Skip to content

Ollee Protocol

The Ollee Watch One uses a custom BLE protocol over the Nordic UART Service (NUS). Communication is frame-based with CRC-16/CCITT-FALSE validation.

Frame Structure

Frames are structured as: 

[00] [LEN] [AA] [55] [CRC-HI] [CRC-LO] [02] [TARGET] [PAYLOAD...]

Where: - [00] - Frame start delimiter - [LEN] - Length of everything after the [00] [LEN] bytes (magic bytes, CRC, 02, target, and payload) — equivalently, total frame length minus 2. LEN is a single byte, so the total frame is capped at 257 bytes - [AA] [55] - Magic bytes - [CRC-HI] [CRC-LO] - CRC-16/CCITT-FALSE (big-endian) over the inner bytes - [02] - Frame type indicator - [TARGET] - Command/response target byte - [PAYLOAD...] - Variable-length payload

Communication Details

  • Maximum ATT chunk size: 20 bytes per write
  • Fragmented reassembly supported for payloads larger than a single BLE notification
  • Responses arrive with target offset of +0x20 from request target
  • Protocol reverse-engineered clean-room from HCI snoop logs and BLE probes