How can I clone a non-paired BLE signal from a remote to trigger a device?

user_17381350 0
Viewed 429

I have a projector that turns on via an RF remote. I want to clone that specific power-on trigger via an arduino or rpi.

I have done some testing and it appears that the remote is a standard Bluetooth HID that works just as any Bluetooth paired input device for when the projector is on and its' onboard android boots. However, when the projector is off there is obviously no paired BT connection. So I gathered that the power on button on the RC must send a separate RF signal. When I started to sniff the Bluetooth signals being sent by the remote via a BLE scanner app I noticed, that on pressing the power button it first sends a certain type of packet (which appears to be the standard BT signal) but then upon realizing that there is no paired device immediately (2 seconds) switches to another BLE packet. I'm assuming that this triggers the power on.

I have looked into non-paired BLE signals, advertisements, UUIDs, beacons but couldn't reproduce the same behavior on the projector (power-on) by using different iOS apps that sounded promising in being able to advertise UUIDs and by randomly plugging in what I could read out from the RC through the Bluetooth Smart Scanner App:

  • First reading
{
kCBAdvDataIsConnectable = 1;
kCBAdvDataLocalName = "BLuetooth 4.0 RC";
kCBAdvDataRxPrimaryPHY = 129;
kCBAdvDataRxSecondaryPHY = 0;
kCBAdvDataServiceUUIDs =     (
    "Human Interface Device"
);
kCBAdvDataTimestamp = "657062407.4927959";
}

  • Second reading:

    { kCBAdvDataIsConnectable = 1; kCBAdvDataLocalName = "BLuetooth 4.0 RC"; kCBAdvDataManufacturerData = <0d00ffff 42415634 2e3337>; kCBAdvDataRxPrimaryPHY = 129; kCBAdvDataRxSecondaryPHY = 0; kCBAdvDataServiceUUIDs = ( "Human Interface Device" ); kCBAdvDataTimestamp = "657078255.763785"; }

Can I prototype cloning/reproducing this signal with my iPhone or rpi4? And if yes, which pieces of information do I need to advertise how?

Thank you!

beacon raspberry-pi bluetooth-lowenergy arduino ios
1 Answers

Understand that the Human Interface Device (UID) Service is a standard Bluetooth LE GATT service. It is commonly used to exchange data for a keyboard, mouse, game controller or a remote control.

Bluetooth LE GATT Services are more complex than Bluetooth LE advertisements -- you can't just send a Bluetooth LE packet (e.g. a beacon advertisement) and expect that to trigger something in the HID service.

One of the two BLE devices must establish a BLE connection. Read/write operations to various GATT Characteristics are used to exchange data over this connection. While the HID service has a specification you can read to understand, the projector will most certainly have a proprietary way of using the HID service. You will have to reverse engineer this. The sniffer may help you here.

If you are only interested in the power-on operation, the reverse engineering process may not be that complicated. It is likely that there is a single characteristic write that causes the power on. You need to figure out which characteristic that is and what value should be written.

Once you reverse engineer how the remote uses the HID service, you can most certainly implement it in iOS using CoreBluetooth APIs or on a Raspberry Pi using Linux BlueZ APIs.

user_14610500
Related