-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathraw.log
1529 lines (1415 loc) · 51.1 KB
/
raw.log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
(Some of) my raw reverse-engineering log for posterity.
[Service] 02f00000-0000-0000-0000-00000000fe00 (Handle: 23): Unknown
[Characteristic] 02f00000-0000-0000-0000-00000000ff02 (Handle: 26): Unknown (Properties: ['read', 'notify'])
[Characteristic] 02f00000-0000-0000-0000-00000000ff00 (Handle: 30): Unknown (Properties: ['read'])
[Characteristic] 02f00000-0000-0000-0000-00000000ff03 (Handle: 24): Unknown (Properties: ['read'])
[Characteristic] 02f00000-0000-0000-0000-00000000ff01 (Handle: 32): Unknown (Properties: ['write-without-response', 'write'])
[Service] 00010203-0405-0607-0809-0a0b0c0d1910 (Handle: 14): Unknown
[Characteristic] 00010203-0405-0607-0809-0a0b0c0d2b11 (Handle: 19): Unknown (Properties: ['read', 'write-without-response', 'write', 'notify'])
[Characteristic] 00010203-0405-0607-0809-0a0b0c0d2b10 (Handle: 15): Unknown (Properties: ['read', 'notify'])
[Service] 00001801-0000-1000-8000-00805f9b34fb (Handle: 10): Generic Attribute Profile
[Characteristic] 00002a05-0000-1000-8000-00805f9b34fb (Handle: 11): Service Changed (Properties: ['read', 'indicate'])
---
D3:39:32:35:1A:88
[Service] 00001801-0000-1000-8000-00805f9b34fb (Handle: 10): Generic Attribute Profile
[Characteristic] 00002a05-0000-1000-8000-00805f9b34fb (Handle: 11): Service Changed (Properties: ['read', 'indicate'])
Read: bytearray(b'\x01\x00\xff\xff')
[Service] 02f00000-0000-0000-0000-00000000fe00 (Handle: 23): Unknown
[Characteristic] 02f00000-0000-0000-0000-00000000ff03 (Handle: 24): Unknown (Properties: ['read'])
Read: bytearray(b'')
[Characteristic] 02f00000-0000-0000-0000-00000000ff00 (Handle: 30): Unknown (Properties: ['read'])
Read: bytearray(b'')
[Characteristic] 02f00000-0000-0000-0000-00000000ff02 (Handle: 26): Unknown (Properties: ['read', 'notify'])
Read: bytearray(b'ntf_enable')
[Characteristic] 02f00000-0000-0000-0000-00000000ff01 (Handle: 32): Unknown (Properties: ['write-without-response', 'write'])
[Service] 00010203-0405-0607-0809-0a0b0c0d1910 (Handle: 14): Unknown
First commands:
Handle 0x14:
aa0100
aa0600
aa0703
330914
aa23ff
aa1200
aa1100
aa0400
aa0100
aa0100
aa0f00
aa4100
aa0501
330100
aa0100
aa0600
aa0600
aa0703
330914
aa23ff
aa1200
aa1100
aa0400
aa0100
330101
aa0600
aa0600
aa0100
aa0703
330914
aa23ff
aa1200
aa1100
aa0400
aa0100
aa0f00
aa4100
aa0501
aa0101
aa0100
aa0100
aa0100
aa0100
---
0x12: 0100 (write not permitted)
0x15: 0100 (write not permitted)
0x16: 0100 (write not permitted)
0x14: aa0101
(0x10 notify): aa0101
0x14: aa0600
(0x10 notify): aa0631
0x14: aa0703
(0x10 notify): aa0703
0x14: 330914
(0x10 notify): 330900
---
Note: found that brightness is modular, not 0xff. Wraps (=0) at 103 and 220, 0 isn't off, seems to be lowest brightness (=1?)
- 0 = 1
- 103 = 0
- 220 = 0
---
Read directly from snoop log:
>aa0600
<aa0631
>aa0703
<aa0703
>330914
<330900
>aa23ff
<aa23ff
>aa1200
<aa12ff
>aa1100
<aa1100
>aa0400
<aa0464
>aa0100
>aa0100
<aa0101
<aa0101
>aa0f00
<aa0f01
>aa4100
<aa4101
>aa0501
<aa0504
>330100 (known set_state=off, issued by app for testing)
>aa0100
<330100
>aa0600
<aa0100
<aa0631
>aa0600
>aa0703
<aa0631
<aa0703
>330914
<330900
>aa23ff
<aa23ff
>aa1200
<aa12ff
>aa1100
<aa1100
>aa0400
<aa0464
>aa0100
<aa0100
>330101 (supposed to be set_state=on, issued by app for testing, but trying to send it during color mode seems to do nothing despite receiving echo?)
