-
-
Save marcust/af93ff47899583f5a52f to your computer and use it in GitHub Desktop.
#!/bin/sh | |
set -ue | |
HANDLE=0x0003 | |
VALUE=4480ebedc17401 | |
MAC=88:C6:26:1E:F5:38 | |
gatttool -b $MAC --char-write-req --handle=$HANDLE --value=$VALUE |
Hello,
Same issue for me, so I can't read the value's handle (<char-read-hnd 0x0003> return "Characteristic value/descriptor read failed: Attribute can't be read")
Tested on RPi 3 with UE MegaBoom
Thanks
Guys, it turns out that "VALUE" is your phone or computer mac address + "01" at the end.
So. in the example above 88:C6:26:1E:F5:38 is "UE Boom" MAC.
"VALUE=4480ebedc17401" is 44:80:eb:ed:c1:74+01. "44:80:eb:ed:c1:74" is the device that connects to UE Boom
Haven't tried it with gattool on linux. Works with UWP program written with C# on Windows.
string laptopMAC = "10:08:b1:a9:35:8a";
ulong bluetoothAddressUeBoom = 211280405159803;
var magicBytes = new byte[7];
byte[] arr = laptopMAC.Split(':').Select(x => Convert.ToByte(x, 16)).ToArray();
Array.Copy(arr, magicBytes, 6);
magicBytes[6] = 1;
var ueBoom = await BluetoothLEDevice.FromBluetoothAddressAsync(bluetoothAddressUeBoom);
var gatt = await ueBoom.GetGattServicesAsync();
var characteristic = await gatt.Services[0].GetCharacteristicsAsync();
var characteristics = characteristic.Characteristics;
var writer = new DataWriter();
writer.WriteBytes(magicBytes);
var result = await characteristics[0].WriteValueWithResultAsync(writer.DetachBuffer(), GattWriteOption.WriteWithResponse);
Thanks for this! The script worked for my UE Roll 2, except that the device's MAC address needs to be changed to C0:28:8D:00:2A:A8
. Does anyone know how to remotely turn off the device in a similar fashion?
I spent some time analyzing the Bluetooth packets sent between the UE Roll app on an Android phone and the UE Roll using Wireshark, and I figured it out! Turning off the device isn't done via the GATT Profile. Instead, I found that it's done via the Serial Port Profile (SPP). I've created a Gist that includes turning on and off the UE Roll: Power on and off a UE Roll via Bluetooth using GATT and SPP.
If you get a chance, I'm curious if it works for the UE Boom too.
This is awesome info! I used it and info from the decompiled Android app to make an iOS app that can turn the UE Roll on and off (even via Siri). It has a bit of documentation in the code about both the Low Energy and Classic Bluetooth protocols.
I suspect decompiling the UE Boom Android app would be a good way to go if you wanted to see see if that worked similarly.
Hi,
Thank yo so much ! For information this is working well on my UE Boom
How are you guys finding UE's mac? A lot of BLE devices around me.
@mlalkaka Just FYI: For the Boom 3, turning it off worked by sending "VALUE=02" instead of the 01 at the end.
Hello,
I tried running your script with my UE Megaboom, but I get the following error.
Characteristic Write Request failed: Attribute requires authorization before read/write
Any ideas?
Thanks
Hi,
I faced the same issue when using this command on my raspberry (Node-RED).
I found out (but I would like confirmation from others), that the MAC address of the sending device (with 01 ou 02 at the end) has to be a MAC address of a previously paired device.
From what I learned, the Mac address does not have be of the sending device but of one of the device that the BOOM was already paired on.
In my cas im using my phone's Mac to ping the BOOM using my raspberry.
Hope this helps.
Adam
Hey, I was just wondering how does this work. There isnt anything online related to this.
Hello,
I tried running your script with my UE Megaboom, but I get the following error.
Characteristic Write Request failed: Attribute requires authorization before read/write
Any ideas?
ThanksHi,
I faced the same issue when using this command on my raspberry (Node-RED).
I found out (but I would like confirmation from others), that the MAC address of the sending device (with 01 ou 02 at the end) has to be a MAC address of a previously paired device.From what I learned, the Mac address does not have be of the sending device but of one of the device that the BOOM was already paired on.
In my cas im using my phone's Mac to ping the BOOM using my raspberry.
Hope this helps.
Adam
I got the same error even after connecting my laptop to the boom and playing music through it. I did try changing the security level of gatttool but despite using gatttool -h, I couldn't figure out the syntax (I only got ubuntu this week)
gatttool
is deprecated and not in current distros anymore.
The following python script should do the trick to turn it on tho:
#!/usr/bin/env python3
import bleak
import asyncio
# ue boom bluetooth mac address
UE_BOOM_MAC = "10:94:97:01:5A:30"
# any mac that was paired to ue boom works here
MY_MAC = "F0:AB:01:A9:6C:EE"
# service to turn on
PWR_ON = "c6d6dc0d-07f5-47ef-9b59-630622b01fd3"
async def main():
ble_msg = bytearray.fromhex(MY_MAC.replace(":",""))
ble_msg.append(1)
dev = bleak.BleakClient(UE_BOOM_MAC)
await dev.connect()
await dev.write_gatt_char(PWR_ON, ble_msg)
if __name__ == '__main__':
asyncio.run(main())
This was tested with a Megaboom 3 on Linux 6.0.9, but should work with UE Boom 2 as well, and also on windows and mac since bleak is working there as well.
