Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Electronic shelf labels (ESL) as smarthome display #3

Open
JsBergbau opened this issue Jan 2, 2022 · 27 comments
Open

Electronic shelf labels (ESL) as smarthome display #3

JsBergbau opened this issue Jan 2, 2022 · 27 comments

Comments

@JsBergbau
Copy link
Owner

Originalpost by mvdklip

I did some research on electronic shelf labels (ESL) and found various options:

Infrared based: https://github.com/furrtek/PrecIR, https://github.com/Jonas1312/Pricehax
2.4GHz based: https://dmitry.gr/?r=05.Projects&proj=29.%20eInk%20Price%20Tags
Telink based: http://wiki.telink-semi.cn/wiki/solution/ESL/

Infrared is useless to me. The Telink variant is most interesting because it also supports Bluetooth and is related to these temperature sensors. Not sure if I can find how to address it through Bluetooth tough. Supposedly there are (Chinese) apps for Android which can send the correct sequences for updating these displays.
@JsBergbau JsBergbau mentioned this issue Jan 2, 2022
Merged
@mvdklip
Copy link

mvdklip commented Jan 3, 2022 •
edited
Loading

After a bit of searching I found the Bluetooth protocol documentation for Sertag which is one of the manufacturers of bluetooth ESLs. Cannot post the doc on this public github page though...

Example from the doc:

1.Request write block size command
CMD DATA
0x01 NULL

Response for write block size command
CMD DATA (short)
0x01 Block size

Note: Short is low before high

@mvdklip
Copy link

mvdklip commented Jan 3, 2022

I also have the Chinese and English 'Bluetag' apps which can be run on an Android phone to program various bluetooth ESLs from Aliexpress.

@mvdklip
Copy link

mvdklip commented Jan 3, 2022

One thing to keep in mind with ESLs is that the update frequency of the display cannot be high. It is only useful to display fairly static data. Updating more than once every 10 minutes is not recommended.

@JsBergbau
Copy link
Owner Author

JsBergbau commented Jan 3, 2022 •
edited
Loading

You can post the link to the document here or try dragging the file into this field.

Updating more than once every 10 minutes is not recommended.

Should be sufficient to display water temperature or some other kind of information. For me this is still very useful.

grafik

@mvdklip
Copy link

mvdklip commented Jan 3, 2022 •
edited
Loading

I meant I should not post 'secret' information on a 'public' Github. ;-)

But I found a public source for the document so I can link it now. You will find it on this page under 'Communication Protocol of Bluetooth Electronic Shelf Labels':

https://www.eslmfg.com/comm07/serve.htm

@JsBergbau
Copy link
Owner Author

JsBergbau commented Jan 3, 2022 •
edited
Loading

I understand. Thought it was some technical thing.

Here is the direct link https://www.eslmfg.com/download-file.htm?guid=488&type=pdf
I neede Chrome to download. Firefox produced an error all the time...

Here https://sertag.en.alibaba.com/productgrouplist-816403506/RF_electronic_shelf_labels.html you find Sertag ESLs. The big ones are quite expensive with around 40 $, but the 2.9" for about 6 $ is a reasonable price.

According to Video on https://www.alibaba.com/product-detail/Sertag-Dot-Matrix-lcd-Tag-Electronic_62543088175.html tag can blink by itself. Would be ideal to sense an alarm like temperature too low.

Do you have some spare time to try to program these? Would be great if you could write some python script to access these displays.

@mvdklip
Copy link

mvdklip commented Jan 4, 2022

Well, I think it's great these Sertag's are available for wholesale but I'm not sure it really helps in the end. If we make this an opensource project I think these guys will just stop selling single displays through Alibaba. I think we need to find a similar (or identical) device on AliExpress so that there is a seller in between and we can (sort of) source these devices anonymously. It will take a bit more research to find out what the Sertag devices actually is (Telink?) and who is selling the same devices under a different brand.

@mvdklip
Copy link

mvdklip commented Jan 5, 2022 •
edited
Loading

The YalaTech devices (available on AliExpress) seem to be very similar but are not identical. Also these are still being sold by the manufacturer itself so it's not said that it is possible to actually order these as a consumer. I would really like to find a source where we know for sure that these devices stay available for a longer period of time.

@JsBergbau
Copy link
Owner Author

JsBergbau commented Jan 5, 2022 •
edited
Loading

If we make this an opensource project I think these guys will just stop selling single displays through Alibaba.

That's an interesting point, I didn't think of. Sadly you're probably right. I can image that these manufacturers will stop selling the devices to customers. I can't really understand that, because making the documentation public and supporting OpenSource community would allow them to sell millions of additional tags to people like us that wan't to use it as information display in Smarthome.

@mvdklip
Copy link

mvdklip commented Jan 6, 2022 via email

@mvdklip
Copy link

mvdklip commented Jan 7, 2022

One of them has been shipped. The other I got enquiries about. I said that I want to use it for a demo in BLE mode and I don't need their base station for that.

@JsBergbau
Copy link
Owner Author

Thanks for the update. Very interesting that even on Aliexpress they tried to sell their basestation before shipping.

@mvdklip
Copy link

mvdklip commented Jan 8, 2022

I have cancelled the Yalatech order. They don't want to ship and they say their ble product cannot function standalone. They recommend me to use nfc version but that's useless in a smarthome setup.

With Gicisky I got a bit further. The device is shipped and I am in contact with a sales rep about SDK access. They normally charge $1280 for this but I said I only need some tech documents. I used the sertag protocol document as evidence that other companies are sharing such info so who knows. Also I found that apparantly the "real" manufacturer for these devices is picksmart.cn which also supplies the standalone BlueTag Android app:

http://a.picksmart.cn:8088/picksmart/app/ble-app-new.apk
http://a.picksmart.cn:8089/login
http://a.picksmart.cn:8081

It's a bit vague who the real manufacturer is. I have found Gicisky, Hi-Link, Pick Smart and Pique Smart as company names until now.

@mvdklip
Copy link

mvdklip commented Jan 11, 2022 via email

@JsBergbau
Copy link
Owner Author

I've already seen similiar devices. However for me the ESLs look much nicer, because they're flat and can just be put on the wall without any measures.

@mvdklip
Copy link

mvdklip commented Jan 12, 2022

I understand. Just mentioning because the ESLs are:

  • not as cheap as they seem. I paid around €17 for one 2.13" sized one.
  • probably well protected against "abuse". I'm going to try and see if I can program the Gicisky one but I'm not too optimistic about it.

The only thing I have right now is documentation by sertag, a Chinese (cloud) app by picksmart and (hopefully soon) a device to dissect. I'll keep you updated.

@mvdklip
Copy link

mvdklip commented Jan 12, 2022

Gicisky said I needed a base station as well if I wanted to use their ESL for anything else than using their app.

@mvdklip
Copy link

mvdklip commented Jan 12, 2022

Was looking at KKM now because they seem fairly open:

https://www.kkmcn.com/2-9-e-ink-display-tag
https://www.kkmcn.com/esl_sdk

They mention that the ESLs can also be programmed over BLE from a raspberry pi. They promise full access to all technical details but I haven't been able to find it yet.

Interestingly enough I found a document by e-paper-display.com (GooDisplay or good-display.com) which has the exact same devices and claims in it, but again wasn't able to find bluetooth protocol docs anywhere yet. Maybe somewhere in here:

https://www.good-display.com/blank15.html#c_portalResCompanyFile_list-15878877704403956-1

@JsBergbau I'm too tired to continue now, but if you find anything let me know.

@mvdklip
Copy link

mvdklip commented Jan 21, 2022 •
edited
Loading

I have received the Gicisky ESL. It works fine and I am able to program it using the Bluetag Android app. I did notice that this device has a TFT instead of e-ink screen which is less pretty. It's also not marked in any way with a manufacterer identification. Not even on the mainboard inside the device. The fact that it comes with the Bluetag app implies that it is compatible with Picksmart which owns that app. Now I "only" have to find out / reverse engineer what protocol this app / Picksmart uses.

Edit: the Picksmart product page lists the 2.1" TFT bluetooth ESL: http://www.picksmart.cn/index.php/list-16.html

@mvdklip
Copy link

mvdklip commented Jan 21, 2022 •
edited
Loading

Haha just used a hacked version of your script to detect the advertisements of this ESL:

BLE packet - Unknown: FF:FF:61:61:66:51 00 100201060302f0fe08ff5350a01f010100 -70

0x5053 (or 0x5350 reversed) is the manufacturer id as documented in the sertag doc. 0x1f is the battery voltage times 10 = 3.1V.

Power ON bluetooth device 0
Bluetooth device 0 is already enabled
Enable LE scan
scan params: interval=1280.000ms window=1280.000ms own_bdaddr=public whitelist=no
socket filter set to ptype=HCI_EVENT_PKT event=LE_META_EVENT
Listening ...
BLE packet - ESL: FF:FF:61:61:66:51 00 100201060302f0fe08ff5350a01f010100 -70
Battery voltage: 3.1 V

BLE packet - ESL: FF:FF:61:61:66:51 00 100201060302f0fe08ff5350a01f010100 -70
Battery voltage: 3.1 V

BLE packet - ESL: FF:FF:61:61:66:51 00 100201060302f0fe08ff5350a01f010100 -73
Battery voltage: 3.1 V

BLE packet - ESL: FF:FF:61:61:66:51 00 100201060302f0fe08ff5350a01f010100 -66
Battery voltage: 3.1 V

@mvdklip
Copy link

mvdklip commented Jan 22, 2022 •
edited
Loading

So it is a confirmed picksmart device:

[��CHG��] Device FF:FF:61:61:66:51 UUIDs: 00001800-0000-1000-8000-00805f9b34fb
[��CHG��] Device FF:FF:61:61:66:51 UUIDs: 00001801-0000-1000-8000-00805f9b34fb
[��CHG��] Device FF:FF:61:61:66:51 UUIDs: 0000fef0-0000-1000-8000-00805f9b34fb
[��CHG��] Device FF:FF:61:61:66:51 UUIDs: f000ffc0-0451-4000-b000-000000000000
[��CHG��] Device FF:FF:61:61:66:51 ServicesResolved: yes
[��CHG��] Device FF:FF:61:61:66:51 Name: PICKSMART
[��CHG��] Device FF:FF:61:61:66:51 Alias: PICKSMART

Both Sertag and Gicisky (and others) seem to resell this device under their own name. The Sertag docs are not great but they should be enough to let us write to this display at some point. It will take a few hours or days of tinkering though.

@JsBergbau
Copy link
Owner Author

To make developing easier for you:
Do you know nrF Connect https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp ? This App shows you a lot of information on your Android device.
There is also a version for Desktop computers available https://www.nordicsemi.com/Products/Development-tools/nRF-Connect-for-desktop
However I have some trouble to get this running on Windows. I have a integrated bluetooth/wifi card. I think this is due to some security settings on Windows.

Also Wireshark is very helpful just to have a look into the broadcasted packages. You can either open it live selecting bluetooth interface and running hcidump in parallel or you can use hcidump to write a file which can then be opened by wireshark hcidump -w filename.pcap.
For more details see https://blog.wirelessmoves.com/2014/01/tracing-bluetooth-with-wireshark-and-hcidump.html

@mvdklip
Copy link

mvdklip commented Jan 23, 2022

There is only an Android app so installing something on a desktop PC is not going to help unfortunately. Well, unless I get a development bluetooth dongle which can be flashed into a sniffing device. Normal bluetooth dongles cannot do this.

But... I have already captured a log on my Android phone by enabling bluetooth logging in the Android developer settings. This file is Wireshark compatible. Just didn't have time yet to analyse it.

@mvdklip
Copy link

mvdklip commented Jan 25, 2022 •
edited
Loading

I have deciphered the following from the dump:

            handle  value
write req   0x000f, 0x01 0x00                           # Enable notifications

write cmd   0x000e, 0x01                                # Request write block size command
rcvd notf   0x000e, 0x01 0xf4 0x00                      # Response for write block size command - Block size = 0x00f4 = 244

write cmd   0x000e, 0x02 0x98 0x0d 0x00 0x00 0x00       # Request write screen command
rcvd notf   0x000e, 0x02 0x00                           # Response for write screen command - Status = 0x00 = Success

write cmd   0x000e, 0x03                                # Request start transfer command
rcvd notf   0x000e, 0x05 0x00 0x00 0x00 0x00 0x00       # Response for start transfer command - Status = 0x00 = Success

write cmd   0x0012, 0x00 0x00 0x00 0x00 ...             # Transfer data packet - 240 bytes of data
rcvd notf   0x000e, 0x05 0x00 0x01 0x00 0x00 0x00       # Response for start transfer command - Status = 0x00 = Success, Next block index = 0x0001

write cmd   0x0012, 0x01 0x00 0x00 0x00 ...             # Transfer data packet - 240 bytes of data
rcvd notf   0x000e, 0x05 0x00 0x02 0x00 0x00 0x00       # Response for start transfer command - Status = 0x00 = Success, Next block index = 0x0002
...
write cmd   0x0012, 0x0e 0x00 0x00 0x00 ...             # Transfer data packet - 120 bytes of data
rcvd notf   0x000e, 0x05 0x08 0x00 0x00 0x00 0x00       # Response for start transfer command - Status = 0x08 = Done

So this is how to transfer an image to the screen. It matches the Sertag documentation. I don't know the format of the image yet.

@mvdklip
Copy link

mvdklip commented Jan 26, 2022 •
edited
Loading

The screen in this device is of type 101 which is not documented. Sertag documentation only has types 000 and 001. If I dump the transferred bytes into a file and assume that it is a raw black and white image (1 bytes = 8 pixels) then the data is for 30.720 pixels. 250x122 seems a likely display resolution in that case.

However... I can already see that this is not correct because the template / image I uploaded has all black on the first couple of lines which would mean that the image should start with a lot of 0xff values which it doesn't so it must be a different format. Even if a 0 pixel would be black instead of white this can't be the case because the file doesn't start with a lot of 0x00 values as well.

I do see 'aaaaaaaaaa' a few times in the hex stream. This kind of attracts attention but I'm not sure what to make of it yet. A hex A is a bin 1010. The predominant repeating patterns are 0's, a's and f's.

I just remembered that I updated the ESL multiple times during dumping and that I did a one-letter change in the template in between. This should lead to a small number of pixels difference when comparing two binary dumps but unfortunately I see that the first packets are identical but then change radically. This probably means that the data is compressed or encrypted in some way. The change happens in the end of the third packet: 56aa80753f4000000880 becomes 56aa80744340fd5aaaa9 and from there on it never recovers; the data is completely different. Also the last packet has 75 (instead of 120) bytes of data.

@jbraceg
Copy link

jbraceg commented Oct 21, 2022

@mvdklip did you get any further with this? I've just acquired a very similar device and gone down much the same path as you. I'd love to compare notes on code to update the screen.

@mvdklip
Copy link

mvdklip commented Oct 22, 2022

@jbraceg did not get any further unfortunately because I don't know what the binary data format is. Would be great to decipher it though so feel free to post your experiences in this thread.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@mvdklip @jbraceg @JsBergbau