Hi @Cplant Unfortunately I am dealing with other life issues currently and wont be free to look at something like this for a good few months… not wanting to put my life story on the internet you can look here at another one of my projects for an explanation https://github.com/erew123/alltalk_tts/issues/377 Im sure you will understand once you read that.
Though, here is a bit more info I have knocked together with AI if you want to give it a shot…
Will Bluetooth HID commands work? (Probably not)
For Bluetooth HID (Human Interface Device) remotes, there is indeed a standardized power button code, but it’s important to understand a few key points:
- The standard HID Usage Code for Power is 0x66 (defined in the USB HID Usage Tables)
- However, just sending this code alone won’t work - it needs to be properly formatted in a HID report
Here’s a typical HID report format for a power button press:
power_command = [
0xA1, # Report type (input)
0x01, # Report ID (usually 1 for consumer controls)
0x66, # Power button usage code
0x00 # Release button
]
However, I should note that:
- Modern Google TVs and many smart TVs often don’t use the standard HID protocol - they frequently use proprietary BLE services and characteristics
- Even if using standard HID, the TV needs to be already paired and connected to accept commands
- Some manufacturers implement additional security measures or custom protocols on top of the standard HID
The most reliable way to know the exact command would be to:
- Get your TV’s Bluetooth MAC address
- Look up your specific TV model’s Bluetooth services using a BLE scanner
- Capture the actual command from an original remote
If you want to try the generic HID power command anyway, you’d need to:
- Ensure your TV is actually using HID protocol (rather than a proprietary protocol)
- Have already completed the pairing process
- Send the command to the HID service characteristic (UUID: 0x2A4D)
Unfortunately, given how modern smart TVs handle their remotes, the generic HID power command has a relatively low chance of working without additional device-specific implementation details.
Potential hardware for capturing Bluetooth Low Energy (BLE) Commands
Yes, there are several alternatives to the Ubertooth One for Bluetooth sniffing. Here are the main options:
-
Nordic nRF52840-based devices ($10-30):
- Makerdiary nRF52840 MDK USB Dongle
- Adafruit nRF52840 Dongle
- Generic nRF52840 dongles from AliExpress
These are much cheaper but have more limited range and capabilities.
-
ESP32 Development Boards ($5-15):
- While not as powerful for sniffing, they can be used with the ESP-IDF Bluetooth stack
- Look for boards with external antennas for better reception
-
HackRF One ($300+):
- More expensive than Ubertooth One
- Much more versatile but more complex to use
- Can handle many protocols beyond just Bluetooth
-
Bluetooth Development Kits:
- Texas Instruments CC2540 ($50-100)
- Silicon Labs BG22 Explorer Kit ($40-50)
If you’re specifically looking for something similar to Ubertooth One but cheaper, I’d recommend:
-
Preferred budget option: Any nRF52840-based board with an external antenna
- Look for ones using the genuine Nordic nRF52840 chipset
- Should cost around $20-30
- Will work with standard Nordic tools
-
Best value alternative: Cypress CYW20819 or CYW20820 evaluation kits
- Usually around $50-75
- Good Bluetooth sniffing capabilities
- Official development support
I should mention that if you do find extremely cheap “Ubertooth One clones” (under $50) on sites like AliExpress or similar, they’re often not functional for actual Bluetooth sniffing - they may be missing crucial components or using incompatible chipsets.
