[bug] CADA RaceCar is not detected

[vicocz]

CADA RacaCar (C51072W) is not detected by BC app on all platforms: Windows, Android, iOS.

[vicocz]

Here is the list based on my investigation:

• seems advertisment packet is different: having 0x11FF manufacturer ID: 0x11FFAA1111000020B985000000A1CCB892A00C0948535A5F48533632323020

• on Windows there is currently unsupported missing flag for advertisement datagrams: NonConnectableUndirected

AI says:

Looking at the hex string you shared: 0x11FFAA1111000020B985000000A1CCB892A00C0948535A5F48533632323020

Manufacturer Specific Data (0xFF): The 11FF indicates a manufacturer-specific AD type.

Company ID: The AA11 is the identifier. Older CaDA models often used AC02 or 00FF. This change alone is enough to make BC2 ignore the device, as the app filters for known "Lego-compatible" IDs.

The Device Name: If you convert the end of that string (48535A5F485336323230) from Hex to ASCII, it translates to HSZ_HS6220.

This confirms the car is likely using a HunterSun HS6220 Bluetooth chip. This chip is becoming popular in newer RC sets but uses a completely different advertising structure than the older "CADA" or "LEGO-clone" protocols.

[vicocz]

@J0EK3R Could you try your CADA RC please?
Here are my findings: #205

[J0EK3R]

@J0EK3R Could you try your CADA RC please? Here are my findings: #205

Yes, I'll look for it as soon as possible.

BC on Android and iOS should work with MouldKing and CaDA - on Windows it's a bit tricky, my Win11 never worked OK because of the problem with BC Advertisement taking up to seconds to be changed.

[J0EK3R]

My first test an Android with BC Legacy 3.4.2505 was successful: the CaDA Racecar was detected.

Then I installed BrickController Legacy 3.425.500 RC2.
On start of the app the formerly added CaDA Racecar was loaded and could control the device.
Delete and rescan was successful, too.

Btw.: you have to switch off/on the CaDA Racecar while scanning.

[vicocz]

Anyway thanx a lot, it seems to me I must have different hw version with diferent advertisment responses. Will see how it goes...

[J0EK3R]

Could you send some screenshots of the CaDA App connecting your device?

[J0EK3R]

Oh, I've recognized that you are working on it.
Is there really a second revision of the CaDA device with different BT behavior?!

[vicocz]

Is there really a second revision of the CaDA device with different BT behavior?!

IMHO, seems so. At least the car gives totally different advertisment packets:

RC CAR

• advertising:
  • 0x11 FF AA11 11000020B985000000A1CCB892A0
• advertising when connected to IOS app:
  • 0x11 FF AA11 11885120B986000000A1CCB892A0

BC iOS - scan

• 0x02 01 1A
• 0x1B 03 C03DCA666D32B29DD257A15BF6BEB075B191489677F8DF421819

iPhone CADA Smart app iOS - scanning for car

• 0x02 01 1A
• 0x1B 03 C03DCA666D32B29DD257A1B5F692B075B191489677F880011819
  • decoded AppId: 0x88, 0x51, 0xF4

CADA Smart - when connected to the car

• 0x02 01 1A
• 0x1B 03 C000BB111120B98851767600F6A1CCB892B0270F862817D3ACCB

[J0EK3R]

Thank you for the screenshot and the datagrams...

With the screenshot I just wanted to verify the App and selected car - it's the same CaDA App I was using.

Did you have any success?

---

I have to admit I'm completely out of touch with this topic – I'd have to familiarize myself with it.

Basically, pairing the app and the RC car works like this: the app sends a datagram with an AppId. The RC car sends a response containing exactly this AppId and a DeviceId.

        byte[] pairingDataArray = new byte[] // 16
        {
              0x75, //  [0] const 0x75 (117)
              0x10, //  [1] 0x17 (23) STATUS_UNPAIRING - else - 0x10 (16)
              0x00, //  [2] DeviceAddress
              0x00, //  [3] DeviceAddress
              0x00, //  [4] DeviceAddress
              _appIdChecksumMaskArray[0], //  [5] AppID
              _appIdChecksumMaskArray[1], //  [6] AppID
              _appIdChecksumMaskArray[2], //  [7] AppID
              0x00, //  [8] 
              0x00, //  [9] 
              0x80, // [10] min 128
              0x80, // [11] min 128
              0x00, // [12] 
              0x00, // [13] 
              0x00, // [14] 
              0x00, // [15] 
        };

The datagrams used for control also contain these two IDs.

    private readonly byte[] _controlDataArray = new byte[] // 16
    {
            0x75, //  [0] const 0x75 (117)
            0x13, //  [1] 0x13 (19) STATUS_CONTROL
            0x00, //  [2] DeviceAddress
            0x00, //  [3] DeviceAddress
            0x00, //  [4] DeviceAddress
            0x00, //  [5] AppID
            0x00, //  [6] AppID
            0x00, //  [7] AppID
            0x00, //  [8] ChannelData random
            0x00, //  [9] ChannelData random
            0x80, // [10] ChannelData verticalValue (min= 0x80 (128))
            0x80, // [11] ChannelData horizontalValue (min= 0x80 (128))
            0x00, // [12] ChannelData lightValue
            0x00, // [13] ChannelData 
            0x00, // [14] ChannelData 
            0x00, // [15] ChannelData 
    };

In your local branch, I'm missing the extraction and setting of the DeviceAddress

            // extend if needed to other CaDA devices
            case 0x11aa:
                if (IsCadaRaceCarRev2(manufacturerData))
                {
                    device = template with
                    {
                        DeviceType = DeviceType.CaDA_RaceCar_Rev2
                    };
                    return true;
                }
                break;

                    // the origin deviceAddress is changing on every scan-response
                    // but inside the manufacturerData are 3 bytes identifying the device
                    string deviceAddress = BitConverter.ToString(manufacturerData.Slice(4, 3).ToArray()).ToLower(); // change device address

                    device = template with
                    {
                        DeviceType = DeviceType.CaDA_RaceCar,
                        DeviceAddress = deviceAddress,        // change device address, 

[vicocz]

So far just at the begining...

Definitely the new car has static bluetooth address, advertised as not connectable and it seems to me it behave little bit different:

• device advertise automatically
  • 0x11 FF AA11 11xxyy20B9zz000000A1CCB892A0
  • xx first byte of AppId based on pairing request from the app
  • yy second byte of AppId based on pairing request from the app
  • zz some flag: 0x85 when not connected, 0x86 when connected
• so I quess there is no address sent in manufacturer data as it used to be before, but need another car to compare

Interestingly, the car does not react to pairing (scanning) request from BC2, even it looks compatible with the CADA one.

Moreover if payload from CADA app after connection starts with C000BB111120B98851767600 it must use different seed / header or context values. Possibly there is no usa of random generator as coding seems to be quite stable.

Update 1: There are 2 types of command send by the CADA app:

• C000AA 1111 20B9 xx yy 6B6B00EBA1CCB892A0BAFD4507415C6C37
• C000BB 1111 20B9 xx yy 8C8C000CA1CCB892B0BAFD4507415C6C37`

Obviously it's different protocol:

• there are not encrypted 2 AppId bytes
• 2089 is some id from RC car, obviously advertised
• obviously there is not 1819 fill at the end, but some dynamic 8byte session id

Will let you now if there is any progress.

[J0EK3R]

...when examining some code, I found a different handlich of 0xFFF0 and 0x11AA.
And it seems to depend on the name of the BT Device - and here we find another well known string "HSZ_HS" (look at your second comment in this thread).

        @Override // p121v3.AbstractC2018m
        /* renamed from: c */
        public void CheckScanResult(int i5, no.nordicsemi.android.support.v18.scanner.ScanResult scanResult) {
            MainActivity.this.RestartScan();
            try {
                if (scanResult.GetBluetoothDevice().getName() != null && scanResult.GetBluetoothDevice().getName().contains("HSZ_HS") && scanResult.GetScanRecord() != null && scanResult.GetScanRecord().GetSparceArray() != null && scanResult.GetScanRecord().GetArrayAt(4522) != null) {
                    MainActivity.this.f3259s.SetScanResultString("scanResultHS", MainActivity.ToHexString(scanResult.GetScanRecord().GetArrayAt(4522), false)); // 8522 (0x11AA)
                }
                if (scanResult.GetScanRecord() == null || scanResult.GetScanRecord().GetSparceArray() == null || scanResult.GetScanRecord().GetArrayAt(65520) == null) { // 65520 (0xFFF0)
                    return;
                }
                MainActivity.this.f3259s.SetScanResultString("scanResultPC", MainActivity.ToHexString(scanResult.GetScanRecord().GetArrayAt(65520), false)); // 65520 (0xFFF0)
            } catch (Exception e5) {
                e5.printStackTrace();
            }
        }
    }