BEKEN iLedBlub

These are LED lamps E27 ~7W with Bluetooth BLE, in variants of RGB color, and without.

Manufacturer/distributor Hama/Xavax.

Product number 00111973 (case marking: 001119730001).

Currently (2018-01-09) sold at http://pollin.de for 4,95 Euro ([1] , [2]).

And, since these are called iLedBlub (sic!), I chose to use the same name for this page.

http://www.instructables.com/id/Reading-Values-From-a-BLE-Device-Using-CSR1010-and/

LabNotes: Reverse Engineering Sex Toys (ermm ;))

# hcitool lescan

[MAC] LED

[MAC] (unknown)

# gattool -I

connnect [MAC]

characteristics

char-read-hnd 0x3

Characteristic value/descriptor: 69 4c 65 64 42 6c 75 62 --> iLedBlub (https://rainerpeffm.wordpress.com/2016/01/18/installation-mit-i-eurolamp-und-brille-%C2%B7-im-eiscafe/)

char-read-hnd 0x5

Characteristic value/descriptor: 03

Characteristic value/descriptor: 00

char-read-hnd 0x7

Characteristic value/descriptor: 64 00 c8 00 00 d0 07

char-read-hnd 0x9

Characteristic value/descriptor: 00

char-read-hnd 0xb

Characteristic value/descriptor: 00 00 00 00 00 00

char-read-hnd 0x12

Characteristic value/descriptor: 42 45 4b 45 4e 00 00 00 00 00 --> BEKEN

(BEKEN likely is http://www.bekencorp.com/en/index.Asp - that page contains text "BK326X is qualified by SIG by Bluetooth", so......)

char-read-hnd 0x14

Characteristic value/descriptor: 42 54 20 34 2e 30 --> BE 4.0

char-read-hnd 0x16

Characteristic value/descriptor: 31 32 78 30 37 78 32 30 31 32 --> 12x07x2012

char-read-hnd 0x18

Characteristic value/descriptor: 53 4d 2d 31 --> SM-1

char-read-hnd 0x1a

Characteristic value/descriptor: 30 31 2e 31 --> 01.1

char-read-hnd 0x1c

Characteristic value/descriptor: 30 31 2e 31 --> 01.1

char-read-hnd 0x1e

Characteristic value/descriptor: de bc 9a fe ff 56 34 12

char-read-hnd 0x20

Characteristic value/descriptor: 89 ab cd ef

char-read-hnd 0x22

Characteristic value/descriptor: 01 0e 00 12 34 01 67

char-read-hnd 0x25

Characteristic value/descriptor: 00 00 01 00 00 00 00 00 01 ff (power-up value of the data word)

Characteristic value/descriptor: 01 f9 01 00 01 ff 01 f3 01 ff

Characteristic value/descriptor: 01 00 01 00 01 00 01 63 01 00

Characteristic value/descriptor: 00 00 00 00 00 00 00 00 00 00 (this zeroing happens directly at char-write-req 0x28 0x0 - however while usually these values indicate the data word, that 0 result then is NOT equal to the data word: 0 would be OFF, which isn't the case here - hmm...)

char-read-hnd 0x2c

Characteristic value/descriptor: 8e 03 f8 a2 b1 00

This will provide NOTIFYs (of current settings):

char-write-req 0x28 0x0

Notification handle = 0x0025 value: 00 00 00 00 00 0f 01 ff 01 15 (current setting of the data word)

Notification handle = 0x002c value: 8e 03 f8 a2 b1 00

char-write-req 0x28 e3105811111111 --> max. 7 bytes value allowed

char-write-req 0x2a 112233445566778899aa --> max. 10 bytes value allowed

char-write-req 0x2a

01f9010001ff01f301ff --> IMMEDIATELY WHITE!! (woohoo!!)

00000000000000000000 --> OFF!!

00000000000f01ff0030 --> RED!

0000017001ff01000030 --> BLUE!

data word format

agGG????abBBarRRalLL

aX = activate sub component (value usually: "01")

R = red

G = green

B = blue

L = Brightness

? = unknown

https://developer.android.com/reference/android/bluetooth/BluetoothGattCharacteristic.html

characteristics

handle: 0x0002, char properties: 0x08, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb 0x2a00 org.bluetooth.characteristic.gap.device_name

handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb 0x2a01 org.bluetooth.characteristic.gap.appearance

handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb 0x2a04 org.bluetooth.characteristic.gap.peripheral_preferred_connection_parameters

handle: 0x0008, char properties: 0x02, char value handle: 0x0009, uuid: 00002a02-0000-1000-8000-00805f9b34fb 0x2a02 org.bluetooth.characteristic.gap.peripheral_privacy_flag

handle: 0x000a, char properties: 0x02, char value handle: 0x000b, uuid: 00002a03-0000-1000-8000-00805f9b34fb 0x2a03 org.bluetooth.characteristic.gap.reconnection_address

handle: 0x000d, char properties: 0x22, char value handle: 0x000e, uuid: 00002a05-0000-1000-8000-00805f9b34fb 0x2a05 org.bluetooth.characteristic.gatt.service_changed

handle: 0x0011, char properties: 0x02, char value handle: 0x0012, uuid: 00002a29-0000-1000-8000-00805f9b34fb 0x2a29 org.bluetooth.characteristic.manufacturer_name_string

handle: 0x0013, char properties: 0x02, char value handle: 0x0014, uuid: 00002a24-0000-1000-8000-00805f9b34fb 0x2a24 org.bluetooth.characteristic.model_number_string

handle: 0x0015, char properties: 0x02, char value handle: 0x0016, uuid: 00002a25-0000-1000-8000-00805f9b34fb 0x2a25 org.bluetooth.characteristic.serial_number_string

handle: 0x0017, char properties: 0x02, char value handle: 0x0018, uuid: 00002a27-0000-1000-8000-00805f9b34fb 0x2a27 org.bluetooth.characteristic.hardware_revision_string

handle: 0x0019, char properties: 0x02, char value handle: 0x001a, uuid: 00002a26-0000-1000-8000-00805f9b34fb 0x2a26 org.bluetooth.characteristic.firmware_revision_string

handle: 0x001b, char properties: 0x02, char value handle: 0x001c, uuid: 00002a28-0000-1000-8000-00805f9b34fb 0x2a28 org.bluetooth.characteristic.software_revision_string

handle: 0x001d, char properties: 0x02, char value handle: 0x001e, uuid: 00002a23-0000-1000-8000-00805f9b34fb 0x2a23 org.bluetooth.characteristic.system_id

handle: 0x001f, char properties: 0x02, char value handle: 0x0020, uuid: 00002a2a-0000-1000-8000-00805f9b34fb 0x2a2a org.bluetooth.characteristic.ieee_11073-20601_regulatory_certification_data_list

handle: 0x0021, char properties: 0x02, char value handle: 0x0022, uuid: 00002a50-0000-1000-8000-00805f9b34fb 0x2a50 org.bluetooth.characteristic.pnp_id

handle: 0x0024, char properties: 0x10, char value handle: 0x0025, uuid: 0000ee01-0000-1000-8000-00805f9b34fb

handle: 0x0027, char properties: 0x0c, char value handle: 0x0028, uuid: 0000ee02-0000-1000-8000-00805f9b34fb

handle: 0x0029, char properties: 0x0c, char value handle: 0x002a, uuid: 0000ee03-0000-1000-8000-00805f9b34fb

handle: 0x002b, char properties: 0x10, char value handle: 0x002c, uuid: 0000ee04-0000-1000-8000-00805f9b34fb

https://www.bluetooth.com/specifications/gatt/characteristics

I managed to figure these access details out relatively easily (~2 hours), without actually doing Bluetooth sniffing. If someone has a Bluetooth sniffing environment easily available, then it would be useful to gather potentially remaining additional commands sent by the XAVAX II app.

I'm currently working on a FHEM module, taking 74_XiaomiFlowerSens.pm as a reference. I will thus possibly use gattool interfacing (or perhaps interfacing to MQTT, but this would require an extra MQTT provider component), and Color.pm (FHEM's color picker wheel).

Legal disclaimer: no warranties - "if it breaks, then you get to keep both pieces." etc.pp.