Medtronic Guardian Connect - BT protocol

[ViktorSchlaffer]

Hi,

I have a Medtronic Guardian Connect transmitter, that has BT radio, and the transmitter is capable of communicating with an Android or IPhone mobile directly. I've tried to connect to the transmitter from my laptop to reveal some information, and it looks like the transmitter advertises a "Continuous Glucose Management Service" that is described in a Bluetooth specification. [1]
This is what I've found out so far:
https://gist.github.com/ViktorSchlaffer/75a1b6a6a9dff961da58fdaa6f40d8fa

So it looks like it's not some proprietary protocol, they're following a standard, and it might make it easier to add it an a new collector source in xDrip. What's your take on this?
(The official app from Medtronic has a 1.2 star rating in the Play store, I guess it explains why I'm trying to do this... )

Thanks,
Viktor
[1] https://www.bluetooth.com/specifications/specs/continuous-glucose-monitoring-service-1-0-1/

[jamorham]

Great news and respect if they are using an open standard. Could you provide a play store link to the exact app you are using? In terms of implementing a collector, this is much easier when I have the actual device but if it really is standards compliant then it might be possible remotely.

[jamorham]

Does it have the glucose show in a persistent notification? If so can you provide a screenshot? thanks

[ViktorSchlaffer]

I have no idea to be honest, I have not tried the official app yet, as it only works with certain models. So I'll have to buy a compatible phone, in order to try it.

[jamorham]

I have added bare-bones support for that package to the Companion collector. So if you can find anyone who is using it already who can test the Nov 8th Nightly with it, please let me know if that gives any data.

[ViktorSchlaffer]

Thank you, I'll try to test it next week.
If I understood correctly, this will try to get a value from the persistent notification.

[ViktorSchlaffer]

Hi @jamorham
I have installed the latest nightly on a supported phone, and xDrip+ can read the sensor value from the Guardian app notification.
I only configured the "Glucose Units" settings to mmol/l and enabled the "Companion App" data source, nothing else was needed.

After that, I've also enabled "Companion Bluetooth" in BT advanced settings, as I can see that it starts the BlueTails "service", but it looks like it's only for Dexcom devices, or at least there is a filter on the btCallback3 function for certain device names.
What would be the next steps?

[jamorham]

@ViktorSchlaffer I believe you are sufficiently technical to understand these brief instructions. They are fairly complex though: Please enable android developer mode on your phone and then enable the hci bluetooth logging from the developer settings. You may need to turn bluetooth off/on to activate it. Allow a significant amount of data to get collected - for example 1 hour of data. Then using adb bugreport on a PC collect the zip file and send this to me privately via email jamorham at gmail (it likely contains some personal information) - Also please include what the glucose value was just before creating the zip for my reference. I can use the bluetooth data to produce a prototype bluetooth companion mode which you can then test out and we can proceed from there.

[ViktorSchlaffer]

Hi @jamorham,
I've prepared the data that you've requested, and sent it over to you via email.

[palmarci]

Hello everyone, i just got my medtronic guardian model 4 sensor. I have tried 16 (!!!!) android phones, 2 iphones and i managed to have the official app only on 3 to run (and when i mean "run" i mean "run" and not "work as intended"). I tried some reverse engineering and i came to the conclusion that there is maybe this bug (flutter/flutter#96367) which causes a crash on startup. This is some memory black-magic, so i dont think that certain android versions and/or models are "incompatible", they just have maybe their memory mapped in a different way (?), or just happen to cause this bug, and they are lazy/dont care to fix it. This i could also reproduce on an iphone6, so definetly cross-plaftorm bug, so thats why im guessing to be flutter-related. Anyways, this is insane to me, on google play more than 150 people reported since november 2022 that the app does not work or freeze for them. (Remember this is a medical device, people's lives may depend on it???). I contacted the support, they "forwarded this to the developers"... Long story short i am also collecting bluetooth hci data and i could give up some of my time to help with this project. I really believe we could make this type of sensor to work with xDrip. Thanks in advance

[Navid200]

If they are selling this device, how do the customers use it if the app is so bad?
If no one can use the official app, how are they still in business?
How is everyone who is buying it using it?

