EQ3 firmwares 1.20+ not working anymore (requires pairing?)

[robluca]

After try to set target temperature at any values it goes at 5.0 Celsius Degree. With Fw 1.10 it is still working. I bought new one and I received it with new FW. Did you see similar issues? Thank you

[ropperto]

Also firmware 1.20 does not work.

[Predator83]

It seems that the producer of the thermostats updated their firmware recently. According to ios and Android appstore comments even the original app of the producer (calorBT) is not able to connect anymore.

Seems like this issue is NOT a problem with the Bluetooth library in use nor the adapter, it seems like a problem with the firmware itsself.

[rytilahti]

I'm not actively maintaining this package, but if someone wants to add support for the newer versions I can try to help however I can by codereviews etc.

The first step would be to figure out the new communication protocol, quick googling brought this site which looks like a helpful starting point on how to reverse BTLE devices: https://reverse-engineering-ble-devices.readthedocs.io/en/latest/

[nakatomi845]

I don't know if this is problem with protocol. I have checked it with eq3cli and it connect and after writing date it disconnect with exception. Thermostat is now with version 1.46.

eq3cli --mac 00:1A:22:06:A7:83 --debug
DEBUG:eq3bt.eq3btsmart:Querying the device..
DEBUG:eq3bt.connection:Trying to connect to 00:1A:22:06:A7:83
DEBUG:eq3bt.connection:Connected to 00:1A:22:06:A7:83
DEBUG:eq3bt.connection:Writing b'031501040e2415' to 1041 with with_response=True
DEBUG:eq3bt.connection:Got exception from bluepy while making a request: Device disconnected
Traceback (most recent call last):
  File "/home/openhab/.local/bin/eq3cli", line 8, in <module>
    sys.exit(cli())
  File "/usr/lib/python3.9/site-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3.9/site-packages/click/core.py", line 1236, in invoke
    return Command.invoke(self, ctx)
  File "/usr/lib/python3.9/site-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3.9/site-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/click/decorators.py", line 21, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/usr/lib/python3.9/site-packages/eq3bt/eq3cli.py", line 34, in cli
    thermostat.update()
  File "/usr/lib/python3.9/site-packages/eq3bt/eq3btsmart.py", line 205, in update
    self._conn.make_request(PROP_WRITE_HANDLE, value)
  File "/usr/lib/python3.9/site-packages/eq3bt/connection.py", line 73, in make_request
    self._conn.writeCharacteristic(handle, value, withResponse=with_response)
  File "/usr/lib/python3.9/site-packages/bluepy/btle.py", line 543, in writeCharacteristic
    return self._getResp('wr')
  File "/usr/lib/python3.9/site-packages/bluepy/btle.py", line 407, in _getResp
    resp = self._waitResp(wantType + ['ntfy', 'ind'], timeout)
  File "/usr/lib/python3.9/site-packages/bluepy/btle.py", line 362, in _waitResp
    raise BTLEDisconnectError("Device disconnected", resp)
bluepy.btle.BTLEDisconnectError: Device disconnected

With BLE Scanner on my phone when i send date to service then I received:

0x02010900042b000000001e0c2c220a it look like similar than prev version.

Problem with btle.py?

[Predator83]

Or maybe a problem with the thermostats new firmware itself, as there is quite a shitstorm on the app store‘s comment sections of the official app (CalorBT) as it cannot connect to the thermostats anymore once they were updated to the new firmware.

[nakatomi845]

From CalorBT works, also works from BLE Scanner. Problem starts when manufacturer add "pairing" then phone starts asking for pairing code.

[rytilahti]

@nakatomi845 if I understand you correctly, the vendor has fixed the security issue where it was possible to control the device without pairing (like this library does)?

[nakatomi845]

Yes, I think this is the problem. But of course I don't know if it's correct implemented on vendor side.

[Predator83]

Ok, that explains some things.

I was already wondering why I was never asked for a PIN when I was setting up the Raspi with the thermostats. In contrast, when pairing with the CalorBT app I had to enter a PIN.

[nakatomi845]

As I can see btle.py supports pair and unpair method so I think it shouldn't be complicated to implement it.

[nakatomi845]

Definitely this is problem with pairing. When I paired it manually eq3cli works well. But I don't know how to implement in on library.

[rytilahti]

What steps were necessary to pair it? Did you just use the bluepy (and the btle.py interface? so this is a standard btle passcode pairing?), or did you do something else?

[nakatomi845]

On my environment.

1. Press and hold wheel on thermostat until Pair will be displayed. Remember or write it.
2. $ sudo bluetoothctl
3. [bluetooth]# power on
4. [bluetooth]# agent on
5. [bluetooth]# default-agent
6. [bluetooth]# scan on
7. [bluetooth]# scan off
8. [bluetooth]# pair 00:1A:22:06:A7:83
9. [agent] Enter passkey (number in 0-999999): <enter pin>
9. [bluetooth]# trust 00:1A:22:06:A7:83
10. [bluetooth]# disconnect 00:1A:22:06:A7:83

Optional steps:
[bluetooth]# devices - to list all devices
[bluetooth]# info 00:1A:22:06:A7:83
Device 00:1A:22:06:A7:83 (public)
	Name: CC-RT-BLE
	Alias: CC-RT-BLE
	Paired: yes
	Trusted: yes
	Blocked: no
	Connected: no
	LegacyPairing: no
	UUID: Generic Access Profile    (00001800-0000-1000-8000-00805f9b34fb)
	UUID: Generic Attribute Profile (00001801-0000-1000-8000-00805f9b34fb)
	UUID: Device Information        (0000180a-0000-1000-8000-00805f9b34fb)
	UUID: Vendor specific           (3e135142-654f-9090-134a-a6ff5bb77046)
	UUID: Vendor specific           (9e5d1e47-5c13-43a0-8635-82ad38a1386f)
	ManufacturerData Key: 0x0000
	ManufacturerData Value:
  00 00 00 00 00 00 00 00 00                       .........

[ropperto]

firmware 1.20 doesn't ask for pin

[bluetooth]# pair 00:1A:22:12:4B:E1
Attempting to pair with 00:1A:22:12:4B:E1
Failed to pair: org.bluez.Error.ConnectionAttemptFailed
[bluetooth]# trust 00:1A:22:12:4B:E1
Changing 00:1A:22:12:4B:E1 trust succeeded
[bluetooth]# info 00:1A:22:12:4B:E1
Device 00:1A:22:12:4B:E1 (public)
        Name: CC-RT-BLE
        Alias: CC-RT-BLE
        Paired: yes
        Trusted: yes
        Blocked: no
        Connected: no
        LegacyPairing: no
        UUID: Generic Access Profile    (00001800-0000-1000-8000-00805f9b34fb)
        UUID: Generic Attribute Profile (00001801-0000-1000-8000-00805f9b34fb)
        UUID: Device Information        (0000180a-0000-1000-8000-00805f9b34fb)
        UUID: Vendor specific           (3e135142-654f-9090-134a-a6ff5bb77046)
        UUID: Vendor specific           (9e5d1e47-5c13-43a0-8635-82ad38a1386f)
[bluetooth]#

I wonder if it is better to upgrade or try to fix this fw version.

[nakatomi845]

What do you mean fix? I think it is better to upgrade. Because this is fix for security.

[ropperto]

I mean to get eq3bt working fine. My final goal is to have the valve again integrated in home assistant. I know that security is important, but in my case where bt signal is not reachable outside my house the original firmware was also a good solution.

[nakatomi845]

I have 3 thermostats all were with 1.20, now they are working with 1.46 nothing change are needed except pairing.

[Predator83]

Hi nakatomi,

do I understand this correct: With the new firmware I need to pair the thermostats via bluetoothctl and then the eq3bt (and other scripts/libraries) should work as before?

[nakatomi845]

Yes.

But it will be nice to see that this library support that.

[nakatomi845]

Ok, one additional comment. Device remember paired device and only one device can be paired. So, if you pair device with pc then you can't connect with phone and vice versa.

[ropperto]

So we can say that only firmware 1.20 is not working with eq3bt, firmware 1.10 and 1.46 are fine. At the moment I can't upgrade, hope to have time in the night.

[nakatomi845]

I think 1.20 works well without pairing. 1.46 needs be paired but also works.

[Predator83]

nakatomi, thanks for your comment above.

Then the new firmware would be actually a deal breaker for me as I use my phone AND my PC to adjust temperature. And this works pretty well currently as is.

[ropperto]

I confirm that 1.20 don't work with eq3bt, it works only with proprietary app on phone.

[Predator83]

Interesting fun fact: I found a master thesis that is analyzing the eq3 regarding its Bluetooth communication. Unfortunately it is in German.

https://www.h-brs.de/files/related/kevin_froehlich-masterthesis.pdf#page74

[rytilahti]

@nakatomi845 thanks for the pairing instructions! Do you mind creating a PR to add simplified instructions to the README file? I think that information is useful as it is, even when it cannot be done programatically for the time being. It may also be worth adding a warning about the fact that these devices can only be paired at the same time to one device => using both this library & the official app will not work on newer fws.

@Predator83 interesting, thanks for the link! Google translate can usually do a pretty good (or at least understandable) job with DE-EN translations.

[ropperto]

Well, after upgrading the valve, the library can connect again. I had to remove the device and then the pairing again asked for the pin. Thank you to all!

[DJTechMo]

Hi, I just got my eq3-Thermostates and they were on 1.20. So i updated to 1.46 with the iPhone app. When i try to pair my linux system (Debian 10) with the thermostate, it times out and fails.

[bluetooth]# pair 00:1A:22:16:2F:2A Attempting to pair with 00:1A:22:16:2F:2A [CHG] Device 00:1A:22:16:2F:2A Connected: yes Request passkey [agent] Enter passkey (number in 0-999999): 314627 [CHG] Device 00:1A:22:16:2F:2A Connected: no Failed to pair: org.bluez.Error.AuthenticationCanceled

Any ideas or experience on that?

[Predator83]

Hi @DJTechMo If you read through this thread from around beginning of this year you will find the answer.

Short version: with the new firmware you cannot pair with multiple devices and it requires an additional authentication step.

[DJTechMo]

Hi @Predator83.

I understood that pairing only with one device is possible. But how can i remove the pairing with the phone app? I already deleted the device in the app. Do i have to do something else? Cannot find anything on this topic above.

Thank you for your help.

[Predator83]

My guess would be that if you pair with a new device the pairing with the old one will be removed automatically, but that is just a guess.

Unfortunately I cannot/don’t want to test this as this would require me to update to the new firmware and i definitely want to stick to the old one because it allows pairing with multiple devices.

Is anybody here aware how you could rollback the firmware of the thermostats to an older version?

[DJTechMo]

@Predator83 I tried to pair several times, so it should have worked and there have to be other problems.

Downgrade would be very nice.

[DJTechMo]

@Predator83 Do you have thermostates with Firmware 1.20?

[Predator83]

Not sure which one I have but it’s not the newest one that requires the secure pairing. Also not sure where I can look up the firmware version.

[DJTechMo]

@Predator83 Restarting the thermostate by removing the battery and put it in again, then it should be displayed in the display as the first information.