Using AI to reverse engineer undocumented Bluetooth protocols has been a godsend for me. We have an RV that came with a "Smart RV" system from BMPro that controls all of the lights, the air conditioning, starting the generator, leveling, slideouts, and other stuff.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
Neywiny 14 days ago [-]
Just to be pedantic, was it reverse engineered? Or did it just extract it out of the apk? Those are very different things imo
AshleyGrant 14 days ago [-]
For me, it was reverse engineered. I am not an expert or even conversant in decompiling Android APKs. It took the decompiled Java (app was apparently written in Kotlin) and extracted all the necessary information.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
mettamage 12 days ago [-]
Using AI to reverse engineer xyz is a godsend quite frankly haha. Haven't tried it out on binaries yet but didn't need to (yet... ;-) )
iscarelli 12 days ago [-]
[flagged]
dgacmu 14 days ago [-]
If you have a eufy scale, you can do this with no LLM needed - just set up an esp32 Bluetooth proxy, add it to home assistant, and then use the EufyLife integration someone already made. I did this recently with my scale to avoid having to sync it to my phone, go to the cloud, fetch data from the cloud, etc., and it's working fantastically. I have a little Home Assistant integration that pokes scale updates to a Python script running locally that provides a UI I like.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
dawnerd 14 days ago [-]
I actually found this out by accident. I set up a BT proxy to capture my combustion thermometers and saw eufy show up as an option and was like wait what? Honestly surprised how open it is.
toomuchtodo 14 days ago [-]
Is there any documentation and a specific esp32 Bluetooth proxy you would recommend?
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
esphome:
name: bluetooth-proxy
esp32:
board: esp32dev
framework:
type: esp-idf
# Enable logging
logger:
# Enable Home Assistant API
api:
encryption:
key: "YOUR_KEY_HERE"
# Enable OTA updates
ota:
- platform: esphome
# WiFi configuration (matching the settings from your other devices)
wifi:
ssid: "YOUR_WIFI_SSID"
password: "YOUR_WIFI_PASSWORD"
# Enable fallback hotspot (captive portal) in case wifi connection fails
ap:
ssid: "Bluetooth Proxy Fallback"
password: "proxyfallback"
captive_portal:
# Enable ESP32 BLE Tracker
esp32_ble_tracker:
scan_parameters:
active: true
# Enable Bluetooth Proxy
bluetooth_proxy:
active: true
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).
toomuchtodo 14 days ago [-]
Thanks so much, I appreciate the time you put into this comment. It is highly relevant to a project I’m currently working on, and has saved me at least a day of time.
kjmr 14 days ago [-]
How can you write (or have AI write) such an article without also sharing the code? Now it’s just a pretty useless brag, “look what I built”.
14 days ago [-]
SaberTail 14 days ago [-]
If the AI wrote the article, and with no code, how do we know this even happened?
bassdreads 14 days ago [-]
Withings has a full available API, I wrote a tool to just scrape what I need from the app at https://developer.withings.com/
frereubu 14 days ago [-]
I think the main point here is that they don't want their data going through yet another cloud service.
jabiko 14 days ago [-]
You can also have a Webhook be delivered when you take a new measurement. I wrote a small script that syncs my weight to Garmin using python-garminconnect.
The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
madaxe_again 14 days ago [-]
You can build your own scale with an ESP32 for like $25 in parts - Hx711, load cells, ESP32, and a handful of trivial components. I threw together one that sits under my gas bottle, so I know when it’s running low. Adding impedance would be a pretty trivial step.
baby_souffle 14 days ago [-]
> Adding impedance would be a pretty trivial step.
But not the calibration that maps a raw ADC sample to "24.5% body fat, 21 Kg bone ..." etc.
alex_sf 14 days ago [-]
Whatever values you stick in there are about as accurate as the scale is, so.
madaxe_again 14 days ago [-]
Sure, you’ve gotta have some known good values to compare to, but those aren’t hard to come by. Pretty sure you can get a decent idea of BF with callipers or somesuch.
baby_souffle 14 days ago [-]
Body fat would be possibly the only metric that a withings scale gives you that you can get a somewhat accurate number from without needing a dexa scan.
tetris11 14 days ago [-]
Very light on details, but did awaken me to the idea that you can setup HW projects like this without soldering. Bluetooth is practically ubiquitous, and ESPhome does offer this up in a palatable way
deivid 14 days ago [-]
Nice!
I also got tired of the Withings app (which now pushes AI subscriptions, wtf) and "made" an app for the smartwatches (at least, it works with my ScanWatch 2)
I'm planning on doing something similar with a $150 treadmill that uses an app called "Gymax." I don't want the app or its adorably embryonic social network. I just want three buttons: slow, fast, and really fast for 60 seconds.
Gehinnn 14 days ago [-]
I'd love to be able to flash a custom firmware on the withings body+ to make the screen truly smart. It's a bummer to know that AI can do all these things if only the firmware was open source / accessible.
cromka 14 days ago [-]
Same. It annoys me I cannot use baby wright mode to also weigh my dog as she's heavier than the 5kg limit they impose. However, reverse engineering firmware is really easy these days...
sabatesduran 14 days ago [-]
Hi! Regarding the code for this project I will upload it soon, it's just that i want to build an small tool to actually make it easier to get person ID's and generate the correct yaml automatically.
variety8675 14 days ago [-]
The interesting thing here is the opportunity to make a sdk for interfacing with the Withings hardware offline. This is the first public example I’ve seen of someone attempting that
venzaspa 14 days ago [-]
We've got a few Withings Steel HR watches in the house, would be interested in doing exactly the same with those. Perhaps I'll spend a bit of time digging around.
mrlinx 14 days ago [-]
I've done it just by using their nice API, no need for any ESP32.
abcd_f 14 days ago [-]
Does this API go through cloud?
Because OP's hookup works offline, via the Bluetooth.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
Once you've got the proxy you can just use the eufylife integration: https://www.home-assistant.io/integrations/eufylife_ble/
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
But not the calibration that maps a raw ADC sample to "24.5% body fat, 21 Kg bone ..." etc.
The app is at https://github.com/DavidVentura/withouthings - the firmware on the watch was leaked as well, and it's been helpful to debug some of the protocol.
Because OP's hookup works offline, via the Bluetooth.