<330100
>aa0600
<aa0631
>aa0600
>aa0100
>aa0703
<aa0631
<aa0101
<aa0703
>330914
<330900
>aa23ff
<aa23ff
>aa1200
<aa12ff
>aa1100
<aa1100
>aa0400
<aa0464
>aa0100
<aa0101
>aa0f00
<aa0f01
>aa4100
<aa4101
>aa0501
<aa0504
>aa0100
<aa0101
---
Try:
brightness
color
temperature
set scene to "illuminate"
>330515
<330500
>aaa501
<aaa501
>aaa502
<aaa502
>aaa503
<aaa503
>aaa504
<aaa504
>aaa505
<aaa505
>330515
<330500
>330515
<330500
>330515
<330500
>330515
<330500
>330504
<330500
>330464
<330400
>a30001
>a30100
>a3020f
>a3ffff
<a30200
>330504
<330500
>a30001
>a301ff
>a302ff
>a30302
>a3041d
>a30529
>a306ff
>a3ffff
<a30200
>330504
<330500
>330504
<330500
>330464
<330400
---
3305040f
r/04,05,06,07,0e,0f,11,12,23,40,41,a3,a5,ee,ef,ff
Command: r/04,05,06,07,0e,0f,11,12,23,40,41,a3,a5,ee,ef,ff
Notify (04): 64
Notify (05): 041608
Notify (06): 312e30302e3134
Notify (0e):
Notify (0f): 02
Notify (11): 011e0f0f
Notify (12): 010a0000000a
Notify (23): 00800000ff
Notify (40): 001e
Notify (41): ff
Notify (a3): 01
Notify (a500): ff033c00ff00010000010101
Notify (ee):
Command: Notify (ef): 000101
rff
Command: Notify (ff):
Notify (a500): ff033c00ff00010000010101
Notify (a501): 64ffffff64ffffff64ffffff
Notify (a502): 64ffffff64ffffff64ffffff
Notify (a503): 64ffffff64ffffff64ffffff
Notify (a504): 64ffffff64ffffff64ffffff
Notify (a505): 64ffffff64ffffff64ffffff
Notify (a506): 64ffffff64ffffff64ffffff
Notify (a507): 64ffffff64ffffff64ffffff
Notify (a508): 64ffffff64ffffff64ffffff
Notify (a509): 64ffffff64ffffff64ffffff
Notify (a50a): 64ffffff64ffffff64ffffff
Notify (a50b): 166464640864646400646464
Notify (a50c): 006464640064646400646464
Notify (a50d): 006464640064641600010101
Notify (a50e): 000101010303035003ff
Notify (a50f): 507f00ff180000ffff0000ff
Notify (a510): 00ffff8b00ff0000ff010101
Notify (a511): 7f01010100010101ff010101
Notify (a512): ff0101010001010100010101
Notify (a513): ff0101010001010100010101
Notify (a514): 00010101ff01010100010101
Notify (a515): ff010101ff0101018b010101
Notify (a516): 00010101ff01010100010101
color, may be where DIY is stored?
00
"ff010101ff01010100006009"
"ff033c00ff00010000010101"
01-05
"45ffa23c45ffa23c45ffa23c"
"64ffffff64ffffff64ffffff"
06-0a = "64ffffff64ffffff64ffffff"
0b
xx646464yy64646400646464
xx = scene id byte 1
yy = scene id byte 2 (unused?)
