Reverse Engineering the GARLYN Bodyscan Master BLE Protocol
Developers looking to integrate with smart devices often face the challenge of proprietary communication protocols. This article details the reverse engineering process of the Bluetooth Low Energy (BLE) protocol used by the GARLYN Bodyscan Master scale, specifically focusing on its IF_B8B firmware. The goal was to build an Android application capable of connecting, initializing, and receiving body composition data, including weight and more granular metrics.
Understanding BLE Topology and GATT Operations
The communication between the Android device and the body scale relies on the standard BLE topology. Key to this interaction is the Generic Attribute Profile (GATT), which organizes data into services and characteristics. The article distinguishes between two critical GATT operations: Notify and Indicate. Notifications are unidirectional pushes of data from the peripheral (scale) to the central (phone) upon characteristic value changes. Indications, on the other hand, are similar to notifications but require an acknowledgment from the central device, confirming receipt. This acknowledgment mechanism is crucial for reliable data transfer, especially for sensitive body composition readings.
Serializing GATT operations is essential for managing the asynchronous nature of BLE communication. Performing multiple GATT read/write operations concurrently can lead to unpredictable behavior or connection drops. The author emphasizes the need to queue these operations sequentially to ensure each command is processed before the next is sent. This structured approach prevents race conditions and maintains a stable connection.
The Initialization Handshake
Before any meaningful data can be exchanged, the scale and the Android device must complete an initialization handshake. This process typically involves a series of GATT writes and reads to establish a secure and recognized communication channel. The specific sequence observed for the IF_B8B protocol includes writing specific byte sequences to certain characteristics. For instance, writing `0x01` to characteristic `0x2A37` (often associated with Heart Rate Measurement, but here repurposed) and then reading from characteristic `0x2A38` (Heart Rate Control Point) appears to be part of the setup. This handshake is critical; without it, the scale will not transmit any data, including weight readings.
Parsing Weight and Body Composition Packets
Once the handshake is complete, the scale begins transmitting data. The primary weight reading is usually transmitted as a standard GATT notification. The raw data often requires a simple conversion, typically involving a scaling factor to convert from grams or a similar unit to kilograms or pounds. However, the more complex body composition data—such as body fat percentage, muscle mass, and water content—is not sent as single values. Instead, it is transmitted in fragmented packets. These packets are often larger than the maximum transmission unit (MTU) for BLE characteristics, necessitating fragmentation and reassembly.
The scale sends these body composition metrics in chunks, often indicating the total size of the data and the current chunk number. The Android application must capture these fragmented notifications, buffer them, and then reassemble them into the complete body composition data payload. Once reassembled, this payload can be further parsed to extract individual metrics. The author's analysis suggests a specific structure for these BIA (Bioelectrical Impedance Analysis) packets, allowing for reconstruction and interpretation of the detailed body composition results.
Android Architecture and Implementation
The Android application architecture is designed to manage the BLE connection lifecycle, handle GATT operations, and process incoming data. This involves using Android's `BluetoothGatt` API to connect to the scale, discover services and characteristics, and subscribe to notifications. The core logic resides in managing the state of the connection, performing the handshake, and implementing the fragmentation and reassembly logic for BIA packets. A dedicated parser then decodes the reassembled byte array into human-readable body composition data.
The source code, available on GitHub, provides a concrete implementation of these principles. It demonstrates how to configure the GATT client, handle callbacks for `onConnectionStateChange` and `onCharacteristicChanged`, and manage the asynchronous GATT operations. The library handles the complexities of BLE communication, allowing developers to focus on the specific protocol nuances of the scale.
Testing and Validation
Testing involved verifying the connection stability, the accuracy of the handshake, and the correctness of the parsed data against the scale's native mobile application. The author confirmed that the reconstructed body composition data aligns with what the official app displays, validating the reverse engineering effort. The findings are presented with a confidence summary, separating observed behaviors from assumptions that might vary across different firmware versions of the IF_B8B protocol.