Many smart appliance can only be controlled by the orinigal BLE remote. To control such appliance by your own smart home system, there need to be a way to replace the original BLE remote with something that is compatible with your smart home system.

It is easy to replace IR remote and capture the command code on air, but BLE remote and the appliance seems to have pre-shared keys, how to link to the appliance with your own BLE node such as ESP32 node and how to know the command formats? Is there some existing generic way to do such things?



Example 1, turn on/off BLE TV or switch HDMI channel of BLE TV at some given condition (e.g. some specific person is dothing some specific thing).

Example 2, some appliance (such as smart toilet) with builtin offline voice command recognition which is error prone, the idea is to use external camera and/or online speech recognition system and send BLE order to the appliance automatically on some condition.


Why not using appliance that is compatible with existing standard smart home system such as Alexa?

Reason 1: many applicance doesn't support such way and may only support a system that is not compatible with your system.

Reason 2: to protect privacy, one possibly better way is to build your own system with ESP32/fruit pies/PCs etc.

1 Answer 1


There's some costly bluetooth sniffer that will allow you to do the capture of BLE including key exchanges while pairing and all the messages you might need afterward.

You can find some cheaper BLE sniffer that will do part of what the bigger one can do, it will be able to capture BLE data and you will then be able to provide it with your keys allowing it to decipher the messages. In some cases they can also do the key pairing sniffing but they are way less effective.

But even then, assuming you are able to get some keys and see what's exchanged, it will be hard for you to reverse engineer the protocol, unless it's standard HID codes shared on the proper BLE service. That's possible but very unlikely for "Smart" devices. I would expect for most of the product a non standard service with custom commands.

So I would say that if you want to do a product that will interface with such devices, the best you can do is to contact the product manufacturer and ask for a datasheet so that you can manufacture your own product based on that.

However if that's for a DIY project I'm not sure they will provide the datasheet to you unless you have a very good reason to get access to it or a promising probable future business opportunity. That can be for instance developing yet another IOT protocol to rule them all, or integrating their device to an existing IOT stack.

  • How can getting the keys even possible? Since then all the BLE security won't make sense. It's for DIY. Then the best choice seems to be opening the remote and use ESP32 to emulate key press (for physical keys, touch keys may be emulated without opening the case)
    – jw_
    Commented Oct 26, 2021 at 13:13
  • You can get the keys during the pairing, that what I meant for "key exchange" I'll edit that. So yes indeed that a good idea to do a hardware hack and emulate the key press, probably any microcontroller and a DAC might do the trick, but that would be very hacky!
    – YCN-
    Commented Oct 26, 2021 at 15:11
  • What about the pre shared key? If pre shared keys (which seems to be the most common case?) are used they you can never get the key right?
    – jw_
    Commented Oct 29, 2021 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.