Controlling Disney’s Droids from Droid Depot with WebBluetooth
tl;dr: I made a web app to control your Droids from Droid Depot. It’s a work in progress available here: https://droid.bap.dev
At Droid Depot, in the recently inaugurated Star Wars: Galaxy’s Edge at Disneyland and Disney World Resorts, you can create your own Droid, see it come to life and play with it using a Bluetooth enabled remote.
Up until recently, the efforts of reverse engineering of the Bluetooth remote were not really successful, even if some found ways to replicate Bluetooth Beacons that are present in the parks and make the Droids come to life.
On May 4th (no coincidence!), Disney released the Droid Depot app, allowing Droid owners to control their little robots with an Android or iOS smartphone app over Bluetooth.
Bluetooth sniffing
I downloaded the app and played around with Apple’s PacketLogger tool (see this post about debugging Bluetooth signals), to dump all the sequences sent to the Droid by the iOS app.
Thankfully, it appears the Droid is a BLE device, with a non-standard BLE service (09b600A0–3e42–41fc-B474-e9c0c8f0c801) containing two BLE characteristics (read 09b600b0–3e42–41fc-b474-e9c0c8f0c801 and write 09b600b1–3e42–41fc-b474-e9c0c8f0c801).
I took down notes of the different sequences of values sent to the Droid by the app, and especially the initialization sequence. The initialization sequence seems to be required to “capture” the attention of the Droid, otherwise the Bluetooth connection is lost immediately and you’re not able to send any further commands.
The initialization sequence seems to be
2220 01repeated multiple times, then
2742 0f44 4400 1f00
2742 0f44 4400 1802also repeated mutliple times. The Droid emits a sound when the pairing is successful.
First prototype
I created a simple yet working web page that uses vanilla JavaScript code to connect to the Droid, and send the initialization sequence.
- This file only runs in browsers that support the WebBluetooth API;
- The script requires the Droid to be turned on and not connected to either the remote or the Droid Depot mobile app;
- All logging is in the console — look there for errors;
- When successfully paired, the Droid will emit confirmation sounds
Using this simple web page, I was able to replay some of the Droid hex commands that I discovered with PacketLogger.
Light and sound effects control
If seems the Droid has multiple library of sounds and light effects. Apparently, you need to select a “sound library” first, then send a command for a sound to play. Here are some hex commands that I found for both sound libraries and sounds themselves. Some sounds are not available accross all libraries:
Sound Banks Hex Codes
2742 0F44 4400 1F00
2742 0F44 4400 1F01
2742 0F44 4400 1F02
2742 0F44 4400 1F03
2742 0F44 4400 1F04
2742 0F44 4400 1F05
2742 0F44 4400 1F06
2742 0F44 4400 1F07
2742 0F44 4400 1F0ASound Hex Codes
2742 0F44 4400 1800
2742 0F44 4400 1801
2742 0F44 4400 1802
2742 0F44 4400 1803
2742 0F44 4400 1804Motor control
I have a BB-Series bot, with two motors, and I believe the R series has one more motor. I could only test the commands for two motors and some were not producing any result — I suspect, given the hex command structure, that it’s still possible to control another one. Feel free to confirm that to me on Twitter!
The general command structure is:
2942 0546 AXYY 012C 0000Where:
- A is the direction of the motor: 0 forward, 8 backward.
- X is the motor number: 0 for the first, 1 for the second or 2 for the third motor (Only motors 0 and 1 are available on BB Droids).
- YY is the power of the motor, from 00 (0%) to FF (100%)
For example:
2942 0546 0000 012C 0000Would turn off the first motor off, while
2942 0546 80FF 012C 0000would turn it on at full power, backwards.
Creating a webapp
To expose all those different commands — and avoid having to remember them and type them all manually, I created a simple webapp with a (somewhat limited) set of commands to control the robot.
I hope I’ll discover and test more commands soon to add to the web app, but it’s already available at https://droid.bap.dev
As soon as the app has more features and has gone through some testing, I’ll publish the source code online as well — and keep this article updated.
Some disclaimers
Since some of the lines of code in here will control your Droid, it’s always good to make sure it can run freely and will not fall from a surface or hit nearby objects.
I did this for fun and if you’re playing with your Droid. Use the instructions provided in this guide at your own risks. The apps and lines of code I wrote were not thoroughly tested and could brick or make your Droid otherwise unusable.
In case you did not already know, I do not own any of the Disney brand.
All the research completed for this article was done without decompiling or reverse engineering of Disney’s proprietary technology. Please do not reverse engineer or decompile intellectual property that’s not yours.
