Getting the IRK on recent Android phone (Pixel 8, Android 15)

[TRSx80]

I would consider myself perhaps a medium level wizard, nonetheless I struggled more than I thought should be necessary to determine the IRK of my phone.

Maybe this is because it's a (relatively) new-ish phone, and maybe Android changed some things (I am on Android 15)? Or maybe I am just thick. 😆

At any rate, hopefully the following is helpful to someone...

Internet awash with bad information

First of all, almost all the information on the Internet (about getting your IRK) seems to be about Apple/iPhones. The ESPresence project even recommends using the HA Companion app to send an iBeacon, instead of trying to determine the IRK. Which did not sound like the ideal approach to me.

Wireshark (did not work (for me))

Wireshark did not work for me. I tried several captures, here were some of the issues I experienced with that approach:

• adb takes quite a while to create each one, often stopping for quite long periods, making me think it had frozen. But no, just be patient. As always with serial connections, try to use a good quality cable which is as short as possible.
• I searched through all of my multiple capture files for all variations of the words 'key, resolv' and many more I found in various guides online, all to no avail. I came across a couple things which looked like keys, but the 'Private BLE Device' Integration (in HA) would not accept them.

ESPresence (did work)

So, what did work finally? Using ESPresence to get the key. It actually worked quite well, easily, and quickly!

I had held off on this as it was sort of recommended against in the wiki here, as well as being essentially against the recommendations of the ESPresence project themselves. But this is apparently all incorrect and perhaps out-of-date information, which was the main reason I decided to make this post.

I actually wish I would have went this way first, as I wasted a lot of time last night and this morning banging my head the Wireguard way. Anyway...

It's pretty straightforward, just follow instructions to flash ESPresence onto any ESP32 device. I even used the same ESP32 device I had been using for Bermuda experiments (which is no problem at all to flash back, as long as you have the YAML source). ESPresence even provide a web-based installer. I used Chromium here (as I block a lot of stuff in my main (Firefox) browser and my experience has shown me these kind of things work better in Chromium). But it was pretty quick and easy:

1. Flash ESPresence using web-based installer.
2. After 'flashing success', and while still connected (via USB), enter your Wi-Fi credentials. Device should now connect to your Wi-Fi network. You might have to reboot (remove and replace power) for this (not sure).
3. Navigate to URL of device and enter your MQTT credentials (I am pretty sure (but not 100%) that this is required for some reason?).

Now, follow the iPhone instructions for 'Enrollment' from an iPhone. Never mind that we are using an Android.

1. Navigate to the web UI of your newly flashed ESPresence device, to the 'Devices' tab, and press 'Enroll' button, and give your phone an easy to remember/find name (at this point I used 'wtfman' out of frustration 😆 ).
2. Go to Bluetoth settings in your phone. Find the 'ESPresence' device and pair to it. I allowed access to my contacts and history (even if that sounds irrelevant), because when I did not do that (the first time) it did not seem to work. But maybe that was a coincidence.
3. If you were successful, on the Devices page (of the ESPresence web UI), you should now see the device you just enrolled, with the name you gave it, and in the ID column it will say IRK:<blablabla>. This is the critical bit we are looking for. Copy this somewhere safe.

This part seemed a bit janky, you might have to repeat 2-3 times before you are successful.

Once you have the IRK, you can delete the 'ESPresence' device from the Bluetooth menu on your phone.

Enter IRK into 'Private BLE Device' Integration

1. Navigate to Integrations page in your HA web UI.
2. Click 'Add Integration'. Select 'Private BLE Integration' from the list (I think it's built-in?).
3. A dialog will pop up, asking you for an IRK. Enter the IRK key from above.
4. Bob's your uncle!

Bonus tip

If you have more than one Android (or iPhone) device in your household, leave the ESPresence device up and running until you have collected all your IRKs.

I was in a hurry to test, and a bit frustrated, so I immediately flashed back to Bermuda. So now I will need to do more flashing back and forth from ESPresence to Bermuda. Not the end of the world, but could have been avoided.

Cheers!

[agittins]

Glad you got it sorted!

