Reverse engineering of a bluetooth sensor
Looking at the datasheet, I interpreted it as:

Byte 1 - 0x46

Indicating this is a unidirectional device (bit7=0) that uses fixed time sending (bit 6=1 which doesn't seem correct) and it is of type 'door contact' (bits 0-5=0x06)

Byte 2 - 0x00/0x02

Indicating that the door is open or closed (bit 1 = 0 or 1). I also think that it indicates there is 'enough battery power' (bit 2 = 0), and the 'anti-tamper' has not been activated (bit 0 = 0)

Byte 3 - 0xXX

This is the 'Frame ID' - counting up for 0x40, to 0x5F then looping ?

Byte 4 - 0xXX

Checksum.

I'd do three things to test this theory:


Run the battery down a lot and see if the battery power indicator changes (byte 2, bit 2).
Open the case and see if the 'anti-tamper' bit changes (byte 2, bit 0)
Do sufficient switching to determine if byte 3 loops around as expected.


This these don't work out then you're likely looking at a different model.