我这个服务发现和读取特征值的函数哪里不对

#define MUL_CON_SER_UUID   {0x47, 0x7C, 0xE1, 0x25, 0x63, 0xFE, 0xD9, 0x9A, 0xef, 0x43, 0x7F, 0x44, 0xD8, 0x55, 0xFE, 0x47}
#define MCS_SERVER_CUST1_UUID {0x1E, 0x6B, 0xCC, 0x92, 0xFE, 0x9C, 0x71, 0xB8, 0x31, 0x42, 0x2C, 0x4C, 0x3B, 0x9A, 0x6A, 0x68} //custom1
#define MCS_SERVER_CUST2_UUID {0x1E, 0x83, 0x8D, 0x3B, 0x56, 0x05, 0x0C, 0xA3, 0xf5, 0x47, 0x93, 0x3C, 0xD6, 0xF5, 0x8F, 0x07} //custom2
#define MCS_SERVER_CUST3_UUID {0xBD, 0x74, 0xFF, 0xD0, 0xE8, 0xED, 0xA1, 0x93, 0x97, 0x47, 0x77, 0x5A, 0xD1, 0xBD, 0x62, 0xB9} //custom3
uint8 mcs_service_uuid[ATT_UUID_SIZE] = MUL_CON_SER_UUID;
uint8 mcs_service_cust1_uuid[ATT_UUID_SIZE] = MCS_SERVER_CUST1_UUID;
uint8 mcs_service_cust2_uuid[ATT_UUID_SIZE] = MCS_SERVER_CUST2_UUID;
uint8 mcs_service_cust3_uuid[ATT_UUID_SIZE] = MCS_SERVER_CUST3_UUID;

static void simpleBLEGATTDiscoveryEvent( gattMsgEvent_t *pMsg )
{
  BLE_DEV *p =  simpleBLECentralGetDev(pMsg->connHandle);

  /*get current state*/
  uint8 dis_state = p->simpleBLEDiscState;
  attReadByTypeReq_t req;
  static uint8 index = 0;
  gattMsgEvent_t temp_msg;
  memcpy(&temp_msg,pMsg,sizeof(gattMsgEvent_t));
  uint8 i;
  switch(dis_state)
  {
    /*step3:先获得服务有几组属性*/
    case BLE_DISC_STATE_SVC:
      // Service found, store handles
      if(pMsg->method == ATT_FIND_BY_TYPE_VALUE_RSP &&
         pMsg->msg.findByTypeValueRsp.numInfo > 0 )
      {
          p->mc_ble_svc_start_hdl = ATT_ATTR_HANDLE(pMsg->msg.findByTypeValueRsp.pHandlesInfo, 0);
          p->mc_ble_svc_end_hdl = ATT_GRP_END_HANDLE(pMsg->msg.findByTypeValueRsp.pHandlesInfo, 0);
          printf("start-%d,end-%d\r\n",p->mc_ble_svc_start_hdl,p->mc_ble_svc_end_hdl);
      }
      if(( pMsg->method == ATT_FIND_BY_TYPE_VALUE_RSP  && 
           pMsg->hdr.status == bleProcedureComplete ) ||
         ( pMsg->method == ATT_ERROR_RSP ) )
      {
        if (p->mc_ble_svc_start_hdl != 0 )
        {
          printf("[1]pMsg->method = %d\r\n",pMsg->method);
          // Discover characteristic
          p->simpleBLEDiscState = BLE_DISC_STATE_CUST1;
        
          req.startHandle = p->mc_ble_svc_start_hdl;
          req.endHandle = p->mc_ble_svc_end_hdl;
          req.type.len = ATT_UUID_SIZE;
          memcpy(&req.type.uuid[0],mcs_service_cust1_uuid,ATT_UUID_SIZE);

          GATT_ReadUsingCharUUID( p->ble_dev_conn_handle, &req, mc_task_id );
        }
      }
      break;
    case BLE_DISC_STATE_CUST1:
       printf("[BLE_DISC_STATE_CUST1]\r\n");
      // Characteristic found, store handle
      if ( pMsg->method == ATT_READ_BY_TYPE_RSP && 
           pMsg->msg.readByTypeRsp.numPairs > 0 )
      {
        p->simpleBLECharHdl[index] = BUILD_UINT16(pMsg->msg.readByTypeRsp.pDataList[0],
                                                    pMsg->msg.readByTypeRsp.pDataList[1]);
        printf("handle[%d]=%d\r\n",index,p->simpleBLECharHdl[index]);
        index++;
      }
      p->simpleBLEDiscState = BLE_DISC_STATE_CUST2;
      req.startHandle = p->mc_ble_svc_start_hdl;
      req.endHandle = p->mc_ble_svc_end_hdl;
      req.type.len = ATT_UUID_SIZE;
      memcpy(&req.type.uuid[0],mcs_service_cust2_uuid,ATT_UUID_SIZE);
      GATT_ReadUsingCharUUID( p->ble_dev_conn_handle, &req, mc_task_id );
      
    break;
    case BLE_DISC_STATE_CUST2:
      printf("[BLE_DISC_STATE_CUST2]\r\n");
      printf("method=%d,numPairs=%d\r\n",pMsg->method,pMsg->msg.readByTypeRsp.numPairs);
      // Characteristic found, store handle
      if ( pMsg->method == ATT_READ_BY_TYPE_RSP && 
           pMsg->msg.readByTypeRsp.numPairs > 0 )
      {
        p->simpleBLECharHdl[index] = BUILD_UINT16(pMsg->msg.readByTypeRsp.pDataList[0],
                                                    pMsg->msg.readByTypeRsp.pDataList[1]);
        printf("handle[%d]=%d\r\n",index,p->simpleBLECharHdl[index]);
        index++;
      }
    
      p->simpleBLEDiscState = BLE_DISC_STATE_CUST3;
      req.startHandle = p->mc_ble_svc_start_hdl;
      req.endHandle = p->mc_ble_svc_end_hdl;
      req.type.len = ATT_UUID_SIZE;
      memcpy(&req.type.uuid[0],mcs_service_cust3_uuid,ATT_UUID_SIZE);
      GATT_ReadUsingCharUUID( p->ble_dev_conn_handle, &req, mc_task_id );
      break;
  case BLE_DISC_STATE_CUST3:
      printf("[BLE_DISC_STATE_CUST3]\r\n");
      printf("method=%d,numPairs=%d\r\n",pMsg->method,pMsg->msg.readByTypeRsp.numPairs);
      if ( pMsg->method == ATT_READ_BY_TYPE_RSP && 
           pMsg->msg.readByTypeRsp.numPairs > 0 )
      {
        p->simpleBLECharHdl[index] = BUILD_UINT16(pMsg->msg.readByTypeRsp.pDataList[0],
                                                    pMsg->msg.readByTypeRsp.pDataList[1]);
        printf("handle[%d]=%d\r\n",index,p->simpleBLECharHdl[index]);
        index++;
      
        p->simpleBLEProcedureInProgress = FALSE;
      }
      p->simpleBLEDiscState = BLE_DISC_STATE_IDLE;
      break;
    default:
      printf("没有匹配特征值\r\n");
  }
}

上面整个过程,抓包是这个结果

查找的这个服务的范围是16-24