"0f4545450045454500454545" // doesn't follow pattern
"096464640064646400646464"
0c = "ff454545ff646464ff646464"
"006464640064646400646464"
0d = "006464640064640f0000ffff"
00646464006464xx00010101
xx = scene id
0e = "000101010101004600ff"
0f = "46ff000009ff0000ff010101"
10 = "00ffff8b00ff0000ff010101"
11 = "7f01010100010101ff010101"
12 = "ff0101010001010100010101"
13 = "ff0101010001010100010101"
14 = "00010101ff01010100010101"
15 = "ff010101ff0101018b010101"
16 = "00010101ff01010100010101"
17-ff = "000101010001010100010101"
---
Notify (04): 64
Notify (05): 041608
Notify (06): 312e30302e3134
Notify (0e):
Notify (0f): 02
Notify (11): 001e0f0f
Notify (12): 000a0000000a
Notify (23): 00000000ff
Notify (40): 001e
Notify (41): ff
Notify (a3): 01
Notify (a500): ff033c00ff00010000010101
Notify (ee):
Notify (ef): 000101
Command: Notify (ff):
Notify (a500): ff033c00ff00010000010101
Notify (a501): 64ffffff64ffffff64ffffff
Notify (a502): 64ffffff64ffffff64ffffff
Notify (a503): 64ffffff64ffffff64ffffff
Notify (a504): 64ffffff64ffffff64ffffff
Notify (a505): 64ffffff64ffffff64ffffff
Notify (a506): 64ffffff64ffffff64ffffff
Notify (a507): 64ffffff64ffffff64ffffff
Notify (a508): 64ffffff64ffffff64ffffff
Notify (a509): 64ffffff64ffffff64ffffff
Notify (a50a): 64ffffff64ffffff64ffffff
Notify (a50b): 166464640864646400646464
Notify (a50c): 006464640064646400646464
Notify (a50d): 006464640064641600010101
Notify (a50e): 000101010303035003ff
Notify (a50f): 507f00ff180000ffff0000ff
Notify (a510): 00ffff8b00ff0000ff010101
Notify (a511): 7f01010100010101ff010101
Notify (a512): ff0101010001010100010101
Notify (a513): ff0101010001010100010101
Notify (a514): 00010101ff01010100010101
Notify (a515): ff010101ff0101018b010101
Notify (a516): 00010101ff01010100010101
aa11 00 1e 0f 0f
3311 ff ff ff ff
aa11 ff ff f0 f0
3311 66 66 66 66
aa11 66 66 66 66
00 = "ff0101 01ff01 010100 006009"
01-05 = "45ffa2 3c45ff a23c45 ffa23c"
06-0a = "64ffff ff64ff ffff64 ffffff"
0b = "0f4545 450045 454500 454545"
0c = "ff4545 45ff64 6464ff 646464"
0d = "006464 640064 640f00 00ffff"
0e = "000101 010101 004600 ff"
0f = "46ff00 0009ff 0000ff 010101"
10-ff = "000101 010001 010100 010101"
---
From repo
DIY mode (multi-packet):
KEEPALIVE
start:WRITE packet#=0 total#
WRITE packet#=1 (name, 0x3b?) (style, mode) speed(0-64) ???=0x18 rgb rgb rgb rg (checksum)
style: 00:Fade 01:Jumping 02:Flicker 03:Marquee 04:Music FF:combo?
mode: 00:Whole 01:subsaection 02:Circulation
note: fade subsection N/A
marquee modes: 03:Straight 04:Gathered 05:Dispersive
music modes: 06:Spectrum 07:Rolling 08:Rhythm
[WRITE packet#=2 blue rgb rgb rgb rgb 000]
[WRITE packet#=3 comb'4o style/mode?]
end:WRITE packet#=0xff
CMD_COLOR DIY
---
w051501b329ef000000007f7f
demonstrated that segment colors go into the a5 multi-register ("color buffer"?) with a prefix of 64 per color for some reason. May be the brightness
w05150200ff00000000007fffff
bright -> string 1 dim green and string 2 bright blue
w051501ffff0000000000007f
set 7/8 of string 1 to dim yellow
w051501ff0000/00-30/0000007fff
only 00 is valid, everything else turns it off
w051501ff0000000000007fff
ra501 = 00ff000000ff000000ff => 00 brightness
w05150100ff00ff00000000ffff
all strings turned off
w05150100ff000000000000ffff
string 1 dim green, string 2 bright green => brightness is not a parameter in this command
w0515026500000000000000ffff
does nothing
w0515006500000000000000ffff
question: replace rr with brightness
does nothing
w0515000000000000000000ffff
question: what happens when it's all 00?
does nothing
w051500ce0000000000ffff
question: 00 command, replace rrggbb with 1 byte brightness
does nothing
w051502ce0000000000ffff
question: try 02 command
does nothing
w051501ce00000000000000ffff
sets everything to red, brightness unchanged
w051501b329ef000000007f7f
sets string 10 segments 7f to b329ef, brightness unchanged
w051501rrggbb??????????sstt
set segments in bitmaps ss and tt to the given color
? unknown bits, sources use all 00
w051501ffcc11123456789affff
question: what happens when ?? is not 00?
