Skip to content

Bluetooth® Low Energy1🔗

Version 0.13 adds the TRANSFER packet, the Consenting state (which renumbers Wrapping Up to 10 in the STATUS packet), the Shots Remaining and Shot Capacity fields in the STATUS packet, parameter keys 7 to 9, and the Test Infrastructure device type.

There is a tool available for testing the KTag BLE packets on Android devices here: https://git.ktag.clubk.club/Software/Android-KTag-Apps/src/branch/main/subapp-bletool

The TRANSFER packet (0x08), which moves items such as K-Points between devices, has a page of its own.

Changes Since v0.13🔗

SystemK 02.03 includes these additions to the v0.13 specification. They will be part of the next version of the specification.

TAG (0x03): Splash Fields🔗

The last five bytes of the TAG packet, which were unused in v0.13, now carry the splash fields used by the BLE Bomb and the Bunker Buster (see Accessory Weapons and Splashes). The originating device sets them, and a device that relays the packet changes only Hops Remaining.

Byte Field Type Meaning 0xFF (legacy TAG packet)
0x1A Splash Target Teams UInt8 Relative to the packet's Team ID: 0 = all teams, 1 = originating team only, 2 = all except the originating team No team filter
0x1B Splash Minimum RSSI SInt8 Receivers ignore the packet if its RSSI is below this value (in dBm). -75 dBm
0x1C Hops Remaining UInt8 Number of times this packet may still be relayed (at most 5). 0 means it isn't relayed. Not relayed
0x1D–0x1E Splash ID UInt16 Identifies one TAG across all of its relays, so that a device acts on it only once. 0xFFFF: no splash ID

A device in any Playing state relays a TAG that has hops remaining, whether or not it was the target, and whether or not the TAG affected it. A device that doesn't support splashes sends 0xFF in all five bytes.

PARAMETERS (0x06): New Parameter Keys🔗

Parameter Key Meaning Value Format
10 Minimum RSSI to initiate a transfer (dBm) SInt32
11 Accessory mode: 0 = off, 1 = BLE Bomb, 2 = Bunker Buster UInt32
12 Bunker Buster direct damage (0 to 255) UInt32
13 Splash damage (0 to 255) UInt32
14 Splash minimum RSSI (dBm, -100 to 0) SInt32
15 Splash target teams: 0 = all, 1 = originating team only, 2 = all except originating team UInt32
16 Special weapon cooldown (milliseconds); 0 means no cooldown UInt32
17 Splash hops (0 to 5) UInt32

Not Yet Implemented in SystemK🔗

These parts of v0.13 are not yet implemented by SystemK 02.03:

  • STATUS (0x05): Shots Remaining and Shot Capacity are sent as 0xFF.
  • TRANSFER (0x08): an item quantity of 65535 ("all of the item") isn't treated specially.

Sniffing KTag BLE Packets with Wireshark🔗

During development, it can be very helpful to see all the BLE packets flying through the air. One way to do this is to use Nordic Semiconductor's nRF Sniffer for Bluetooth LE for Wireshark. Our preferred hardware is the nRF52840 Dongle, which can be obtained for about $10 wherever fine electronics are sold.

Instructions for installing the nRF Sniffer can be found here, but if you prefer watching videos to reading, Stuart Patterson has made a series of videos with clear instructions:

Sniffing, Reverse Engineering, and Coding the ESP32 Bluetooth LE by Stuart Patterson🔗

"Learn to sniff Bluetooth traffic, reverse engineer a custom protocol, and then code an embedded app on the ESP32 to leverage the protocol. Sniffing Bluetooth is not difficult and this 3 part series gets your started!"

Here's what KTag BLE packets look like on Wireshark. You can use the filter btcommon.eir_ad.entry.data[0:4] == 4b:54:61:67 to show only the KTag advertisements.

KTag BLE with Wireshark

  1. Bluetooth® Low Energy is a registered trademark of Bluetooth SIG, Inc. All trade names, trademarks, and registered trademarks mentioned in this documentation are the property of their respective owners, and are hereby acknowledged. ↩