Goodnature is a New Zealand based manufacturer of humane traps. Their model A24 trap targets Rat & Stoats. The device is triggered when a pest brushes past an activation pin. This causes the striker to activate instantly using the power of a small, replacable CO2 gas canister.
The device is also available with an optional visual counter or a Bluetooth Low Energy (BLE) enabled device and companion app, named Chirp. This gist aims to document some of the more technical details of the Goodnature A24 Chirp device (such as the BLE Services and Characteristics) which are not immediately clear from the support website.
- The app requires "Always"-On location permission to detect when the user is near the trap. When near the trap, the app will then listen for BLE beacons from the Chirp.
- Only one device using the app can connect to the Chirp at any time. When the device disconnects from the Chirp, it goes back to "sleep" again and must be "woken".
- Because the Chirp does not have Wi-Fi or Cellular, this can make notifications unreliable as you need to be within proximity of the Chirp (Bluetooth range) to receive them.
The Chirp device seems to have an unregistered MAC Address prefix of D7:AC:E9.
The Bluetooth chip in the Chirp appears to be from Nordic, as BLE services for Nordic firmware updates are present.
There appears to be a 23 second cooldown between activations (persumably to save battery life).
Pest enters the A24 chamber and brushes past the activation pin:
- A24 strike activates
- Chirp is shaken by the strike activation
- Chirp transmits BLE advertisement with name "GN"
- App listens for BLE advertisements from Chirp
- App receives BLE advertisement from Chirp
- App interrogates Chirp BLE Services for kill information
I suspect that the Chirp transmits periodically following a strike as a yellow light flashes, but have not seen evidence of the BLE activating afterwards.
From checking, it appears that the slide to refresh in the app does not do anything, as the Chirp does not appear to have a way to "wake" manually as it is a "sleepy" device.
Tilt the Chirp device so it is facing upside down:
- A red light begins to flash.
- If the red light does not show, shake it.
- If the red light still does not show, wait 30 seconds & shake again.
Chirp transmits BLE advertisement with name "GN":
- App listens for BLE advertisements from Chirp
- App receives BLE advertisement from Chirp
- App interrogates Chirp BLE Services for kill information
There are quite a number of Services & Characteristics, however I have only managed to work out a few of these.
Kill information (Service)
Unknown - usually empty May be test strike related, but is writable.
Kill information (Characteristic) - string
AAbbbbbbbbCdddEEEEEEEfGG
- A Unknown value (61 77 92 b3) - changes
- b Serial number (XXYYZZ00) - values are reversed from right to left in groups of two, i.e. a serial number of ABCDEF00 would show as 00EFCDAB
- C Unknown value (1) - static
- d Unknown value (a87 bb4 cd1 c1f) - changes
- E Unknown value (bda3010) - static
- f Kill count (1 3 4 6) - does not reset in BLE when reset in the app, i.e. you need to deduct from the kill count when it is reset. I am not sure what happens when the kill count goes over 10, as I have not activated it this many times. It is possible that the value moves left or right.
- G Unknown value (00) - static (may be used for Kill count but have not confirmed this)
Unknown - usually 0
Unknown - usually empty. Seems to be serial number related.
Device information service
Serial number characteristic - string
Unknown - usually 2 Seems to be Test strike related in that the value may be able to be 0 or 2. It's usually 2. Perhaps you write to value 0, then it goes back to 2 once struck? Or maybe 5?
Unknown - usually 2
Unknown - usually empty. May be related to (value) / 255 * 100
Unknown - usually 0
Unknown service
Unknown - usually empty (writeable)
Unknown - usually empty
Unknown - usually empty
Time service
Time characteristic (writable) - string in hex with Little Endian encoding
Current time in milliseconds is 1650500007224 as at 21-Apr-2022 00:13:27 UTC (source: https://currentmillis.com). Therefore 1650500007224 / 60000 is 27508333.4537 rounded to 27508333 which would be 6dbea301 in hex (source: https://www.save-editor.com/tools/wse_hex.html).
- a2bda301 27508130
- babda301 27508154
- f1bda301 27508209
- f6bda301 27508214
- 00bea301 27508224
Unknown service
Unknown - usually 234
Unknown - usuallly 0. Seems it may have been serial number related.
I can confirm the "gn" device is the A24 device. Mine has a MAC-address of CC:53:AE:FD:AA:94 so it doesn't start with the MAC prefix mentioneed in the protocol description