openScale icon indicating copy to clipboard operation
openScale copied to clipboard

Support for PICOOC S1 Pro

Open pililac opened this issue 5 years ago • 8 comments

Hi together, I really like my PICOOC S1 Pro, but the App is a disaster. The only way for export data is saving a JPG of the report. I recorded some BT traffic and also the openScale debug log file. I had a first look at the data with Wireshark, but I didn't find the weight values. Maybe someone with more experience can help?

Scale name

PICOOC S1 Pro

https://eu.picooc.com/en/product-s1pro.php

Log Files

User settings in the vendor app for all four measurements:

jacob male Feb/10/1989 180 cm Germany (Region) White/Caucasian

No Fitness level was asked

Measurement 1:

BT Snoop Log: btsnoop_hci_1.log

Measured true values: measurement1.txt

Screenshot: measurement1

Measurement 2:

BT Snoop Log: measurement2.txt

Measured true values: btsnoop_hci_2.log

Screenshot: measurement2

Measurement 3:

BT Snoop Log: measurement3.txt

Measured true values: btsnoop_hci_3.log

Screenshot: measurement3

Measurement 4:

BT Snoop Log: measurement4.txt

Measured true values:btsnoop_hci_4.log

Screenshot: measurement4

openScale debug log file

openScale_2020-01-20_22-29.txt

All data in one zip: PICOOC_S1.zip

pililac avatar Jan 20 '20 22:01 pililac

Okay, ich found the date and the weight in the BT data. The scale sends data to the receiver via handle 0x0012 in the format 390a5e2614fe06b40f8c, (taken from the four measurements 1). I found the following format:

columns
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |

  39  0a  5e  26  14  fe  06  b4  0f  8c
  39  0a  5e  26  15  ad  07  18  0f  be
  39  0a  5e  26  16  52  06  f0  0f  aa
  39  0a  5e  26  16  e8  06  ce  0f  c8`

col 3 - 6 [date]:

5e  26  14  fe	=	Mo, 20 Januar 2020 22:00:46 +0100
5e  26  15  ad	=	Mo, 20 Januar 2020 22:03:41 +0100
5e  26  16  52	=	Mo, 20 Januar 2020 22:06:26 +0100
5e  26  16  e8	=	Mo, 20 Januar 2020 22:08:56 +0100

Format: UNIX 32bit hex value big endian

col 7 & 8

[weight]

06 b4		1716	/20 =  85.8
07 18		1816	/20 =  90.8
06 f0		1776	/20 =  88.8
06 ce		1742	/20 =  87.1

I don't know what the other columns are for, but maybe someone of you has an idea.

pililac avatar Mar 06 '20 03:03 pililac

From my experience the first two column are mostly the command handles. The last column could be a XOR checksum or with column 9 and 10 the impedance value!?

The body measurements are done in the vendors app. Unfortunately in a .so library.

oliexdev avatar Mar 10 '20 09:03 oliexdev

Based on the openScale debug log file, to me it seems that this scale and the mini variant, see #401, have the same protocol. I also own the mini scale and I wonder what else needs to be done to support this scale. How can I help?

tobiaspc avatar Jul 29 '20 16:07 tobiaspc

It's looking like a dead end to me. When the calculations are done in the app and the .so library cannot be opened, I have no clue how to proceed.

pililac avatar Oct 27 '20 14:10 pililac

Just a naive question, but based on the research done by @pililac above, would it make sense to offer "partial support" for this scale, by recording only the weight and not the other (calculated) body measurements?

jvkersch avatar Sep 20 '23 12:09 jvkersch

I've decompiled the Picooc apk and found out the following peace of code. It contains the logic how they parse the byte array and get weight and impedance values, I hope it might help:

BTBleForBroadcasDevice.java image

at the line 242 there is the calculation from byte array that gets weight value. Also I can find other calculations, seems that they are not under .so file. Also the code seems not obfuscated so it might be possible to get all the required values.

VladislavNikolaev avatar Dec 06 '23 11:12 VladislavNikolaev

I've decompiled the Picooc apk and found out the following peace of code. It contains the logic how they parse the byte array and get weight and impedance values, I hope it might help:

Looks like that piece of code is for "PICOOC-W" and "PICOOC-L" scales. These scales broadcast measurements without the need of first writing timestamp to characteristic. For Mini, S1 Pro, and other "PICOOC-TWO-LETTERS" devices the parsing logic is in BTBle.displayData, and impedance calculations are in WeightingDirect class (no native library is involved by the looks of it)

4ndv avatar Mar 21 '24 18:03 4ndv