[palmarci]

Okay, happy news guys. I started reverse engineering the app(s), i almost understand the bluetooth communication, and i can talk directly with the device. However, of course there are still grey areas, which needs to be sorted out, but the hard part is over.
The transmitter uses bluetooth 4.0 (low energy) GATT profiles (as previously mentioned). There are a few services which run on the transmitter (only one of them is the official bluetooth GCM). However the interesting data is in those other services. I will buy a bluetooth dongle so i can create basic scripts to communicate and play with the transmitter. I really hope that someone will be able to help with the integration. I can of course test everything and i will provide more information on the communication when i will have more free time.
Thx in advance :)

[ViktorSchlaffer]

Hey @palmarci ,

We also went down this path, and we were able to capture the traffic between the BT transmitter and an Android phone.

The "00002aa7-0000-1000-8000-00805f9b34fb" uuid should have the glucose value, but I have not been able to figure out the message format.

I've also tried reading uuid "00002aaa-0000-1000-8000-00805f9b34fb",which is supposed to be the CGM session start time, as I expected that to be quite static, but the answer seems to have no static parts:

D 00:16:52.227 gatt.readCharacteristic(00002aaa-0000-1000-8000-00805f9b34fb)
I 00:16:54.509 Read Response received from 00002aaa-0000-1000-8000-00805f9b34fb, value: (0x) 03-6D-5B-2A-67-8B-6E-32-C9-F7-31-2C-C1-5C

D 00:17:00.676 gatt.readCharacteristic(00002aaa-0000-1000-8000-00805f9b34fb)
I 00:17:02.773 Read Response received from 00002aaa-0000-1000-8000-00805f9b34fb, value: (0x) A7-FB-EE-3D-C5-5B-86-02-EC-17-14-2D-57-FA

D 00:17:05.729 gatt.readCharacteristic(00002aaa-0000-1000-8000-00805f9b34fb)
I 00:17:07.122 Read Response received from 00002aaa-0000-1000-8000-00805f9b34fb, value: (0x) B7-52-9C-B5-57-18-95-9D-12-E7-51-2E-0F-52

D 00:17:08.590 gatt.readCharacteristic(00002aaa-0000-1000-8000-00805f9b34fb)
I 00:17:10.169 Read Response received from 00002aaa-0000-1000-8000-00805f9b34fb, value: (0x) EB-BA-F4-CD-D3-6F-93-D0-25-A7-9A-2F-55-D9

D 00:17:11.253 gatt.readCharacteristic(00002aaa-0000-1000-8000-00805f9b34fb)
I 00:17:13.212 Read Response received from 00002aaa-0000-1000-8000-00805f9b34fb, value: (0x) 89-F2-E8-40-C5-9A-7E-48-BB-AD-F3-30-5B-98

As all the fields are changing, I suspect that there is encryption on the data of these handles.

If you open btsnoop files with Wireshark, and filter down with "btatt.opcode == 0x1b" those messages should be the measurement notifications sent to the phone, but it also seems to have some encryption, I got payloads like this:

d3 ad 7f fa ac c8 d0 19 2b 61 dc af 59 8d 06 06 d8
82 79 e8 eb bc 75 5e 59 b5 90 e9 c9 34 41 08 44 c6
aa 50 0b d5 62 82 31 d5 ca 2e 8f cd d3 dc 0a 01 33
ff ba b9 0b 91 8f d5 35 74 65 26 32 10 bf 0c 71 2d
b7 93 cf d8 28 81 0f 16 f9 ed f0 c3 99 fe 0e d8 cc
d6 05 3e 16 8e eb 55 26 fa a7 e2 8e 75 c8 10 f9 f4
51 51 0f 9a e6 56 2c 04 46 f9 7b bf 2a ec 12 63 6d
8b a7 cf 89 dc 07 09 45 68 e9 fd 75 37 8f 14 36 73
79 56 16 9b de 99 f8 d8 98 51 65 0d cd 54 16 c6 c1
e7 9b c0 f8 dc db a3 5d a2 11 4b b4 3c 79 18 f9 87  
                                           *3rd octet from the back looks like a sequence number

If you think you can figure out more, I can share my captures with you.

