Controlling Philips Hue lamp

Hi to everyone.

I installed a Hue lamp (simple dimmable white lamp with a remote) and since then I see rows like this one below in mqtt:

OpenMQTTGateway_ESP32_BLE/BTtoMQTT/SOMEADDRESS {“id”:“someaddress”,“mac_type”:1,“name”:“Hue Lamp”,“rssi”:-76,“txpower”:10,“servicedata”:“hexstring”,“servicedatauuid”:“otherhexstring”}

But when I use the remote that comes with the lamp nothing appears… so I guess the remote is not bluetooth, but then why the lamp is transmitting some bluetooth signal?

Is there a possibility to control it via OpenMQTTGateway or it is encrypted?

Hi @christian-0s,

this sounds interesting, as far as I knew Philips Hue was all Zigbee, and I would assume that the remote still controls the lamp via Zigbee, but obviously your dimmable white lamp also broadcasts some BLE info, possibly off its state.

While it’s unlikely it’ll be possible to control the lamp via bluetooth, it could be interesting to find out what the broadcasts represent. For that you would need to send the full MQTT messages with the clear “servicedata”:“hexstring”,“servicedatauuid”:“otherhexstring” along with the concurrent state of the lamp, i.e. ON and dimmed to 30%.

Other than that it could just be a BLE braodcast for integration into the Hue app on a phone with BLE identification.

Unfortunately the two strings don’t change with the status of the lamp, I’ve tried off, on 100% and on dimmed and got always
“servicedata”:“0210dde606”,“servicedatauuid”:“0xfe0f”
By the way the lamp is this one: amazon.it/dp/B07SV87BBZ/

Yes, it seems to be controllable via bluetooth as well, when connected to the lamp. So the OpenMQTTGateway WRITE command should be able to control the lamp, the same as it’s possible to control the lamp with the Hue app on a phone just over bluetooth, that is if the communication is not encypted.

Now getting the correct service, characteristic and which hex codes to send to control would be the next step.

Searching GitHub for it, with results like this

should get you further, also exploring the services and characteristics with the nrfConnect app, and reading up on the WRITE command for OMG

Let us know how you get on.

I paired it to my laptop (I had to install Hue app on my phone to put the lamp in pairing mode) and read the attributes:

