#492 Amazfit Pace support

Open
opened 3 years ago by Tobi-K · 25 comments
Tobi-K commented 3 years ago (Migrated from github.com)

Hello everyone,

after my plan of acquiring a Pebble Time 2 and use it with Gadgetbridge was sadly destroyed by FitBit, I finally settled with the Amazfit Pace as my first ever smartwatch.

Like most people around here, I would like to keep my personal data as private as possible. Therefore I hope that the watch can be used with Gadgetbridge sometime, and I hope to be able to contribute to that.

The Amazfit Pace is a Smartwatch with a focus on sports / activity tracking, mainly running, with build in GPS and heart rate monitor. It is manufactures by a sub-brand of Xiaomi, the makers of the Mi Bands that are already supported by Gadgetbridge. Because of that last fact, I hope that maybe the communication between watch and app might be, at least partly, already implemented in GadgetBridge (one can dream, right?).

I realize that the developers here are already very busy, and I have nothing but respect for the dedication and the time they invest. I do embedded programming for a living and have worked with different buses and protocols in the automobile sector. Therefore, the Bluetooth logs I acquired in the last two days look somewhat familiar to me. I was surprised how well Androids Bluetooth Logs and Wireshark work together. However, I don’t have any experience with Java, Bluetooth or Android development. So, while I would really love to actively contribute here, I will definitely need some help.

The watch arrived on this past Sunday, 01.01.17, and here is what I did and found out so far:

  • Before pairing the watch with the official app, I tried to search for it with Gadgetbridge, plain Android settings as well as a Linux laptop (hcitool scan, hcitool lescan). None of the three managed to find it.
  • This seems to be the first stepping stone: there is no option in the watches menu to make it visible or detectable. When selecting the Bluetooth option in the watches menu, it displays the caption “Searching...", no option to make it visible. It supports bluetooth headphones, hence the search I guess.
  • To pair the watch with the official app, a QR code is displayed on the watch that is then scanned by the app, then the pairing takes place. For me this is consistent with the assumption that the watch is not detectable like most Bluetooth devices, but has to be addressed directly. I have a btsnoop-Log of the procedure, but have not had the time to analyze it properly.
  • I tried several times to find the device with Gadgetbridge and the Android Bluetooth menu, while paired to the official app and while unpaired, but to no avail.
  • The last ting I tried was talking to the device directly by using the Bluetooth MAC address that can be found in its menu, and that finally worked with the linux laptop: by issuing hcitool info MAC-Address I was able to extract the attached information: amazfit_pace_info.txt. This does not mean a whole lot to me right now, but I guess it helps.

I will set up android-studio on my machine and will check out and try to understand some code as soon as I find the time (3 kids, I know, everyone has excuses...). In the Polar M400 request issue #455 a certain diff was mentioned that shows the work done to support a new device, I will have a look at that too.

Furthermore, I will try to analyze the communication between official app and watch some more. So far there is a lot of plain ASCII that I found, but also many parts I do not understand yet. I have attached a small log that shows the reception of an e-mail with k-9 mail: btsnoop_hci_mail_received.txt

I was not allowed to attach the binary .log-file here, so I had to rename it to .txt,I hope that is ok.
If somebody finds the time to have a look at this and finds something familiar, that would be awesome.

However after that, I am unsure how to proceed. Without knowing much more, my plan was to add the possibility of manually entering a MAC-address to the Gadgetbridge code (I guess the Debug section would be a good place for that) and then see if I can get some basic responses from the watch.

  • Does this seem like a viable plan to you or am I getting ahead of myself?
  • Should I focus on analyzing the communication first, to check if an implementation into Gadgetbridge is even possible?
  • Is there anything else that you would do before touching the code, any additional information that I should extract first?

I really do hope to find the time to contribute here, until then, thank you very much in advance and have a nice day.

