Sniffing Sugar
Sniffing sugar - well decoding Bluetooth data off an Aidex glucose sensor anyway....
Some background on getting the data off an Aidex glucose sensor for my telemetry tracker.
The sensor appears to use Bluetooth LE broadcast packets to output its status and data for alerts, which is rather convenient.
Realised I hadn't added details of the tools/software used here! The AdaFruit BLE Friend is used to capture the data, this can be viewed in WireShark
Interestingly since the Aidex system uses a more advanced (so I assume more expensive) chip compared to the Libre the sensor design is split into two, the sensor contains the battery and the sensor wire which clips into the unpowered transmitter unit. It's a shame to see that the lifespan issue (which I had wondered about) has been solved by including a small disposable lithium battery inside each sensor patch, there must be a better, more environmentally friendly way to build these things.
(My first sensor expired so I took the opportunity to disassemble one)
Patch innards |
Transmitter and sensor patch |
Listening to the data stream there are a couple of modes it cycles through.
Firstly in response to a bluetooth scan request it returns advertising data:
Advertising Data
Manufacturer Specific
Length: 11
Type: Manufacturer Specific (0xFF)
Company ID: Nordic Semiconductor ASA (0x0059)
Data: 240A000807062857
Device Name: AiDEX
Length: 6
Type: Device Name (0x09)
Device Name: AiDEX
The serial number is encoded with A-Z into hex 0x0A-0x24 and digits to their hex as values.
i.e. Serial# ZA0876 => 240A00080706
This can be used to identify which device to listen to the broadcasts from and just parse the "manufacturer data" in the BLE broadcast packets.
e7 01 7c010000 0700 01 04 FE00 FFFFFFFFFFFF002a
e7 01 86010000 0800 01 04 FF00 FFFFFFFFFFFF0090
The app then initiates a "warmup" sequence by sending time/date information to the sensor, the sensor then runs through a countdown phase for an hour. (0x3b -> 0x00) i.e. 59->00
e5 01 1032ad29 b101 02 04 FF00 FFFFFFFFFFFF02d3
d8 01 24589b29 0400 02 04 3B00 FFFFFFFFFFFF0216
e5 01 2432ad29 0400 02 04 3900 FFFFFFFFFFFF0200
e4 0b 2432ad29 0400 02 04 3700 FFFFFFFFFFFF0288
d9 01 02669b29 1300 02 0c 340a FFFFFFFFFFFF02fb < stabilizing
d9 01 34669b29 1400 02 07 3472 FFFFFFFFFFFF02ea
The fields appear to decode as:
1 2 3 4 5 6 7 8
C3 08 D09FB129 8604 06 88 40 5F FFFFFFFFFFFF029b
- C3 - unknown?
- 08 - sample age/10 (=80 secs)
- D09FB129 - time (epoch 1/1/2000 - 8hr China time!)
699506640 + 946684800 - 28800 = 1/3/2022 19:24 - 8604 - sensor age (in 5 min units) = 300*0x486/(24*60*60) = 4 days
- 06 - sensor number
- 88 - flags? unknown? 0x4=starting? 0xC=stabilizing?
- 40 - glucose (mmol / 10) - 64/10= 6.4mmol
- 5F - unknown?