Now that I can finally use LEGO Education WeDo 2.0 app let’s use my latest crazy aquisition: the Ubertooth One (an open source Bluetooth sniffer).
I used a simple project to change the WeDo 2.0 Hub color to ‘pink’ (‘1’) each time I click the ‘Play’ block:
After capturing a few packets I selected just the interesting part:
1 0.000000000 LE LL 33 Empty PDU 2 0.037564000 ATT 44 UnknownDirection Write Command, Handle: 0x003d 3 0.074999800 LE LL 33 Empty PDU 4 0.187500200 LE LL 33 Empty PDU 5 0.225000800 LE LL 33 Empty PDU 6 0.262503000 LE LL 33 Empty PDU 7 0.262732400 LE LL 33 Empty PDU 8 0.375069400 ATT 44 UnknownDirection Write Command, Handle: 0x003d 9 0.412505800 LE LL 33 Empty PDU
Most frames are empty but 2 frames (‘2’ and ‘8’) show some writing to the 0x003d handle (the same handle that is used to control the motors). Let’s inspect those frames:
Frame 2: 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface 0 PPI version 0, 24 bytes DLT: 147, Payload: btle (Bluetooth Low Energy Link Layer) Bluetooth Low Energy Link Layer Bluetooth L2CAP Protocol Bluetooth Attribute Protocol Opcode: Write Command (0x52) 0... .... = Authentication Signature: False .1.. .... = Command: True ..01 0010 = Method: Write Request (0x12) Handle: 0x003d Value: 06040101
Frame 8: 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface 0 PPI version 0, 24 bytes DLT: 147, Payload: btle (Bluetooth Low Energy Link Layer) Bluetooth Low Energy Link Layer Bluetooth L2CAP Protocol Bluetooth Attribute Protocol Opcode: Write Command (0x52) 0... .... = Authentication Signature: False .1.. .... = Command: True ..01 0010 = Method: Write Request (0x12) Handle: 0x003d Value: 06040103
So the App is writing “06040101” to the handle and then “06040103”.
I already know something about this handler from the motor control examples I found before:
- first byte is the “port” identifier (’01’ and ’02’ are the physical plugs to connect motors or sensors so ’06’ is the LED port)
- second byte is the command sent to the port so ’04’ means “change color”
- third byte is the length of the arguments of the command so ’01’ means that the color is just one byte length – the fourth
So ’01’ and ’03’ must be some colors right? And I already know that ‘1’ in the App means ‘red’ so probably “06040101” means “change color to pink” and “06040103” means “change color to blue” (blue is the color of the WeDo Hub while waiting for commands).
So let’s test it with gatttool:
char-write-cmd 3d 06040101
Yes! It turns red indeed!
After testing other values I got these 11 values:
00 off 01 pink 02 purple 03 blue 04 cyan 05 light green 06 green 07 yellow 08 orange 09 red 0A light blue
(the real color labels may differ as I’m not very good with colors)
Now a small python script to cycle through all those colors:
#!/usr/bin/python
from gattlib import GATTRequester
from time import sleep
colors = ['\x00','\x01','\x02','\x03','\x04','\x05','\x06','\x07','\x08','\x09','\x0A']
req = GATTRequester("A0:E6:F8:1E:58:57",True,"hci0")
while True:
for color in colors:
req.write_by_handle(0x3d, "\x06\x04\x01" + color)
sleep(2)
And, of course, the video: