Hacking PLAYBULB candles

PLAYBULB candles are smart LED candles that can be controlled by mobile Android/iOS devices. The official apps are good enough but I’d like to be able to control these candles using say a STACK Box or a NINJA SPHERE (when I’ll get them). The candles are Bluetooth Smart (aka Bluetooth Low Energy or BLE) devices so that shouldn’t be too complicated.

I just started playing with the candles and I’ll show you in this post how to control them using a computer with a BLE adapter. You’ll only need a Linux PC (should also work on a Mac) with integrated Bluetooth 4.0 or a USB BLE adapter (tested with this one but this one should also work). I used Santoku Linux on VirtualBox for my tests because it comes with BlueZ, the tool we are going to use to interact with the candle.

Turn the candle on then open a terminal and type in the following command to scan for BLE devices:

$ sudo hcitool lescan

The candle should appear in the list of devices:

LE Scan ...
AC:E6:4B:06:6F:CD (unknown)
AC:E6:4B:06:6F:CD PLAYBULB CANDLE

We can then use the mac address of the candle to enter interactive mode using gatttool:

$ gatttool -b AC:E6:4B:06:6F:CD -I

And connect to the candle:

[  ][AC:E6:4B:06:6F:CD][LE]> connect

Now that we are connected, we just need to write the right value to the right characteristic to do something useful with the candle. Using an Android device with the official app, I captured the communication to find out what data is sent when the app is used. For example, here’s the command to turn the candle on and set the color to red:

> char-write-cmd 0x0016 00FF0000

0X0016 is the handle to indicate what characteristic we want to write to and 00FF0000 is the value. FF0000 is the hex code for the color red so to set the candle to green (#00FF00) we just need to send the following command:

> char-write-cmd 0x0016 0000FF00

After capturing a few more packets, I figured out how to set an effect. We have to use another handle and the value format is slightly different. Here’s how we can set the candle effect on with the color blue:

> char-write-cmd 0x0014 000000FF04000100

The first eight bytes (000000FF) indicate that we want to set blue (#0000FF) as a static color. The next byte (04) indicates that we want the candle effect on. I don’t know yet what the next byte is used for but we can also choose the effect speed using the next one (01).

Here are a few other examples on how to use gatttool to control the candle.

Flashing effect, green color, lower speed:

> char-write-cmd 0x0014 0000FF0000001F00

Pulse effect, blue color, lower speed:

> char-write-cmd 0x0014 000000FF01001F00

Rainbow effect, highest speed:

> char-write-cmd 0x0014 0100000002000100

Rainbow effect fade, lower speed:

> char-write-cmd 0x0014 0100000003002600

To turn the candle off, it seems we just need to use this command:

> char-write-cmd 0x0016 00000000

This data could be used to control the candles through any BLE central device but also to develop alternate apps for Android/iOS.