• thanks to Raspberry PI Bluetooth implementation I was able to sniff around my Puck and another device that sends the Home button correctly :

    bluetoothctl of my Puck
    > info F5:BB:1E:D3:CB:34
    Device F5:BB:1E:D3:CB:34
    	Name: Puck.js cb34
    	Alias: Puck.js cb34
    	Paired: yes
    	Trusted: no
    	Blocked: no
    	Connected: yes
    	LegacyPairing: no
    	UUID: Generic Access Profile    (00001800-0000-1000-8000-00805f9b34fb)
    	UUID: Generic Attribute Profile (00001801-0000-1000-8000-00805f9b34fb)
    	UUID: Human Interface Device    (00001812-0000-1000-8000-00805f9b34fb)
    	UUID: Nordic UART Service       (6e400001-b5a3-f393-e0a9-e50e24dcca9e)
    
    from command line get the report descriptor
    > cat /sys/kernel/debug/hid/0005\:0000\:0000.000F/rdesc
    05 0c 09 01 a1 01 85 00 15 00 26 80 03 19 00 2a 80 03 75 10 95 01 81 00 c0
    
    btmon sniffing the press of my Puck
    > ACL Data RX: Handle 64 flags 0x02 dlen 9                                                 
          ATT: Handle Value Notification (0x1b) len 4
            Handle: 0x0015
              Data: 2302
    > ACL Data RX: Handle 64 flags 0x02 dlen 9                                                 
          ATT: Handle Value Notification (0x1b) len 4
            Handle: 0x0015
              Data: 0000
    
    // my code with the report taken from the other device
    var report = new Uint8Array([
    0x05, 0x0C,        // Usage Page (Consumer)
    0x09, 0x01,        // Usage (Consumer Control)
    0xA1, 0x01,        // Collection (Application)
    0x15, 0x00,        //   Logical Minimum (0)
    0x26, 0x80, 0x03,  //   Logical Maximum (896)
    0x19, 0x00,        //   Usage Minimum (Unassigned)
    0x2A, 0x80, 0x03,  //   Usage Maximum (0x0380)
    0x75, 0x10,        //   Report Size (16)
    0x95, 0x01,        //   Report Count (1)
    0x81, 0x00,        //   Input (Data,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
    0xC0,              // End Collection
    // 25 bytes
    ]);
    
    NRF.setServices(undefined, {
     hid : report
    });
    
    NRF.on('connect', function(addr) {
      digitalPulse(LED3, 1, 1000);
    });
    
    NRF.on('disconnect', function(addr) {
      digitalWrite(LED3, 0);
    });
    
    function p(c,cb) {
      NRF.sendHIDReport(c, function() {
        setTimeout(function(){
          NRF.sendHIDReport([0,0], cb);
        },500);
      });
    }
    
    setWatch(function(){
      try{
        digitalPulse(LED1, 1, 50);
        p([0x23, 0x02],function(){print('done');});
      } catch (e) {
        print(e);
        digitalPulse(LED3, 1, [50,50,50,50,50]);
      }
    }, BTN, {edge:"rising",repeat:true, debounce:50});
    

    **and the sniff of the other device that works **

    > ACL Data RX: Handle 12 flags 0x02 dlen 8                                                 
          Channel: 65 len 4 [PSM 0 mode 0] {chan 0}
            a1 03 23 02                                      ..#.
    > ACL Data RX: Handle 12 flags 0x02 dlen 8                                                 
          Channel: 65 len 4 [PSM 0 mode 0] {chan 0}
            a1 03 00 00                                      ....
    

    I tried with the ble_hid_controls.js module and it works on iPhone (almost same btmon trace but just 1 byte sent instead of 2).

About

Avatar for tbd @tbd started