Primary Service (Handle 0x0009)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039
	b8843add-0000-4aa1-8794-c3f462030bda
	Vendor specific
Characteristic (Handle 0x7324)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039/char0041
	b8843add-0004-4aa1-8794-c3f462030bda
	Vendor specific
Characteristic (Handle 0x7324)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039/char003f
	b8843add-0003-4aa1-8794-c3f462030bda
	Vendor specific
Characteristic (Handle 0x7324)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039/char003c
	b8843add-0002-4aa1-8794-c3f462030bda
	Vendor specific
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039/char003c/desc003e
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Characteristic (Handle 0xa528)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0039/char003a
	b8843add-0001-4aa1-8794-c3f462030bda
	Vendor specific
Primary Service (Handle 0xa920)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023
	932c32bd-0000-47a2-835a-a8d455b859dd
	Vendor specific
Characteristic (Handle 0xc434)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0037
	932c32bd-1005-47a2-835a-a8d455b859dd
	Vendor specific
Characteristic (Handle 0xc434)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0034
	932c32bd-0007-47a2-835a-a8d455b859dd
	Vendor specific
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0034/desc0036
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Characteristic (Handle 0xe688)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0032
	932c32bd-0006-47a2-835a-a8d455b859dd
	Vendor specific
Characteristic (Handle 0xe688)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0029
	932c32bd-0003-47a2-835a-a8d455b859dd
	Vendor specific
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0029/desc002b
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Characteristic (Handle 0x0608)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0026
	932c32bd-0002-47a2-835a-a8d455b859dd
	Vendor specific
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0026/desc0028
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Characteristic (Handle 0x2d78)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0024
	932c32bd-0001-47a2-835a-a8d455b859dd
	Vendor specific
Primary Service (Handle 0xa920)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011
	0000fe0f-0000-1000-8000-00805f9b34fb
	Unknown
Characteristic (Handle 0x3c84)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0021
	97fe6561-a001-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x3c84)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char001f
	97fe6561-2004-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x3c84)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char001d
	97fe6561-2002-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x3c84)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char001b
	97fe6561-2001-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x3c84)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0018
	97fe6561-0008-4f62-86e9-b71ee2da3d22
	Vendor specific
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0018/desc001a
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Characteristic (Handle 0x9658)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0016
	97fe6561-0004-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x9658)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0014
	97fe6561-0003-4f62-86e9-b71ee2da3d22
	Vendor specific
Characteristic (Handle 0x9658)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0011/char0012
	97fe6561-0001-4f62-86e9-b71ee2da3d22
	Vendor specific
Primary Service (Handle 0xa920)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service000a
	0000180a-0000-1000-8000-00805f9b34fb
	Device Information
Characteristic (Handle 0xbad4)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service000a/char000f
	00002a28-0000-1000-8000-00805f9b34fb
	Software Revision String
Characteristic (Handle 0xbad4)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service000a/char000d
	00002a24-0000-1000-8000-00805f9b34fb
	Model Number String
Characteristic (Handle 0xbad4)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service000a/char000b
	00002a29-0000-1000-8000-00805f9b34fb
	Manufacturer Name String
Primary Service (Handle 0xa920)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0001
	00001801-0000-1000-8000-00805f9b34fb
	Generic Attribute Profile
Characteristic (Handle 0xdf44)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0001/char0002
	00002a05-0000-1000-8000-00805f9b34fb
	Service Changed
Descriptor (Handle 0x0015)
	/org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0001/char0002/desc0004
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration

According to the python code I found here GitHub - walter5138/hue_ble_python: Project controlling Philips Hue Bluetooth Color bulbs. Python version. it seems the characteristic used to switch on/off the lamp is /org/bluez/hci0/dev_xx_xx_xx_xx_xx_xx/service0023/char0026.
Switching the lamp on and off with hue_on_off.py does work, but I don’t get what I should send via mqtt. Also I am not sure if it would work, since the lamp is not paired to my esp32 running OpenMQTTGateway.
The facts that I do not know nor bluetooth neither python do not help I guess :sweat_smile:

Yes, the pairing might be an issue, but did you have it paired when testing the hue_on_off.py on your PC?

So here you have the required service and characteristic already, which you would also need for an OpenMQTTGateway WRITE command, but for a dimmable lamp I would have expected not just an On/OFF, but possibly brightness setting, with 0 being OFF, 255 ON, and in between all the dimming states - hue_brightness_set.py?!?

But do try the ON/OFF first, with the service/characteristc given above with publishing to

home/OpenMQTTGateway/commands/MQTTtoBT/config
{
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "ble_write_service":"0023",
  "ble_write_char":"0026",
  "ble_write_value":"00",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }

the value 00 just being a test for switching the lamp OFF, 01 for ON, not having examined the code further, but you can also read the current value with your phone for /service0023/char0026

The brightness seems to use the same service, but characteristic 0029, so testing with the value (in hex between 00 - ff) would be my next trial :wink:

Yes I paired and trusted it it before testing.

