Import data from Scubapro Aladin Sport Matrix

[Berthold Stoeger]

On Freitag, 20. Oktober 2017 12:58:15 CEST Linus Torvalds wrote:
> On Thu, Oct 19, 2017 at 5:51 PM, Berthold Stoeger
> 
> <bstoeger at mail.tuwien.ac.at> wrote:
> > Sorry, I confused dec 18 with hex 18. The second characteristic is notify
> > and read. This is clearly a read/write pair.
> 
> So that looks very regular, and the existing code in core/qt-ble.cpp
> should hopefully "just work" for the communication side.
> 
> The question is mainly what the protocol is. We have had cases where
> the bluetooth packets are literally just a direct translation of a
> previous serial line protocol, and then the serial emulation code
> should just work. But honestly, that's the exception rather than the
> rule. Usually there is some packetization and quoting layer, even if
> it might be trivial.
> 
> If you have an android phone that has a vendor appliction to download
> dives, you can try to generate a bluetooth snoop log. Google for
> "bluetooth snoop android" - you'll need to enable a developer option
> (and not every phone necessarily allows that) and then get the
> resulting log out of the phone (which can be another problem spot).
> And then maybe we can figure things out.

I only have a work-sponsored android phone, so I'd prefer not messing around 
with it too much. Therefore I approached it from a different angle and tried 
to simulate the dive computer by starting a GATT server. This was (and is) an 
incredibly painful experience. Ultimately I used "Gobbledegook" after the 
Bluez example server and everything speaking directly to the kernel sockets 
failed. All this DBUS/bluetoothd stuff is pure madness. Unfortunately LogTrak 
still doesn't accept my notifications, but at least I got a few commands.

The packets are usually(!) one byte length and then payload. Command is the 
first byte of the payload. The rest (if any) seems to be parameters.

Fetch newest dives does (I: to divecomputer O: from divecomputer)
I: 09c69a32b94210270000
O: 0400000000

Fetch all dives does:
I: 09c60000000010270000
O: 04f05e0000

If LogTrack doesn't get a response for a few seconds, it ends the session 
with:
 I: 0114
O: 046666c103

I tried all commands without parameters and list those with a response at the 
end of the message. The interesting one is c6: it dumps lots of binary data. 
After a certain point it produces only '0'. I stopped after 5 min and >100K of 
largely 0. I guess this is some debugging command. Another funny one is around 
ca. e0: it makes the computer beep. I'm a bit anxious of hitting a "write 
firmware" command.

So does this ring a bell or should I try to investigate further?

Thank you,

Berthold

Command: 0110
Output : 0117
Command: 0111
Output : 0100
Command: 0112
Output : 0146
Command: 0113
Output : 0115
Command: 0114 {good bye?}
Output : 046666c103
Command: 0115
Output : 0453a251a0
Command: 0116
Output : 1000000000000000000000000000000000
Command: 0117
Output : 0400000000
Command: 0118
Output : 0472040000
Command: 0119
Output : 021400
Command: 011a
Output : 041c030000
Command: 011b
Output : 0100
Command: 011c
Output : 0100
Command: 011d
Output : 0100
Command: 0130
Output : 024006
Command: 0131
Output : 020000
Command: 0132
Output : 0100
Command: 0133
Output : 0100
Command: 0134
Output : 02ffff
Command: 0137
Output : 020410
Command: 0138
Output : 010a
Command: 0139
Output : 029a00
Command: 013a
Output : 020600
Command: 013b
Output : 020f00
Command: 013c
Output : 020000
Command: 013d
Output : 02660a
Command: 013e
Output : 020000
Command: 013f
Output : 020000
Command: 0140
Output : 0103
Command: 0141
Output : 0100
Command: 0143
Output : 024006
Command: 0144
Output : 024006
Command: 0145
Output : 0103
Command: 0146
Output : 0115
Command: 0147
Output : 0100
Command: 0148
Output : 0100
Command: 0149
Output : 020000
Command: 014a
Output : 020000
Command: 014b
Output : 020000
Command: 0170
Output : 020000
Command: 0171
Output : 020000
Command: 0172
Output : 020000
Command: 0173
Output : 020000
Command: 0174
Output : 0100
Command: 0175
Output : 020000
Command: 0176
Output : 020000
Command: 0177
Output : 020000
Command: 0178
Output : 020000
Command: 0179
Output : 020000
Command: 017a
Output : 020000
Command: 017b
Output : 020000
Command: 017c
Output : 020000
Command: 017d
Output : 020000
Command: 017e
Output : 020000
Command: 017f
Output : 020000
Command: 0180
Output : 020000
Command: 0181
Output : 020000
Command: 0182
Output : 020000
Command: 0183
Output : 020000
Command: 0184
Output : 020000
Command: 0185
Output : 020000
Command: 0186
Output : 02e038
Command: 0187
Output : 029919
Command: 0188
Output : 020000
Command: 0189
Output : 020000
Command: 018a
Output : 020000
Command: 018b
Output : 0100
Command: 018c
Output : 0100
Command: 01c1
Output : 0400000000
Command: 01c3 { this one is strange!}
Output : 29000000000000000483c508a005410924854109
Output : 14a005c1082405c10824a34509e000000e909498
Output : 27909600
Command: 01c4
Output : 0400000000
Command: 01c6 {new dives command?}
Output : 0400000000
Command: 01c7
Output : 0404000200
Output : {>100 K of Binary stuff, mostly 0 }
Command: 01f0
Output : 02f400
Command: 01f1
Output : 02f603
Command: 01f2
Output : 02f400
Command: 01f3
Output : 02ffff
Command: 01f4
Output : 0100
Command: 01f5
Output : 041f1ca81d
Command: 01f6
Output : 0400000000
Command: 01f7
Output : 02ffff
Command: 01f8
Output : 0100