MoasureONE E222

1. Project Overview

What is the MoasureONE?

The MoasureONE E222 is a handheld IMU-based measurement device that retails for around $150. It uses inertial sensors (accelerometers and gyroscopes) to measure distances, areas, and elevations by tracking its own motion through space. The device communicates via Bluetooth Low Energy with a companion mobile app that performs all computation—the device itself is essentially a dumb IMU sensor with a simple state machine.

Why this project?

Moasure's ecosystem is locked down. The mobile app validates devices against a server-side database (checking serial number and MAC address), firmware images are AES-encrypted, and there's no public API or SDK. This project aims to build open-source measurement software that talks directly to the device over BLE, bypassing the proprietary app entirely.

What we've accomplished

• Fully mapped the BLE GATT service—all 9 characteristics, their behaviors, and the cmd1 command set
• Decoded the IMU data format (124 bytes per packet, 5 samples at 100Hz)
• Reverse-engineered the firmware updater app (.NET MAUI) and its USB serial protocol
• Discovered and documented the production API (factory test data, calibration matrices, device metadata)
• Downloaded the full 138KB calibration dataset (48×24 matrix for sensor correction)
• Built a working Electron BLE explorer with real-time IMU visualization (Madgwick AHRS + dead reckoning)
• Wrote 12 Python research scripts for protocol probing, MITM proxying, and data capture
• Designed a next-generation hardware concept (UWB + RTK GPS measurement puck system)

2. Device Hardware

Dual Processor Architecture

The MoasureONE runs two separate processors on a single board, each with independent firmware:

Device Identity

Manufacturing History

The device went through 5 manufacturing phases with 41 factory tests, all passing. Data retrieved from the Moasure production API.

3. BLE Protocol

GATT Service

The device exposes a single BLE service with UUID 81f61400-3834-4eca-ba7f-845c28a2e453 containing 9 characteristics. All characteristic UUIDs share the same base with only the 16-bit suffix differing.

Status Codes

State Machine

cmd1 Command Map

IMU Data Format

During streaming, the data characteristic delivers 124-byte packets via notifications at ~20 packets/second (100Hz effective sample rate):

Offset  Size   Type        Description
0       4      uint32 LE   Packet counter (increments by 50 per packet)
4       24     6×float32   Sample 0: ax, ay, az, gx, gy, gz
28      24     6×float32   Sample 1: ax, ay, az, gx, gy, gz
52      24     6×float32   Sample 2: ax, ay, az, gx, gy, gz
76      24     6×float32   Sample 3: ax, ay, az, gx, gy, gz
100     24     6×float32   Sample 4: ax, ay, az, gx, gy, gz

5 samples × 6 floats × 4 bytes = 120 + 4 counter = 124 bytes
Accelerometer: m/s² (gravity ≈ 9.81 on vertical axis)
Gyroscope: rad/s (IEEE 754 LE float32)

Key Findings

• Firmware characteristic is a live counter, not a version number. Values fluctuate in the ~5180–5216 range (uint16 LE). Likely battery voltage ADC or temperature.
• Sensor characteristic slowly drifts in all states. 96 bytes of what appears to be live calibration offsets or bias readings.
• Streaming and measure are mutually exclusive. Sending 0x01 from measure mode exits to streaming; the device does not return to measure when streaming stops.
• The phone app does all computation. The device is just a sensor + state machine. All IMU integration, dead reckoning, and measurement calculation happens on the phone.

Connection Notes

• Keepalive: Read the config characteristic (0x1406) every 2–5 seconds to prevent disconnect
• Write mode: Use write-with-response (not withoutResponse) for cmd1
• Auto-sleep: Device sleeps if not physically moved or tapped. Wake with double-tap.
• Re-advertise: After disconnect, device takes 5–15 seconds to begin advertising again
• Single connection: Only one BLE connection at a time, but device continues advertising while connected
• Noble: Use @stoprocent/noble for macOS Electron compatibility

4. Firmware Update System

Firmware updates use USB (Micro USB cable), not BLE. A dedicated .NET MAUI app communicates with Moasure API servers and flashes firmware over USB serial.

USB Serial Protocol

Command Set

All commands use the .CMD\r\n format—a dot prefix, 3-letter command code, and CRLF terminator. Data payloads are hex-encoded.

Flash Update State Machine

ConnectingToModule
  → AcceptModuleConfig        (get serial, type, firmware version)
  → AcceptUnlock / Unlocked   (with UnlockPassword)
  → ConnectToBootloader       (enter bootloader mode)
  → AcceptBootLoaderInfo
  → FlashErase                (with FlashErasePassword)
  → AcceptFlashDataPage       (repeated for each firmware page)
  → RebootComplete
  → AcceptNrfUpdate           (optional: nRF52 BLE processor)
  → CalibrationUpdateReboot   (optional: calibration update)

Firmware Images

Five encrypted firmware images were extracted from the updater app bundle:

• M1 = PRO-ONE-260 (original MoasureONE, S70 processor)
• M2 = M2P 1600Hz (newer model, higher internal sample rate)
• All files are AES encrypted (entropy ~7.999 bits/byte, all sizes multiples of 16)
• Decryption happens on-device in the bootloader (key stored in device flash)
• No recognizable headers, strings, or magic bytes in the encrypted data

5. Moasure Production API

Overview

The Moasure production API provides access to factory test data, device metadata, and calibration matrices. All endpoints are unauthenticated—only the device serial number and MAC address are required.

Endpoints

get_tracker_info

GET /production/get_tracker_info?serial_no=18S1FR521035023
Accept: application/json; v=2.0

Returns the full manufacturing history: all 5 phases, 41 factory test results with actual/min/max values, distance accuracy measurements, and user ownership history.

get_the_module

GET /production/get_the_module?serial_no=18S1FR521035023&mac_address=22:E2:0F:8D:83:E6
Accept: application/json; v=2.0

Returns device metadata: serial, MAC, model ID, firmware versions (S70 and nRF52), sensor IDs, calibration state, validation status, and SHA hash for calibration verification.

return_the_calibration

GET /production/return_the_calibration?serial_no=18S1FR521035023&mac_address=22:E2:0F:8D:83:E6
Accept: application/json; v=2.0

Returns the full 138KB calibration dataset including the 48×24 calibration matrix, raw accel/gyro data (20 and 30 orientation captures respectively), and processing metadata.

Calibration Data Structure

The calibration result is a 48×24 matrix representing 8 orientation groups. Each group contains correction parameters for both accelerometer and gyroscope:

• 48 rows × 24 columns — stored as a JSON-encoded nested array string
• 8 orientation groups (6 rows each): each with a 3×3 rotation matrix + 3-element bias vector, for both accel and gyro
• Raw data: 20 accelerometer captures (576 values each) + 30 gyroscope captures (577 values each)
• Processed on: AWS EC2 instance EC2AMAZ-PFH7AJE running "MCC ver 2.1.4"
• Processing time: ~0.97s (accel) + ~0.67s (gyro)
• Scores: accel -13.96, gyro 2.51

API Response Structure

6. Existing Software Architecture

Stack

The current explorer is an Electron desktop application with a BLE manager in the main process, an IPC bridge via preload, and a Canvas 2D renderer for real-time IMU visualization.

Source Files

Architecture Diagram

┌─────────────────────────────────────────────┐
│  Main Process                               │
│  ┌────────────┐      ┌──────────────────┐   │
│  │  index.js   │─────▶│     ble.js       │   │
│  │  (Electron) │      │  (noble + GATT)  │   │
│  └────────────┘      └───────┬──────────┘   │
│                              │ IPC           │
│  ┌────────────┐              │               │
│  │ preload.js  │◀────────────┘               │
│  │ (bridge)    │                             │
│  └─────┬──────┘                              │
├────────┼────────────────────────────────────┤
│  Renderer Process                           │
│        │ contextBridge                       │
│  ┌─────▼──────┐  ┌──────┐  ┌────────────┐  │
│  │   app.js    │──│imu.js│──│visualizer.js│  │
│  │  (UI ctrl)  │  │(AHRS)│  │  (Canvas)   │  │
│  └────────────┘  └──────┘  └────────────┘  │
└─────────────────────────────────────────────┘

Research Scripts

12 Python scripts were written for protocol research and reverse engineering:

Current Status

The Electron app is a fully functional BLE explorer and IMU visualizer. It can scan for and connect to the device, send arbitrary commands, stream IMU data, and render real-time 3D orientation and motion trails. It is not yet a measurement application—that's the next phase.

7. Hardware Design Concept

A next-generation measurement system designed for contractors: a universal puck form factor with UWB mesh positioning, RTK GPS, and inertial dead reckoning.

Product Line

Two SKUs sharing a single ~60mm hockey puck enclosure (glass-filled polycarbonate + TPU overmold, IP67, MIL-STD-810H):

Positioning System

The puck system combines multiple positioning technologies for centimeter-level accuracy across all environments:

Z-Axis Accuracy Targets

• Outdoor (RTK + baro): ±2–3 cm
• Holes / Indoor (UWB + baro): ±2–5 cm
• IMU-only fallback: ±10–30 cm

Multi-Puck Operation

Any puck can be a beacon (fixed reference) or rover (moving measurement point), with roles set in software. Multi-puck modes enable:

• Distance — point-to-point between any two pucks
• Area & Perimeter — walk the boundary with rover puck(s)
• Elevation Profiles — traverse terrain with altitude tracking
• Volume — walk the surface of dirt piles, excavations
• Retaining Walls — measure along vertical faces

Charging & Accessories

Each puck has USB-C plus a magnetic pogo-pin interface for station charging:

• 2-slot station — $69
• 4-slot station — $99
• 8-slot crew case — $149 (rugged carry case with integrated charger)

Retail Bundles

• Single Indoor Puck — $149
• 2-Pack Indoor + 2-Slot Station — $367
• 4-Pack Indoor + 4-Slot Station — $695
• Pro Kit (1 Outdoor + 3 Indoor + 4-Slot) — $945

Find My Integration

Every puck supports Apple Find My and Google Find My Device networks via BLE, UWB precision finding (point-and-locate), and piezo buzzer for audible location.

RTK Corrections

The Outdoor Puck uses the u-blox ZED-F9P GNSS receiver with NTRIP correction sources:

• Free: State DOT CORS networks, RTK2go community casters
• Paid: Swift Navigation Skylark, PointOne Navigation
• Antenna: u-blox ANN-MB-00 (integrated ceramic patch in puck lid)

8. Implementation Roadmap

The path from BLE explorer to measurement application, broken into four phases: