New Fogstar 628ah uses JBD Protocol variant that won;t work in BatMon-HA

[darrenjackson72]

Hi..

I have a new batch Fogstar 628ah battery which does not work with BatMon-HA at all.. It does work with the FogStar Drift App.. I have decompiled the APK and got the following information:

Fogstar Drift 628Ah BLE Protocol - COMPLETE ANALYSIS

Summary

The Fogstar Drift uses TWO different data formats:

1. Short Notifications (9 bytes) - Sent automatically, NOT PARSED BY APP
2. Long Response (100+ bytes) - Requested by app with command 3A3030303230303030306565387E

---

Issue: Your 9-Byte Notifications Are IGNORED

Your BLE Scanner captures show:

0000 FA4E 7700 0000...  (9 bytes)

The Fogstar app does NOT parse these!

Looking at v.java (the Fogstar protocol handler), line 19-41:

public boolean a(int i5, byte[] bArr) {
    String lowerCase = x.i.a(bArr).toLowerCase();
    
    // Only processes data starting with "3a3031" (ASCII ":01")
    if (lowerCase.startsWith("3a3031")) {
        // ... parse full response
    }
    
    return false;  // Short notifications are IGNORED
}

The app ONLY processes responses that start with 3A3031 (ASCII ":01")

---

The ACTUAL Protocol: Long Response Format

Command to request full data:

Write to FF01: 3A3030303230303030306565387E
               (ASCII: ":0002000000ee8~")

Response format (from v.java line 126-183):

The response comes as multiple packets starting with 3A3031 and must be assembled.

Once assembled and decoded (method x.z.a() decodes it), the format is:

Position  | Length | Description                    | Formula
----------|--------|--------------------------------|------------------
0-14      | 14     | Header (skipped)               | 
14-18     | 4      | Total Voltage                  | (hex_value * 2) / 1000 V
18-20     | 2      | Number of cells                | decimal
20-20+N*4 | N*4    | Cell voltages (N cells)        | hex_value / 1000 V each
...       | 4      | Charge current                 | hex_value / 100 A
...       | 4      | Discharge current              | hex_value / 100 A  
...       | 2      | Number of temp sensors         | decimal
...       | M*2    | Temperatures (M sensors)       | hex_value - 40 °C
...       | 4+     | Protection flags               | bit fields
...       | 2      | SOC %                          | decimal
...       | 4      | Remaining capacity             | hex_value / 10 Ah
...       | 4      | Total capacity                 | hex_value / 10 Ah
...       | 4      | Cycle count                    | decimal

Key parsing code from v.java:

// Line 133: Total voltage
batteryDetailBean.setTotalVoltage(
    r.s(((float)(r.i(substring.substring(0, 4)) * 2)) / 1000.0f, 2)
);

// Line 141-147: Current (charge vs discharge)
double i7 = r.i(substring4.substring(0, 4));  // Charge current
double i8 = r.i(substring4.substring(4, 8));  // Discharge current
if (i8 == 0.0d) {
    current = r.s(i7 / 100.0d, 1) + "";  // Charging
} else {
    current = r.s((-i8) / 100.0d, 1) + "";  // Discharging (negative)
}

// Line 117: Temperature
temperature = (hex_value - 40) °C

// Line 173: SOC
soc = r.r(substring13.substring(0, 2))  // Decimal percentage

// Line 175: Remaining capacity  
remaining_ah = (r.i(substring14.substring(0, 4)) / 10.0f)

// Line 176: Total capacity
total_ah = (r.i(substring14.substring(4, 4)) / 10.0f)

// Line 171: Cycles
cycles = r.r(substring12.substring(0, 4))  // Decimal

---

The Short Notifications (UNDOCUMENTED)

Your 9-byte notifications are NOT used by the app. They appear to be:

• Live voltage/current updates sent automatically
• Possibly a legacy protocol or debugging data
• The app ignores them completely

Hypothesis for 9-byte format:

Bytes  | Description
-------|---------------------------
0-1    | 0000 (header/padding)
2-3    | FA4E (voltage? current?)
4-5    | 7700 (constant 0x77)
6-8    | 0000... (padding/checksum)

But since the app doesn't parse these, this format is unreliable.

---

SOLUTION: Use The Official Command

To get battery data reliably:

1. Write command to FF01:

   3A3030303230303030306565387E
   

2. Enable notifications on FF01

3. Collect response packets (multiple packets starting with 3A3031)

4. Assemble and decode per the format above

---

Example Full Response

From the app code, a complete response looks like:

3A3031... [many bytes] ...7E

After decoding (removing ASCII encoding and checksums), you get the binary data that follows the format described above.

---

Next Steps

Option 1: Capture Real Response

Enable HCI snoop logging on Android:

1. Settings → Developer Options → Enable "Bluetooth HCI Snoop Log"
2. REBOOT phone
3. Open Fogstar app for 30+ seconds
4. Get btsnoop_hci.log from /sdcard/Android/data/
5. Analyze with Wireshark

This will show you the ACTUAL full response format.

Option 2: Use batmon-ha

Try https://github.com/fl4p/batmon-ha - MotorhomeFun users confirmed it works with Fogstar Drift.

Option 3: Implement Full Protocol in ESPHome

ESPHome will need to:

1. Write command 3A3030303230303030306565387E to FF01
2. Collect multi-packet response starting with 3A3031
3. Decode ASCII hex encoding
4. Parse binary data per format above

This is complex but doable.

---

Files Analyzed

• v.java - Fogstar protocol handler (y/v.java)
• BatteryDetailBean.java - Data model
• a.java - Event dispatcher (y/a.java)
• b0.java - BLE manager (y/b0.java)

Conclusion

Your 9-byte notifications are unsupported by the Fogstar app.

To integrate with Home Assistant, you must:

1. Send the request command
2. Handle multi-packet responses
3. Decode the long response format

The protocol is more complex than standard JBD, but now fully documented above.