[palmarci]

Oh this looks very promising! Unfortunately i have a weird bug where btsnoop only can see the first 5 or so bytes of the transmission, so currently i dont have real world data, but i think i do have the parsers classes.
I didnt have enough time to understand the GATT protocol fully, so i may be a little off. By the way check out the '"nRF Connect" app. It is basically a GATT client, you can send and receive data. It can fix the sensor disconnect problems, the app runs in the background properly, which keeps the BT connection alive. So the phone is constantly "connected" and the medtronic app more or less """works"". Anyways, please do email me at ---- :)

[palmarci]

Ive got the parsing i think:

examples:


(i dont understand the crc stuff)

[ViktorSchlaffer]

I've reached out to you via mail. I think the CRC is there for integrity protection.

[palmarci]

guardian_characteristic_parser.zip (only for feature information)
i think i can parse the some messages now
if anybody has data, please test it :)

[krisz768]

Hi @palmarci! (Szia!)

Any update? Can i help? I also want an xdrip implementation because the official app is garbage.

[palmarci]

Hello!

The current objective is to understand the encryption. I have extracted a "key database" from an other medtronic app, since the guardian is so obfuscated. Technically it works, but i still need to understand the handshake procedure, however currently i dont have a sensor on me. The communication is more complex than i thought, so this will be definitely a longer project. Of course every help is appreciated. :)

[krisz768]

So the guardian 3 and 4 handshake and encryption is the same?

[palmarci]

No its not the same

[krisz768]

I had some free time so i tried to find the encryption algorithm. And I think I found it: it's written in native c.... in libandroid-sake-lib.so.

related java codes: com.medtronic.e.a.a.a.f (Top layer, calls SakeClient)
com.medtronic.e.a.a.a.e (SakeClient - coordinates encyption/decryption and provides the key)
com.medtronic.minimed.sake.i
com.medtronic.minimed.sake.SakeJNI (Is a static class to interface native c code)

[krisz768]

I don't have much practice with native code reverse engineering, so I'm basically stuck. Can somebody help?

[Navid200]

Guys, please, there should be no talk about reverse engineering in these forums or any other xDrip platform.

[igorpele]

Hi I have a Guardian 4 sensor connected to a 780G pump.
If you have any code that I can test, please send it. Is there any other communication channel that we can use?

[krisz768]

Any update?

[palmarci]

Im sorry i gave up.

[palmarci]

Hello guys, i made a little writeup for everyone interested in the Guardian 4. Hope it will be useful. Also i think we could pull off supporting the older Guardian 3, but i actually dont own one.
See https://github.com/palmarci/OpenGuardian4

[ViktorSchlaffer]

Nice to hear from you, and thanks for the summary!
One alternative for the xDrip/CareLinkFollower is to use the "Companion mode" in xDrip, which will read the glucose value from the persistent notification of the Guardian app, so it will work even when there is a CareLink outage.
(I use this method so that I can see the glucose values on my old smartwatch)

[palmarci]

Oh wow, I cant believe i missed that feature, that is such a good idea. I hope i did not reimplement an existing feature with my database visualizer too 😆

[Troxelke]

Hi guys, great work over here. It would be such a dream for me to have Xdrip getting the BG values from the Guardian 4 sensor directly, so that we do not need this Minimed Mobile or Guardian apps anymore.

I own a 780G system so I even have the pump in between, so would it be possible (potentially) to have the pump out of the loop?

Already such a great job is the Companion app, so Carelink (or a bad internet connection) is out of the loop already, so happy to use this while mountainbiking / trail running in forest without proper internet (and still having my BG values on my Garmin watch).

[palmarci]

Not until we break the encryption im afraid 😢 . I will look into the other APK, but im not expecting anything new really. By the way, how does it work together? You need two apps or just the Minimed? Does the pump directly communicate with the sensor?

[Troxelke]

With the 780G system you only need the Minimed Mobile app, so the phone only communicates with the pump. The Guardian 4 sensor is communicating with the pump, not yet phone.

