Can you get battery state?

[ext4xfs]

A quick search of the code, it doesn't seem like it, but it seems like the findmy network provides that info? I saw this - https://github.com/MatthewKuKanich/FindMyFlipper/blob/e5a678e33dd17af46bb63050be4c9d10e17f6252/FindMyFlipper/findmy.c#L136, which seems to indicate that info should be available?

[malmeloo]

Battery level is not a standardised data point that is transmitted through the FindMy network. Apple devices obtain it (to my knowledge) by interacting with the device locally, which means it is only updated when the tag is in range of an owner device.

The FindMy protocol does allow for a single byte of arbitrary data to be transmitted from the tag to a finder device. I haven't inspected the code thoroughly, but FindMyFlipper appears to use this byte to transmit battery information. The library exposes this value through the status property of a location report, however since the use of this field is not standardised, it is up to you (the user) to parse this value.

[malmeloo]

My home assistant integration (see readme) exposes the status byte as an attribute on the device entity. So if you know the format of the byte, you should be able to use that with perhaps a little bit of templating.

[fz6]

I believe this is incorrect - as in, it is a standardised data point. The (leaked?) Find_My_network_accessory_protocol_specification.pdf states that the payload for separated state (which is the state our fake tags operate in) uses the 2nd byte of the payload (after the length byte with value 0x19).

It states that bits 6-7 are used for battery state, with values 0 = Full, 1 = Medium, 2 = Low, 3 = Critically low. I implemented this in the firmware I use and when using an application that understands the protocol (like nRF Connect), it correctly displays the battery state.

As an aside, note that setting this byte correctly (to spec) also causes my Android device to notify an AirTag is tracking me.

[malmeloo]

Interesting, I must be mistaken then. Can you confirm that the contents of this byte is also present in location reports returned by this library?

[fz6]

It should be, LocationReport.status() should contain the byte with the relevant bits.

FWIW I have experimented a bit with (ab)using this byte, as some of the bits are marked as reserved, or have defined uses (like the battery bits), and it seems like whatever value you set is respected and available in the report. Also, it is not documented in the protocol specification, but I believe some of the other bits must be used to represent what 'accessory' is broadcasting... I misuse the byte to broadcast temperature, and as a result the AirGuard software warns me a [phone|airbuds|airtag] is tracking me, depending on the weather 😄

[malmeloo]

That's definitely a clever way of delivering weather notifications 😆

I was aware of the status byte, with some clever tricks you can use it to exfiltrate a little bit of information from airgapped environments. But I wasn't aware that it is also officially used to report battery levels. You're probably right that some of those reserved bits are used to indicate that it's a tag instead of a full-blown device - otherwise AirGuard etc. would trigger on iPhones as well.