I tried reading and writing using service 23 and char 26, but got no answer from the lamp and no status change.
I also found this gist: Philips Hue BLE Services and Characteristics (WIP) · GitHub

DeviceInfo(softwareRevision, isOn, 
SceneLightState(color, powerOnBehavior, deviceInfo
Light(id,
Capabilities(dimmable, customState
PowerOnBehavior(option

hueplay, huebloom, hueiris, huelightstrip, huego, plug, bollard, wallspot, groundspot, flexiblelamp, wallshade, walllantern

[ea:44:13:bd:db:59]  Service [b8843add-0000-4aa1-8794-c3f462030bda]              Unknown, ble_firmware_update?
[ea:44:13:bd:db:59]    Characteristic [b8843add-0004-4aa1-8794-c3f462030bda]
[ea:44:13:bd:db:59]    Characteristic [b8843add-0003-4aa1-8794-c3f462030bda]
[ea:44:13:bd:db:59]    Characteristic [b8843add-0002-4aa1-8794-c3f462030bda]
[ea:44:13:bd:db:59]    Characteristic [b8843add-0001-4aa1-8794-c3f462030bda]
[ea:44:13:bd:db:59]  Service [932c32bd-0000-47a2-835a-a8d455b859dd]             light_control - startupConfiguration, combinedControl
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0001-47a2-835a-a8d455b859dd]    unk, 00 01 03 01 02 99 00 02 02 F4 01 03 02 01 00
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0002-47a2-835a-a8d455b859dd]    Light state, 01/00
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0003-47a2-835a-a8d455b859dd]    Brightness
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0004-47a2-835a-a8d455b859dd]    unk, E9 00
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0005-47a2-835a-a8d455b859dd]    Color
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0006-47a2-835a-a8d455b859dd]    unk, write-only
[ea:44:13:bd:db:59]    Characteristic [932c32bd-0007-47a2-835a-a8d455b859dd]    everything, includes color and brightness combined_light_control_port
[ea:44:13:bd:db:59]    Characteristic [932c32bd-1005-47a2-835a-a8d455b859dd]    Also everything, but last four bytes FF FF FF FF - default powerloss state? combined_light_control_port_factory?

[ea:44:13:bd:db:59]  Service [0000fe0f-0000-1000-8000-00805f9b34fb]             device_configuration_service_info - ProximityPairingSetup somewhere
[ea:44:13:bd:db:59]    Characteristic [97fe6561-0001-4f62-86e9-b71ee2da3d22]    zigbee address, 64 e2 7a 08 01 88 17 00
[ea:44:13:bd:db:59]    Characteristic [97fe6561-0003-4f62-86e9-b71ee2da3d22]    userDefinedDeviceName, "Lamp"
[ea:44:13:bd:db:59]    Characteristic [97fe6561-0004-4f62-86e9-b71ee2da3d22]
[ea:44:13:bd:db:59]    Characteristic [97fe6561-0008-4f62-86e9-b71ee2da3d22]
[ea:44:13:bd:db:59]    Characteristic [97fe6561-a001-4f62-86e9-b71ee2da3d22]    write-only
[ea:44:13:bd:db:59]    Characteristic [97fe6561-2004-4f62-86e9-b71ee2da3d22]    write-only
[ea:44:13:bd:db:59]    Characteristic [97fe6561-2002-4f62-86e9-b71ee2da3d22]    write-only
[ea:44:13:bd:db:59]    Characteristic [97fe6561-2001-4f62-86e9-b71ee2da3d22]    unk, 0A

[ea:44:13:bd:db:59]  Service [0000180a-0000-1000-8000-00805f9b34fb]
[ea:44:13:bd:db:59]    Characteristic [00002a28-0000-1000-8000-00805f9b34fb]     fw version
[ea:44:13:bd:db:59]    Characteristic [00002a24-0000-1000-8000-00805f9b34fb]     model
[ea:44:13:bd:db:59]    Characteristic [00002a29-0000-1000-8000-00805f9b34fb]     manufacturer
[ea:44:13:bd:db:59]  Service [00001801-0000-1000-8000-00805f9b34fb]
[ea:44:13:bd:db:59]    Characteristic [00002a05-0000-1000-8000-00805f9b34fb]     Service changed

So I tried reading and writing to service 932c32bd-0000-47a2-835a-a8d455b859dd and char 932c32bd-0002-47a2-835a-a8d455b859dd but it didn’t work either.

