MPE Bluetooth Reverse Engineering

cookiesowns · 12-12-2017, 12:47 AM

Hi guys,

I've decided to embark on a small project to see if I can reverse engineer the bluetooth system for the M2 MPE.

The goal is to build a cross platform ( iOS & android app ) that allows you to connect to the MPE exhaust controller and open and close at will.

This will mean you will most likely need to leave the stock controller away from the car or remove the battery.

If I'm unable to get anywhere, I'll probably go the route of reverse engineering the stock exhaust flaps and interface with the MPE exhaust flaps.

I may open-source the project.
Timeline
~1-2months to reverse engineer the BLE stack, given its the holidays
~1-2months on my free time to engineer a cross platform iOS/Android app or ~ .5months to do a iOS only app
~ Future plans - geofenced ( GPS based ) app to open and close the valves based on the location. eg: open the flaps once you're outside neighbor hood.
~ Speed based flap control
~ Future future plans, link to Carista or ELM bluetooth adapter, and detect which mode you're in to open or close flaps if end-user doesn't want to go the route of re-wiring the controller.

Benzima · 12-12-2017, 12:19 PM

Cool project!

F87_LCI · 12-12-2017, 05:44 PM

Interested...as I've been asking people where they keep the controller...I hate things rattling around in my car (side door storage) and I don't want to use up one of my cup holders or remove the charging port - these are some of the ideas i have seen. Selfishly, I would like to see this on Android before iOS.

cookiesowns · 12-13-2017, 12:02 AM

Update: I've managed to use a few BLE sniffer apps on the iOS to connect to the bluetooth controller.

Funfact, the controller is actually named: SimpleBLEPheripheral. In which its actually not that simple at all. It presents two services, one with read/write privileges the other is a notify service.

Not so fun fact, I can't seem to get the controller to send my phone commands, so I'll have to be getting the BLE sniffer to see the packets that it transmits.

Dirtboy · 12-14-2017, 07:58 PM

Sub'd. I hope you get some where with this. If not the BT route, maybe you could find a way to hard-wire a switch to the rear control unit.

///M² · 12-14-2017, 08:45 PM

Sub'd as well. I been waiting for an app like this and always wondered why BMW never came out with one.

cookiesowns · 12-15-2017, 01:55 AM

I ordered the BLE sniffer yesterday night. so hopefully once I get it I'll have sometime to work on this project. I think once I have the protocols sniffed and saved it shouldn't be too hard to write a VERY, VERY basic app to get this working.

I'll let you guys know once I have a beta iOS app out. Sorry android guys, iOS first since that's my daily driver phone

lax01 · 12-18-2017, 12:46 AM

Subscribed!

M2UROTRSH · 12-18-2017, 12:31 PM

Quote:

Originally Posted by cookiesowns

I ordered the BLE sniffer yesterday night. so hopefully once I get it I'll have sometime to work on this project. I think once I have the protocols sniffed and saved it shouldn't be too hard to write a VERY, VERY basic app to get this working.

I'll let you guys know once I have a beta iOS app out. Sorry android guys, iOS first since that's my daily driver phone

Would love to get in on the TestFlight for this. I’m an app developer as well, if I can be of any help. Looking forward to this! Thanks for working on it.

cookiesowns · 12-19-2017, 11:28 PM

Quote:

Originally Posted by M2UROTRSH

Would love to get in on the TestFlight for this. I’m an app developer as well, if I can be of any help. Looking forward to this! Thanks for working on it.

I'm glad you know of testflight. I'm still pretty new to iOS app dev, but I have a developers account.

If its a possibility, I might try to build this via a framework such as react native. For now my goal is to focus on the BLE sniffing, but have not had time yet due to the holidays.

byrel · 12-23-2017, 03:01 PM

I've been thinking of doing something along the same lines but would probably just be repackaging the BT controller somewhere in the dash

SteveC90 · 01-20-2018, 05:11 PM

Very interesting. Will be monitoring for updates.

963mw · 01-20-2018, 05:11 PM

Subbed.

cookiesowns · 02-04-2018, 09:21 PM

Sorry guys no updates yet, haven't had time to invest time into engineering. Started a new job not too long ago, and been having VERY long weeks. Last thing I want to do is sit on a laptop in my car trying to sniff BLE.

SeanWRT · 02-22-2018, 11:33 PM

OP, is it possible to have mpe open at default and close upon double press? I prefer it being open 80% of time but valves often close all by itself as many of other forum members also reported. The reason remain unknown but it looks to me the Bluetooth signal impact in downtown city. That's why I unplug the control module from battery to make it permanently open. I think a default open mode would make that problem much easier to live with.

