Using AI to reverse engineer undocumented Bluetooth protocols has been a godsend for me. We have an RV that came with a "Smart RV" system from BMPro that controls all of the lights, the air conditioning, starting the generator, leveling, slideouts, and other stuff.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
For me, it was reverse engineered. I am not an expert or even conversant in decompiling Android APKs. It took the decompiled Java (app was apparently written in Kotlin) and extracted all the necessary information.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
If you have a eufy scale, you can do this with no LLM needed - just set up an esp32 Bluetooth proxy, add it to home assistant, and then use the EufyLife integration someone already made. I did this recently with my scale to avoid having to sync it to my phone, go to the cloud, fetch data from the cloud, etc., and it's working fantastically. I have a little Home Assistant integration that pokes scale updates to a Python script running locally that provides a UI I like.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
I actually found this out by accident. I set up a BT proxy to capture my combustion thermometers and saw eufy show up as an option and was like wait what? Honestly surprised how open it is.
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
esphome:
name: bluetooth-proxy
esp32:
board: esp32dev
framework:
type: esp-idf
# Enable logging
logger:
# Enable Home Assistant API
api:
encryption:
key: "YOUR_KEY_HERE"
# Enable OTA updates
ota:
- platform: esphome
# WiFi configuration (matching the settings from your other devices)
wifi:
ssid: "YOUR_WIFI_SSID"
password: "YOUR_WIFI_PASSWORD"
# Enable fallback hotspot (captive portal) in case wifi connection fails
ap:
ssid: "Bluetooth Proxy Fallback"
password: "proxyfallback"
captive_portal:
# Enable ESP32 BLE Tracker
esp32_ble_tracker:
scan_parameters:
active: true
# Enable Bluetooth Proxy
bluetooth_proxy:
active: true
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).
Thanks so much, I appreciate the time you put into this comment. It is highly relevant to a project I’m currently working on, and has saved me at least a day of time.
You can also have a Webhook be delivered when you take a new measurement. I wrote a small script that syncs my weight to Garmin using python-garminconnect.
The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
Very light on details, but did awaken me to the idea that you can setup HW projects like this without soldering. Bluetooth is practically ubiquitous, and ESPhome does offer this up in a palatable way
Nice!
I also got tired of the Withings app (which now pushes AI subscriptions, wtf) and "made" an app for the smartwatches (at least, it works with my ScanWatch 2)
You can build your own scale with an ESP32 for like $25 in parts - Hx711, load cells, ESP32, and a handful of trivial components. I threw together one that sits under my gas bottle, so I know when it’s running low. Adding impedance would be a pretty trivial step.
Sure, you’ve gotta have some known good values to compare to, but those aren’t hard to come by. Pretty sure you can get a decent idea of BF with callipers or somesuch.
Body fat would be possibly the only metric that a withings scale gives you that you can get a somewhat accurate number from without needing a dexa scan.
I'm planning on doing something similar with a $150 treadmill that uses an app called "Gymax." I don't want the app or its adorably embryonic social network. I just want three buttons: slow, fast, and really fast for 60 seconds.
Hi! Regarding the code for this project I will upload it soon, it's just that i want to build an small tool to actually make it easier to get person ID's and generate the correct yaml automatically.
I'd love to be able to flash a custom firmware on the withings body+ to make the screen truly smart. It's a bummer to know that AI can do all these things if only the firmware was open source / accessible.
Same. It annoys me I cannot use baby wright mode to also weigh my dog as she's heavier than the 5kg limit they impose. However, reverse engineering firmware is really easy these days...
The interesting thing here is the opportunity to make a sdk for interfacing with the Withings hardware offline. This is the first public example I’ve seen of someone attempting that
We've got a few Withings Steel HR watches in the house, would be interested in doing exactly the same with those. Perhaps I'll spend a bit of time digging around.