Sending 00 or 01 via nrfconnect from my phone to 932c32bd-0002-47a2-835a-a8d455b859dd works so I guess that pairing is the issue

That’s seems to be the problem then :frowning: on one hand good for security, on the other hand bad for not being able to use OpenMQTTGateway for controlling the lamp.

Try to add the mac_type into your json command "mac_type”:1

When controlling the switchbots, we have to add this.

No luck also adding "mac_type”:1
Does the order matter? The command was:

mosquitto_pub -t home/OpenMQTTGateway/commands/MQTTtoBT/config -m '{
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "ble_write_service":"932c32bd-0000-47a2-835a-a8d455b859dd",
  "ble_write_char":"932c32bd-0002-47a2-835a-a8d455b859dd",
  "ble_write_value":"01",
  "value_type":"HEX",
  "mac_type": 1,
  "ttl":4,
  "immediate":true }'

One last try with the previous service and characteristic? :wink:

mosquitto_pub -t home/OpenMQTTGateway/commands/MQTTtoBT/config -m '{
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "mac_type": 1,
  "ble_write_service":"0023",
  "ble_write_char":"0026",
  "ble_write_value":"01",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }'

BTW - the name of your BLE OpemMQTTGateway is just OpenMQTTGateway, or is it possibly OpenMQTTGateway_ESP32_BLE if you’re using the default BLE binary?

The WRITE commands would need the proper gateway name to work, if at all possible.

Yes, it’s OpenMQTTGateway_ESP32_BLE from your first posting :wink:

:man_facepalming:

I tried again all the commands, this time with the right topic. At least now I get a response from the lamp, unfortunately even when it reports “success” the lamp does not change state:

home/OpenMQTTGateway_ESP32_BLE/commands/MQTTtoBT/config {
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "mac_type": 1,
  "ble_write_service":"0023",
  "ble_write_char":"0026",
  "ble_write_value":"01",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }
home/OpenMQTTGateway_ESP32_BLE/BTtoMQTT/AABBCCDDEEFF {"id":"AA:BB:CC:DD:EE:FF","service":"0x0023","characteristic":"0x0026","write":"01","success":false}

home/OpenMQTTGateway_ESP32_BLE/commands/MQTTtoBT/config {
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "mac_type": 1,
  "ble_write_service":"932c32bd-0000-47a2-835a-a8d455b859dd",
  "ble_write_char":"932c32bd-0002-47a2-835a-a8d455b859dd",
  "ble_write_value":"00",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }
home/OpenMQTTGateway_ESP32_BLE/BTtoMQTT/AABBCCDDEEFF {"id":"AA:BB:CC:DD:EE:FF","service":"932c32bd-0000-47a2-835a-a8d455b859dd","characteristic":"932c32bd-0002-47a2-835a-a8d455b859dd","write":"00","success":true}

home/OpenMQTTGateway_ESP32_BLE/commands/MQTTtoBT/config {
  "ble_write_address":"AA:BB:CC:DD:EE:FF",
  "mac_type": 1,
  "ble_write_service":"932c32bd-0000-47a2-835a-a8d455b859dd",
  "ble_write_char":"932c32bd-0002-47a2-835a-a8d455b859dd",
  "ble_write_value":"01",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }
home/OpenMQTTGateway_ESP32_BLE/BTtoMQTT/AABBCCDDEEFF {"id":"AA:BB:CC:DD:EE:FF","service":"932c32bd-0000-47a2-835a-a8d455b859dd","characteristic":"932c32bd-0002-47a2-835a-a8d455b859dd","write":"01","success":true}

Hmm, so it sends back success, but nothing changes - hmm.