set all segments to bluish, string 1 very dim, string 2 bright
ra500 = ff033c00 ff000100 00003412
ra501 = 0056789a 0056789a 0056789a # segments 0.00-02
ra502 = 0056789a 0056789a 0056789a # segments 0.03-05
ra503 = 0056789a 0056789a 6456789a # segments 0.06-07, 1.00
ra504 = 6456789a 6456789a 6456789a # segments 1.01-03
ra505 = 6456789a 6456789a 6456789a # segments 1.04-06
ra506 = 6456789a 64ffffff 64ffffff # segments 1.07-08, unknown
this outcome is very weird. It ignores the rrggbb which normally it
attends to and used 56789a as the color
w051501fedcba0000000000ffff
question: now try zeroing that
everything set to whitish blue
ra501 = 00fedcba00fedcba00fedcba
...
ra504 = 64fedcba64fedcba64fedcba
w051501fedcba9800000000ffff
question: unzero
everything turns off
ra501 = 000101010001010100010101
ra504 = 640101016401010164010101
note: firmware seems to use 010101 as an "undefined" color
w051501fedcba9876543210ffff
unzero everything?
string 2 dim warm white, string 1 still off
ra501 = 005432100054321000543210
ra504 = 645432106454321064543210
note: "off" probably an artifact of a low value color
w051501fedcba0076543210ffff
unzero just that sus byte
no effect
w051501fedcba0000543210ffff
unzero both sus bytes?
everything is on, still dim/bright
ra500 = ff033c00ff00010000010101
ra501 = 00fedcba00fedcba00fedcba
ra504 = 64fedcba64fedcba64fedcba
the colors remain the same even though one of the strings is "off" -
how does the firmware keep track of this?
w051501fedcbaff00543210ffff
unzero just sus byte 1
string 1 turned off
ra500 = ff033c00ff000100000000ff
ra501 = 005432100054321000543210
ra504 = 645432106454321064543210
observations: command has two colors separated by two bytes.
if those bytes are 00, uses the first color
if they're nonzero, uses the second color and also turns off string 1
may be an unintended edge case of the firmware, probably just need to
zero everything out
"turning off" string 1 appears to be signaled by a500 which gets the
undefined color
w0515000123456789abcdefffff
examine command 00
ra500 = ff033c00ff000100000000ff
ra501 = 005432100054321000543210
ra504 = 645432106454321064543210
no observed change
probably does nothing
w0515020123456789abcdefffff
examine command 02
turned off segment 2 on string 2?
ra500 = ff033c00ff000100000000ff
ra501 = 015432100154321000543210
ra504 = 645432100154321064543210
!!!! the brightness changed!
w05150265ffff
hypothesis: first byte is brightness followed by segment bitmaps, rest is ignored
everything is the same color/brightness!
ra500 = ff033c00ff000100000000ff
ra501 = 655432106554321065543210
ra504 = 655432106554321065543210
w05150100ff000000000000ffff
set to color that isn't low-value
everything is max brightness green!
w051502/70-80/ffff
examine different brightness values because tests showed that the full range isn't used
went to 0 and then up again so modulo = 0 is in this range
w05150270ffff
w05150271ffff
w05150272ffff
0 brightness here
w05150200ffff
dim but not off, now let's compare to 7x to see what it's equivalent to
w05150276ffff - too dim
w0515027cffff - slightly too bright
w0515027affff - looks right
Conclusions:
71 = max brightness
72 = 0 brightness
00 <=> 7a brightness
7a - 72 = 8 (-1?)
therefore 00 = 8 brightness
min = 0
max = 120
float -> int via (round(value*(0x71 + 8)) - 8)%0x7a
We can determine an upper bound for the number of supported strings:
Setting colors ~ 33051501rrggbb0000000000 minimum, 12 bytes
Messages are capped at 20 bytes total, of which the last is always checksum
19 - 12 = 7 bytes for the command, each byte = 1 string
Now let's check the ordering of the bitmap
w051501ff0000 0000000000 0100
(before: all max brightness green)
set segment 0 to (dim) red, why dim?
ra500 = ff033c00ff00010000010101
ra501 = 71ff00007100ff007100ff00
brightness is the same, but the color is different
w05150100ff00 0000000000 0100
set segment 0 to max brightness green
question: why is the brightness different for red?
