Reading an ANKO body scale from its Bluetooth advertisements

The ANKO iF1012D is the body scale Kmart sells in Australia. It advertises over Bluetooth LE as IF_B7, and everything it measures is in the advertisement. Nothing has to connect to it, which means any passive listener in range can read a weigh-in, including an ESPHome Bluetooth proxy.

The layout of the manufacturer data, after the two-byte company ID:

Bytes	Meaning
10 to 11	weight, big-endian, in hundredths of a kilogram
13	impedance, as a raw code; 0 means no foot contact
14	status: 0x01 while measuring, 0xA1 when finished
15 to 16	frame counter and checksum

It belongs to the Senssun family of protocols. I worked it out from the vendor’s app and confirmed it against captures.

The impedance bytes were wrong for three releases

The first version of the integration read bytes 13 and 14 together as a 16-bit impedance in hundredths of an ohm, and treated the value 0x0001 as a “still settling” marker. It produced plausible numbers.

It was wrong. I added the last 30 raw advertisements to the diagnostics download so the decoding could be checked against real weigh-ins, and the captures showed two separate one-byte fields: a raw impedance code and a status flag. The “settling marker” was the status byte reading 0x01.

The raw codes seen so far run from 117 to 128 for a 61.5 kg man and 165 for a 71.65 kg man. How a code converts to ohms is still unknown. The integration keeps the old scaling as an assumption, labels every result derived from it bia_assumed, and will stay provisional until the scale has been measured against known resistors.

A decoder that produces believable numbers has not been shown to be right. The raw frames had to be put somewhere they could be looked at.