Last week I visited thomasdotwtf from eventphone who has a jura coffee machine.
We took one evening to look into it, how easy it is, to use a generic BLE device like a raspberry pi to control it.
He has a Jura Z8 Automatic Coffee Machine which supports an IOS/Android app via Bluetooh LE.
Jura released (at least) two different apps to control it.
Both apps supports ordering, changing properties of a coffee (e.g. how much water do you want to have or how much coffee should be in
there?).
mkssystems.pl seems to went out-of-service, but the internet archive still have an old version
and they show a lot of coffee machine related products. As well as a small blue device [1].
This is the BlueFrog a bluetooth dongle to control Jura coffee machines.
What we found out?
The J.O.E. application is using XML files to be configured for the different coffee machines.
The XML defines products (e.g. a coffee, a green tea, ...), there are properties (e.g. how much coffee should be produced), statistics and
settings. The article number defines the XML file to be used.
A firmware process including the update urls and the new firmware.
We tried to find the same commands which should work on the RS232/serial in the bluetooth packet trace, but there wasn't any.
After looking further in the code, we found a lot UUIDs for characteristics including a human readable name.
We discovered also an "encryption" method which uses 2x hardcoded keys as well an additional input of 8 bit from the BLE advertisment.
The encryption look like a static key.
In the BLE advertisment, there are manufactoring data.
In our case, the manufactoring data contains 27 bytes. If 16 bit will be used, it's little endian.
manufactoring data as hex (27 byte):
aa 05 06 03 d73a yyyy xxxx 5836 4435 01 c0 00 00 00 00 00 00 00 00 00 00 00
aa: key
05: BlueFrog Major Version
06: BlueFrog Minor Version
03: unused (maybe Patch Version?)
d73a: article number (the specific type of the machine)
yyyy: machine number
xxxx: serial number
5836: production date (Feb. 2017)
4435: production date UHCI (does UHCI means the bluefrog?) (Okt. 2016)
01: unused
c0: bitmask, define supported features
The production dates can be decoded and also validated using the application where it's shown in the connection fragment:
days: (i & 31)
month: ((i & 480) >> 5)
year: ((i & 65024) >> 9) + 1990;
Bluetooth Interface
The good thing of BLE is, it's standarzied in the communication.
BLE uses Bluetooth Attribute Protocol to communicate.
The Bluetooth Attribute Protocol uses services and characteristics.
A service is an object which can hold multiple characteristics. A characteristic can support one or more of the following operations
read, write, notification, indication.
Every service has a UUID as well a characteristic has a UUID. The Bluetooth Attribute Protocol has it's own methods to discover avaiable
services and characterics. For more information please take a closer look into Bluetooth Low Energy.
As a general BLE device, the BlueFrog annouce itself on the BLE.
> hcitool lescan
LE Scan ...
C9:26:E8:4B:72:02 TT214H BlueFrog
> HCI Event: LE Meta Event (0x3e) plen 43 #8 [hci0] 8.466202
LE Advertising Report (0x02)
Num reports: 1
Event type: Scan response - SCAN_RSP (0x04)
Address type: Random (0x01)
Address: C9:26:E8:4B:72:02 (Static)
Data length: 31
Company: Ingenieur-Systemgruppe Zahn GmbH (171)
Data: aa050603d73a080402005836443501c00000000000000000000000
RSSI: -78 dBm (0xb2)
And further more we can also look for the services and characteristics via the gatttool.
> gatttool -b C9:26:E8:4B:72:02 --services -t random
attr handle = 0x0001, end grp handle = 0x0007 uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle = 0x0008, end grp handle = 0x0008 uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle = 0x0009, end grp handle = 0x0033 uuid: 5a401523-ab2e-2548-c435-08c300000710
attr handle = 0x0034, end grp handle = 0x003a uuid: 5a401623-ab2e-2548-c435-08c300000710
attr handle = 0x003b, end grp handle = 0xffff uuid: 00001530-1212-efde-1523-785feabcd123
> gatttool -b C9:26:E8:4B:72:02 --characteristics -t random
handle = 0x0002, char properties = 0x0a, char value handle = 0x0003, uuid = 00002a00-0000-1000-8000-00805f9b34fb
handle = 0x0004, char properties = 0x02, char value handle = 0x0005, uuid = 00002a01-0000-1000-8000-00805f9b34fb
handle = 0x0006, char properties = 0x02, char value handle = 0x0007, uuid = 00002a04-0000-1000-8000-00805f9b34fb
handle = 0x000a, char properties = 0x02, char value handle = 0x000b, uuid = 5a401524-ab2e-2548-c435-08c300000710
handle = 0x000d, char properties = 0x08, char value handle = 0x000e, uuid = 5a401525-ab2e-2548-c435-08c300000710
handle = 0x0010, char properties = 0x08, char value handle = 0x0011, uuid = 5a401529-ab2e-2548-c435-08c300000710
handle = 0x0013, char properties = 0x08, char value handle = 0x0014, uuid = 5a401528-ab2e-2548-c435-08c300000710
handle = 0x0016, char properties = 0x0a, char value handle = 0x0017, uuid = 5a401530-ab2e-2548-c435-08c300000710
handle = 0x0019, char properties = 0x02, char value handle = 0x001a, uuid = 5a401527-ab2e-2548-c435-08c300000710
handle = 0x001c, char properties = 0x02, char value handle = 0x001d, uuid = 5a401531-ab2e-2548-c435-08c300000710
handle = 0x001f, char properties = 0x0a, char value handle = 0x0020, uuid = 5a401532-ab2e-2548-c435-08c300000710
handle = 0x0022, char properties = 0x0a, char value handle = 0x0023, uuid = 5a401535-ab2e-2548-c435-08c300000710
handle = 0x0025, char properties = 0x0a, char value handle = 0x0026, uuid = 5a401533-ab2e-2548-c435-08c300000710
handle = 0x0028, char properties = 0x02, char value handle = 0x0029, uuid = 5a401534-ab2e-2548-c435-08c300000710
handle = 0x002b, char properties = 0x02, char value handle = 0x002c, uuid = 5a401536-ab2e-2548-c435-08c300000710
handle = 0x002e, char properties = 0x02, char value handle = 0x002f, uuid = 5a401537-ab2e-2548-c435-08c300000710
handle = 0x0031, char properties = 0x02, char value handle = 0x0032, uuid = 5a401538-ab2e-2548-c435-08c300000710
handle = 0x0035, char properties = 0x02, char value handle = 0x0036, uuid = 5a401624-ab2e-2548-c435-08c300000710
handle = 0x0038, char properties = 0x08, char value handle = 0x0039, uuid = 5a401625-ab2e-2548-c435-08c300000710
handle = 0x003c, char properties = 0x04, char value handle = 0x003d, uuid = 00001532-1212-efde-1523-785feabcd123
handle = 0x003e, char properties = 0x18, char value handle = 0x003f, uuid = 00001531-1212-efde-1523-785feabcd123