Is that an easier effort than to control valve via cell phone as your original plan?

Thanks.

cookiesowns · 02-26-2018, 06:05 PM

Quote:

Originally Posted by SeanWRT

OP, is it possible to have mpe open at default and close upon double press? I prefer it being open 80% of time but valves often close all by itself as many of other forum members also reported. The reason remain unknown but it looks to me the Bluetooth signal impact in downtown city. That's why I unplug the control module from battery to make it permanently open. I think a default open mode would make that problem much easier to live with.

Is that an easier effort than to control valve via cell phone as your original plan?

Thanks.

No, as there's no way to over-write the stock bluetooth controller / module firmware. If someone with some EE background, they could probably reverse the signals from the MPE exhaust module to open upon close signal, and close upon open signal. I'm sure an arduino wired in would be perfect for this.

a Piggyback for your MPE so to speak

SeanWRT · 02-27-2018, 02:28 AM

Quote:

Originally Posted by cookiesowns

No, as there's no way to over-write the stock bluetooth controller / module firmware. If someone with some EE background, they could probably reverse the signals from the MPE exhaust module to open upon close signal, and close upon open signal. I'm sure an arduino wired in would be perfect for this.

a Piggyback for your MPE so to speak

Thanks for the reply.

Never mind, I just got this problem fixed. Turns out to be the installation error. The fuse for MPE module was loose, and thus can disconnect from time to time to cause valve close.

Now valve is working correctly.

horsepower_and_hounds · 02-27-2018, 08:20 PM

Quote:

Originally Posted by SeanWRT

Thanks for the reply.

Never mind, I just got this problem fixed. Turns out to be the installation error. The fuse for MPE module was loose, and thus can disconnect from time to time to cause valve close.

Now valve is working correctly.

Nice eh? I love mine

12-12-2017, 12:47 AM	#1
cookiesowns ;) 587 Rep 898 Posts Drives: X5 45e, 535i N54, X3 N55 Join Date: Jan 2011 Location: West iTrader: (0)	MPE Bluetooth Reverse Engineering Hi guys, I've decided to embark on a small project to see if I can reverse engineer the bluetooth system for the M2 MPE. The goal is to build a cross platform ( iOS & android app ) that allows you to connect to the MPE exhaust controller and open and close at will. This will mean you will most likely need to leave the stock controller away from the car or remove the battery. If I'm unable to get anywhere, I'll probably go the route of reverse engineering the stock exhaust flaps and interface with the MPE exhaust flaps. I may open-source the project. Timeline ~1-2months to reverse engineer the BLE stack, given its the holidays ~1-2months on my free time to engineer a cross platform iOS/Android app or ~ .5months to do a iOS only app ~ Future plans - geofenced ( GPS based ) app to open and close the valves based on the location. eg: open the flaps once you're outside neighbor hood. ~ Speed based flap control ~ Future future plans, link to Carista or ELM bluetooth adapter, and detect which mode you're in to open or close flaps if end-user doesn't want to go the route of re-wiring the controller. __________________ *BM3, MHD, ECUTek Calibrator* \| N55/S58 specialist \| 2023 X5 45e Frozen Marina Bay Blue
	Appreciate 3 longbeachbluem2246.00 Dirtboy197.00 ///M²281.00 Tweet Quote

12-12-2017, 12:19 PM	#2
Benzima Colonel 1324 Rep 2,924 Posts Drives: 2017 BMW M2 Join Date: Nov 2015 Location: Montreal, CANADA iTrader: (0)	Cool project! __________________ BMW ///M Club Montreal BMW ///M Club Montreal Facebook Page
	Appreciate 0 Quote

12-12-2017, 05:44 PM	#3
F87_LCI Lieutenant Colonel 1787 Rep 1,718 Posts Drives: 2018 LBB F87 Join Date: Mar 2007 Location: North iTrader: (1)	Interested...as I've been asking people where they keep the controller...I hate things rattling around in my car (side door storage) and I don't want to use up one of my cup holders or remove the charging port - these are some of the ideas i have seen. Selfishly, I would like to see this on Android before iOS.
	Appreciate 0 Quote

12-13-2017, 12:02 AM	#4
cookiesowns ;) 587 Rep 898 Posts Drives: X5 45e, 535i N54, X3 N55 Join Date: Jan 2011 Location: West iTrader: (0)	Update: I've managed to use a few BLE sniffer apps on the iOS to connect to the bluetooth controller. Funfact, the controller is actually named: SimpleBLEPheripheral. In which its actually not that simple at all. It presents two services, one with read/write privileges the other is a notify service. Not so fun fact, I can't seem to get the controller to send my phone commands, so I'll have to be getting the BLE sniffer to see the packets that it transmits. __________________ *BM3, MHD, ECUTek Calibrator* \| N55/S58 specialist \| 2023 X5 45e Frozen Marina Bay Blue
	Appreciate 0 Quote

