@Saschakopp I have been working on the same challenge for a few weeks now. The information is scattered everywhere and really needs to be centalised. The most useful info comes from the original post by Victron staffer Matthijs on the old Victron forum archive “Victron Bluetooth Advertising Protocol” .
That post is the source of the “Extra Manufacturer Data” PDF you linked in your first post. But much further down are very useful contributions by Jake Baldwin (19 May 23) and Chris Jackson (3 Nov 23).
For my convenience (and now yours I captured those contributions into this text document:
Victron protocol - Jake Baldwin 19 May 2023 (B).pdf (46.8 KB)
That info will give you lot’s of help on how to decode the data.
I highly recommend the 'nRF Connect" Bluetooth sniffer app. I’ve been using it on my Android mobile to look at the advertised data from my Smartshunt, BMV-712 battery monitors, and my MPPT100/30 solar charger.
For example this is an example of the RAW data from my Smartshunt:
0x0201061AFFE102100289A3025D9795F874601C3F869B6A196258EB22EDD314094241545462616E6B20536D6172745368756E74
Decoding this in 3 parts
1:020106
2:1AFFE102100289A3025D9795F874601C3F869B6A196258EB22EDD3
3:14094241545462616E6B20536D6172745368756E74
part 1
02 len: 2 bytes
01 type: 1 (flags)
06 value: 6 binary:0000 0110
part 2
1A len : 0x1A (26) bytes
FF type: 0xFF (the following 25 bytes are Vendor specific)
E102 Company identifier 0x02E1 (little endian) = “Victron Energy BV” (see Bluetooth Assigned Numbers p.234)
10 Manufacturer Data Record Type (always (0x10)
0289 Model Id for Smartshunt Battery Monitor
A3 “read out type” not always 0xA3 (JB ref A shows 0xA0)
02 Record Type: 0x02 = Battery Monitor (ref B)
the data above remains constant, whereas
the data below (except 0x95 constant) is updated continually
So these are only example data:
5D97 Nonce/Counter, the “salt” used in decryption (little endian)
95 Constant, so far (JB says this should match first byte of Encryption Key for this device but that’s 0x55 in m case??)
F874601C3F869B6A196258EB22EDD314 Encyrpted data (15 bytes)
(the “Battery Monitor” table in “Extra Manufacturing Data” doc confirms this should be 15 bytes, and shows how the bytes are allocated. I think this is what you were looking for in this thread.)
part 3
14 len : 0x14 (20 bytes)
09 type: 0x09 Complete Local name (from BT Assigned Numbers doc, table 2.3 Common Data Types)
42 41 54 54 62 61 6E 6B 20 53 6D 61 72 74 53 68 75 6E 74 (19 characters ASCII)
ASCII for “BATTbank_Smartshunt”