How to obtain client_id in laymans terms

[flinthamm]

Let me second the comment about @alexpilotti and outstanding work ;)

I stumbled upon your code when trying to create some automations for our newly installed Mira modes. Unfortunately with almost zero experience using BLE or Bluetooth in general, after a few hours research and trial and error, it seems I'm barely any further forward.

I've managed to find what seems to be some great tools, like the nRFConnect and Logger mobile apps and these have sniffed some useful information but I can't find any 0x11 characteristic info or know how I would go about decoding the client_id from the CRC data, if indeed I was able to obtain it?

The Adafruit BLE Sniffer v2 has also been problematic with Wireshark as it seems to lock up just when it appears your starting to get at the data needed.

Literally ANY pointers on how to get this information and decode it would be very gratefully received and no doubt use to others in the community? Thanks in advance for any help.

[spamoom]

@flinthamm did you ever get anywhere with this? I've done exactly the same as you - new to the BLE stuff, had limited output from wireshark that relates to the 0x11 stated in the readme 😂

[flinthamm]

Very frustratingly no, although mainly due to time as I rarely give up...unfortunately, this is one of those times, as I could not get any feedback or assistance. I'm resigned to waiting for our next shower upgrade that will be WiFi enabled, although no doubt that will be a long time.
If you do make any progress, any knowledge you gain would be much appreciated and I'd be prepared to cross reference your testing from this side, if that helps? Equally, maybe our comments here might spark others interest or better still the original creator may have some updates to this that they would be willing to share?
Either way, good luck and I'll certainly do what I can if you make any progress :)

[kingal123]

Adding my two pence worth I found a fork of this at https://github.com/dave01945/python-miramode. This includes the brute force loop that is mentioned in this repository, I'm just trying to get my head around it now!

[cook1emr]

Adding my two pence worth I found a fork of this at https://github.com/dave01945/python-miramode. This includes the brute force loop that is mentioned in this repository, I'm just trying to get my head around it now!

I hope you can, and can share back. I have two of these showers, I initially tried to get it working. However other priorities took over. I will come back to it at some point.

[spamoom]

I also have the mode bath - I'm used to code on a higher level than this so it's also pretty foreign to me. Perhaps GPT can help ;)

[alexpilotti]

Hi all, apologies, I missed the initial comment here! As my Mira shower and bath work well in Home assistant / Alexa with the current implementation since almost 4 years, I didn’t progress past this initial proof of concept to sort out the pairing process and add more features.
I have plans in my backlog to do a complete Home Assistant integration at some point though.

[spamoom]

Hey @alexpilotti thanks for the response. I think the majority of the people in this issue are just after some idiot proof steps to find the device ID/CRC - once I have something working, I'm pretty good at debugging

[kingal123]

Completely agree with @spamoom if you do have 5mins spare to put together a very quick how-to guide as detailed above it would be very much appreciated @alexpilotti! Thanks again for all your hard work with this!

[kingal123]

I finally managed to get it working with the help of dave01945

1. Firstly you will need a Wireshark capture with the Handle 0x0011 and with a Value that is 20 characters long as shown here:
   Wireshark.Capture.pdf
2. From this you can decipher the Value (my example is: 0187050001c200009f74) and you'll have a device id of 0x01 and a CRC 0x9f74
3. Now to generate the Client ID you need to edit the crc16_loop python script (https://github.com/kingal123/python-miramode/blob/master/mira/crc16_loop.py)
   At the top of the python script are 2 byte arrays, you need to copy your value into these. data excludes the CRC and payl is the entire value.

Split the value into hex pairs so they look the same as below:

data = bytearray([
0x01,
0x87, 0x05,
0x03,
0x01,
0x9a,
0x00,
0x00])
payl = bytearray([
0x01,
0x87, 0x05,
0x03,
0x01,
0x9a,
0x00,
0x00,
0xd5,0x28])

Now save the file and run the script. It should then generate a Client ID for you.

4. You now should have everything you need to run the example scripts in the Readme or use one of the scripts that Dave01945 has written https://github.com/kingal123/python-miramode/tree/master

[robotfelix]

@kingal123 Thanks for the details explanation of the steps once you have the right capture.

Can you share any more information about how you managed to get a capture containing the 0x0011 handle in the first place? I've captured the entirely process of starting and stopping each of the two outlets via my phone, and have lots of traffic on the Handle 0x0010 and Handle 0x0012 handles, but no packets with the 0x0011 handle.

Did you make your Wireshark capture during normal usage, or do I need to record the packets exchanged during the pairing process?

