elec:notes:wt_pulse
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
Last revision | |||
— | elec:notes:wt_pulse [2015/08/21 09:32] – created redox | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | # Withings Pulse | ||
+ | ## Overview | ||
+ | |||
+ | It's an activity tracker. I'm curious about this stuff theses days, so I thought I'd dive in and see... And of course, look closer =) | ||
+ | |||
+ | ## USB | ||
+ | |||
+ | The USB port of the device is only here for charging. But plugging it would throw: | ||
+ | < | ||
+ | [27701.907508] usb 4-1: new full-speed USB device number 18 using uhci_hcd | ||
+ | [27702.023964] usb 4-1: device descriptor read/64, error -71 | ||
+ | ... | ||
+ | [27703.414113] usb 4-1: device not accepting address 20, error -71 | ||
+ | ... | ||
+ | [27703.934408] hub 4-0:1.0: unable to enumerate USB device on port 1 | ||
+ | </ | ||
+ | So I thought there would be some way to put the Pulse in some kind of real USB Mode: | ||
+ | To get there, hold the Pulse button before you plug it in. With some trials, it enumerates as an USB HID device | ||
+ | [27723.342193] hid-generic 0003: | ||
+ | |||
+ | ### lsusb output | ||
+ | < | ||
+ | |||
+ | Bus 004 Device 017: ID 1fb2: | ||
+ | Device Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | bcdUSB | ||
+ | bDeviceClass | ||
+ | bDeviceSubClass | ||
+ | bDeviceProtocol | ||
+ | bMaxPacketSize0 | ||
+ | idVendor | ||
+ | idProduct | ||
+ | bcdDevice | ||
+ | iManufacturer | ||
+ | iProduct | ||
+ | iSerial | ||
+ | bNumConfigurations | ||
+ | Configuration Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | wTotalLength | ||
+ | bNumInterfaces | ||
+ | bConfigurationValue | ||
+ | iConfiguration | ||
+ | bmAttributes | ||
+ | Self Powered | ||
+ | MaxPower | ||
+ | Interface Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | bInterfaceNumber | ||
+ | bAlternateSetting | ||
+ | bNumEndpoints | ||
+ | bInterfaceClass | ||
+ | bInterfaceSubClass | ||
+ | bInterfaceProtocol | ||
+ | iInterface | ||
+ | HID Device Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | bcdHID | ||
+ | bCountryCode | ||
+ | bNumDescriptors | ||
+ | bDescriptorType | ||
+ | wDescriptorLength | ||
+ | | ||
+ | ** UNAVAILABLE ** | ||
+ | Endpoint Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | bEndpointAddress | ||
+ | bmAttributes | ||
+ | Transfer Type Interrupt | ||
+ | Synch Type None | ||
+ | Usage Type Data | ||
+ | wMaxPacketSize | ||
+ | bInterval | ||
+ | Endpoint Descriptor: | ||
+ | bLength | ||
+ | bDescriptorType | ||
+ | bEndpointAddress | ||
+ | bmAttributes | ||
+ | Transfer Type Interrupt | ||
+ | Synch Type None | ||
+ | Usage Type Data | ||
+ | wMaxPacketSize | ||
+ | bInterval | ||
+ | Device Status: | ||
+ | Self Powered | ||
+ | Remote Wakeup Enabled | ||
+ | </ | ||
+ | |||
+ | ## Sync | ||
+ | ### Overview | ||
+ | |||
+ | The Android App syncs with the Pulse, and then to the account. It uses some kind of JSON API, with POST requests. | ||
+ | |||
+ | The base URL for the synchronization server is `http:// | ||
+ | |||
+ | There' | ||
+ | |||
