Yeah, the BTLE layer 2 protocol isn't very exciting, and the fragmentation and indirection between UUIDs and handles doesn't make it easy to follow. You should also query the device with https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp to get a map of the UUIDs and which ones are read/write. Maybe googling the device ID will yield prior work as well.
Tom (npub12zt…pr9e)