Hi fellow ilumi users!
… and for those who haven’t heard of ilumi yet: They successfully ran several kickstarter campaigns some years ago promoting hub-less bluetooth lights. So everything runs using their app, which makes the installation easy initially but integrating them in a smart home becomes difficult. Of course, the latter is exactly what I would like to do.
2.5 years ago, there was a post on element14.com https://www.element14.com/community/community/design-challenges/pi-iot/blog/2016/08/08/pi-iot-smarter-spaces-4-remote-horse-feeder-system , which even covers the integration in openhab. I found another post on reverse engeneering bluetooth lights in general https://medium.com/@urish/reverse-engineering-a-bluetooth-lightbulb-56580fcb7546 , but this addresses bulbs which are controlled by connecting to them. The ilumi bulbs appear to work differently.
I am using A19 bulbs and installed bluez-5.50 on the raspberry pi running openhab.
I basically found the same bluetooth characteristics as on the br30:
handle: 0x0002, char properties: 0x0a, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x0009, char properties: 0x20, char value handle: 0x000a, uuid: 00002a05-0000-1000-8000-00805f9b34fb
handle: 0x000d, char properties: 0x02, char value handle: 0x000e, uuid: 00002a29-0000-1000-8000-00805f9b34fb
handle: 0x000f, char properties: 0x02, char value handle: 0x0010, uuid: 00002a24-0000-1000-8000-00805f9b34fb
handle: 0x0011, char properties: 0x02, char value handle: 0x0012, uuid: 00002a27-0000-1000-8000-00805f9b34fb
handle: 0x0013, char properties: 0x02, char value handle: 0x0014, uuid: 00002a26-0000-1000-8000-00805f9b34fb
handle: 0x0015, char properties: 0x02, char value handle: 0x0016, uuid: 00002a28-0000-1000-8000-00805f9b34fb
handle: 0x0018, char properties: 0x1e, char value handle: 0x0019, uuid: f000f0c1-0451-4000-b000-000000000000
When the ilumi is not active, the handle “0x0019” is writable:
sudo gatttool -i hci0 -b E6:9E:C6:B8:B0:22 --char-write-req --handle=0x0019 --value=3235352c302c302c3130302c2c2c2c2c2c2c
but it has no effect.
I also tried to write to the bulbs when they are not “paired” with the app, without any effect either.
Using the app on my phone and wireshark on my PC, I tried to figure out the communication via snooping. I found the bulb’s “LE Advertising Report”, but there are no other events with the bulb’s bluetooth address and no “write characteristic value” commands. There are however quite a few packages being exchanged between the host and a controller using an unkown opcode 0xfd57, which apparently refers to opcode group field: vendor-specific command 0x3f and a opcode command field 0x157.
Well, I am new to openhab and bluetooth snooping, so please take this with a grain of salt, but it would be a shame to have these (actually nice) bulbs just lying around. Has anyone else tried to control ilumi bulbs without using the app? Also more general suggestions are very appreciated as well.
Thanks and best wishes