Ramblings of an aging IT geek
← Ramblings of an aging IT geek
hardware

sniffing a £6 bluetooth thermometer with gatttool

Poking at a cheap Bluetooth Low Energy temperature sensor to read its values without the awful vendor app.

A small electronics gadget on a workbench

I bought a cheap BLE temperature and humidity sensor, the sort with a little LCD and a coin cell, for about six quid. It works fine on its own. The problem is the only way to get the readings onto a computer is a vendor app that wants an account, an internet connection and far too many permissions to report that my study is 19 degrees.

So I skipped the app. BLE devices expose their data as GATT characteristics, and you can walk those from the command line with gatttool on any Linux box with a Bluetooth adapter. First find the address with hcitool lescan, then connect and dump the handles:

$ gatttool -b A4:C1:38:XX:XX:XX -I
[A4:C1:38:XX:XX:XX][LE]> connect
[A4:C1:38:XX:XX:XX][LE]> char-read-hnd 0x0021
Characteristic value/descriptor: e9 07 27 02 ...

The fun is figuring out what the bytes mean. I watched one characteristic while breathing on the sensor and warming it in my hand, and the value tracked. A bit of staring later: temperature was a little-endian 16-bit integer in tenths of a degree, humidity a single byte, battery a percentage. No checksum, no encryption, nothing clever. Just numbers the app dresses up.

From there it's a tiny Python script with bluepy polling the handle on a timer and shoving the result at my metrics box. Total cost six pounds, total accounts created zero, and now the readings live somewhere I actually control. The vendor app remains uninstalled, which was the entire point.