Are you getting any viable replies when READING the ON/OFF state?

home/OpenMQTTGateway_ESP32_BLE/commands/MQTTtoBT/config {
  "ble_read_address":"AA:BB:CC:DD:EE:FF",
  "mac_type": 1,
  "ble_read_service":"932c32bd-0000-47a2-835a-a8d455b859dd",
  "ble_read_char":"932c32bd-0002-47a2-835a-a8d455b859dd",
  "value_type":"HEX",
  "ttl":4,
  "immediate":true }

Most likely a pairing issue, what kind of pairing did it do when you connected with your phone? Did you need to enter a pin code or select yes/no? NimBLE should auto pair if the characteristic requires security to read/write to it, but if the device doesn’t respond with that being required when reading/writing then that won’t happen and needs to be done manually.

1 Like

Reading reply reports a failure:

 home/OpenMQTTGateway_ESP32_BLE/commands/MQTTtoBT/config {
   "ble_read_address":"AA:BB:CC:DD:EE:FF",
   "mac_type": 1,
   "ble_read_service":"932c32bd-0000-47a2-835a-a8d455b859dd",
   "ble_read_char":"932c32bd-0002-47a2-835a-a8d455b859dd",
   "value_type":"HEX",
   "ttl":4,
   "immediate":true }
 home/OpenMQTTGateway_ESP32_BLE/BTtoMQTT/AABBCCDDEEFF {"id":"AA:BB:CC:DD:EE:FF","service":"932c32bd-0000-47a2-835a-a8d455b859dd","characteristic":"932c32bd-0002-47a2-835a-a8d455b859dd","success":false}

Select yes/no, the same also with the laptop.

Thanks, I suspected that to be the case.

PR opened that might work for this: Add secure option for BLE connections. by h2zero · Pull Request #1251 · 1technophile/OpenMQTTGateway · GitHub

I just built and uploaded your fork to my esp32 and tried this, without success unfortunately.
I added "secure":true, to the json string, is this correct?

Wait no, I did something wrong, let me try again…

If you are unsuccessful could you please enable NimBLE debug logging by adding -DCONFIG_NIMBLE_CPP_LOG_LEVEL=5 to your build flags and post the log of the error?

Sorry, I built the wrong branch before.
Now if I send a command to the lamp the esp32 crashes. I added the debug flag, this is what I get:

18:12:24.713 -> N: [ MQTT->OMG ]: {"ble_read_address":"AA:BB:CC:DD:EE:FF","mac_type":1,"ble_read_service":"932c32bd-0000-47a2-835a-a8d455b859dd","ble_read_char":"932c32bd-0002-47a2-835a-a8d455b859dd","value_type":"HEX","ttl":4,"immediate":true,"secure":true}
18:12:24.746 -> N: BLE Connect begin
18:12:24.979 -> E: Failed to secure connection to aa:bb:cc:dd:ee:ff
18:12:25.079 -> CORRUPT HEAP: Bad head at 0x3ffe8384. Expected 0xabba1234 got 0x3f402790
18:12:25.079 -> abort() was called at PC 0x40087155 on core 1
18:12:25.112 -> 
18:12:25.112 -> ELF file SHA256: 0000000000000000
18:12:25.112 -> 
18:12:25.112 -> Backtrace: 0x4008fac4:0x3ffe7e40 0x4008fd41:0x3ffe7e60 0x40087155:0x3ffe7e80 0x40087281:0x3ffe7eb0 0x40128b5f:0x3ffe7ed0 0x40122209:0x3ffe8190 0x40122179:0x3ffe81e0 0x40094975:0x3ffe8210 0x40081f26:0x3ffe8230 0x4008704d:0x3ffe8250 0x4000bec7:0x3ffe8270 0x401ac5e1:0x3ffe8290 0x400d27d5:0x3ffe82b0 0x400ecb39:0x3ffe82d0 0x400ed2ca:0x3ffe82f0 0x400d27f8:0x3ffe8320 0x400d43ea:0x3ffe8340 0x400d6d65:0x3ffe8360 0x400d70d2:0x3ffe83e0 0x40090d52:0x3ffe8420
18:12:25.145 -> 
18:12:25.145 -> Rebooting...