…

________________________________ Van: Pal Marci ***@***.***> verzonden: dinsdag 19 september 2023 19:36 Aan: NightscoutFoundation/xDrip Cc: Troxelke; Comment Onderwerp: Re: [NightscoutFoundation/xDrip] Medtronic Guardian Connect - BT protocol (Discussion #2438) Not until we break the encryption im afraid 😢 . I will look into the other APK, but im not expecting anything new really. By the way, how does it work together? You need two apps or just the Minimed? Does the pump directly communicate with the sensor? — Reply to this email directly, view it on GitHub<#2438 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AL6LOP5UYBQZZJXQYHJRYGLX3HJ2LANCNFSM6AAAAAARZMPMRU>. You are receiving this because you commented.Message ID: ***@***.***>

[palmarci]

Hello guys, i have been doing some work on the apps and got some very interesting results. To continue the investigation of the bluetooth communication I need some help. I have created a group chat at https://discord.gg/PnKwESJp and would like you to join if you are interested in it :) see link below

[Troxelke]

HI, that makes me curuous ;)! It seems the group chat invitation is expired?

[bojanpotocnik]

I am currently using 780G and to this point I have been using Libre 1 & 2, Dexcom G4 & G6, Guardian 3, and now I also have access to Guardian 4 and Dexcom G7.

My experience with Guardian 3 was - comparable to Dexcom G6 - so bad, that I sacrificed the benefits of the SmartGuard loop and rather used G6 instead of Guardian 3.

Dexcom G7 and Libre 3 do not make wearing Guardian 4 any less inferior, so I am exercising the idea of using e.g. BGM220SC22 (or nRF52) as a proxy between Dexcom G7 and 640G/780G. I am aware that

there should be no talk about reverse engineering in these forums or any other xDrip platform.

so I would be grateful for an email if someone is still researching this topic.

[palmarci]

hello, i have been doing some very interesting things, there is a chatgroup with a lot of info and other people, we could talk there
(see below)

[smorgeous]

Hey @palmarci I just stumbled upon this thread and was wondering if that Discord discussion is still alive? The links seem to all be expired.
Would love to join as I'm very interested in getting the best setup with my Guardian 4 and xDrip.
Hope to hear back, cheers!

[palmarci]

https://discord.gg/tb4egy8VYh
hello! sadly the progress halted since i dont have enough free time, but im not planning on abandoning this :)

[planiitis]

Hello,

I've been looking into the encryption protocol here for the last couple of days. I believe I've managed to fully figure out the encryption protocol.

I also managed to interface with my own Guardian 4 transmitter and, just as a test using manually crafted messages, managed to verify the authentication tag in the second handshake message coming from the transmitter.

I plan to write a reference implementation in the next few weeks.

@palmarci, I've been unable to join Discord, but I'd be interested to know the latest findings here. Feel free to drop me an email.

(edited for brevity)

[Navid200]

I have already mentioned that there should be no discussions about reverse engineering in these forums.
I will have no choice but to delete this post if it is not cleaned up or removed.

We have asked you guys to try xDrip companion mode app.
No one has done that. Test it and tell us if it works or not.
This is how you can set up the companion app mode: https://navid200.github.io/xDrip/docs/Follow/CompanionApp.html

[palmarci]

@Navid200 sorry for the technical information, however I believe no sensitive material (keys) or anything like that was ever posted in this thread. Of course, we will move to a different place with the conversation.

[palmarci]

@planiitis I am so happy for this, thank you! Great to see that someone picked the project up, after I got tired. Im sorry for the discord link, https://discord.gg/tb4egy8VYh I hope we can talk about stuff here :)

[planiitis]

@Troxelke It should at least be possible to pair with a Guardian 4 transmitter and get its readings. If you also have e.g. a 780G pump that should be receiving the data from the Guardian transmitter, the transmitter will instead have to be connected directly to the pump as usual. But AIUI it should be possible to connect to the pump (at least specific models) and get the sensor readings and presumably insulin delivery data as well.

[kukuchta]

Honestly, I bet everyone on the discord is excited about this news, because its a really major step since a while😉 Do you have any other place or preference where we could collaborate on this?

I'm also really curious about testing this approach with app-to-pump scenario.