Practical Introduction to BLE GATT Reverse Engineering: Hacking the Domyos EL500

Re:Practical Introduction to BLE GATT Reverse Engineering: H... by blutack on Monday October 28, 2024 @05:14PM (#41976376)

If you generated that UART log with an ESP32, then ignore me! Otherwise, it looks like you found the debug port for an ESP IDF project. In that case it's not likely to use the BLE to UART Microchip unfortunately. Therefore there's no guarantee that the UART matches anything to do with the bluetooth (the ESP32 is a separate processor which could be doing a whole bunch of smart stuff).

Also, those Microchip modules are an expensive way to add bluetooth to something (trading dev time for BOM) - I would be surprised to see them in any mass produced or cost optimised design.

Generally, best bet is probably to run jadx over the android app and go from there.

That said, it looks like the FitShow module supports FTMS (standard Bluetooth fitness profile). In that case, fantastic, you should be able to use any off the shelf FTMS bluetooth library to pull data from it. No UART required.

[ Parent | on HN ]

Re:Practical Introduction to BLE GATT Reverse Engineering: H... by andry_ad on Tuesday October 29, 2024 @08:04AM (#41983012)

My apologies, I captured the logs through EPS32 :) since it's not Microchip, the UART protocol is probably a custom FitShow one. I've tried to use FTMS from the Kinomap app, but it seems the FitShow module I have doesn't support it. I'm yet to look into the BLE GATT part to confirm. Will keep digging. Thanks for the reply!

[ Parent | on HN ]