Skip to content

Instantly share code, notes, and snippets.

@pwnall
Created January 29, 2017 11:38
Show Gist options
  • Save pwnall/4ec3cc3d18affa062dd5596f1b4308c9 to your computer and use it in GitHub Desktop.
Save pwnall/4ec3cc3d18affa062dd5596f1b4308c9 to your computer and use it in GitHub Desktop.
Yunmai smart scale (M1301, M1302, M1303) Bluetooth LE protocol notes
Yunmai smart scale (M1301, M1302, M1303) Bluetooth LE protocol notes
Commands are written to GATT attribute 0xffe9 of service 0xffe5. Responses come
as value change notifications for GATT attribute 0xffe4 of service 0xffe0. These
are 16-bit Bluetooth LE UUIDs, so nnnn is 0000nnnn-0000-1000-8000-00805F9B34FB.
-----
Packet Structure
0d - packet start
1e - scale software version (only in responses)
nn - total packet length (includes packet start and CHK)
nn - command / response opcode
data
CHK - XOR of all bytes except for frame start
Example command: 0d 05 13 00 16
Example response: 0d 1e 05 05 1e
-------
Response
BE = big endian (most numbers are big endian)
LE = little endian (the weight stored in a profile is little endian)
00: 0d - packet start
01: 1e - scale software version
02: total packet length (includes packet start and CHK)
03: response type
03: 01 - unfinished weighing
04-07: date (unix time, seconds) - BE uint32
08-09: weight - BE uint16 times 0.01
10: CHK
03: 02 - finished weighing
04: 00 - historical info
05-08: date (unix time, seconds) - BE uint32
09-12: recognized userID - BE uint32
13-14: weight - BE uint16 times 0.01
15-16: resistance - BE uint 16
17-18: fat percentage - BE uint16 times 0.01
19: CHK
03: 06 - result to user operation
04: operation type - USER_ADD_OR_UPDATE: 1 | USER_ADD_OR_QUERY: 3 | USER_DELETE: 2
05-08: userID - 4 bytes, BE
09: height - in cm
10: sex - 1 for male
11: age - in years
12: waist line - default 85 (0x55)
13: bust - default 90 (0x5a)
14-15: basisWeight - default 0, set to previously received weight - LE uint16 times 0.01
16: display unit - 1 metric
03: 17 - device time
04-07:
08: CHK
-----
Command
00: 0d - packet start
01: total packet length (includes packet start and CHK)
02: command
02: 11 - set time
03-07: date (unix time, seconds) - BE uint32
08: fractional second
09: CHK
02: 17 - read time
03: CHK
02: 10 - user operation
03: operation type - USER_ADD_OR_UPDATE: 1 | USER_ADD_OR_QUERY: 3 | USER_DELETE: 2
04-07: userID - 4 bytes, BE
08: height - in cm
09: sex - 1 for male, 2 for female
10: age - in years
11: waist line - default 85 (0x55)
12: bust - default 90 (0x5a)
13-14: basisWeight - default 0, set to previously received weight
15: display unit - 1 for metric, 2 for imperial
16: body type - always 3
17: CHK
@pwnall
Copy link
Author

pwnall commented Jun 3, 2020

@vitoresende I stopped working with that scale a while back, so I don't know anything past this gist.

The most active effort I'm aware of is at oliexdev/openScale#71

@vitoresende
Copy link

Hi @pwnall, thanks for your answer. In fact I've found my error, the error was on the command I sent to the scale. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment