battery percentage
 LOG  characteristic uuid: fc540008-236c-4c94-8fa9-944a3e5353fa, characteristic id: 16 - liquid state
 LOG  characteristic uuid: fc54000a-236c-4c94-8fa9-944a3e5353fa, characteristic id: 17 
 LOG  characteristic uuid: fc54000c-236c-4c94-8fa9-944a3e5353fa, characteristic id: 18 - firmware version
 LOG  characteristic uuid: fc54000d-236c-4c94-8fa9-944a3e5353fa, characteristic id: 19
 LOG  characteristic uuid: fc54000e-236c-4c94-8fa9-944a3e5353fa, characteristic id: 20
 LOG  characteristic uuid: fc54000f-236c-4c94-8fa9-944a3e5353fa, characteristic id: 21
 LOG  characteristic uuid: fc540010-236c-4c94-8fa9-944a3e5353fa, characteristic id: 22
 LOG  characteristic uuid: fc540011-236c-4c94-8fa9-944a3e5353fa, characteristic id: 23
 LOG  characteristic uuid: fc540012-236c-4c94-8fa9-944a3e5353fa, characteristic id: 25 - push events
 LOG  characteristic uuid: fc540014-236c-4c94-8fa9-944a3e5353fa, characteristic id: 27 - mug color
 LOG  characteristic uuid: fc540013-236c-4c94-8fa9-944a3e5353fa, characteristic id: 28
 LOG  characteristic uuid: 00001532-1212-efde-1523-785feabcd123, characteristic id: 31
 LOG  characteristic uuid: 00001531-1212-efde-1523-785feabcd123, characteristic id: 32
 LOG  characteristic uuid: 00001534-1212-efde-1523-785feabcd123, characteristic id: 34
bmiddha commented 1 year ago

Nordic Device Firmware Update (DFU) Service

https://developer.nordicsemi.com/nRF5_SDK/nRF51_SDK_v4.x.x/doc/html/group__dfu__ble__service__spec.html

It seems like that it's a Nordic semiconductor Bluetooth chip

 LOG  service uuid: 00001530-1212-efde-1523-785feabcd123, service id: 30  - DFU Service

 LOG  characteristic uuid: 00001532-1212-efde-1523-785feabcd123, characteristic id: 31 - DFU Packet
 LOG  characteristic uuid: 00001531-1212-efde-1523-785feabcd123, characteristic id: 32 - DFU Control Point
 LOG  characteristic uuid: 00001534-1212-efde-1523-785feabcd123, characteristic id: 34 - DFU Version

Standard Bluetooth things

Bluetooth SIG have reserved a range of UUIDs: XXXXXXXX-0000-1000-8000-00805F9B34FB

To find out what the spec says, take the last 4 of the XXXX digits and look them up here: https://btprodspecificationrefs.blob.core.windows.net/assigned-numbers/Assigned%20Number%20Types/Assigned%20Numbers.pdf

Example: 00002a00-0000-1000-8000-00805f9b34fb -> 0x2a00 -> Device name

 LOG  service uuid: 00001800-0000-1000-8000-00805f9b34fb, service id: 1 - Generic Access service
 LOG  service uuid: 00001801-0000-1000-8000-00805f9b34fb, service id: 5 - Generic Attribute service

 LOG  characteristic uuid: 00002a00-0000-1000-8000-00805f9b34fb, characteristic id: 2 - Device Name 
 LOG  characteristic uuid: 00002a01-0000-1000-8000-00805f9b34fb, characteristic id: 3 - Appearance
 LOG  characteristic uuid: 00002a04-0000-1000-8000-00805f9b34fb, characteristic id: 4 - Peripheral Preferred Connection Parameter
 LOG  characteristic uuid: 00002a05-0000-1000-8000-00805f9b34fb, characteristic id: 6 - Service Changed

The rest is ember's stuff

XXXXXXXX-236c-4c94-8fa9-944a3e5353fa

bmiddha commented 1 year ago

Try using the nRF Connect app to investigate what the other stuff is. https://www.nordicsemi.com/Products/Development-tools/nrf-connect-for-mobile

foostuff commented 1 year ago

What I found in the app about the ember stuff... (Read/Write info from bluetooth terminal)

