Third-party hubs over Bluetooth
Bluetooth Low Energy at 2.4 GHz, both ways for the brands that accept a connection and one way for the clone hubs driven by advertising. Four brands sell a battery brick that takes Bluetooth instead of infrared, and none of them asks for a password: connect, discover, write. The packet formats live here rather than in each brick's own note.
BuWizz
Detection by manufacturer data: v1 starts 48-4d, v2 and v3 start 4e-05, and the two are separated by the complete-local-name — "BuWizz" means v2.
v1, four channels. Service 0000ffe0-…, characteristic 0000ffe1-…, HM-10 style. One 5-byte write without response, v from −255 to 255: b0..b3 = (abs(v)>>2) | (v<0 ? 0x40 : 0), and b0 also carries | 0x80; b4 = level*0x20 (0, 0x20 or 0x40). Re-send inside 1500 ms or the motors stop.
v2, four channels. Service 4e050000-74fb-4481-88b3-9919b1676e93, characteristic 000092d1-…, notifying at 25 Hz with battery and motor voltage. Two writes: level {0x11, level+1} for 1 to 4, then outputs {0x10, c1, c2, c3, c4, 0x00} with c = v/2, −127 to 127. Rev-2 units swap the port order to v1, v0, v3, v2 when manufacturer-data byte 5 is 0x1E.
v3, six channels — four Powered Up smart ports and two Power Functions. Service 500592d1-…, characteristic 50052901-…, notifying at 20 Hz with a 54-byte status that includes per-port telemetry. Values are signed bytes, −127 to 127.
Command 0x31, "set motor data extended to support PU functions", is 21 bytes written without response and paced around 100 ms:
| bytes | what |
|---|---|
0 | the command |
1..16 | four signed int32 references for Powered Up ports 1–4: PWM, speed or position, whichever that port's mode wants |
17..18 | two signed int8 for Power Functions ports 5–6 |
19 | brake flags, bits 5–0, one per motor: set means slow decay with the armature shorted, clear means coast |
20 | lookup-table options |
The older 0x30 carries the same brake field at byte 7 and only six int8 PWM values, 0x81 full reverse to 0x7F full forward. Also 0x50 sets port mode (PWM, servo, stepper), 0x52 a servo reference, 0x53 PID, 0x38 a current limit from firmware 3.22.
BuWizz publishes its own specification, so read the PDF rather than a decompiled app: 3.0 API 3.22 and 2.0 API 1.3.
SBrick
Remote-control service 4dc591b0-857c-41de-b5f1-15abda665b0c, with a quick-drive characteristic 489a6ae0-c1ab-4c9c-bdb2-11d373c1b7fb for motors and a control characteristic 02b8cbcc-0e25-4bda-8790-a15f53e6010f for voltage and configuration.
Quick-drive is four bytes, one per channel, v from −255 to 255: byte[ch] = (abs(v) & 0xFE) | 0x02 | dir where dir is 1 for reverse. Bit 0 is direction, bit 1 is always set, bits 2 to 7 are the magnitude. Written with response.
Battery: write {0x0F, 0x08} to the control characteristic and read two bytes, then V = raw * 0.83875 / 2047.
Circuit Cubes
The simplest of the four. A plain Nordic UART service 6e400001-…, RX 6e400002, TX 6e400003, and plain text on it. Three outputs addressed by letter, each with a sign and a magnitude from 0 to 255: +077a-000b+000c. 0 stops everything, b asks for the battery.
Mould King, CaDA, JieStar
The DIY module is an ordinary peripheral: service 0000ae3a-…, characteristic 0000ae3b-…, four ports, heartbeat every second.
Everything else in the family is driven by advertising, which a browser is not permitted to do. What goes on the air travels as Bluetooth and is not a Bluetooth message: it is a proprietary nRF24 or XN297 frame — fixed header, 5-byte address seed, CRC-16, then LFSR whitening — dropped at a known byte offset inside the advertising PDU: offset 15 on Android as manufacturer data, offset 13 on iOS, where CoreBluetooth forbids manufacturer data and the bytes travel disguised as fake 16-bit service UUIDs. Manufacturer IDs are 0xFFF0 for Mould King and JieStar, 0xC200 for CaDA.
"No pairing" glosses over a light bind. A one-off connect telegram — on MK 6.0 6D 7B A7 80 80 80 80 92 — switches the hub out of 2.4 GHz remote mode, and bytes 1 and 2 of every telegram carry a per-controller app ID so two phones do not fight over one hub. CaDA adds a scan-request handshake on top.
Channel counts and value ranges per hub: Clone hubs (Mould King · CaDA · JieStar).