title: Reverse engineering Bluetooth LE - device sends weird responses back
body: <p>I recently aquired a Segway Ninebot ES2 electric scooter. I can connect to the scooter via Bluetooth LE and grab information such as battery status, current mileage, temperature, and so on. This is all done through an <a href="https://play.google.com/store/apps/details?id=cn.ninebot.ninebot&amp;hl=en" rel="nofollow noreferrer">application</a>.</p>
  
  <p>On my Android device, I've successfully extraceted the HCI log file, which I imported into Wireshark. I can see all the requests and commands send back and forth between my phone and the scooter. However, the requests and responses are all garbage and I have no idea how to interpret them.</p>
  
  <p><strong>Example of a sent command</strong> (info says <code>Sent Write Command, Handle: 0x000e (Nordic UART Service: Nordic UART Tx)</code>)</p>
  
  <p><a href="https://i.stack.imgur.com/RcG4O.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RcG4O.png" alt="sent command"></a></p>
  
  <p><strong>Example of the received value I got right after</strong> (info says <code>Rcvd Handle Value Notification, Handle: 0x000b (Nordic UART Service: Nordic UART Rx)</code>)</p>
  
  <p><a href="https://i.stack.imgur.com/apwQv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/apwQv.png" alt="received"></a></p>
  
  <p>How am I supposed to interpret these responses? If the battery status was 59%, I would expect it to return something like <code>0x3b</code> (0x3b hex is 59 decimal). But honestly, I have no idea how this works. Maybe they're returning a bunch of data in a data type only their app knows how to interpret? Like JSON for web.</p>
  
  <p>Here's an example from the <a href="https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&amp;hl=en" rel="nofollow noreferrer">nRF Connect for Mobile</a> application, where I hit the down arrow on all the characteristics: <a href="https://i.imgur.com/hREDomP.jpg" rel="nofollow noreferrer">https://i.imgur.com/hREDomP.jpg</a> (large image)</p>
  
  <p>And probably more important: How do I replicate a request or command in nRF Connect? I've tried sending a byte array that looks like <code>0x {02410011000d.....}</code> (from the Write Command) in the application, but I have no idea how to read the response.</p>