Capturing BLE commands (2x Methods)
Required Equipment
Hardware
- Ubertooth One ($120-150 USD) OR Nordic nRF52840 dongle ($30 USD)
- USB extension cable (optional but recommended for better positioning)
- The original remote control
- The Google TV that’s being controlled
- A computer running Linux (Ubuntu 20.04 or later recommended)
- Windows can work but requires additional setup steps not covered here
- Could always boot linux from a USB stick if you dont have Linux installed
Software
- Wireshark (latest version)
- Ubertooth tools (if using Ubertooth One)
- Nordic Semiconductor nRF Connect (if using nRF52840)
- Python 3.8 or later
Part 1: Setting Up the Capture Environment
Installing Required Software (Ubuntu)
# Update system
sudo apt update && sudo apt upgrade -y
# Install Wireshark
sudo apt install wireshark
sudo usermod -a -G wireshark $USER
# Install Ubertooth tools (if using Ubertooth One)
sudo apt install cmake libusb-1.0-0-dev make gcc g++ libbluetooth-dev \
pkg-config libpcap-dev python3-numpy python3-qtpy python3-distutils
sudo apt install ubertooth
# Install Python requirements
sudo apt install python3-pip
pip3 install pyubertooth pybluez bluepy
Configuring Wireshark
- Launch Wireshark
- Go to Edit → Preferences → Protocols → Bluetooth
- Enable “Try to decode BREDR as BLE”
- Enable “Analyze BR/EDR packets in LE tab”
- Click “OK”
Part 2: Capturing the Bluetooth Traffic
Method 1: Using Ubertooth One
- Connect the Ubertooth One to your computer
- Open terminal and verify connection:
ubertooth-util -v
-
Start Wireshark and configure:
- Click the gear icon next to “Ubertooth One”
- Enable promiscuous mode
- Set channel to “Auto-detect”
-
Start capture:
ubertooth-btle -f -c bluetooth.pcap
- In a separate terminal, start Wireshark:
wireshark -k -i bluetooth.pcap
- Capture the power-on sequence:
- Press the power button on your remote 3-4 times
- Wait 5 seconds between each press
- Make sure the TV responds each time
Method 2: Using nRF52840
- Install nRF Connect for Desktop
- Launch nRF Connect
- Select “Bluetooth Low Energy” monitor
- Click “Start scan”
- Press the remote’s power button several times
- Look for packets that appear when the button is pressed
Part 3: Analyzing the Captured Data
Identifying Relevant Packets
- In Wireshark, apply the following display filter:
btatt or btle
- Look for patterns that occur when the power button is pressed:
- Note packets that appear consistently with each button press
- Record the following for each relevant packet:
- Source MAC address
- Destination MAC address
- Service UUID (if present)
- Characteristic UUID (if present)
- Data payload (hexadecimal)
Creating a Command Profile
Create a text file named remote_profile.txt with the following information:
TV MAC Address: XX:XX:XX:XX:XX:XX
Remote MAC Address: YY:YY:YY:YY:YY:YY
Service UUID: XXXX
Characteristic UUID: YYYY
Command Payload: [captured hex data]
Part 4: Replicating the Command
Python Script for Command Replication
import asyncio
from bleak import BleakClient
import sys
# Configuration
TV_MAC_ADDRESS = "XX:XX:XX:XX:XX:XX" # Replace with your TV's MAC
CHARACTERISTIC_UUID = "YYYY" # Replace with captured characteristic UUID
COMMAND_PAYLOAD = bytes.fromhex("ZZZZ") # Replace with captured payload
async def send_power_command():
try:
# Connect to TV
async with BleakClient(TV_MAC_ADDRESS) as client:
print(f"Connected: {client.is_connected}")
# Send command
await client.write_gatt_char(CHARACTERISTIC_UUID, COMMAND_PAYLOAD)
print("Command sent successfully")
# Wait for confirmation
await asyncio.sleep(1)
except Exception as e:
print(f"Error: {str(e)}")
# Run the command
asyncio.run(send_power_command())
Testing the Replication
- Save the script as
send_power.py
- Update the script with your captured values
- Run the script:
python3 send_power.py
Part 5: Troubleshooting
Common Issues and Solutions
-
No Packets Captured
- Verify Ubertooth/nRF device is properly connected
- Try repositioning the capture device closer to the remote
- Ensure remote has working batteries
- Try pressing other buttons to verify capture is working
-
TV Doesn’t Respond to Replicated Command
- Double-check all MAC addresses and UUIDs
- Verify payload data is exact
- Try adding small delays between connection and command
- Check if remote uses rolling codes (payload changes with each press)
-
Permission Issues
sudo setcap 'cap_net_raw,cap_net_admin+eip' `which python3`
sudo setcap 'cap_net_raw,cap_net_admin+eip' `which hcitool`
Security Notes
- This process is for educational purposes and personal use only
- Some TVs may use encrypted communications
- Verify you own all devices involved
- Do not attempt to capture other devices’ traffic
Additional Resources
„Switching off“ works fine though.