Unable to connect to Onyx2.1


I have an Kiiroo Onyx 2. Using the tutorial, I get to the part that says: “Let’s see what devices we can discover.” After starting the scan it does not find my device. It is not paired with the PC, but it is discoverable as Onyx2.1. I noticed the firmware is 1.1, causing the Device name to be Onyx2.1 . So, do you think the device name is the problem or is it something else?



It’s very likely that we just need to add the new BLE name, but I’ll see if mine upgrades this weekend, then I’ll be able to confirm.


A quick update: my Onyx2 is reporting that it has firmware 1.6, and that it’s up-to-date. This could mean that you have a hardware revision that we’ve not seen yet.

Whilst I suspect that the protocol will not have changed, I’d love to test before making any changes.

If you happen to have an Android phone, nRF Connect will let you see the service and characteristic UUIDs of your Onyx, if these match the ones from the original Onyx2, then we can try sending it the same commands and see how it reacts.

The service UUID should be f60402a6-0293-4bdb-9f20-6758133f7090
Which should have these characteristic UUIDs:

  • 02962ac9-e86f-4094-989d-231d69995fc2
  • d44d0393-0731-43b3-a373-8fc70b1f3323
  • c7b7a04b-2cc4-40ff-8b10-5d531d1161db

If that all looks right, send 0x00 (byte) to c7b7a04b-2cc4-40ff-8b10-5d531d1161db.
Then send [ 0x60 0x32 ] to 02962ac9-e86f-4094-989d-231d69995fc2
Then send [ 0x03 0x32 ] to 02962ac9-e86f-4094-989d-231d69995fc2

If this all works right, the Onyx should “move” at half pace from one extreme to the other.


Have this issue with a new 2.1

These look different from the above when I look at them in nRF Connect


Characteristic UUID are


Thanks for the UUIDs. I suspect two of those characteristics is going to have write attributes and the other will have read and subscribe.

Could you please try sending the initialisation message (the single 0x00 byte) to one of the characteristics and then the movement commands to the other ([ 0x60 0x32 ] [ 0x03 0x32 ])?

If the protocol is the same, all we’ll need to do is add the new UUIDs and the name to get the Onyx2.1 working.


Just in case I’m understanding this wrong.

Read Write Write without response
Read Write Write without response Notify
Read Notify

Sending 00 to 1901 turns off the device and disconnects

Sending 00 to 1902 first and then 0632 to 1901 followed by 0332 doesn’t seem to do anything


Hi, any updates on the Onyx 2.1? I just ordered and received an Onyx2.1, and can confirm what gfrankf has said.

Only one other thing I tried was just sending [ 0x60 0x32 ] [ 0x03 0x32 ] to 00001902-0000-1000-8000-00805f9b34fb and I hear the device make a slight twitch on the second command, but not the movement that it should be doing.

If there’s anything else I can do, let me know. Thanks!


Damn, sorry for disappearing like that.
Unfortunately, the evidence suggests that Kiiroo have changed the protocol.

If either of you could capture the Bluetooth traffic when FeelConnect is controlling the device with either a HCI log or a BLE sniffer, we might be able to just spot what’s changed.


Hey, not OP, but I have some logs for you, sniffed and extracted from the bugreport, readable by wireshark. This covers connection to test playing a video:



Awesome! I might not have time to analyse it until Saturday, but I’ll report back as soon as I have.


I found a couple of minutes…
There’s a suspiciously low number of writes (wireshark filter “btatt.opcode == 0x12 || btatt.opcode == 0x52”), so I’m not sure if the log needed flushing to capture the video’s control, but we might have enough.

The interesting bit is that what looks like the movement commands have an extra 0x03 byte before them. The initialisation command looks like it’s missing, which is odd.

If that’s right, after power cycling the device (in case there’s lingering initialisation from FeelConnect), try sending [ 0x03 0x60 0x32 ] followed by [ 0x03 0x03 0x32 ] to 1902.


Hey, thanks for all you guys’ work on this. I’ll try to figure out how to capture a log as well, probably over the weekend, but I was able to try sending the 2 commands [ 0x03 0x60 0x32 ] and [ 0x03 0x03 0x32 ], but got no response from the onyx.


This conversation continued somewhat over on the Discord server, where @funjack commented:

But yeah, connecting to it and writing `[0x03, 0x00, 0x64, Position]` to `1902` without response should make it move.