ra500 = ff033c00ff00010000010101
ra501 = 7100ff007100ff007100ff00
w051501ff0000 0000000000 0200
segment 1
w051501ff0000 0000000000 0400 - segment 2
w051501ff0000 0000000000 0800 - segment 3
w051501ff0000 0000000000 1000 - segment 4
w051501ff0000 0000000000 2000 - segment 5
w051501ff0000 0000000000 4000 - segment 6
w051501ff0000 0000000000 8000 - segment 7
w051501ff0000 0000000001 0001 - segment 8
w051501ff0000 0000000002 0002 - segment 9
w051501ff0000 0000000004 0004 - segment 10
w051501ff0000 0000000008 0008 - segment 11
w051501ff0000 0000000010 0010 - segment 12
w051501ff0000 0000000020 0020 - segment 13
w051501ff0000 0000000040 0040 - segment 14
w0515010000ff 0000000040 0080 - segment 0 bright GREEN, strange artifact of firmware
Note: actually 1 string with 15 segments, not 2 strings of 8
w0515010000ff 0000000040 0100 - segment 0 dim blue
Note: Copilot randomly inserted non-zeros in the zero block, doesn't seem to have affected it because the first 2 bytes were 00
Note: Pressing button changes status register but doesn't otherwise send a notification - requires polling
w0515010000ff 0000000000 ff7f - all segments to dim blue
w05150100ff00 0000000000 ff7f - all segments to bright green
w051501ff0000 0000000000 ff7f - all segments to dim red
UGH WHY
hypothesis: What if different colors have different interpretations of brightness?
w05150260ff7f - bright red
w05150271ff7f - dim red
w0515026bff7f - very dim
w0515026aff7f - dimmer
w05150265ff7f - bright
w05150268ff7f - almost off
w05150267ff7f - almost off
w05150266ff7f - off
w05150265ff7f - max brightness
Question: What is 00?
w05150200ff7f - dim, +8 of off?
w0515026eff7f - slightly brighter (may have been wrong earlier about +8)
w0515026dff7f - looks about right
Question: What does this red's max look like in green?
w05150100ff00 0000000000 ff7f - all segments to green
w05150265ff7f - bright green
w05150271ff7f - flashes slightly, not obviously brighter
Considering 0x72+ wrapping around to 00 seems to be a firmware quirk, it may also be a quirk that 0x66+ works at all for any colors
Check blue
w0515010000ff 0000000000 ff7f - all segments to blue
w05150266ff7f - turns them all off
w05150265ff7f - max brightness
Conclusion: 0x66+ is almost certainly a firmware bug
w0465 turns everything off
w0464 max brightness
w0430 roughly half brightness
Conclusion: 04 register is the global brightness level which works in addition to the per-segment brightness
---
w05040000
dim red
ra500 = ff033c00ff00010000010101
ra501 = 650000ff650000ff650000ff
w05040001
rotates between white, blue, and purple
00: ff033c00ff00010000010101
01: 650000ff650000ff650000ff
02: 650000ff650000ff650000ff
03: 650000ff650000ff650000ff
04: 650000ff650000ff650000ff
05: 650000ff650000ff650000ff
06: 710000ff71ffffff71ffffff
07: 71ffffff71ffffff71ffffff
08: 71ffffff71ffffff71ffffff
09: 71ffffff71ffffff71ffffff
0a: 71ffffff71ffffff71ffffff
0b: 006565650165656500656565
0c: 006565650071717100717171
0d: 007171710071710000010101
0e: 000101010303035003ff0000
0f: 507f00ff180000ffff0000ff
10: 00ffff8b00ff0000 (rest undefined color)
00 remains unchanged
we also see blue, white... but 00656565 is dim white
---
Checking scenes by setting them in the app then reading the register:
- 1608 - twilight
- 1708 - meteor
ea86
dec: 60038
bin: 11101010 10000110
7015
hex: 1b67
bin: 00011011 01100111
Nah, not even close
---
At this point I finally installed LineageOS on an old Pixel 4 XL so I could use wireshark bluetooth snoop over adb in a dedicated setup. My personal phone was truncating the logs so I couldn't see everything.
Setting a scene in the app:
>aa01
<aa0101
>a300010b020429000100320201ff0003ff0a0ab5
>a30101a50506ff0000ff7f00ffff0000ff000085
>a302ffff8b00ff1400fd000880002900010032ae
>a3030201ffb203ff0a0a01a30506ff0000ff7fcc
>a30400ffff0000ff0000ffff8b00ff1600fc10d6
>a3050180012900010032000194940080141400bd
>a306e71406ff0000ff7f00ffff0000ff0000ff2f
>a307ff8b00ff000080000080002900021901001c
>a30801ffff0080141400fc1406ff0000ff7f00bb
>a309ffff0000ff0000ffff8b00ff0000800000a1
>a3ff8000000000000000000000000000000000dc
<a3020000000000000000000000000000000000a1
>330504110800000000000000000000000000002b
<3305000000000000000000000000000000000036
This follows the reverse engineering patterns from the repo but does clarify things:
- keepalive did occur before, but this is every 2 seconds and there's a period of just under 1 second between the response and the next command. It's unlikely the app took that long to continue with the sequence, so it's probably not actually part of it.
