2

I just started using Bluetooth and want to read the body composition measurement from a body scale (Model: adeVital Analysis BA 1401) via Bluetooth.

When set up my iPhone as Central and connect it to the scale (which is CBPeripheral), I can read the scales device information such as Hardware Revision Number, Manufacturer, etc. I can't get the actual measurement data though.

I iterated through all services and characteristics and set the notification flag.

[peripheral setNotifyValue:YES forCharacteristic:aCharacteristic]

for each characteristic. And the delegate method

- (void) peripheral:(CBPeripheral *)peripheral didUpdateNotificationStateForCharacteristic:(CBCharacteristic *)characteristic error:(NSError *)error {

gets called without error. When I check the updated peripheral, I find this:

<CBCharacteristic: 0x1740949b0, UUID = 8A82, properties = 0x20, value = <a1014711 f3000000 00000000 00000000 00000000>, notifying = YES>

This all happens when the scale is turned on (without having measured anything yet). Now when I step on the scale and the measurement is done, it shows a Bluetooth icon indicating a data transfer, the iOS Application is not receiving any notifications though. What am I missing?

So summarized: The peripheral connects to the central and updates a characteristic before it measures, but after that, no more notifications come up.

Could the value in the updated CBCharacteristic be a UUID for a Service to which I would have to subscribe somehow to get the actual data?

Hope someone can help me out here

EDIT:

As it might be relevant, here are the services and characteristics I receive:

Services:
"<CBService: 0x17407dc40, isPrimary = YES, UUID = Device Information>",
"<CBService: 0x174070f80, isPrimary = YES, UUID = 7802>"

Characteristics
"<CBCharacteristic: 0x1740959a0, UUID = Serial Number String, properties = 0x2, value = (null), notifying = NO>",
"<CBCharacteristic: 0x174095900, UUID = Hardware Revision String, properties = 0x2, value = (null), notifying = NO>",
"<CBCharacteristic: 0x1740952c0, UUID = Firmware Revision String, properties = 0x2, value = (null), notifying = NO>",
"<CBCharacteristic: 0x1740958b0, UUID = Manufacturer Name String, properties = 0x2, value = (null), notifying = NO>",
"<CBCharacteristic: 0x174095860, UUID = Software Revision String, properties = 0x2, value = (null), notifying = NO>"

"<CBCharacteristic: 0x170095ea0, UUID = 8A21, properties = 0x20, value = (null), notifying = NO>",
"<CBCharacteristic: 0x170095e50, UUID = 8A22, properties = 0x20, value = (null), notifying = NO>",
"<CBCharacteristic: 0x1700952c0, UUID = 8A20, properties = 0x2, value = (null), notifying = NO>",
"<CBCharacteristic: 0x170095e00, UUID = 8A81, properties = 0x8, value = (null), notifying = NO>",
"<CBCharacteristic: 0x170095db0, UUID = 8A82, properties = 0x20, value = (null), notifying = NO>"

EDIT 2:

The CBCharacteristics have the following properties:

8A20 = Read
8A21 = Indicate
8A22 = Indicate
8A81 = Write
8A82 = Indicate

all other properties are BOOL NO

When I turn on notifications for 8A21, 8A22 and 8A82, I receive an NSData from 8A82 right at the start, when the scale is turned on (so it can’t be a measurement at that point). I assume, the actual measurement data is being updated by the 8A21 characteristic. Yet it won’t notify my delegate and I can’t figure out why.

Viewing the syslog, you can see that the official app of the manufacturer spills the log as follows:

Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = receive push data(<a1018b3b 02000000 00000000 00000000 00000000>),with command(a1), from characteristic(8A82)
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = receive randomnumber (37456641)
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = next step is :operating_receive_random_number
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = next step is :operating_write_xor_results
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command with data:<200eff57 c5>
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command data((null)) to characteristic(8A81)
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write success with status - operating_write_xor_results
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = next step is :operating_write_utc_time
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command with data:<02033b8b 0b>
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command data((null)) to characteristic(8A81)
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write success with status - operating_write_utc_time
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = next step is :operating_write_disconnect
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command with data:<22>
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write command data((null)) to characteristic(8A81)
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = write success with status - operating_write_disconnect
Feb 20 14:19:49 i6S lifesensehealth1_1[4163]: message = next step is :operating_uploaded_results_process
stm
  • 121
  • 1
  • 6
  • The "well known" weight scale service UUIDs is 0x181d - https://developer.bluetooth.org/gatt/services/Pages/ServiceViewer.aspx?u=org.bluetooth.service.weight_scale.xml do you see this service on your device? – Paulw11 Dec 07 '14 at 19:51
  • No, neither `0x181B` (body composition) nor `0x181D` (weight scale). Additional info: when using the manufacturers official app, it needs to "pair" (InApp) the scale before reading its values. Is it possible / likely that in order to communicate with the scale, a privateKey must be exchanged eventhough the BLE communcation is not marked encrypted? – stm Dec 07 '14 at 20:08
  • 1
    Yes, if it isn't using the "well known" service, then it must be using a proprietary service - which means that you would need to reverse engineer their protocol. Characteristic 0x8A81 is a write-only, so you probably need to send some specific challenge data to that – Paulw11 Dec 07 '14 at 20:29
  • There is no encryption on this connection. As Paulw11 said, you need to write challenge data to it. See my included answer. – Zimano Nov 16 '15 at 14:49

1 Answers1

1

You need to write some data to a certain characteristic first. In my case that characteristic was 8A81. I wrote a byte array of a UTC Time code I generated through an algorithm that I cannot publish here. Try writing any 5-byte long array/char to it and see what happens (For example: [1,1,1,1,1])

Zimano
  • 1,870
  • 2
  • 23
  • 41
  • Actually, I figured it out. Wasn't too hard after all, since all the information on how to create the specific data that needs to be written to the characteristic can be found in the syslog (the adeVital app logs them as debug information). – stm Mar 26 '16 at 09:33