Fix Huawei AH100 body composition parsing

[martinriedel]

Fix Huawei AH100 body composition parsing

Summary

This PR fixes the Huawei AH100 (CH100) Bluetooth scale handler to properly parse body composition metrics (body fat %, body water %, and impedance) in addition to weight. Previously, the handler only showed weight measurements.

Problem

The original implementation attempted to parse measurement data after AES-CTR decryption, but the scale actually transmits data that is XOR-obfuscated only (using device MAC address), not AES encrypted. This caused all body composition values to be incorrect or missing.

Solution

Through reverse engineering with BLE packet captures, I discovered the correct data format:

Measurement Data Format

The scale sends measurements as two 16-byte frames (opcodes 0x0E and 0x8E) that are merged into a 32-byte buffer. This data is XOR-obfuscated with the device MAC address but NOT AES encrypted.

Byte positions in the XOR'd 32-byte buffer:

• Position 1: Weight (encoded as: weight_kg = (1457 - byte[1]) / 10)
• Position 2-3: Impedance (big-endian, ohms)
• Position 20: Body fat % (whole percent)
• Position 27: Body water % (whole percent)
• Position 31: User ID
• Timestamp: Position not yet identified (using current time)

Key Changes

1. Removed incorrect AES decryption from handleEncryptedPair() - data is XOR-only
2. Fixed weight parsing - discovered the encoded formula at position 1
3. Added body fat % parsing from position 20
4. Added body water % parsing from position 27
5. Added impedance parsing from positions 2-3 (big-endian)
6. Updated logging to show parsed metrics for debugging

Interesting Discovery: App-Dependent Calculations

Position 20 shows different values depending on which app is connected:

• With openScale: Displays as body fat % (e.g., 45%)
• With Huawei Health: Displays as skeletal muscle % (e.g., 45.8%)

This suggests the scale performs different calculations based on user profile data sent by each app during the authentication/setup phase.

Testing

Tested with:

• Device: Huawei AH100 (advertises as "CH100")
• Test measurements verified accurate values for:
  • Weight: ✓ Matches scale display (e.g., 128.2 kg)
  • Body fat %: ✓ Matches scale display (e.g., 45%)
  • Body water %: ✓ Matches scale display (e.g., 49%)
  • Impedance: ✓ Reasonable values (~300-500 Ω)

Limitations

1. Timestamp: The exact position of the timestamp in the 32-byte buffer has not been identified. The handler uses the current device time (Date()) for measurements. This is acceptable for real-time measurements but may affect historical data accuracy.

2. Additional metrics: Other metrics that Huawei Health displays (visceral fat, skeletal muscle mass, bone mineral, protein, etc.) are either:

   • Not transmitted in the BLE data, or
   • Calculated client-side by the Huawei Health app using proprietary algorithms

3. Initial investigation found visceral fat at position 10, but values were inconsistent with scale display and were removed.

Reverse Engineering Process

The fix was developed through systematic BLE packet analysis:

1. Captured raw BLE communication using Android HCI snoop logging
2. Created Python scripts to parse btsnoop format and extract measurement frames
3. Analyzed XOR-obfuscated data to identify metric positions
4. Verified findings across multiple measurements with known values
5. Discovered the weight encoding formula through regression analysis

Files Changed

• android_app/app/src/main/java/com/health/openscale/core/bluetooth/scales/HuaweiAH100Handler.kt
  • Removed AES decryption (lines 301-311)
  • Updated parseAndPublishMeasurement() with correct parsing (lines 329-371)
  • Added u16be() helper for big-endian reads (lines 436-437)
  • Enabled BODY_COMPOSITION capability (line 74)
  • Added detailed documentation of data format (lines 313-328)

Commit History

1. 85bf57c8 - Fix Huawei AH100 body composition parsing (remove AES, fix weight/impedance)
2. 70f8fe4e - Add visceral fat, skeletal muscle, and body water parsing
3. 9b28fb84 - Parse position 20 as body fat percentage
4. 2bc88406 - Remove visceral fat parsing due to inaccurate values

Related Issues

This addresses users who reported that the Huawei AH100 scale only showed weight without body composition metrics when using openScale, while the official Huawei Health app displayed full body composition data.