ESP32 micropython BLE connections

[mmx64]

Hi, im trying to connect to a BLE device

just for testing purpuses i writed a simple class

BX = BLEX()
BX.scan()
time.sleep(1)
print("Found device ",BX._name,BX._addr_type,BX._addr)
BX.do_connect()
time.sleep(1)
BX._ble.gattc_discover_services(BX._conn_handle)
time.sleep(2)
BX._ble.gattc_write(BX._conn_handle, 0xFF02,b'\xfe\x04\x30\x61\x00\x3c\xba\xca' , True)
time.sleep(1)

and result to this code

BX.scan()

EVENT 5 0x5 (1, <memoryview>, 0, -88, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (0, <memoryview>, 3, -96, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (0, <memoryview>, 3, -84, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (1, <memoryview>, 3, -68, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (1, <memoryview>, 0, -83, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (1, <memoryview>, 3, -62, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (1, <memoryview>, 2, -81, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (0, <memoryview>, 0, -89, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 5 0x5 (0, <memoryview>, 3, -78, <memoryview>)  #_IRQ_SCAN_RESULT
EVENT 6 0x6 () #_IRQ_SCAN_DONE

Found device SolarLife 0 b'\x04\x7f\x0e\xa1\xec`' #found my device

BX.do_connect()

Trying to connect to  0 b'\x04\x7f\x0e\xa1\xec`' 2000 **#connecting to my device**
EVENT 7 0x7 (0, 0, <memoryview>) **#IRQ_PERIPHERAL_CONNECT**

BX._ble.gattc_discover_services(BX._conn_handle)
and in event 9 _IRQ_GATTC_SERVICE_RESULT
self._ble.gattc_discover_characteristics(self._conn_handle, start_handle, end_handle)

EVENT 9 0x9 (0, 1, 3, UUID(0x1801)) #_IRQ_GATTC_SERVICE_RESULT
EVENT 9 0x9 (0, 4, 14, UUID(0x1800)) #_IRQ_GATTC_SERVICE_RESULT
EVENT 9 0x9 (0, 15, 26, UUID(0xff00)) #_IRQ_GATTC_SERVICE_RESULT
EVENT 10 0xa (0, 0) #_IRQ_GATTC_SERVICE_DONE
EVENT 11 0xb (0, 2, 3, 123, UUID(0x2a05))  #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 12 0xc (0, 0) #_IRQ_GATTC_CHARACTERISTIC_DONE
EVENT 11 0xb (0, 5, 6, 2, UUID(0x2a00)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 7, 8, 2, UUID(0x2a01)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 9, 10, 2, UUID(0x2a02)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 11, 12, 2, UUID(0x2a04)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 13, 14, 2, UUID(0x2aa6)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 12 0xc (0, 0) #_IRQ_GATTC_CHARACTERISTIC_DONE
EVENT 11 0xb (0, 16, 17, 16, UUID(0xff01)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 19, 20, 12, UUID(0xff02)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 21, 22, 28, UUID(0xff03)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 11 0xb (0, 24, 25, 30, UUID(0xff04)) #_IRQ_GATTC_CHARACTERISTIC_RESULT
EVENT 12 0xc (0, 0) #_IRQ_GATTC_CHARACTERISTIC_DONE

I did some BLE sniffing between android my device

Frame 660: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
    Encapsulation type: Bluetooth H4 with linux header (99)
    Arrival Time: Oct 21, 2022 11:00:55.328665000 GTB Daylight Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1666339255.328665000 seconds
    [Time delta from previous captured frame: 0.246617000 seconds]
    [Time delta from previous displayed frame: 0.246617000 seconds]
    [Time since reference or first frame: 48.202012000 seconds]
    Frame Number: 660
    Frame Length: 20 bytes (160 bits)
    Capture Length: 20 bytes (160 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    Point-to-Point Direction: Sent (0)
    [Protocols in frame: bluetooth:hci_h4:bthci_acl:btl2cap:btatt]
Bluetooth
    [Source BD_ADDR: Google_------ ()]
    [Destination: BarrotTe_a1:ec:60 (04:7f:0e:a1:ec:60)]
Bluetooth HCI H4
    [Direction: Sent (0x00)]
    HCI Packet Type: ACL Data (0x02)
Bluetooth HCI ACL Packet
    .... 0000 0100 0000 = Connection Handle: 0x040
    ..00 .... .... .... = PB Flag: First Non-automatically Flushable Packet (0)
    00.. .... .... .... = BC Flag: Point-To-Point (0)
    Data Total Length: 15
    Data
    [Connect in frame: 317]
    [Disconnect in frame: 674]
    [Source BD_ADDR: Google_------ ()]
    [Source Device Name: Pixel 6]
    [Source Role: Unknown (0)]
    [Destination BD_ADDR: BarrotTe_a1:ec:60 (04:7f:0e:a1:ec:60)]
    [Destination Device Name: SolarLife]
    [Destination Role: Unknown (0)]
    [Current Mode: Unknown (-1)]
Bluetooth L2CAP Protocol
    Length: 11
    CID: Attribute Protocol (0x0004)
Bluetooth Attribute Protocol
    Opcode: Write Command (0x52)
        0... .... = Authentication Signature: False
        .1.. .... = Command: True
        ..01 0010 = Method: Write Request (0x12)
    Handle: 0x0014 (Unknown: Unknown)
        [Service UUID: Unknown (0xff00)]
        [UUID: Unknown (0xff02)]
    Value: fe043061003cbaca

