I have been attempting to pair a FitBit Inspire HR and a RENPHO ES-26R scale with my Raspberry Pi (3B+, 4B, and Zero), all with the same negative results. Running bluetoothctl (v5.50), the devices can be seen (ED:67 is the scale, 01:C5 is the Fitbit) :
...
[CHG] Device ED:67:37:60:78:22 ManufacturerData Key: 0xffff
[CHG] Device ED:67:37:60:78:22 ManufacturerData Value:
aa bb ed 67 37 60 78 22 00 01 23 14 ff ff ff 14 ...g7`x"..#.....
00 6a 04 4d a2 02 1d 0c .j.M....
[CHG] Device 01:C5:59:47:49:F9 RSSI: -47
[CHG] Device 01:C5:59:47:49:F9 TxPower: 3
...
When I attempt to pair or connect the scale, the outputs from bluetoothctl, hcidump, and gatttool are as follows:
bluetoothctl
Attempting to pair with ED:67:37:60:78:22
Failed to pair: org.bluez.Error.AuthenticationCanceled
hcidump
> HCI Event: Command Complete (0x0e) plen 4
LE Remove Device From White List (0x08|0x0012) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Add Device To White List (0x08|0x0011) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Parameters (0x08|0x000b) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Enable (0x08|0x000c) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Enable (0x08|0x000c) ncmd 1
status 0x00
gatttool
> sudo gatttool -b ED:67:37:60:78:22 -I
[ED:67:37:60:78:22][LE]> connect
Attempting to connect to ED:67:37:60:78:22
Error: connect error: Connection refused (111)
Per a few threads I've seen, I've tried using the address type of both public and random, with no change. The hcidump doesn't seem to have a lot going on for the Scale.
Inspecting the Scale further, it appears that it is not "connectable". Given that there are no defined services or characteristics, I started looking at the "manufacturing data" in the Advertisement. I can see that as the measurement on the scale changes, portions of the data are changing:
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 00 00 4d a2 02 8a 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 d2 00 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 d2 00 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 60 04 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 68 06 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 68 06 4d a2 02 8b 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 ad 07 4d a2 02 8c 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4d 7f 7e 3a 14 00 ad 07 4d a2 02 8c 25
ff ff aa bb ed 67 37 60 78 22 5e 94 d7 4e 7f 7e 3a 14 00 6b 08 4d a2 02 8c 25
Now I just need to confirm that the updated portions are actually weight data - once I figure out what is what in the soup (e.g., unit of measure, weight, etc.).
For the Fitbit, there are a lot more outputs, but the pairing still fails:
bluetoothctl
pair 01:C5:59:47:49:F9
Attempting to pair with 01:C5:59:47:49:F9
[CHG] Device 01:C5:59:47:49:F9 Connected: yes
[CHG] Device 01:C5:59:47:49:F9 ServicesResolved: yes
[CHG] Device 01:C5:59:47:49:F9 ServicesResolved: no
[CHG] Device 01:C5:59:47:49:F9 Connected: no
Failed to pair: org.bluez.Error.AuthenticationCanceled
hcidump
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Parameters (0x08|0x000b) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Enable (0x08|0x000c) ncmd 1
status 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Scan Enable (0x08|0x000c) ncmd 1
status 0x00
> HCI Event: Command Status (0x0f) plen 4
LE Create Connection (0x08|0x000d) status 0x00 ncmd 1
> HCI Event: Command Status (0x0f) plen 4
LE Read Remote Used Features (0x08|0x0016) status 0x00 ncmd 1
> HCI Event: Command Complete (0x0e) plen 14
LE Read Remote Used Features (0x08|0x0016) ncmd 1
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) status 0x00 ncmd 1
> HCI Event: Disconn Complete (0x05) plen 4
status 0x00 handle 64 reason 0x16
Reason: Connection Terminated by Local Host
gatttool
Unlike the Scale, I am able to use gatttool to connect to the Fitbit and retrieve characteristics:
[01:C5:59:47:49:F9][LE]> connect
Attempting to connect to 01:C5:59:47:49:F9
Connection successful
[01:C5:59:47:49:F9][LE]> characteristics
handle: 0x0002, char properties: 0x02, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x0008, char properties: 0x02, char value handle: 0x0009, uuid: 00002aa6-0000-1000-8000-00805f9b34fb
handle: 0x000b, char properties: 0x20, char value handle: 0x000c, uuid: 00002a05-0000-1000-8000-00805f9b34fb
handle: 0x000f, char properties: 0x02, char value handle: 0x0010, uuid: adabfb04-6e7d-4601-bda2-bffaa68956ba
