Sony Camera BLE Control Interface

Posted by Mark Kirschenbaum on

Sony Cameras are now supporting a Bluetooth Low Energy (BLE) based control protocol. This interface allows a client to control as well as acquire status from a BLE enabled remote. 


[Sony RMT-P1BT - Remote works similarly as the JJC RMT-P1BT]

This article assumes the reader knows basic BLE terminology so perhaps have a read on the Introduction of BLE from Adafruit if you're unfamiliar. This is not a step-by-step guide, but a broad reference guide on this protocol. As always, I'm available for hire if your product needs this connectivity. 


Discovery is rather straight forward for Sony BLE enabled cameras. How the App discovers the camera is via searching through the advertised manufacturer data for Sony's Bluetooth manufacturer ID of 0x012D (Little Endian).

Sony Manufacturer Advertisement Header

To summarize, we search for the advertising packet whose manufacturing data consists of:

0x2D 0x01 0x03 0x00 0x64 0x00

We don't necessarily search for a particular model code, but can for your particular application. Our camera is an e-mount and therefore transmits ASCII 'E1'
ModelCode = 'E1'


Finally, we seek for the camera's status via <tag><00><data>. Multiple tags can be added to each advertisement.

Tag 22h

 Meaning Mask
PairingSupported 0x80
PairingEnabled 0x40
LocationFunctionSupported 0x20
LocationFunctionEnabled 0x10
UnknownFunctionSupported 0x08
UnknownFunctionEnabled 0x04
RemoteFunctionEnabled 0x02
Unknown 0x01


Value Meaning
0xEF Pairing, Location not enabled
0xAF No Pairing, Location not enabled

Tag 21h

This tag seems to be mainly set by the Send to Smartphone Func.->Cnct. during Power OFF Option

Definitition Value
WirelessPowerOnEnabled 0x80
CameraOn 0x40
WifiHandoverSupported 0x20
WifiHandoverEnabled 0x10


Device Name

The device name is user configurable and is sent as an advertising packet.


A unique UUID is also sent on the a7c but not the a7m4. This may be unique to every camera. For example the ILCE-7C has


Supporting cameras have several modes of operations that determine which Services are operational. We'll focus on the DIRC service but for completeness here are the various modes.


Camera Control Service

The service enables various camera control over BLE. It's believed this service has more functionality than the DIRC, but its usage is somewhat limited at this time by clients. Once clients begin using this interface, you can be sure we'll snoop the interface. Camera Control Service is disabled if the "Bluetooth Rmt Cnt" is activated.

The Camera Control Service is currently being used by the Sony App for BLE to Wifi Handoff. Many of it's characteristics appear to be for FTP server support, but this is not confirmed. CC40 does contain all the FTP user provided server names so we expect the proceeding characteristics to apply to the 9 FTP servers.  

Characteristic UUID
CameraControlNotify CC01
CameraControlCharacteristic CC02
WifiStatusNotifyCharacteristics CC05
WifiSsidCharacteristics CC06
WifiPasswordCharacteristics CC07
FTP Status? Notify* CC21
FTP/Wifi Servers? Writes* CC22-CC2C
FTP Server Names* CC40

*ILCE-7C only

Camera Location Services

It appears this characteristic is for your mobile device to actively push location and time data to your camera. This gets enabled when "Location Info. Link Set." is enabled. 

Characteristic UUID
CameraLocation Service 8000DD00-DD00-FFFF-FFFF-FFFFFFFFFFFF
CameraLocationNotifyCharacteristic DD01
CameraLocationInfoCharacteristic DD11
CameraLocationFeatureCharacteristic DD21


Camera Pairing Service

This characteristic appears to allow untethered pairing and shutdown of the camera. 

Characteristic UUID
Pairing Service 8000EE00-EE00-FFFF-FFFF-FFFFFFFFFFFF
CameraPairingCharacteristic  EE01

Commands (Untested)

Command Values
writePairingCommand 06 08 01 00 00 00
writePairingCommandWithDisconnect 06 08 02 00 00 00
writePowerOffCommand 03 08 13


Camera Remote Control Service

This service provides a means to control the camera with a small subset of features. 

Characteristic UUID
RemoteCommand FF01
RemoteNotify FF02



S1 (Focus)
S2 (Shutter)
AF-ON Customizable Button
C Customizable Button
Focus Far
Focus Near
Zoom Tele
Zoom Wide



IRC will send a 0x0185 GATT Status back if there is a protocol error. 
Various notifications will be sent if processes such as a photo is taken, or recording starts.

Share this post

← Older Post Newer Post →

Hypoxic Products