Intercepting And Decoding Bluetooth Low Energy Data For Victron Devices

[ChrisJ7903] has created two Ardiuno programs for reading Victron solar controller telemetry data advertised via BLE. If you’re interested in what it takes to use an ESP32 to sniff Bluetooth Low Energy (BLE) transmissions, this is a master class.

The code is split into two main programs. One program is for the Victron battery monitor and the other is for any Victron solar controller. The software will receive, dissect, decrypt, decode, and report the data periodically broadcast from the devices over BLE.

The BLE data is transmitted in Link-Layer Protocol Data Units (PDUs) which are colloquially called “packets”. In this particular case the BLE functionality for advertising, also known as broadcasting, is used which means the overhead of establishing connections can be avoided thereby saving power.

Decryption is handled with the the wolfSSL library and [ChrisJ7903] had nice things to say about the helpful people over at wolfSSL. The AES-CTR algorithm is used and seeded with the per-device encryption key, a nonce/salt in little-endian format, and the encrypted data.

[ChrisJ7903] relied heavily on technical documentation provided by Victron in order to decode the received data; some of that documentation is made available in the Git repo and ultimately everything is revealed in the code itself.

We’ve done heaps of BLE stuff here at Hackaday in the past. If you’re interested in BLE tech check out this rain gauge and this doorbell.

9 thoughts on “Intercepting And Decoding Bluetooth Low Energy Data For Victron Devices

  1. Definitely well documented and an interesting read. Cool to see how the packets can be received for decoding without pairing, needing only the device name. I wonder if this could be done other ble devices I’ve seen in the wild like CPAP machines, toaster ovens and garage doors. He also used the excellent nRF Connect app, which is a great tool for the Bluetooth curious. Thanks for sharing this work!

    1. Ys, it absolutely is possible to do this for other BLE devices, I developed a little app to control a BLE device only last year by capturing the packets with one of the Nordic devices and nRF connect but I actually prefer to use my Android phone and Wireshark.

  2. Important work. This is a safety net for people with energy products still on their roofs that might lose access to diagnostic information as companies sunset products or completely go under (Renesola for example). Keep it up!

  3. Very cool. Might be worth mentioning that the program is reliant on the victron app being available and installed, at least for a period of time in order to gain access to the parameters required.

    The second the app leaves the app store and/or is retired the program will be useless :-(

    1. All Victron products with Bluetooth, and many without, also have a ve.direct port that can be communicated with over serial. They publish the full protocol details.

  4. I’ve bought a lot of victron gear and wondered about this. I am a bit puzzled about the image though. It shows bluesolar with bluetooth where I thought that was minus bluetooth and smartsolar has bluetooth.
    Maybe it’s different in other countries.

  5. The old days: manual with all requests and responses documented. Then they started culling the listed info (the old documents still worked, you just had to find them or remember the information).
    Now? 3 choices: log into a cloud using an app (shudder), reverse engineer it, let someone else reverse engineer it and put it on github.

    If using a device requires reverse engineering I will just shake my head: facepalm 🤦🏼‍♂️.

    Although it seems Victron publishes how to connect over serial, maybe a better (easier?) solution would be a serial connected micro-computer serving a local webpage with all the statistics?

Leave a Reply to AmphraredamineCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.