[alexpilotti]

@robotfelix the WireShark capture needs to be performed while turning on / off the outlets, I’m surprised by the lack of 0x11 packets. The pairing process is a different story, would be good to have that sorted out eventually to avoid the need of WireShark in the first place :)

[flinthamm]

Hello again all and I can almost say... "Happy New Year".
Thanks for keeping this issue alive and for the recent posts which together with a little time have rekindled the Mira Mode flame.

I'll try and keep this short and appreciate this is not a technical support forum, especially for BLE sniffing but I'm hoping someone can quickly point out the obvious error I'm making, which is simply that I can't seem to receive any ATT protocol data, as was pictured in the WireSharkCapture.pdf posted by @kingal123.

I'm using the Adafruit nRF51822 USB dongle on a Win10 Laptop with the latest WireShark v4.2 and Npcap v1.78, CP210x Universal Windows Driver v11.3.0, Python 3.12.1, pyserial 3.5. The nrf_sniffer_for_bluetooth_le_4.1.1.zip found on the Nordic Semiconductor has then been used to copy the relevant files into the global WirelShark plug-ins directory and from the same archive, the configuration profile files have been copied into the personal configuration folder.

With the above setup completed, the system rebooted and the dongle plugged in, everything appears to be functioning correctly. A blue LED "CONN" flashes initially, the WireShark interfaces page loads. The "nRF Sniffer for Bluetooth LE Com5" interface is selected and on doing so, lots of "LE LL" protocol data starts flooding in, while a new amber LED (one of two mounted directly above one and other but not labelled, presumably TX/RX) starts flashing in addition to flashing blue "CONN" LED. When the Mira Mode bath filler is then selected from the device dropdown in WireShark (provided by the plugin config toolbar) a new red "MODE" LED flashes with the amber instead of the Blue LED. If I then select the Mira app on my phone that has been previously paired to the Mira Bath filler, immediately a connection is made in the app the LED's seem to stop flashing (or flash VERY occasionally), unless the Mira Mode device is unselected in favour of the "All advertising devices" or the app is disconnected. I've tried interacting with the Mira within the app, turning the bath filler valve on / off which all work but the data is never seen in WireShark.
To cut a long story short (as it maybe unnecessary) all I ever seem to get is "LE LL" protocol data. I've tried changing the Key from "Legacy Passkey" (the default) to other settings and tried changing the initial interfaces default configuration, by adding "Only advertising packets" and "Scan and follow devices on LE Coded PHY" as a last resort but this has made no difference. I've also tried changing the switch on the dongle from "CMD" to "DAT" but again, no data other than the advertising packets is ever recorded in WireShark?

As this is the first time I've ever conducted BLE sniffing and as far as I'm aware, all instructions have been followed to the "T", I'm not sure where to look next? Google found a few people with similar issues in various Forums but the messages threads never concluded with any useful information. Hopefully others have had more luck than me but I thought it was worth posting here as hopefully something is obviously wrong, at least to the right trained set of eyes :)

[flinthamm]

Perhaps I'm just being unlucky and need to persevere. See Adafruit Introduction FAQ

[spafrost]

Perhaps I'm just being unlucky and need to persevere. See Adafruit Introduction FAQ

Not that it helps, but I have had the same exact experience you describe above - not being able to record anything other than advertising packets with the Adafruit.

I have now moved to inspecting the packets using the HCI Snoop Log on my android device.

1. Enable developer settings
2. Enable "HCI Snoop Log" in developer settings
3. Play with the app for a bit, turning device on and off and loading/changing settings
4. Connect phone to PC and run "adb bugreport"
5. Extract bug report, find HCI Snoop log and open with Wireshark

I have not managed to find an 0x11 packet yet, though.

[flinthamm]

Thanks @spafrost for confirming this, interesting :) Funny enough, I remember going down the exact road you describe too (well over a year ago, so can't remember the exact details) and I probably gave up too easy. Unfortunately, with the documented Adafruit process having not provided any useful data and having not seen any useful threads of people having or certainly resolving similar issues, it was time constraints that finally caused me to give up. I consigned myself to hoping more information would come to light in time, as and when further investigation could be done + hoping this thread might be one solution.
The truth is, I was annoyed at myself for having installed a BLE based device, rather than something with a better suited wireless interface, like almost every other device in the house, which is reliable and either has an API or a workaround. Of course I think at the time there were not that many "Connected" options and of course, Mira now make a 802.11x based product.
As and when time allows, I'll try and progress further and will update this thread accordingly. If anyone has any pointers whatsoever or could share their experience of sniffing the BLE traffic, especially if it's been successful, that would be much appreciated.