Wahoo Fitness Bluetooth scale reverse engineering

I had a friend recently ask about putting his bluetooth scale on out IOT.  My first answer: just grab the serial lines and fuck bluetooth.  That turned out not to be completely correct in this case.

scale, with notes

The board included a footprint for a bluetooth board that was not present as well as a bunch of test points, that was useful.  Turns out the NRF8001 has a serial port but it’s not used in normal operation so the data from the scale was getting to the bluetooth controller some other way.  I probes the lines with a scope and leaned on the scale while monitoring the bluetooth connection, I knew that the bluetooth connection had changing data and that the data I wanted would be updating at that rate somewhere on the PCB.  eventually I found it to be SPI with simple clock and data lines, every time the bluetooth program updated the data bus had a spike.

clock and data

The connector is broken out to the exterior of the device because I should have no hope of battery powering an esp8266 for any reasonable amount of time so this will probably get an external box with an esp and regulator to power the scale as well so it doesn’t need batteries anymore.  Remaining reverse engineering to come later.

external power and data connector

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


%d bloggers like this: