Document Tremblr BT-R Protocol

[Mumble]

Service: 0xfff0
TX: 0xfff1

Message format

{command} 0x64 0x00 0x00 0x00 0x00 0x31 0x32 0x33 0x34 0x00 0x00 0x00 0x00 0x00 0x00 0x00 {crc-8 checksum}

The 0x31 0x32 0x33 0x34 bytes are intended to be used for password functionality but it appears to not be implemented.

Commands

The commands all map to button presses or releases on the UI.

0x01 - On/Off button held down
0x02 - On/Off button released

0x05 - Speed Up button held down
0x06 - Speed Down button held down
0x03 - Speed buttons released

0x07 - Suction Up button held down
0x08 - Suction Down button held down
0x09 - Suction buttons released

ex.
Turn on device - Send 0x01 and then 0x02
Turn off device - Send 0x01 and then 0x02
Increase speed - Send 0x05 once. The device will continue slowly speeding up until 0x03 is sent.

There doesn't appear to be a way of reading what the current on/off state, speed, or suction level is of the device.

CRC-8

The CRC-8 checksum formula is non-standard. In JavaScript it looks like:

calcCrc8 (data) {
    let bitCount = 0
    let crc = 0

    for (let i = 0; i < data.length; i++) {
      const byte = data[i]
      for (let j = 0; j < 8; j++) {
        if ((byte & (1 << j)) !== 0) {
          bitCount++
        }
      }
    }

    const remainder = bitCount % 3

    if (remainder === 0) {
      crc = 222 - bitCount
    } else if (remainder === 1) {
      crc = Math.floor(bitCount / 2) + 111
    } else if (remainder === 2) {
      crc = Math.floor(bitCount / 3) + 177
    }

    return crc
}

[penaltybush]

@denialtek Do you have the BLE Name it advertises under?

I'm looking to write a BLE to RF bridge for the Tremblr so that the older model can be used by the new BT-R smart app and any future services. Simular to LVS-Gateway.

My current attempts to emulate it using the information you have already provided doesn't allow for it to be detected by the smart app. If you have any additional information about the way this model presents itself via bluetooth I'd be greatful.

Thanks.

[Mumble]

BLE Name: FM-T

[penaltybush]

@denialtek Thanks that was what I was missing. I was able to grab some data from the iOS app.

From the iOS app I don't seem to receive button release messages, if I hold down a button on the app the message repeats around once per second.

[penaltybush]

I noticed that in the App Store screenshots it also shows a remote marked as 'GIGOLO'. I checked the FCC ID filing for the Tremblr BT-R and the documents mention both the Tremblr and the Gigolo so I suspect there will be an announcement for a Gigolo BT-R at some point.

I tested setting the BLE Name to 'FM-G' and this makes the BLE device show up in the iOS App as GIGOLO and presents the same virtual remote minus the -/+ Suction buttons. I can also confirm that the buttons on the Gigolo remote send exactly the same codes as the Tremblr remote.