Using AI to reverse engineer undocumented Bluetooth protocols has been a godsend for me. We have an RV that came with a "Smart RV" system from BMPro that controls all of the lights, the air conditioning, starting the generator, leveling, slideouts, and other stuff.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
Just to be pedantic, was it reverse engineered? Or did it just extract it out of the apk? Those are very different things imo
For me, it was reverse engineered. I am not an expert or even conversant in decompiling Android APKs. It took the decompiled Java (app was apparently written in Kotlin) and extracted all the necessary information.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
[flagged]
If you have a eufy scale, you can do this with no LLM needed - just set up an esp32 Bluetooth proxy, add it to home assistant, and then use the EufyLife integration someone already made. I did this recently with my scale to avoid having to sync it to my phone, go to the cloud, fetch data from the cloud, etc., and it's working fantastically. I have a little Home Assistant integration that pokes scale updates to a Python script running locally that provides a UI I like.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
I actually found this out by accident. I set up a BT proxy to capture my combustion thermometers and saw eufy show up as an option and was like wait what? Honestly surprised how open it is.
Is there any documentation and a specific esp32 Bluetooth proxy you would recommend?
esp32 bluetooth proxy: There's a standard esphome component that just turns any esp32 with appropriate h/w into a BTLE proxy: https://esphome.io/components/bluetooth_proxy/
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
Once you've got the proxy you can just use the eufylife integration: https://www.home-assistant.io/integrations/eufylife_ble/
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).Thanks so much, I appreciate the time you put into this comment. It is highly relevant to a project I’m currently working on, and has saved me at least a day of time.
How can you write (or have AI write) such an article without also sharing the code? Now it’s just a pretty useless brag, “look what I built”.
If the AI wrote the article, and with no code, how do we know this even happened?
Withings has a full available API, I wrote a tool to just scrape what I need from the app at https://developer.withings.com/
I think the main point here is that they don't want their data going through yet another cloud service.
You can also have a Webhook be delivered when you take a new measurement. I wrote a small script that syncs my weight to Garmin using python-garminconnect.
The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
Very light on details, but did awaken me to the idea that you can setup HW projects like this without soldering. Bluetooth is practically ubiquitous, and ESPhome does offer this up in a palatable way
Nice! I also got tired of the Withings app (which now pushes AI subscriptions, wtf) and "made" an app for the smartwatches (at least, it works with my ScanWatch 2)
The app is at https://github.com/DavidVentura/withouthings - the firmware on the watch was leaked as well, and it's been helpful to debug some of the protocol.
You can build your own scale with an ESP32 for like $25 in parts - Hx711, load cells, ESP32, and a handful of trivial components. I threw together one that sits under my gas bottle, so I know when it’s running low. Adding impedance would be a pretty trivial step.
> Adding impedance would be a pretty trivial step.
But not the calibration that maps a raw ADC sample to "24.5% body fat, 21 Kg bone ..." etc.
Whatever values you stick in there are about as accurate as the scale is, so.
Sure, you’ve gotta have some known good values to compare to, but those aren’t hard to come by. Pretty sure you can get a decent idea of BF with callipers or somesuch.
Body fat would be possibly the only metric that a withings scale gives you that you can get a somewhat accurate number from without needing a dexa scan.
I'm planning on doing something similar with a $150 treadmill that uses an app called "Gymax." I don't want the app or its adorably embryonic social network. I just want three buttons: slow, fast, and really fast for 60 seconds.
Hi! Regarding the code for this project I will upload it soon, it's just that i want to build an small tool to actually make it easier to get person ID's and generate the correct yaml automatically.
I'd love to be able to flash a custom firmware on the withings body+ to make the screen truly smart. It's a bummer to know that AI can do all these things if only the firmware was open source / accessible.
Same. It annoys me I cannot use baby wright mode to also weigh my dog as she's heavier than the 5kg limit they impose. However, reverse engineering firmware is really easy these days...
The interesting thing here is the opportunity to make a sdk for interfacing with the Withings hardware offline. This is the first public example I’ve seen of someone attempting that
We've got a few Withings Steel HR watches in the house, would be interested in doing exactly the same with those. Perhaps I'll spend a bit of time digging around.
I've done it just by using their nice API, no need for any ESP32.
Does this API go through cloud?
Because OP's hookup works offline, via the Bluetooth.
[dead]
[dead]
[flagged]