so im trying to send the same command like this

BX._ble.gattc_write(BX._conn_handle, 0xFF02,b'\xfe\x04\x30\x61\x00\x3c\xba\xca' , True)

and i get the result

EVENT 17 0x11 (0, 65282, 257) #_IRQ_GATTC_WRITE_DONE   so result is 0xFF02 0x101 invalid_conn_handle
EVENT 27 0x1b (0, 16, 0, 400, 0) #i dont know what event is this??

any idea what im dooing wrong?

[jimmo]

BX = BLEX()

What is BLEX?

BX._ble.gattc_write(BX._conn_handle, 0xFF02,b'\xfe\x04\x30\x61\x00\x3c\xba\xca' , True)

gattc_write takes a connection handle and a value handle. It looks like you're passing the UUID of the characteristic in place of the value handle. You need to use the value handle from the _IRQ_GATTC_CHARACTERISTIC_RESULT event.

https://docs.micropython.org/en/latest/library/bluetooth.html#bluetooth.BLE.gattc_write

[jimmo]

and no other answer from the device.

What are you expecting to receive back? It entirely depends on the device you're talking to.

(FYI you might also want to look at aioble -- it makes working with BLE much simpler, and removes all the callbacks and event handling)

[mmx64]

well if you look at the screenshot of wireshark , at frame 349 it receives the data im interested in.
The wireshark screenshot is all communication between phone and device. I am trying to replicate it with this esp32

[mmx64]

I think i got some progress
BX._ble.gattc_write(BX._conn_handle, BX._write_handle,b'\xfe\x04\x30\x11\x00\x47\xfb\x32' , True)
and i get write reponse ok

EVENT 17 0x11 (0, 20, 0)
EVENT 18 0x12 (0, 22, <memoryview>)

and after i get back a notification in a

What is this and how to decode its values?

[jimmo]

What is this and how to decode its values?

The content of the notification is entirely up to the device sending it. MicroPython just gives you the bytes received (in that memoryview). Much like the values you're writing, it's likely a proprietary format.

You haven't said what sort of device you're talking to. Some sort of solar thing from the HCI cap above?

[mmx64]

Yes its a solar charge controller, it uses this app for android
https://play.google.com/store/apps/details?id=com.lm.tyhz.tyhzandroid&hl=en&gl=US

so sending this command

Frame 412: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Write Command (0x52)
    Handle: 0x0014 (Unknown: Unknown)
        [Service UUID: Unknown (0xff00)]
        [UUID: Unknown (0xff02)]
    Value: fe03901f00018cc3

i get 2 frames in response

Frame 414: 15 bytes on wire (120 bits), 15 bytes captured (120 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Handle Value Notification (0x1b)
    Handle: 0x0011 (Unknown: Unknown)
        [Service UUID: Unknown (0xff00)]
        [UUID: Unknown (0xff01)]
    Value: 010302

and

Frame 415: 16 bytes on wire (128 bits), 16 bytes captured (128 bits)
Bluetooth
Bluetooth HCI H4
Bluetooth HCI ACL Packet
Bluetooth L2CAP Protocol
Bluetooth Attribute Protocol
    Opcode: Handle Value Notification (0x1b)
    Handle: 0x0011 (Unknown: Unknown)
        [Service UUID: Unknown (0xff00)]
        [UUID: Unknown (0xff01)]
    Value: 0000b844

i will try later to figure our what this data is , but only if i can replicate this communication with an esp32