handle: 0x0011, char properties: 0x06, char value handle: 0x0012, uuid: adabfb02-6e7d-4601-bda2-bffaa68956ba
handle: 0x0013, char properties: 0x12, char value handle: 0x0014, uuid: adabfb03-6e7d-4601-bda2-bffaa68956ba
handle: 0x0016, char properties: 0x10, char value handle: 0x0017, uuid: adabfb01-6e7d-4601-bda2-bffaa68956ba
handle: 0x0019, char properties: 0x20, char value handle: 0x001a, uuid: adabfb05-6e7d-4601-bda2-bffaa68956ba
handle: 0x001d, char properties: 0x12, char value handle: 0x001e, uuid: 558dfa01-4fa8-4105-9f02-4eaa93e62980
handle: 0x0021, char properties: 0x02, char value handle: 0x0022, uuid: 00002a29-0000-1000-8000-00805f9b34fb
handle: 0x0023, char properties: 0x02, char value handle: 0x0024, uuid: 00002a24-0000-1000-8000-00805f9b34fb
handle: 0x0025, char properties: 0x02, char value handle: 0x0026, uuid: 00002a25-0000-1000-8000-00805f9b34fb
handle: 0x0027, char properties: 0x02, char value handle: 0x0028, uuid: 00002a27-0000-1000-8000-00805f9b34fb
handle: 0x0029, char properties: 0x02, char value handle: 0x002a, uuid: 00002a26-0000-1000-8000-00805f9b34fb
handle: 0x002b, char properties: 0x02, char value handle: 0x002c, uuid: 00002a28-0000-1000-8000-00805f9b34fb
handle: 0x002d, char properties: 0x02, char value handle: 0x002e, uuid: 00002a23-0000-1000-8000-00805f9b34fb
handle: 0x002f, char properties: 0x02, char value handle: 0x0030, uuid: 00002a2a-0000-1000-8000-00805f9b34fb
handle: 0x0031, char properties: 0x02, char value handle: 0x0032, uuid: 00002a50-0000-1000-8000-00805f9b34fb
Bluetooth Service Status
● bluetooth.service - Bluetooth service
Loaded: loaded (/lib/systemd/system/bluetooth.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2020-04-09 18:32:27 BST; 24min ago
Docs: man:bluetoothd(8)
Main PID: 5515 (bluetoothd)
Status: "Running"
Tasks: 1 (limit: 4915)
Memory: 1.1M
CGroup: /system.slice/bluetooth.service
└─5515 /usr/lib/bluetooth/bluetoothd --compat --noplugin=sap -E
Apr 09 18:32:27 archer systemd[1]: Starting Bluetooth service...
Apr 09 18:32:27 archer bluetoothd[5515]: Bluetooth daemon 5.50
Apr 09 18:32:27 archer systemd[1]: Started Bluetooth service.
Apr 09 18:32:27 archer bluetoothd[5515]: Excluding (cli) sap
Apr 09 18:32:27 archer bluetoothd[5515]: Bluetooth management interface 1.14 initialized
dmesg | grep Bluetooth
[ 12.451287] Bluetooth: Core ver 2.22
[ 12.451337] Bluetooth: HCI device and connection manager initialized
[ 12.452111] Bluetooth: HCI socket layer initialized
[ 12.452123] Bluetooth: L2CAP socket layer initialized
[ 12.452151] Bluetooth: SCO socket layer initialized
[ 12.462111] Bluetooth: HCI UART driver ver 2.3
[ 12.462118] Bluetooth: HCI UART protocol H4 registered
[ 12.462172] Bluetooth: HCI UART protocol Three-wire (H5) registered
[ 12.462284] Bluetooth: HCI UART protocol Broadcom registered
[ 12.677032] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 12.677038] Bluetooth: BNEP filters: protocol multicast
[ 12.677048] Bluetooth: BNEP socket layer initialized
[ 818.140511] Bluetooth: RFCOMM TTY layer initialized
[ 818.140529] Bluetooth: RFCOMM socket layer initialized
[ 818.140542] Bluetooth: RFCOMM ver 1.11
Connection
WiFi and Bluetooth both are active on all of the PIs, and I am connected via SSH.
I've been walking many, many threads from multiple forums and making various recommended configuration changes (keeping the PI 3B+ clean as a control) with no success. I would much appreciate any advice or pointers on where to go next. There must be something I am missing somewhere - most likely something simple that is making most of you guffaw like you've never guffawed before :)
Thank you for your time in reading this lengthy question.
For the Scale, I was finally able to decode the important values (weight). There are a few bits which I still do not know what they are, but the main problem was solved. Given the following positions and values:
Position: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
Value: ff ff aa bb ed 67 37 60 78 22 5e 97 4a 74 7f 7e 3a 15 00 6a 04 4d a2 02 4a 3d
The mapping is as follows:
I was - mistakenly - attempting to use the FitBit for sanity; but, obviously the roles and services the two devices fulfill and provide - and how they advertise - are not similar at all, so it was a bad solutioning set :).
I hope this helps anyone else trying to retrieve data from a scale (specifically Renpho ES-26R) which provides its data in the advertisement. If anyone else comes across the meanings of the unknown bits, please feel free to leave a comment with the information.
Thanks!