Sniffing a Bosch laser tape 2

[Dainius G]

Hi.

I`m trying to figure out a way I can control a Bosch GLM120C laser measure device using a micro controller.

I`m a stage where I can activate  the laser(1st command) and take a measurement(2nd command) using NRF connect app on my phone.

Service UUID: 2A6C0D0-0451-4000-B000-FB3210111989

Command I`m writing "c05601001e"  first time it activates the laser and 2nd time it takes a measurement. 

While the app from Bosch does get the distance value. I can`t seem to figure out what packet  the data is being sent back in, I`m using Wireshark and BLE sniffer(52 dongle).

https://www.dropbox.com/s/z97dv8qdbm8emja/514mm%282%29.pcapng?dl=0

Any input would be much appreciated. 

Thanks Guys.

[Sparkybert]

Hi Dainius G,

thank you for the information. JADX sounds interesting. I might have a look at it in the future.

I tried to suppress advertising packets of the GLM120C using drastic measures, but to no success.
Good luck with your micro controller application.

[run_ar]

Maybe you have enabled the "TrackMyTools" feature or something, which in case it would make sense to advertise while in "off" mode?

[Sparkybert]

Hi run_ar,

thank you very much for your hint. You were absolutely right.
I checked my original manual again, which mentions TrackMyTools (TMT) briefly. The manual only says that you can turn it on or off in the settings and that there is a dedicated app for it. That's pretty much it.

Anyway, I turned TMT off in the device settings and tested again and it actually stopped advertising when the device is turned off.

Thanks again.

[kosnick]

Hi Sparkybert,

I am trying to apply your info on a GLM50C. And it seems to be working. Almost.

At the moment I able to send the request and the laser turns on and gets a value. According to Dainius G. post ("send the bytes twice").

However, I do not get a response back (including the measured value), unless I connect the device to the official application first (I connect the device with the app, I disconnect it and there it is... ).

I have turned on the indications on the characteristic but there is no hex with the measurement value. The moment I connect the device to the official app (MeasureOn) and disconnect it (even without taking any measurement), I am able to receive hex with the correct value.

By the way, it is the same when using nRF connect (in case you are not familiar, an android app to sniff bluetooth, but i assume it's the same as nRF sniffer you mentioned on your post).

( this following section might be irrelavent, but in any case ....

I tried sniffing the bluetooth with my android phone, and one thing to mention that might help is that as soon as the indication flag is set on the characteristic:

the official app       sent write request, handle 0x001e with value c05502

the device              rcvd write respons, handle 0x001e              and then

the device              rcvd handle value indication, handle 0x001e with value 001000

the official app       sent handle value confiramation, handle 0x001e

)

Any help would be much appreciated.

Thanks.