- a3 is the command (not a1 like some other govee products)
- a300 01 0b 02 ...data is the start packet, containing data
- 0b (11) is the packet count including the start and end packets
- This is followed by 02, some info suggests other govee products have an 02 constant in the protocol. Cross-referencing with the "candy" params from the API dump, the first byte is 04 which comes after that so 02 is definitely part of the start packet header.
- a3pp ...data is the ppth packet
- a3ff ...data is the end packet, containing data
- ACK of a302, the meaning of 02 is unclear. None of the other repos mention this.
- followed by a write to 05 to set the mode to 04 (scene) 0x0811 (little endian, "Life - Candy")
Despite seeming to perfectly replicate the collected data, the lights didn't change. It acts as if the a3 command is unrecognized because there's no ACK. Awaiting the ACK at the end just hangs, or times out if the heartbeat is running.
My attempt to replicate:
a300010b020429000100320201ff0003ff0a0ab5
a30101a50506ff0000ff7f00ffff0000ff000085
a302ffff8b00ff1400fd000880002900010032ae
a3030201ffb203ff0a0a01a30506ff0000ff7fcc
a30400ffff0000ff0000ffff8b00ff1600fc10d6
a3050180012900010032000194940080141400bd
a306e71406ff0000ff7f00ffff0000ff0000ff2f
a307ff8b00ff000080000080002900021901001c
a30801ffff0080141400fc1406ff0000ff7f00bb
a309ffff0000ff0000ffff8b00ff0000800000a1
a3ff8000000000000000000000000000000000dc
a300010b020429000100320201ff0003ff0a0ab5
a30101a50506ff0000ff7f00ffff0000ff000085
a302ffff8b00ff1400fd000880002900010032ae
a3030201ffb203ff0a0a01a30506ff0000ff7fcc
a30400ffff0000ff0000ffff8b00ff1600fc10d6
a3050180012900010032000194940080141400bd
a306e71406ff0000ff7f00ffff0000ff0000ff2f
a307ff8b00ff000080000080002900021901001c
a30801ffff0080141400fc1406ff0000ff7f00bb
a309ffff0000ff0000ffff8b00ff0000800000a1
a3ff8000000000000000000000000000000000dc
The order is wrong! Might be an endianness issue?
a302000b0429000100320201ff0003ff0a0a00b4
a30101a50506ff0000ff7f00ffff0000ff000085
a302ffff8b00ff1400fd000880002900010032ae
a3030201ffb203ff0a0a01a30506ff0000ff7fcc
a30400ffff0000ff0000ffff8b00ff1600fc10d6
a3050180012900010032000194940080141400bd
a306e71406ff0000ff7f00ffff0000ff0000ff2f
a307ff8b00ff000080000080002900021901001c
a30801ffff0080141400fc1406ff0000ff7f00bb
a309ffff0000ff0000ffff8b00ff0000800000a1
a3ff8000000000000000000000000000000000dc
I was printing the correct data but writing the wrong data. Now scenes work!!! Then I tried to replicate the collaboration scenes SPICE and ARRAKIS:
SPICE
Value: a3000106020326000000050201cb3303db1414a5
Value: a30103001405ff1e07ff3707ff5a07ff3707ff0b
Value: a3021e07000080000080001a500301020001ff0c
Value: a303000099141400991401ff32071600fc000095
Value: a30480001a550301020001ff0000991414009996
Value: a3ff1401ff31071400fc000080000000000000e8
Value: 3305041327000000000000000000000000000006
0326000000050201cb3303db141403001405ff1e07ff3707ff5a07ff3707ff1e07000080000080001a500301020001ff000099141400991401ff32071600fc000080001a550301020001ff000099141400991401ff31071400fc000080000000000000
0x2713 = 10003
AyYAAAAFAgHLMwPbFBQDABQF/x4H/zcH/1oH/zcH/x4HAACAAACAABpQAwECAAH/AACZFBQAmRQB/zIHFgD8AACAABpVAwECAAH/AACZFBQAmRQB/zEHFAD8AACAAAAAAAAA
ARRAKIS
Value: a300010402021d000303050001a0a000001414bf
Value: a30103001402ff8330ff85230000801001ed01df
Value: a3021a000000010001ff8c01ef14140300070123
Value: a3ffff631a0000800000800000000000000000da
Value: 3305041427000000000000000000000000000001
021d000303050001a0a00000141403001402ff8330ff85230000801001ed011a000000010001ff8c01ef141403000701ff631a0000800000800000000000000000
0x2714 = 10004
