BLE commands for battery status etc.
Has anyone tried to get inside the Onewheel?
Managed to connect with gatttool, but the data structure seems quite cryptic.
char-write-req 0x0013 0100
yields the board to speak out quite a bit, but I didn't get a hold on the data. E.g. didn't find the bits which change when changing the mode from "standard" to "extreme". Anyone had a better luck?
@newtechsports Check out this thread and see if it helps:
@newtechsports I suspect talk of reversing the protocol might get squashed here, so use caution.
That said, I believe BLE has a concept of services. So an app would tell the the BLE device which services it is interested in, and the BLE device will respond with which ones are available.
In the OneWheel (theorizing at this point) I would guess that list of services would include each of the items listed on the Settings screen of the app. For example "Battery Temperature" or "Odometer Revs".
@thegreck Thanks! That was an interesting view of getting the battery status, but if I'm right it actually needs the display draw commands from the app, so it works well only when the Onewheel app is on the screen.
@akraut I hope the guys at Futuremotion will tell about their attitude towards protocol reversals. Didn't find anything on the forum rules about that (actually didn't find any rules except talk Onewheel)
One can find three BLE services from the board:
attr handle: 0x0001, end grp handle: 0x000b uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle: 0x000c, end grp handle: 0x000f uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle: 0x0010, end grp handle: 0xffff uuid: e659f300-ea98-11e3-ac10-0800200c9a66
I would guess the service mapping is somewhat like this:
- FW update service
- Settings service
- Data service (This is probably in the right position as 0x0013 starts the data flood)
In addition, one can find 40 characteristics values of the service handles
I will try to write something to store the data flood and get something out of it next.