Using AI to reverse engineer undocumented Bluetooth protocols has been a godsend for me. We have an RV that came with a "Smart RV" system from BMPro that controls all of the lights, the air conditioning, starting the generator, leveling, slideouts, and other stuff.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
For me, it was reverse engineered. I am not an expert or even conversant in decompiling Android APKs. It took the decompiled Java (app was apparently written in Kotlin) and extracted all the necessary information.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
If you have a eufy scale, you can do this with no LLM needed - just set up an esp32 Bluetooth proxy, add it to home assistant, and then use the EufyLife integration someone already made. I did this recently with my scale to avoid having to sync it to my phone, go to the cloud, fetch data from the cloud, etc., and it's working fantastically. I have a little Home Assistant integration that pokes scale updates to a Python script running locally that provides a UI I like.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
I actually found this out by accident. I set up a BT proxy to capture my combustion thermometers and saw eufy show up as an option and was like wait what? Honestly surprised how open it is.
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
esphome:
name: bluetooth-proxy
esp32:
board: esp32dev
framework:
type: esp-idf
# Enable logging
logger:
# Enable Home Assistant API
api:
encryption:
key: "YOUR_KEY_HERE"
# Enable OTA updates
ota:
- platform: esphome
# WiFi configuration (matching the settings from your other devices)
wifi:
ssid: "YOUR_WIFI_SSID"
password: "YOUR_WIFI_PASSWORD"
# Enable fallback hotspot (captive portal) in case wifi connection fails
ap:
ssid: "Bluetooth Proxy Fallback"
password: "proxyfallback"
captive_portal:
# Enable ESP32 BLE Tracker
esp32_ble_tracker:
scan_parameters:
active: true
# Enable Bluetooth Proxy
bluetooth_proxy:
active: true
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).
Thanks so much, I appreciate the time you put into this comment. It is highly relevant to a project I’m currently working on, and has saved me at least a day of time.
You can also have a Webhook be delivered when you take a new measurement. I wrote a small script that syncs my weight to Garmin using python-garminconnect.
The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
Nice!
I also got tired of the Withings app (which now pushes AI subscriptions, wtf) and "made" an app for the smartwatches (at least, it works with my ScanWatch 2)
Very light on details, but did awaken me to the idea that you can setup HW projects like this without soldering. Bluetooth is practically ubiquitous, and ESPhome does offer this up in a palatable way
I'm planning on doing something similar with a $150 treadmill that uses an app called "Gymax." I don't want the app or its adorably embryonic social network. I just want three buttons: slow, fast, and really fast for 60 seconds.
Hi! Regarding the code for this project I will upload it soon, it's just that i want to build an small tool to actually make it easier to get person ID's and generate the correct yaml automatically.
I'd love to be able to flash a custom firmware on the withings body+ to make the screen truly smart. It's a bummer to know that AI can do all these things if only the firmware was open source / accessible.
Same. It annoys me I cannot use baby wright mode to also weigh my dog as she's heavier than the 5kg limit they impose. However, reverse engineering firmware is really easy these days...
We've got a few Withings Steel HR watches in the house, would be interested in doing exactly the same with those. Perhaps I'll spend a bit of time digging around.
The interesting thing here is the opportunity to make a sdk for interfacing with the Withings hardware offline. This is the first public example I’ve seen of someone attempting that
You can build your own scale with an ESP32 for like $25 in parts - Hx711, load cells, ESP32, and a handful of trivial components. I threw together one that sits under my gas bottle, so I know when it’s running low. Adding impedance would be a pretty trivial step.
Sure, you’ve gotta have some known good values to compare to, but those aren’t hard to come by. Pretty sure you can get a decent idea of BF with callipers or somesuch.
Body fat would be possibly the only metric that a withings scale gives you that you can get a somewhat accurate number from without needing a dexa scan.
The BMPro app is... well, it's like they actively worked to make it terrible.
I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.
It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.
I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.
Call it what you will, the point is I do not have the necessary skills to accomplish this task, but I was able to go from an APK to a working implementation that was controlling the lights in my RV in a couple of hours back in early April using whatever was the current version of Opus at the time. While I understand what it did to accomplish this, it might as well be magic for me, because it would take me months of free time to get to where it got.
It also wrote out documentation of the protocol so subsequent work would not require reading decompiled Java code.
Huge fan of running it this way.
(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)
I'm just using a cheap ESP-WROOM-32 but the recommended way to do it is with an wired ethernet-based ESP32 so you don't have interference with the wifi and btle. For a scale this works well enough. I haven't yet received the athom smart plug so I can't recommend it yet. Should be here in a week or so.
Once you've got the proxy you can just use the eufylife integration: https://www.home-assistant.io/integrations/eufylife_ble/
To setup the esphome bluetooth proxy you install esphome, and then create a yaml file that you'll use to configure the board, like this:
Once that's done, plug in your board to your system and use esphome run bluetooth-proxy.yaml (you might have to find the device it's showing up as in tty.usbserial or whatever).The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.
The app is at https://github.com/DavidVentura/withouthings - the firmware on the watch was leaked as well, and it's been helpful to debug some of the protocol.
Because OP's hookup works offline, via the Bluetooth.
But not the calibration that maps a raw ADC sample to "24.5% body fat, 21 Kg bone ..." etc.