Where did you find a suggestion to use wireshark? I'd have thought the IRK wouldn't be sent in plaintext but if wireshark has a built-in protocol follower I guess it could do it. Just haven't seen that described, as far as I can recall (or I might have and immediately dismissed it - which might be why it's not in the wiki 😄 ) For that matter, the amount of BS guides online was exactly why I wrote the wiki page, so now there'd be another one! 🤣

I figure the espresense and fyrefyrefyre methods as probably being about equal in difficulty, and I certainly don't discourage the espresense method, I've just never tried it - good to have a run-down on how it works though! I think I was mostly just unsure if the UI for it was on-device or needed something else installed, or MQTT running.

back and forth from ESPresence to Bermuda

between ESPresense and ESPHome, to be picky 😄

By the way, you might still want to enable the iBeacon transmitter in the companion app - not because you need iBeacons, but because it keeps the phone transmitting (and at a chosen power level) - which it might not if just left to its own devices - ymmv.

[TRSx80]

Where did you find a suggestion to use wireshark?

Android debugging logs section of the How to get the IRK (Identity Resolving Keys) for iOS, Android etc wiki page.

so now there'd be another one!

Well at least it is much more up-to-date information, for the most part.

I was mostly just unsure if the UI for it was on-device or needed something else installed, or MQTT running.

The UI (for the ESPresence method) is on device. Good point about MQTT. I do run it anyway, so I didn't even consider that. If someone was not though, that indeed would be a bit more setup. I cannot swear that it was required, but it seemed like it worked better if I put in the MQTT information on the ESPresence device.

So maybe I will send a patch to the wiki with some wording like "this method is very easy if you already have an MQTT broker running, otherwise setting that up (even temporarily) would be a little more work. There is an in-depth guide for this method on Android here (but should also work for iPhone).

you might still want to enable the iBeacon transmitter in the companion app

I have 10 more ESP32 on the way and should be arriving any day now. Once I get enough of those deployed, I'll be able to start really testing and tweaking the system. So I will keep that in mind when I get to that phase, thanks!

[tylerhartwig]

I searched through all of my multiple capture files for all variations of the words 'key, resolv' and many more I found in various guides online, all to no avail. I came across a couple things which looked like keys, but the 'Private BLE Device' Integration (in HA) would not accept them.

Did you reverse the keys when you found them and account for endians? when I tried this recently I had to adjust the endian for it to work -- you could check this manually now if you have logs of the keys you found.

in case you're not familiar, this is what reversing the key in terms of endianness:

1234AB

reversed would be (each pair is reversed)

AB3412

[TRSx80]

Did you reverse the keys

Indeed, I did. I had read about that and tried it, amongst many, many other things.

Maybe with all the changes I made, I messed up something along the way. Otherwise it seemed (as I wrote in OP) like much more of a hassle than I thought it should have been. Hopefully something I wrote saves someone else a little time and/or hassle.

[bartgrefte]

@TRSx80 Last weekend I tried to get the IRK of my Galaxy S20 FE 5G (Android 13). Initially I tried the Windows-method, no luck there. Tried several systems and several different (branded) bluetooth controllers. Realtek, MediaTek and Intel.

I ended up using the ESP32-method described at https://community.home-assistant.io/t/guide-getting-the-irk-for-your-phone/623694 , which uses
https://github.com/fryefryefrye/Decoding-Random-Bluetooth-Address/tree/master/esp32_get_irk/Arduino/esp32_get_irk to obtain the IRK. Just try to connect to it using a bluetooth terminal app and then check the terminal of the Arduino IDE for the IRK. That worked :)

Then I tried my smartwatch, Nothing Watch Pro 2, also no luck using the Windows-method and can't force it to connect to the ESP32, so that option is off the table.

[DerekSeaman]

I have released an ESPHome package which can grab the IRKs from Apple devices (iPhone, Watch, iPad), Android phones, and some Android watches. You can find the ESPHome package here: IRK Capture for ESPHome

[DerekSeaman]

Awesome! It should now also work with more Android watches.

[tylerhartwig]

Thank you for this! Just got my pixel watch irk with it, which was always a pain before. Actually didn't even need the tracker app

[DerekSeaman]

Thank you for this! Just got my pixel watch irk with it, which was always a pain before. Actually didn't even need the tracker app

Awesome! Android is very inconsistent on what actually will work.

[jksmurf]

Worked perfectly for me too, very slick. Thank you!

[philipp-volgger]

Hi Derek,

Thanks for the irk-capture project, great work! I wanted the same thing but without having to flash a dedicated ESP32, so I took your concept (Heart Rate / Logitech K380 GATT peripheral with encrypted reads to trigger full key distribution) and implemented it as a native Linux/BlueZ tool.

First tests with Android phones and an Apple iPad work fine. I vibe-coded it with Claude, and you're credited in the README.

Repo: https://github.com/philipp-volgger/bluez-irk-extractor