Ah0AAwMFAAGgoAAAFBQDABQC/4Mw/4UjAACAEAHtARoAAAABAAH/jAHvFBQDAAcB/2MaAACAAACAAAAAAAAAAAA=
Trying to deconstruct it after changing the speed:
0326000000050201cb3303
(c9)
14140103001405ff1e07ff3707ff5a07ff3707ff021e07000080000080001a500301020001ff03000
(0801)
4140
(0801)
401ff3207160
(0f9)
00000480001a550301020001ff0000
(80)
14140
080f
f1401ff31071400f9000080000000000000
0326000000050201cb3303
(db)
14140103001405ff1e07ff3707ff5a07ff3707ff021e07000080000080001a500301020001ff03000
(0991)
4140
(0991)
401ff32071600
(fc)
00000480001a550301020001ff0000
(99)
14140
(099f)
f1401ff31071400fc000080000000000000
db
0x2713
10003
---
021d000303050001a0a0000014140103001402ff8330ff85230000801001f701021a000000010001ff8c01f9141403000701ffff631a0000800000800000000000000000
0x2714
10004
---
33051501ffffff0fa0ffd5a1ff7f0
Warmest: 330515 01 ffffff 07d0 ff8d0b ff7f 0000000000f3
AlmostW: 330515 01 ffffff 0960 ffa23c ff7f 000000000055
HalfC : 330515 01 ffffff 16a8 fff1e7 ff7f 00000000000a
Coldest: 330515 01 ffffff 2260 dbe2ff ff7f 0000000000d9
Value: 33051501ffffff1af4faf7ffff7f000000000041
Value: 33051501ffffff1004ffd7a6ff7f0000000000c7
Value: 33051501ffffff1004ffd7a6ff7f0000000000c7
Value: 33051501ffffff0ed8ffd097ff7f000000000033
Value: 33051501ffffff1f40e5e9ffff7f0000000000f1
Value: 33051501ffffff1bbcf5f4ffff7f000000000004
Value: 33051501ffffff0d48ffc682ff7f0000000000a3
Value: 33051501ffffff2134dfe5ffff7f00000000008d
Value: 33051501ffffff1ce8eff0ffff7f000000000049
Value: 33051501ffffff19c8fff9fdff7f000000000077
Value: 33051501ffffff16a8fff1e7ff7f00000000000a
Value: 33051501ffffff13ecffe8d0ff7f000000000065
Value: 33051501ffffff10ccffdbafff7f00000000000a
Value: 33051501ffffff0d48ffc682ff7f0000000000a3
Value: 33051501ffffff0a28ffaa4dff7f000000000067
temp color
1af4 faf7ff
1004 ffd7a6
1004 ffd7a6
0ed8 ffd097
1f40 e5e9ff
1bbc f5f4ff
0d48 ffc682
2134 dfe5ff
1ce8 eff0ff
19c8 fff9fd
16a8 fff1e7
13ec ffe8d0
10cc ffdbaf
0d48 ffc682
0a28 ffaa4d
Color
Undef : 330515 01 010101 0000 000000 ff7f 0000000000a3
Mic mode:
Value: 3305050100000000000000000000000000000032
Value: 330505003a000000000000000000000000000009
Value: 3305050014000000000000000000000000000027
Value: 3305050064000000000000000000000000000057
Value: 33050500b4000000000000000000000000000087
Value: 33050500fe0000000000000000000000000000cd
Value: 33050500cc0000000000000000000000000000ff
Value: 330505009a0000000000000000000000000000a9
Value: 3305050054000000000000000000000000000067
Value: 3305050014000000000000000000000000000027
Value: 3305050064000000000000000000000000000057
Value: 33050500b4000000000000000000000000000087
Value: 33050500fe0000000000000000000000000000cd
Value: 33050500cc0000000000000000000000000000ff
Value: 330505009a0000000000000000000000000000a9
Value: 33050500ea0000000000000000000000000000d9
Value: 33050500fe0000000000000000000000000000cd
Value: 33050500a0a00000000000000000000000000033
Value: 3305050078780000000000000000000000000033
Value: 3305050041410000000000000000000000000033
Value: 3305050080800000000000000000000000000033
Value: 33050500bfbf0000000000000000000000000033
Value: 33050500c7c70000000000000000000000000033
Value: 33050500a0a00000000000000000000000000033
Value: 3305050078780000000000000000000000000033
Value: 3305050041410000000000000000000000000033
Value: 330505000f0f0000000000000000000000000033
Value: 330505004e4e0000000000000000000000000033
Value: 33050500c7c70000000000000000000000000033
Value: 3305050000cc00000000000000000000000000ff
Value: 33050500009a00000000000000000000000000a9
Value: 3305050000540000000000000000000000000067
Value: 3305050000140000000000000000000000000027
Value: 3305050000640000000000000000000000000057