MUG_NAME (RW)
    UUID = FC540001-236C-4C94-8FA9-944A3E5353FA
    MUG_NAME_ALLOWED_CHARACTERS = "[A-Za-z0-9,.\\[\\]#()!\"':|\\-_+<>%= ?]*"
    MUG_NAME_MAX_LENGTH = 16
DRINK_TEMPERATURE (R)
    UUID = FC540002-236C-4C94-8FA9-944A3E5353FA
TARGET_TEMPERATURE (RW)
    UUID = FC540003-236C-4C94-8FA9-944A3E5353FA
    CELSIUS_BOTTOM = 50
    CELSIUS_EDGE_CASE_0 = 49.5
    CELSIUS_EDGE_CASE_1 = 48.0
    CELSIUS_TOP = 65.0
    CELSIUS_FIRE = 67.5
    FAHRENHEIT_BOTTOM = 120.0
    FAHRENHEIT_TOP = 150.0
    FAHRENHEIT_FIRE = 155.0
TEMPERATURE_UNIT (RW)
    UUID = FC540004-236C-4C94-8FA9-944A3E5353FA
    CELSIUS_VALUE = 0
    FAHRENHEIT_VALUE = 1
LIQUID_LEVEL (R)
    UUID = FC540005-236C-4C94-8FA9-944A3E5353FA
    LIQUID_LEVEL_EMPTY = 5
TIME_DATE_AND_ZONE (RW)
    UUID = FC540006-236C-4C94-8FA9-944A3E5353FA (only BasicMug?)
BATTERY (R)
    UUID = FC540007-236C-4C94-8FA9-944A3E5353FA
    OFFSET_BATTERY_LEVEL = 0
        BATTERY_LOW_LEVEL = 11
    OFFSET_CHARGER_CONNECTED = 1
        CHARGER_CONNECTED = 1
LIQUID_STATE (R)
    UUID = FC540008-236C-4C94-8FA9-944A3E5353FA
    UNKNOWN = 0 
    EMPTY = 1
    FILLING = 2
    COLD_NO_TEMPERATURE_CONTROL = 3
    COOLING = 4
    HEATING = 5
    TARGET_TEMPERATURE = 6
    WARM_NO_TEMPERATURE_CONTROL = 7
VOLUME 
    UUID = FC540009-236C-4C94-8FA9-944A3E5353FA (only BasicMug?)
LAST_LOCATION (W)
    UUID = FC54000A-236C-4C94-8FA9-944A3E5353FA
ACCELERATION 
    UUID = FC54000B-236C-4C94-8FA9-944A3E5353FA (only BasicMug?)
OTA (R)
    UUID = FC54000C-236C-4C94-8FA9-944A3E5353FA
    OFFSET_FIRMWARE_VERSION = 0
    OFFSET_HARDWARE_VERSION = 2
    OFFSET_BOOTLOADER_VERSION = 4
MUG_ID (R)
    UUID = FC54000D-236C-4C94-8FA9-944A3E5353FA
    LENGTH_MUG_ID_BYTES = 6
DSK (R)
    UUID = FC54000E-236C-4C94-8FA9-944A3E5353FA
UDSK (R)
    UUID = FC54000F-236C-4C94-8FA9-944A3E5353FA
CONTROL_REGISTER_ADDRESS (RW)
    UUID = FC540010-236C-4C94-8FA9-944A3E5353FA
CONTROL_REGISTER_DATA (RW)
    UUID = FC540011-236C-4C94-8FA9-944A3E5353FA
PUSH_EVENT
    UUID = FC540012-236C-4C94-8FA9-944A3E5353FA
    BATTERY_SOC_CHANGED = 1
    CHARGER_CONNECTED = 2
    CHARGER_DISCONNECTED = 3
    TARGET_TEMPERATURE_CHANGED = 4
    DRINK_TEMPERATURE_CHANGED = 5
    AUTH_INFO_NOT_FOUND = 6
    LIQUID_LEVEL_CHANGED = 7
    LIQUID_STATE_CHANGED = 8
    BATTERY_VOLTAGE_STATE_CHANGED = 9
STATISTICS
    UUID = FC540013-236C-4C94-8FA9-944A3E5353FA
LED (RW)
    UUID = FC540014-236C-4C94-8FA9-944A3E5353FA (only mugCM?)
    OFFSET_RED_LED_VALUE = 0
    OFFSET_GREEN_LED_VALUE = 1
    OFFSET_BLUE_LED_VALUE = 2 
    OFFSET_ALPHA_LED_VALUE = 3
GiridharKarnik commented 1 year ago

@foostuff thank you, seems like there is a minimum value for the target temperature, CELSIUS_BOTTOM = 50. When I try to write below this, the mug defaults to 50.

foostuff commented 1 year ago

about MUG_ID: Bytes 8-18 seem to contain the serial number: (i replaced the last 3 digits) øÚCÜfPCPG20100123

There is "CM19P CPG20100123" written on the bottom of my mug.