Turning of (linux only) would work like this:
#!/usr/bin/env python3
import socket
# ue boom bluetooth mac address
UE_BOOM_MAC = "10:94:97:01:5A:30"
# ue boom spp bt channel
UE_BOOM_PORT = 1
# message to turn the speaker off
UE_BOOM_OFF_MSG = b'\x02\x01\xb6'
def main():
dev = socket.socket(
socket.AF_BLUETOOTH,
socket.SOCK_STREAM,
socket.BTPROTO_RFCOMM
)
dev.connect((
UE_BOOM_MAC,
UE_BOOM_PORT
))
dev.sendall(b'\x02\x01\xb6')
dev.close()
if __name__ == '__main__':
main()
check out my repo for updates: https://github.com/eni23/ueboom
gatttool
is deprecated and not in current distros anymore.The following python script should do the trick to turn it on tho:
#!/usr/bin/env python3 import bleak import asyncio # ue boom bluetooth mac address UE_BOOM_MAC = "10:94:97:01:5A:30" # any mac that was paired to ue boom works here MY_MAC = "F0:AB:01:A9:6C:EE" # service to turn on PWR_ON = "c6d6dc0d-07f5-47ef-9b59-630622b01fd3" async def main(): ble_msg = bytearray.fromhex(MY_MAC.replace(":","")) ble_msg.append(1) dev = bleak.BleakClient(UE_BOOM_MAC) await dev.connect() await dev.write_gatt_char(PWR_ON, ble_msg) if __name__ == '__main__': asyncio.run(main())This was tested with a Megaboom 3 on Linux 6.0.9, but should work with UE Boom 2 as well, and also on windows and mac since bleak is working there as well.
Turning of (linux only) would work like this:
#!/usr/bin/env python3 import socket # ue boom bluetooth mac address UE_BOOM_MAC = "10:94:97:01:5A:30" # ue boom spp bt channel UE_BOOM_PORT = 1 # message to turn the speaker off UE_BOOM_OFF_MSG = b'\x02\x01\xb6' def main(): dev = socket.socket( socket.AF_BLUETOOTH, socket.SOCK_STREAM, socket.BTPROTO_RFCOMM ) dev.connect(( UE_BOOM_MAC, UE_BOOM_PORT )) dev.sendall(b'\x02\x01\xb6') dev.close() if __name__ == '__main__': main()check out my repo for updates: https://github.com/eni23/ueboom
yo how did you get the PWR_ON service, I wish your repo had a bit more information
yo how did you get the PWR_ON service, I wish your repo had a bit more information
TBH, i did not invest a lot of time into this, but i got most infos from this thread here, a Reddit post where one decompiled the UE Android app https://www.reddit.com/r/bluetooth/comments/ap6npx/bluetooth_protocol_for_ue_boom_2/ and some playing around with bluetoothctl
gatttool
is deprecated and not in current distros anymore.
The following python script should do the trick to turn it on tho:#!/usr/bin/env python3 import bleak import asyncio # ue boom bluetooth mac address UE_BOOM_MAC = "10:94:97:01:5A:30" # any mac that was paired to ue boom works here MY_MAC = "F0:AB:01:A9:6C:EE" # service to turn on PWR_ON = "c6d6dc0d-07f5-47ef-9b59-630622b01fd3" async def main(): ble_msg = bytearray.fromhex(MY_MAC.replace(":","")) ble_msg.append(1) dev = bleak.BleakClient(UE_BOOM_MAC) await dev.connect() await dev.write_gatt_char(PWR_ON, ble_msg) if __name__ == '__main__': asyncio.run(main())This was tested with a Megaboom 3 on Linux 6.0.9, but should work with UE Boom 2 as well, and also on windows and mac since bleak is working there as well.
Turning of (linux only) would work like this:#!/usr/bin/env python3 import socket # ue boom bluetooth mac address UE_BOOM_MAC = "10:94:97:01:5A:30" # ue boom spp bt channel UE_BOOM_PORT = 1 # message to turn the speaker off UE_BOOM_OFF_MSG = b'\x02\x01\xb6' def main(): dev = socket.socket( socket.AF_BLUETOOTH, socket.SOCK_STREAM, socket.BTPROTO_RFCOMM ) dev.connect(( UE_BOOM_MAC, UE_BOOM_PORT )) dev.sendall(b'\x02\x01\xb6') dev.close() if __name__ == '__main__': main()check out my repo for updates: https://github.com/eni23/ueboom
yo how did you get the PWR_ON service, I wish your repo had a bit more information
Hello,
If u want more information I have created a repo with some explanation about this.
Has someone gotten party up to work? Aka speaker interconnect?
Hello,
I tried running your script with my UE Megaboom, but I get the following error.
Characteristic Write Request failed: Attribute requires authorization before read/write
Any ideas?
Thanks