Value: 3305050000b40000000000000000000000000087
Value: 3305050000fe00000000000000000000000000cd
Value: 3305050000cc00000000000000000000000000ff
Value: 33050500009a00000000000000000000000000a9
Value: 3305050000540000000000000000000000000067
Value: 3305050000140000000000000000000000000027
Value: 3305050000640000000000000000000000000057
Value: 3305050000b40000000000000000000000000087
But reloading the app it suddenly had a different UI and more fleshed-out microphone mode:
Value: a5028300858534
Value: a5028300858534
Value: a502830000143e
Value: a502830000fe28
Value: a5028300005680
Value: a502830000fe28
Value: a5028300005680
Value: a502838a00feb2
Value: a502832e0056ae
Value: a502830a001448
Value: a502838a00feb2
Value: a502838a00feb2
Value: a502839f9f9f07
Value: a502830c0c0c4e
Value: a502839f9f9f07
Value: a502834f4f4f17
Value: a50283fe000028
Value: a502831400003e
Value: a50283fe000028
Value: a502830f0f0048
Value: a50283c7c700b8
Value: a50283636300f0
Value: a50283c7c700b8
Value: a502830014003e
Value: a5028300fe0028
Value: a50283007f00a9
Value: a5028300fe0028
Value: a50283000f0f48
Value: a5028300c7c7b8
Value: a50283006363f0
Value: a5028300c7c7b8
Value: a502830000143e
Value: a502830000fe28
Value: a502830000143e
Value: a502830000fe28
Value: a5028300007fa9
Value: a502838a00feb2
Value: a5028345007fee
Value: a502838a00feb2
Value: a5028345007fee
Value: a502839f9f9f07
Value: a502836060604a
Value: a502832121218d
Value: a502839f9f9f07
---
turn alarm 1 on
Value: 3323008000008000000000000000000000000010
turn alarm 1 off
Value: 3323000000008000000000000000000000000090
turn alarm 1 off?
Value: 3323000000000000000000000000000000000010
turn alarm 1 on
Value: 3323018000008000000000000000000000000011
turn alarm 1 off
Value: 3323010000008000000000000000000000000091
turn alarm 1 on
Value: 3323008000000000000000000000000000000090
turn alarm 1 off
Value: 3323000000000000000000000000000000000010
turn alarm 2 on
Value: 3323018000008000000000000000000000000011
turn alarm 2 off
Value: 3323010000008000000000000000000000000091
turn alarm 1 on
Value: 3323008000000000000000000000000000000090
turn alarm 2 on
Value: 3323018000008000000000000000000000000011
turn alarm 1 off
Value: 3323000000000000000000000000000000000010
turn alarm 2 off
Value: 3323010000008000000000000000000000000091
turn alarm 1 on
Value: 3323008000000000000000000000000000000090
turn alarm 2 on
Value: 3323018000008000000000000000000000000011
turn alarm 3 on
Value: 3323028000008000000000000000000000000012
turn alarm 4 on
Value: 3323038000008000000000000000000000000013
"wake up" at 00:00
Value: 331201640000800a0000000000000000000000ce
"sleeping" (turn off after 15 minutes)
Value: 3311011e0f0f000000000000000000000000003d
turn off sleeping
Value: 3311001e0f0f000000000000000000000000003c
turn off wake up no repeat wake-up at 00:00 for duration 10, no repeat, final brightness 100
Value: 331200640000800a0000000000000000000000cf
turn alarm 4 off
Value: 3323030000008000000000000000000000000093
turn alarm 3 off
Value: 3323020000008000000000000000000000000092
turn alarm 2 off
Value: 3323010000008000000000000000000000000091
turn alarm 1 off
Value: 3323000000000000000000000000000000000010
turn on wake-up at 15:21 repeat tues thurs fri, duration 11 minutes, final brightness 70
Value: 331201460f159a0b0000000000000000000000ed
(weekday bit masks)
wake-up no repeat
10000000
wake-up repeat tues/thurs/fri
10011010
Value: 3311011e1313000000000000000000000000003d
---
power-off memory off
Value: 3341000000000000000000000000000000000072
power-off memory on
Value: 3341010000000000000000000000000000000073
---
Wrote scene "twilight"
For reference, twilight is: