Using AI to reverse engineer undocumented Bluetooth protocols has been a godsend for me. We have an RV that came with a "Smart RV" system from BMPro that controls all of the lights, the air conditioning, starting the generator, leveling, slideouts, and other stuff.

The BMPro app is... well, it's like they actively worked to make it terrible.

I put up with it for 2 years and then had the bright idea to throw the APK at Claude Opus earlier this year. I now no longer have to use their terrible app as it reverse engineered the Bluetooth protocol and I can either use the custom-built Android app, website hosted on GitHub Pages, or the Home Assistant app I built using AI.

It's not perfect, and it has bugs, but it is less buggy than their app. I've been busy at work lately, so I haven't had a chance to resolve the bugs, but I'll get around to it.

I ended up also using Opus to patch the original APK to fix several bugs and inexplicably bad UI choices they made. I still prefer to use my own app, but I have the patched app as a fallback.

If you have a eufy scale, you can do this with no LLM needed - just set up an esp32 Bluetooth proxy, add it to home assistant, and then use the EufyLife integration someone already made. I did this recently with my scale to avoid having to sync it to my phone, go to the cloud, fetch data from the cloud, etc., and it's working fantastically. I have a little Home Assistant integration that pokes scale updates to a Python script running locally that provides a UI I like.

Huge fan of running it this way.

(Yesterday I ordered a more commercial, polished-looking esp32 Bluetooth proxy integrated into a smart plug - athome brand - but it's the same functionality, just in a nicer package than having a USB thing dangling from my outlet)

Is there any documentation and a specific esp32 Bluetooth proxy you would recommend?

The ESPHome bluetooth_proxy component is the standard route here, documented on esphome.io. Any generic ESP32 dev board works, no need for anything specialized in hardware terms. The active connection mode matters if you want it grabbing the Withings BLE broadcast reliably rather than just passive scanning.

How can you write (or have AI write) such an article without also sharing the code? Now it’s just a pretty useless brag, “look what I built”.

If the AI wrote the article, and with no code, how do we know this even happened?

Withings has a full available API, I wrote a tool to just scrape what I need from the app at https://developer.withings.com/

I think the main point here is that they don't want their data going through yet another cloud service.

Yeah that was my exact reasoning too. I ran their official API through a cron job for a while but hated depending on OAuth tokens renewing correctly. Went ESP32 route after mine kept silently failing for weeks before I noticed the gap in data.

Used the API directly for something similar — auth is OAuth2 and access tokens expire every 3 hours, so you need to handle refresh token rotation or it silently stops updating. Wish they documented that better, cost me a day chasing stale data.

You can also have a Webhook be delivered when you take a new measurement. I wrote a small script that syncs my weight to Garmin using python-garminconnect.

The experience integrating with Withings was really good. Garmin on the other hand seems to be actively hostile if you (as an end user) want to programmatically interact with their ecosystem.

Very light on details, but did awaken me to the idea that you can setup HW projects like this without soldering. Bluetooth is practically ubiquitous, and ESPhome does offer this up in a palatable way

Nice! I also got tired of the Withings app (which now pushes AI subscriptions, wtf) and "made" an app for the smartwatches (at least, it works with my ScanWatch 2)

The app is at https://github.com/DavidVentura/withouthings - the firmware on the watch was leaked as well, and it's been helpful to debug some of the protocol.

You can build your own scale with an ESP32 for like $25 in parts - Hx711, load cells, ESP32, and a handful of trivial components. I threw together one that sits under my gas bottle, so I know when it’s running low. Adding impedance would be a pretty trivial step.

> Adding impedance would be a pretty trivial step.

But not the calibration that maps a raw ADC sample to "24.5% body fat, 21 Kg bone ..." etc.

I'm planning on doing something similar with a $150 treadmill that uses an app called "Gymax." I don't want the app or its adorably embryonic social network. I just want three buttons: slow, fast, and really fast for 60 seconds.

I'd love to be able to flash a custom firmware on the withings body+ to make the screen truly smart. It's a bummer to know that AI can do all these things if only the firmware was open source / accessible.

Same. It annoys me I cannot use baby wright mode to also weigh my dog as she's heavier than the 5kg limit they impose. However, reverse engineering firmware is really easy these days...

We looked at open sourcing our device firmware once and killed it fast. Support tickets triple when people brick hardware flashing custom builds, and returns eat margin. Withings isn't being cheap, they're avoiding a support cost nobody budgets for until it hits.

Hi! Regarding the code for this project I will upload it soon, it's just that i want to build an small tool to actually make it easier to get person ID's and generate the correct yaml automatically.

The interesting thing here is the opportunity to make a sdk for interfacing with the Withings hardware offline. This is the first public example I’ve seen of someone attempting that

We've got a few Withings Steel HR watches in the house, would be interested in doing exactly the same with those. Perhaps I'll spend a bit of time digging around.

I've done it just by using their nice API, no need for any ESP32.

Does this API go through cloud?

Because OP's hookup works offline, via the Bluetooth.

ESP32 dies, Home Assistant integration breaks silently on next firmware update, and nobody notices till the scale data's been flatlined for two weeks. Ask me how I know.