The client and the Ninebot One communicate through Bluetooth Low Energy, a service and a characteristic.
The wheel starts a server which offers
Communication is always started by the application writing to the characteristic and answers are "notified" by the wheel varying the value of the characteristic.
The protocol seems to come from a more serial oriented one a defines some structure to commands and answers. Also answers may be spread over various variable changes so as to limit maximum answer size.
The model that implements the Wheel is an array of up to 256 positions which we will call variables. Each one has 16 bit value with interpretation varying according to the meaning.
Look into variables section for meaning and structure of each variable.
Each command or answer is a packet(s) with the following structure
When writing data (as when setting riding level) the x09 x01 are changed to x09 x03
To read the value of some variables the application writes a packet to the characteristic with com = number of first variable and ... is the length to read (2 * number of variables to read)
The wheel answers notifying of a variable change with blocks where com is the number of the first variable and every 2 bytes of ... represent a value of the form v = p[i+1] * 256 + p[i].
It is important to understand that answers may be split between different notifications.
An example of the communication follows :
< 55aa0309011708d3ff > 55aa08090117303030303030b6fe55aa0409011a > 353171ff < 55aa0309011708d3ff > 55aa08090117303030303030b6fe55aa0409011a > 353171ff < 55aa030901100ed4ff < 55aa030901b70437ff > 55aa080901104e324f45413157fe55aa08090113 > 35333341343595fe55aa04090116313278ff > 55aa060901b78a18030093fe < 55aa030901100ed4ff < 55aa030901b70437ff > 55aa080901104e324f45413157fe55aa08090113 > 35333341343595fe55aa04090116313278ff > 55aa060901b78a18030093fe < 55aa030901b70437ff < 55aa030901100ed4ff > 55aa060901b78a18030093fe55aa080901104e32 > 4f45413157fe55aa0809011335333341343595fe > 55aa04090116313278ff
Here the application begins asking for 8 bytes (4 variables) beginning at variable 0x17. First 3 variables correspond to the Pin Code (000000) and the other variable is the version number.
From here the dialog continues.