Anaren boosterpack with Emmoco firmware looks like this over BLE: [BC:6A:29:AB:2E:31][LE]> primary attr handle: 0x0001, end grp handle: 0x000b uuid: 00001800-0000-1000-8000-00805f9b34fb attr handle: 0x000c, end grp handle: 0x000f uuid: 00001801-0000-1000-8000-00805f9b34fb attr handle: 0x0010, end grp handle: 0xffff uuid: 0000ffe0-0000-1000-8000-00805f9b34fb # 1800: Generic Access [BC:6A:29:AB:2E:31][LE]> characteristics 1 0x0b # 2a00: Device Name handle: 0x0002, char properties: 0x02, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb # 2a01: Appearance handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb # 2a02: Peripheral Privacy Flag handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a02-0000-1000-8000-00805f9b34fb # 2a03: Reconnection Address handle: 0x0008, char properties: 0x0a, char value handle: 0x0009, uuid: 00002a03-0000-1000-8000-00805f9b34fb # 2a04: Peripheral Preferred Connection Parameters handle: 0x000a, char properties: 0x02, char value handle: 0x000b, uuid: 00002a04-0000-1000-8000-00805f9b34fb [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x01 Characteristic value/descriptor: 00 18 [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x02 Characteristic value/descriptor: 02 03 00 00 2a [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x03 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x04 Characteristic value/descriptor: 02 05 00 01 2a [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x05 Characteristic value/descriptor: 00 00 [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x06 Characteristic value/descriptor: 02 07 00 02 2a [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x07 Characteristic value/descriptor: 00 [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x08 Characteristic value/descriptor: 0a 09 00 03 2a [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x09 Characteristic value/descriptor: 00 00 00 00 00 00 [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0a Characteristic value/descriptor: 02 0b 00 04 2a [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0b Characteristic value/descriptor: 50 00 a0 00 00 00 e8 03 # 1801: Generic Attribute [BC:6A:29:AB:2E:31][LE]> characteristics 0x0c 0x0f handle: 0x000d, char properties: 0x20, char value handle: 0x000e, uuid: 00002a05-0000-1000-8000-00805f9b34fb [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0c Characteristic value/descriptor: 01 18 # 2a05: Service Changed (Indicate) [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0d Characteristic value/descriptor: 20 0e 00 05 2a # uint16: Start of Affected Attribute Handle Range # uint16: End of Affected Attribute Handle Range [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0e Error: Characteristic value/descriptor read failed: Attribute can't be read [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x0f Characteristic value/descriptor: 00 00 [BC:6A:29:AB:2E:31][LE]> characteristics 0x10 handle: 0x0011, char properties: 0x12, char value handle: 0x0012, uuid: 0000ffe1-0000-1000-8000-00805f9b34fb handle: 0x0014, char properties: 0x12, char value handle: 0x0015, uuid: 0000ffe2-0000-1000-8000-00805f9b34fb handle: 0x0017, char properties: 0x0c, char value handle: 0x0018, uuid: 0000ffe3-0000-1000-8000-00805f9b34fb handle: 0x0019, char properties: 0x0c, char value handle: 0x001a, uuid: 0000ffe4-0000-1000-8000-00805f9b34fb [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x10 Characteristic value/descriptor: e0 ff [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x11 Characteristic value/descriptor: 12 12 00 e1 ff [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x12 Error: Characteristic value/descriptor read failed: Request attribute has encountered an unlikely error [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x13 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x14 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x15 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x16 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x17 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x18 Error: Characteristic value/descriptor read failed: Attribute can't be read [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x19 Characteristic value/descriptor: [BC:6A:29:AB:2E:31][LE]> char-read-hnd 0x1a Error: Characteristic value/descriptor read failed: Attribute can't be read ============= [BC:6A:29:AB:2E:31][LE]> primary ffe0 Starting handle: 0x0010 Ending handle: 0xffff [BC:6A:29:AB:2E:31][LE]> characteristics 0x0010 0xffff handle: 0x0011, char properties: 0x12, char value handle: 0x0012, uuid: 0000ffe1-0000-1000-8000-00805f9b34fb handle: 0x0014, char properties: 0x12, char value handle: 0x0015, uuid: 0000ffe2-0000-1000-8000-00805f9b34fb handle: 0x0017, char properties: 0x0c, char value handle: 0x0018, uuid: 0000ffe3-0000-1000-8000-00805f9b34fb handle: 0x0019, char properties: 0x0c, char value handle: 0x001a, uuid: 0000ffe4-0000-1000-8000-00805f9b34fb [BC:6A:29:AB:2E:31][LE]> char-desc 0x0010 0xffff handle: 0x0010, uuid: 00002800-0000-1000-8000-00805f9b34fb * GATT Primary Service Declaration handle: 0x0011, uuid: 00002803-0000-1000-8000-00805f9b34fb + GATT Characteristic Declaration handle: 0x0012, uuid: 0000ffe1-0000-1000-8000-00805f9b34fb handle: 0x0013, uuid: 00002902-0000-1000-8000-00805f9b34fb + Client Characteristic Configuration handle: 0x0014, uuid: 00002803-0000-1000-8000-00805f9b34fb + GATT Characteristic Declaration handle: 0x0015, uuid: 0000ffe2-0000-1000-8000-00805f9b34fb handle: 0x0016, uuid: 00002902-0000-1000-8000-00805f9b34fb + Client Characteristic Configuration handle: 0x0017, uuid: 00002803-0000-1000-8000-00805f9b34fb + GATT Characteristic Declaration handle: 0x0018, uuid: 0000ffe3-0000-1000-8000-00805f9b34fb handle: 0x0019, uuid: 00002803-0000-1000-8000-00805f9b34fb + GATT Characteristic Declaration handle: 0x001a, uuid: 0000ffe4-0000-1000-8000-00805f9b34fb ======================================================================== After some playing around, the role of the attributes looks like this: ffe1 [R,I]: Data read Receives Indicate messages containing variable id in the first byte, zero in second byte, variable value in the rest. Maybe variable id is two-byte (LE). ffe2[R,I]: Operation completion code After some writes, esp. into uuid ffe3, this characteristic gets Indicate 32bit long, all zeroes, or with non-zero first byte. Observed 0x07 and 0x33. Looks like return code from the operation initiated by write into ffe3. ffe3[W]: Command(?) Write of any length, with the first byte 1 or 2 results in Indicate message on ffe2. ffe4[W]: Data write(?) Write seems to affect the Indicate code that arrives in response to subsequent writes to ffe3. ====================================================================== Hypothesis: command may have similar format to the Em_Message that is used to communicate between the MCM and EDR. #define Em_Message_INDSIZE 4 typedef uint8_t Em_Message_Size; typedef uint8_t Em_Message_Kind; typedef uint8_t Em_Message_ResId; typedef uint8_t Em_Message_Chan; #define Em_Message_NOP 0 #define Em_Message_FETCH 1 #define Em_Message_FETCH_DONE 2 #define Em_Message_STORE 3 #define Em_Message_STORE_DONE 4 #define Em_Message_INDICATOR 5 #define Em_Message_CONNECT 6 #define Em_Message_DISCONNECT 7 #define Em_Message_ECHO 8 #define Em_Message_PAIRING 9 #define Em_Message_PAIRING_DONE 10 #define Em_Message_OFFLINE 11 #define Em_Message_ACCEPT 12 #define Em_Message_START 13 #define Em_Message_ACTIVE_PARAMS 14 typedef struct Em_Message_Header { uint8_t size; uint8_t kind; uint8_t resId; uint8_t chan; } Em_Message_Header; typedef struct Em_App_Message { uint8_t dummy[3]; uint8_t sot; struct Em_Message_Header { uint8_t size; uint8_t kind; uint8_t resId; uint8_t chan; } hdr; uint8_t data[20]; /* 4 for Indicator */ } Em_App_Message; Write ffe3 Ind ffe2 FF - FE 0D 00 protocolLevel FD 0D 00 protocolLevel FC 42 20 79 91 51 01 00 00 Build FB - FA bc d0 b8 ea f0 13 c8 32 0b 21 07 09 c0 5c 43 48 0d 00 11 00 F9 04 09 F8 - F7 - F6 00 F5 50 55 4c 53 2d 43 4e 54 52 00 - 01 00 00 00 53 - byte changes after reset (EA) 02 00 00 00 53 After write to ffe4 write to ffe3 stops producing results Hypothesis about a match between Em messagas and wire messages was wrong ============================================= Other hardware that looks more promising: NUCLEO-L053R8 (STM32L053R8T6) http://www.st.com/web/en/catalog/tools/FM116/SC959/SS1532/LN1847/PF260001 X-NUCLEO-IDB05A1 (SPBTLE-RF) http://www.st.com/web/catalog/tools/FM146/CL2167/SC2006/LN1988/PF262191