openScale When connecting to Renpho ‎ES-CS20M-RD app chrashews.

Describe the bug When connecting to Renpho ‎ES-CS20M-RD app chrashews.

To Reproduce Steps to reproduce the behavior:

open app
start scale
app reports connectiong to scale
app crashes

Debug log Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2023-09-10 11:51:57 Device: HUAWEI CLT-L29 OS version: Android 10 (SDK 29)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:900) at android.os.Handler.dispatchMessage(Handler.java:103) at android.os.Looper.loop(Looper.java:219) at android.app.ActivityThread.main(ActivityThread.java:8668) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:513) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1109)

Sep 10 '23 09:09 kambancode

Adding my logs as well. Scale: Renpho ES-CS20M

Build version: 2.5.2 
Build date: 1981-01-01 01:01:02 
Current date: 2023-09-13 17:41:01 
Device: Google Pixel 6a 
OS version: Android 13 (SDK 33) 
 
Stack trace:  
java.lang.NullPointerException: no valid characteristic provided
	at j$.util.Objects.requireNonNull(Unknown Source:5)
	at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291)
	at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612)
	at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210)
	at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464)
	at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210)
	at android.os.Handler.handleCallback(Handler.java:942)
	at android.os.Handler.dispatchMessage(Handler.java:99)
	at android.os.Looper.loopOnce(Looper.java:201)
	at android.os.Looper.loop(Looper.java:288)
	at android.app.ActivityThread.main(ActivityThread.java:7918)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)
3m

Sep 13 '23 21:09 iamstevedavis

I can confirm this, too.

Oct 07 '23 16:10 floriansto

I too have ES-CS20M from amazon. The app crashes on bluetooth approach to scale. I have allowed Bluetooth permission in app settings. Here is my log

Build version: 2.5.2 Build date: [1981-01-01 01](tel:1981-01-01 01):01:02 Current date: [2023-10-17 22](tel:2023-10-17 22):46:44 Device: Samsung SM-G991U1 OS version: Android 12 (SDK 31)

Oct 18 '23 03:10 kiers

Same scale, same problem:

Why is it still listed as compatible in the wiki??

Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2023-12-11 18:09:37 Device: Google Pixel 6 Pro OS version: Android 14 (SDK 34)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:958) at android.os.Handler.dispatchMessage(Handler.java:99) at android.os.Looper.loopOnce(Looper.java:205) at android.os.Looper.loop(Looper.java:294) at android.app.ActivityThread.main(ActivityThread.java:8194) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:552) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:971)

Dec 11 '23 23:12 iff7378

The SDK for this scale is here (and all scales that show up as QN Scale): https://github.com/YolandaQingniu/qnscalesdkX

I wish I had the dev skills to help implement this but I'm not a software person. I'd really like to see this fixed.

@oliexdev If there's other ways I can help get this issues fixed, I'm all ears.

Dec 17 '23 19:12 iff7378

Build version: 2.5.2 Build date: 1981-01-01 01:01:02 Current date: 2024-03-08 15:58:55 Device: Google Pixel 6a OS version: Android 14 (SDK 34)

Stack trace:
java.lang.NullPointerException: no valid characteristic provided at j$.util.Objects.requireNonNull(Unknown Source:5) at com.welie.blessed.BluetoothPeripheral.writeCharacteristic(BluetoothPeripheral.java:1229) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:303) at com.health.openscale.core.bluetooth.BluetoothCommunication.writeBytes(BluetoothCommunication.java:291) at com.health.openscale.core.bluetooth.BluetoothQNScale.onNextStep(BluetoothQNScale.java:111) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:610) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.nextMachineStep(BluetoothCommunication.java:612) at com.health.openscale.core.bluetooth.BluetoothCommunication.resumeMachineState(BluetoothCommunication.java:210) at com.health.openscale.core.bluetooth.BluetoothCommunication$1.onServicesDiscovered(BluetoothCommunication.java:464) at com.welie.blessed.BluetoothPeripheral$1$1.run(BluetoothPeripheral.java:210) at android.os.Handler.handleCallback(Handler.java:959) at android.os.Handler.dispatchMessage(Handler.java:100) at android.os.Looper.loopOnce(Looper.java:232) at android.os.Looper.loop(Looper.java:317) at android.app.ActivityThread.main(ActivityThread.java:8501) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:552) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:878)

Mar 08 '24 20:03 antoinebou12

It looks like the expected service does not support the expected characteristic on the QN-Scale ES-CS20M-RD. BluetoothQNScale.java:111 writeBytes(WEIGHT_MEASUREMENT_SERVICE, CUSTOM3_MEASUREMENT_CHARACTERISTIC, ffe3magicBytes); leads to BluetoothCommunication.java:303 btPeripheral.writeCharacteristic(btPeripheral.getCharacteristic(service, characteristic), bytes, noResponse ? WriteType.WITHOUT_RESPONSE : WriteType.WITH_RESPONSE); getCharacteristic will return null if the characteristic is not found, which will trip the nonnull check in writeCharacteristic: https://github.com/weliem/blessed-android/blob/eb3f852532b62b669844e278fe37b4bf6f05d2b6/blessed/src/main/java/com/welie/blessed/BluetoothPeripheral.java#L1228-L1229

Can someone with an ES-CS20M-RD follow the directions cited below and submit the debug log? https://github.com/oliexdev/openScale/wiki/How-to-reverse-engineer-a-Bluetooth-4.x-scale#2-find-out-the-bluetooth-services-and-characteristic

Mar 26 '24 14:03 tsteven4

I believe this is where the problem is (from https://yolandaqingniu.github.io/en/flow/ble_scale_custom_connect.html)

Our scale uses two sets of services, and one device will only contain one set. The APP needs to traverse all services to find one set of service IDs. If one set is found, the feature values that need to be called back are enabled according to the feature values in the following table.

The driver for QN-Scale uses FFE0. The other service ID is FFF0. The characteristic UUIDs are different.

Here is the mentioned table for characteristics of FFF0:

FFF1 	Notify 	Data callback feature value
FFF2 	Write 	Data write characteristic value
2A19 	Read 	Charging scale electric quantity characteristic value

So the question would be how to query the scale for the service ID it wants. And if there would be a place to store it so that it doesn't need to probe on every connection. Finally, I wonder if it would be better to split into two different drivers because the changes might be extensive and confusing.

This is all theory right now. I have not yet recompiled with the new values to see if it fixes the crash on my scale. I'm not even sure how the new values would work because they're missing several parts of the state machine. I suspect they may have simplified the scale to use less round trips, but sniffing the official apps bluetooth connection may be the only way to really know how to deal with it.

I haven't jumped through the hoops to try the official app yet, but if I do I'll post the snoop log.

Jul 28 '24 05:07 rfdrake

I recompiled and tried it using the other service ID and characteristic and it no longer crashes. It doesn't log the weight either, but I suspect that is because I'm not doing the right thing with the results. I'll need to run a packet capture to get a better idea of what to do next.

Aug 05 '24 20:08 rfdrake

openScale openScale copied to clipboard

When connecting to Renpho ‎ES-CS20M-RD app chrashews.

openScale
openScale copied to clipboard