Sony Cameras are now supporting a Bluetooth Low Energy (BLE) based control protocol. This interface allows a client to control as well as acquire status from a BLE enabled remote.
[Sony RMT-P1BT - Remote works similarly as the JJC RMT-P1BT]
This article assumes the reader knows basic BLE terminology so perhaps have a read on the Introduction of BLE from Adafruit if you're unfamiliar. This is not a step-by-step guide, but a broad reference guide on this protocol. As always, I'm available for hire if your product needs this connectivity.
Discovery is rather straight forward for Sony BLE enabled cameras. How the App discovers the camera is via searching through the advertised manufacturer data for Sony's Bluetooth manufacturer ID of 0x012D (Little Endian).
Sony Manufacturer Advertisement Header
|2d 01||Sony Corporation Company Identifier (0x012D)|
|03 00||This Sony is a Camera|
|45 31||ASCII Model Code
e-mount cameras 'E1', a-mount 'A1', etc.
To summarize, we search for the advertising packet whose manufacturing data consists of:
0x2D 0x01 0x03 0x00 0x64 0x00
We don't necessarily search for a particular model code, but can for your particular application. Our camera is an e-mount and therefore transmits ASCII 'E1'
ModelCode = 'E1'
Finally, we seek for the camera's status via <tag><00><data>. Multiple tags can be added to each advertisement.
|0xEF||Pairing, Location not enabled|
|0xAF||No Pairing, Location not enabled|
This tag seems to be mainly set by the Send to Smartphone Func.->Cnct. during Power OFF Option
The device name is user configurable and is sent as an advertising packet.
A unique UUID is also sent on the a7c but not the a7m4. This may be unique to every camera. For example the ILCE-7C has
Supporting cameras have several modes of operations that determine which Services are operational. We'll focus on the DIRC service but for completeness here are the various modes.
Camera Control Service
The service enables various camera control over BLE. It's believed this service has more functionality than the DIRC, but its usage is somewhat limited at this time by clients. Once clients begin using this interface, you can be sure we'll snoop the interface. Camera Control Service is disabled if the "Bluetooth Rmt Cnt" is activated.
The Camera Control Service is currently being used by the Sony App for BLE to Wifi Handoff. Many of it's characteristics appear to be for FTP server support, but this is not confirmed. CC40 does contain all the FTP user provided server names so we expect the proceeding characteristics to apply to the 9 FTP servers.
|FTP Status? Notify*||CC21|
|FTP/Wifi Servers? Writes*||CC22-CC2C|
|FTP Server Names*||CC40|
Camera Location Services
It appears this characteristic is for your mobile device to actively push location and time data to your camera. This gets enabled when "Location Info. Link Set." is enabled.
Camera Pairing Service
This characteristic appears to allow untethered pairing and shutdown of the camera.
|writePairingCommand||06 08 01 00 00 00|
|writePairingCommandWithDisconnect||06 08 02 00 00 00|
|writePowerOffCommand||03 08 13|
Camera Remote Control Service
This service provides a means to control the camera with a small subset of features.
|AF-ON Customizable Button|
|C Customizable Button|
IRC will send a 0x0185 GATT Status back if there is a protocol error.
Various notifications will be sent if processes such as a photo is taken, or recording starts.