The Cowgirl - Support coming?

I notice that The Cowgirl is not yet supported.

It has been some time between app updates from the manufacturer and I’m hoping to see support implemented at some point.

Mostly curious to see if the rotator can be reveresed and what sort of custom patterns could be applied to the vibration and rotation.

I do own one so if their is any information or testing I can do to help implement support please let me know.

Generally the limiting factors for adding support for devices to Buttplug is access to hardware and the complexity of the protocol.

We do have a vague idea of the protocol for the cowgirl, but we’ll need your help to test that, plus there’s some gaps in our knowledge that will need filling in.

First off, I think we should confirm the BLE name and UUIDs. My preferred way to do this is with the nRF Connect app: it’ll scan for any BLE devices, let you connect to them and list their services and characteristics and send/receive data from there.

We believe that the cowgirl advertises itself as “THE COWGIRL” so that should show up in the device scanner list (the case is important too, so if it’s not showing up exactly like that, we’ll need to know).

When you click on the connect button, the app will take you to another screen where it’ll list the available services, and clicking on those will list characteristics. Look for the one with the UUID of 0000fe01-0000-1000-8000-00805f9b34fb (we’ll need to know if it’s a service or a characteristic; if it’s a characteristic, we’ll need the UUID for the service it’s under and if it has a WRITE property, if it’s a service we’ll need a list of the characteristics on that service).

We think we know what the data packets look like, but we can’t be 100% certain, and there’s still some unknowns that we might need to ask you to try out.

Happy to offer assistance where I can,

Can confirm device advertises as “THE COWGIRL”

UUID FE01 is listed as a characteristic with READ and WRITE

It is listed under the UUID FE00 which is listed as a Primary Service.


So we think the Cowgirl takes commands as 4 byte sequences, but we’re not certain what all the bytes do.

The first byte takes 0-2 (not sure what these do)
The second byte looks like the pattern 0-6
The third byte looks like the rotation speed in the range 0-255
The forth looks like vibration speed in the range 0-255

It looks like sending 0,0,0,0 will stop the cowgirl.

If you can send some varying speeds to the last 2 bytes and see if they respond as expected, that’d be a great starting point.

You might need to set a pattern to get them to respond.

We really have no idea what that first byte does, so leave that as 0 for now. Last thing we want is to put the device into some sort of firmware update mode.

Let us know how you get on.


So I connected to the Cowgirl with the NRF app and played around.

Sent commands as a byte array in the following format XXXXXXXX (AABBCCDD)

AA - left this as 00 as unknown.

BB - Patterns, needs to be at least 01 (steady) for vibration or rotation function to engage however as I expected this doesn’t apply any pattern to rotation function. 00 stops all functions. Suspect ‘00’ is like the pause function in the manufacturers app.

CC - Vibration Function. Tried values from 01 (can hear motor start/whine but to slow to function) 02 (very slow) for practical use 08 or higher. Not certain where increasing value causes no change but suspect around 90 as with rotation function below. 00 stops.

DD - Rotation Function. Tried values from 01 (rotates very slowly but may not be strong enough with attachment used internally) up to FF. No discernable speed increase above approx 90.

Cool, that confirms a lot about what we thought we knew.

I’m supprised at the speed cutoffs at 0x90 (I’m assuming that was hex not dec) since the app goes through the whole range in 10 intervals. Does the app’s speed control have the same sort of level off behaviour half way through its range?

I’m guessing the rotation never changes direction with these controls? Does it do so for any of the other 5 patterns?

I see the app saves and restores the value of the first byte, but I haven’t seen anywhere where that’s changed from. I doubt that setting this to 1 or 2 would cause any damages, but since the device is neither mine nor cheap, I’m more paranoid than I would be normally.

Btw, I’m documenting this over at incase you want to add notes directly.

I’m not sure on the speed cut off, I will have to compare with the app over the next few days. The app provides 10 speed settings, but the jump between them is more of a step where changing the value from say 10 to 11 to 12 to 13 provides a much more gradual/linear speed adjustment, closer to if one was using the manual control dial.

Rotation direction doesn’t change with these controls and honestly I’m not sure if it can currently. I’d seen it was a feature of the Motorbunny when using the app but not sure when they added it or if it was a feature all along. Although it is certainly not a feature of the physical controller on either machine. I’m guessing that The Cowgirl may require some sort of firmware update/modification to enable that feature.

As for hex I’m not certain but guessing it would be as I sent it a value of FF and it accepted it although the speed didn’t change.

I’ll have a bit more of a play around and see if I can better document the values for you.

If it helps, the app’s increments are:
0: 0x00
1: 0x19
2: 0x32
3: 0x48
4: 0x64
5: 0x7D
6: 0x96
7: 0xAF
8: 0xC8
9: 0xE1
10: 0xFF

Basically increments of 25, except the last one which is 30.

OK, So i’ve spent a bit more time playing around with the machine and I think I just wasn’t giving it enough time for the speed to ramp up.

Rotation range is confirmed from 00 through to FF

Vibration range is confirmed from 00 through to FF

The patterns themselves don’t have names but 1 through 6 correspond with the following taken from the owners manual.

Guessing typical names for the following patterns but the others I’m unsure.

  1. Pulse
  2. Wave