ITP Bluetooth LE

Bluetooth LE

ITP | Week 7 | March 10, 2017

Don Coleman

adafru.it/3400

Beacon Project

Course Evaluations

https://goo.gl/NQ2w2Z

Reverse Engineering

SwitchBot

switch-bot.com

adb pull /sdcard/btsnoop_hci.log

Scan for FEE7

Use service cba20d00-224d-11e6-9fb8-0002a5d5c51b

Characteristic cba20002-224d-11e6-9fb8-0002a5d5c51b

Write 0x5701 to activate switchbot

Sniffing Bluetooth LE Packets

Requires Windows
Bluefruit LE Sniffer (hardware)
Nordic nRF-Sniffer (software)
Wireshark-win64-1.12.13.exe (a really old version)
Adafruit Tutorial

Bluefruit LE Sniffer

Switchbot Timer

57 09 03 01 00 <repeat> <hour> <min> 00 00

repeat
00 - Never
01 - Monday
02 - Tuesday
04 - Wednesday
08 - Thursday
10 - Friday
20 - Saturday
40 - Sunday
7f - Everyday
80 - Once

hour 
0 - 23 (0x0 - 0x17)
min
0 - 59 (0x0 - 0x3b)

Bluetooth HID

org.bluetooth.service.human_interface_device.xml

Mouse


    #include <BLEHIDPeripheral.h>
    #include <BLEMouse.h>
    BLEHIDPeripheral bleHIDPeripheral;
    BLEMouse bleMouse;
    bleHIDPeripheral.addHID(bleMouse);

Mouse


    bleMouse.move(x, y);
    bleMouse.click();
    bleMouse.press();
    bleMouse.release();

BLEMouse.h

Keyboard


    #include <BLEHIDPeripheral.h>
    #include <BLEKeyboard.h>
    BLEHIDPeripheral bleHIDPeripheral;
    BLEKeyboard bleKeyboard;
    bleHIDPeripheral.addHID(bleKeyboard);

Keyboard


    bleKeyboard.write(char);
    bleKeyboard.press(key);
    bleKeyboard.release(key);
    bleKeyboard.releaseAll();

BLEKeyboard.h

Mulitmedia


    #include <BLEHIDPeripheral.h>
    #include <BLEMultimedia.h>
    BLEHIDPeripheral bleHIDPeripheral;
    bleHIDPeripheral.addHID(bleMultimedia);

Mulitmedia


    bleMultimedia.write(MMKEY_VOL_UP);
    bleMultimedia.write(MMKEY_VOL_DOWN);
    bleMultimedia.write(MMKEY_MUTE);

Unpair


  // Hold down button on start to unpair
  if (buttonState == LOW) {
    Serial.println("clearing bond data");
    bleHIDPeripheral.clearBondStoreData();
  }

Bluetooth MIDI

MIDI

MIDI is a music protocol that sends description of the notes rather than actual music.

https://midi.org/

MIDI Service

03b80e5a-ede8-4b33-a751-6ce34ec4c700

MIDI Data I/O Characteristic

7772e5db-3868-4112-a1a9-f2669d106bf3

read, write, writeWithoutResponse, notify

Bluetooth LE MIDI Specification


  BLEPeripheral blePeripheral;
  BLEService midiService(
      "03B80E5A-EDE8-4B33-A751-6CE34EC4C700");
  BLECharacteristic midiChar(
      "7772E5DB-3868-4112-A1A9-F2669D106BF3", 
      BLEWrite | BLEWriteWithoutResponse | BLENotify | BLERead, 
      5);


    uint8_t channel = 10;
    uint8_t note = 38; // snare drum
    uint8_t velocity = 127;
    uint8_t data[] = { 0x80, 0x80, 
        0x90 + channel, note, velocity
    };
    midiChar.setValue(data, sizeof(data));