12-14-2017, 07:58 PM	#5
Dirtboy Second Lieutenant 197 Rep 258 Posts Drives: F87, F97 Join Date: Sep 2016 Location: Dallas iTrader: (0)	Sub'd. I hope you get some where with this. If not the BT route, maybe you could find a way to hard-wire a switch to the rear control unit.
	Appreciate 0 Quote

12-14-2017, 08:45 PM	#6
///M² Lieutenant 281 Rep 399 Posts Drives: 2017 BMW M2 6MT Join Date: Apr 2016 Location: Toronto iTrader: (0) Garage List 2017 BMW M2 [0.00]	Sub'd as well. I been waiting for an app like this and always wondered why BMW never came out with one. __________________ '17 BMW M2 LBB 6MT MPE '13 BMW 335i Estoril Blue - sold
	Appreciate 0 Quote

12-15-2017, 01:55 AM	#7
cookiesowns ;) 587 Rep 898 Posts Drives: X5 45e, 535i N54, X3 N55 Join Date: Jan 2011 Location: West iTrader: (0)	I ordered the BLE sniffer yesterday night. so hopefully once I get it I'll have sometime to work on this project. I think once I have the protocols sniffed and saved it shouldn't be too hard to write a VERY, VERY basic app to get this working. I'll let you guys know once I have a beta iOS app out. Sorry android guys, iOS first since that's my daily driver phone __________________ *BM3, MHD, ECUTek Calibrator* \| N55/S58 specialist \| 2023 X5 45e Frozen Marina Bay Blue
	Appreciate 2 PiK61.00 963mw331.00 Quote

12-18-2017, 12:46 AM	#8
lax01 Major 793 Rep 1,367 Posts Drives: 2017 M2 Join Date: Jan 2007 Location: Los Angeles, CA iTrader: (0)	Subscribed!
	Appreciate 0 Quote

12-23-2017, 03:01 PM	#11
byrel Registered 3 Rep 4 Posts Drives: F87 M2 LCI Join Date: Nov 2017 Location: Texas iTrader: (0)	I've been thinking of doing something along the same lines but would probably just be repackaging the BT controller somewhere in the dash
	Appreciate 0 Quote

01-20-2018, 05:11 PM	#12
SteveC90 Enlisted Member 83 Rep 30 Posts Drives: 2018 M2 Join Date: Nov 2017 Location: Washington, USA iTrader: (0) Garage List 2018 BMW m2 [0.00]	Very interesting. Will be monitoring for updates.
	Appreciate 0 Quote

01-20-2018, 05:11 PM	#13
963mw BMW Fanatic 331 Rep 1,076 Posts Drives: M2 Join Date: Nov 2014 Location: Mexico iTrader: (0)	Subbed. __________________ 18 BMW M2 \| ER DP \| ER CP \| Wagner Evo 2 Comp Intercooler \| Aquamist HFS4 \| BM3 \| CSF Oil Cooler \| AFE Drop-in Filter \| Bilstein B16 PSS10
	Appreciate 0 Quote

02-04-2018, 09:21 PM	#14
cookiesowns ;) 587 Rep 898 Posts Drives: X5 45e, 535i N54, X3 N55 Join Date: Jan 2011 Location: West iTrader: (0)	Sorry guys no updates yet, haven't had time to invest time into engineering. Started a new job not too long ago, and been having VERY long weeks. Last thing I want to do is sit on a laptop in my car trying to sniff BLE. __________________ *BM3, MHD, ECUTek Calibrator* \| N55/S58 specialist \| 2023 X5 45e Frozen Marina Bay Blue
	Appreciate 0 Quote

02-22-2018, 11:33 PM	#15
SeanWRT Colonel 3179 Rep 2,577 Posts Drives: E90 M3 & F87 M2 Join Date: Sep 2015 Location: Shanghai iTrader: (1)	OP, is it possible to have mpe open at default and close upon double press? I prefer it being open 80% of time but valves often close all by itself as many of other forum members also reported. The reason remain unknown but it looks to me the Bluetooth signal impact in downtown city. That's why I unplug the control module from battery to make it permanently open. I think a default open mode would make that problem much easier to live with. Is that an easier effort than to control valve via cell phone as your original plan? Thanks. __________________ Lemania 2320
	Appreciate 0 Quote

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search