+ | ### / | ||
+ | Query | ||
+ | action=get& | ||
+ | |||
+ | |||
+ | * `_ANDRO_APPV_` is the Android App version. Current is: `161` | ||
+ | |||
+ | Reply: | ||
+ | {" | ||
+ | |||
+ | |||
+ | * `_ONCEVAL_` is a server-generated value that's used to instanciate session (both User and Device) | ||
+ | |||
+ | ### / | ||
+ | It looks like there are different actions handled by this URL. | ||
+ | #### User login | ||
+ | Query: | ||
+ | action=new& | ||
+ | |||
+ | |||
+ | * `_ACCOUNT_MAILADDR_` is the Mail address of the account, in plain text | ||
+ | * `_ACCOUNT_HASH_` looks like a MD5 hash, but isn't the account password. It's generated with `md5(_ACCOUNT_MAILADDR_: | ||
+ | * `_ACCOUNT_PASSWORD_` is the plain-text password of the account | ||
+ | |||
+ | |||
+ | Reply: | ||
+ | {" | ||
+ | |||
+ | |||
+ | * `_SESSION_ID_` is a server-generated ID: `xxxx-xxxxxxxx-xxxxxxxx` | ||
+ | * `_ACCOUNT_ID_` must be the real account ID (not sure though...) | ||
+ | |||
+ | #### Pulse login | ||
+ | Query: | ||
+ | action=new& | ||
+ | |||
+ | |||
+ | * `_PULSE_MACADDR_` is the Bluetooth MAC Address of the Pulse device: `xx: | ||
+ | * `_PULSE_HASH_` looks like a MD5 hash. | ||
+ | * It's generated with `md5(_PULSE_MACADDR_: | ||
+ | * `_PULSE_SECRET_` is a 16-chars hexstring: `NNxxxNNNNxNxNNNN` | ||
+ | I don't know it's generated, but it can be extracted from the Android log (with logcat, search for `-- withings *` ) | ||
+ | * `_PULSE_FWV_` is the Firmware version. Current is `971`. | ||
+ | * `_MFGID_` is a numeric ID: `XX32XX`. | ||
+ | * `_PULSE_BATLVL_` is the battery percentage: `0` to `100` | ||
+ | |||
+ | Reply: | ||
+ | {" | ||
+ | |||
+ | * `_PULSE_SESSID_` is a server-generated ID: `xxxx-xxxxxxxx-xxxxxxxx` | ||
+ | * `_DATEA_` is a Unix timestamp. Ex: `1391328539` | ||
+ | * `_DATEB_` is a Unix timestamp. Ex: `1396141200` | ||
+ | |||
+ | #### Session destroy | ||
+ | Query: | ||
+ | action=delete& | ||
+ | |||
+ | |||
+ | * `_SESSION_ID_` is the server-generated ID of the session to be destroyed: `xxxx-xxxxxxxx-xxxxxxxx` | ||
+ | |||
+ | Reply: | ||
+ | {" | ||
+ | |||
+ | |||
+ | ### Not detailed yet | ||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | firmware? | ||
+ | {" | ||
+ | |||
+ | / | ||
+ | |||
+ | / | ||
+ | |||
+ | ## Random notes | ||
+ | |||
+ | The Pulse has an OLED screen, a USB port, an onboard button and, of course, bluetooth | ||
+ | |||
+ | * Freescale Kinetis MK20DX256 - FCC photo is bad quality...K23ZJ2SD74 | ||
+ | * USB Mode, CDC Shell | ||
+ | * Serial Debug | ||
+ | * Hack firmware | ||
+ | * AC20B co-processor maybe | ||
+ | * SPI flash | ||
+ | * I2C bus | ||
+ | * DbLib | ||
+ | * 1234 | ||
+ | * DHD_RTOS | ||
+ | * ADXL 202/345 | ||
+ | * CC2564 | ||
+ | * | ||
+ | |||
+ | http:// | ||
+ | |||
+ | ## Links | ||
+ | |||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | * [[https:// | ||
+ | * [[http:// | ||
+ | |||
+ | ### Angel | ||
+ | |||
+ | * [[http:// | ||
+ | * [[http:// |
/home/share/www/redox.ws/wiki/data/pages/elec/notes/wt_pulse.txt · Last modified: 2023/11/24 21:55 by 127.0.0.1