Hello everyone, after my plan of acquiring a Pebble Time 2 and use it with Gadgetbridge was sadly destroyed by FitBit, I finally settled with the [Amazfit Pace](https://www.amazfit.com/shop/pace?variant=25112) as my first ever smartwatch. Like most people around here, I would like to keep my personal data as private as possible. Therefore I hope that the watch can be used with Gadgetbridge sometime, and I hope to be able to contribute to that. The Amazfit Pace is a Smartwatch with a focus on sports / activity tracking, mainly running, with build in GPS and heart rate monitor. It is manufactures by a sub-brand of Xiaomi, the makers of the Mi Bands that are already supported by Gadgetbridge. Because of that last fact, I hope that maybe the communication between watch and app might be, at least partly, already implemented in GadgetBridge (one can dream, right?). I realize that the developers here are already very busy, and I have nothing but respect for the dedication and the time they invest. I do embedded programming for a living and have worked with different buses and protocols in the automobile sector. Therefore, the Bluetooth logs I acquired in the last two days look somewhat familiar to me. I was surprised how well Androids Bluetooth Logs and Wireshark work together. However, I don't have any experience with Java, Bluetooth or Android development. So, while I would really love to actively contribute here, I will definitely need some help. The watch arrived on this past Sunday, 01.01.17, and here is what I did and found out so far: * Before pairing the watch with the official app, I tried to search for it with Gadgetbridge, plain Android settings as well as a Linux laptop (_hcitool scan_, _hcitool lescan_). None of the three managed to find it. * This seems to be the first stepping stone: there is no option in the watches menu to make it visible or detectable. When selecting the Bluetooth option in the watches menu, it displays the caption "Searching...", no option to make it visible. It supports bluetooth headphones, hence the search I guess. * To pair the watch with the official app, a QR code is displayed on the watch that is then scanned by the app, then the pairing takes place. For me this is consistent with the assumption that the watch is not detectable like most Bluetooth devices, but has to be addressed directly. I have a btsnoop-Log of the procedure, but have not had the time to analyze it properly. * I tried several times to find the device with Gadgetbridge and the Android Bluetooth menu, while paired to the official app and while unpaired, but to no avail. * The last ting I tried was talking to the device directly by using the Bluetooth MAC address that can be found in its menu, and that finally worked with the linux laptop: by issuing _hcitool info MAC-Address_ I was able to extract the attached information: [amazfit_pace_info.txt](https://github.com/Freeyourgadget/Gadgetbridge/files/684705/amazfit_pace_info.txt). This does not mean a whole lot to me right now, but I guess it helps. I will set up android-studio on my machine and will check out and try to understand some code as soon as I find the time (3 kids, I know, everyone has excuses...). In [the Polar M400 request issue #455](https://github.com/Freeyourgadget/Gadgetbridge/issues/455) a certain diff was mentioned that shows the work done to support a new device, I will have a look at that too. Furthermore, I will try to analyze the communication between official app and watch some more. So far there is a lot of plain ASCII that I found, but also many parts I do not understand yet. I have attached a small log that shows the reception of an e-mail with k-9 mail: [btsnoop_hci_mail_received.txt](https://github.com/Freeyourgadget/Gadgetbridge/files/684719/btsnoop_hci_mail_received.txt) I was not allowed to attach the binary _.log_-file here, so I had to rename it to _.txt_,I hope that is ok. If somebody finds the time to have a look at this and finds something familiar, that would be awesome. However after that, I am unsure how to proceed. Without knowing much more, my plan was to add the possibility of manually entering a MAC-address to the Gadgetbridge code (I guess the Debug section would be a good place for that) and then see if I can get some basic responses from the watch. * Does this seem like a viable plan to you or am I getting ahead of myself? * Should I focus on analyzing the communication first, to check if an implementation into Gadgetbridge is even possible? * Is there anything else that you would do before touching the code, any additional information that I should extract first? I really do hope to find the time to contribute here, until then, thank you very much in advance and have a nice day.
daniele commented 3 years ago
Owner

Hello and welcome!

I just wanted to point you toward https://github.com/Freeyourgadget/Gadgetbridge/pull/470 that adds support for a BLE device: this should give you some hints about where you have to start diving into our codebase. :-)

Further, in https://github.com/Freeyourgadget/Gadgetbridge/issues/455#issuecomment-268106277 the gattool is mentioned. Run that command, because it’s possible that the device uses standard BLE characteristics and you can reuse some code already implemented for other devices.
One more thing, please try scanning with BLExplorer as it’s possible you couldn’t see the device just because it’s advertising itself as BLE device only.

Hello and welcome! I just wanted to point you toward https://github.com/Freeyourgadget/Gadgetbridge/pull/470 that adds support for a BLE device: this should give you some hints about where you have to start diving into our codebase. :-) Further, in https://github.com/Freeyourgadget/Gadgetbridge/issues/455#issuecomment-268106277 the gattool is mentioned. Run that command, because it's possible that the device uses standard BLE characteristics and you can reuse some code already implemented for other devices. One more thing, please try scanning with [BLExplorer](https://f-droid.org/repository/browse/?fdfilter=explorer&fdid=org.ligi.blexplorer) as it's possible you couldn't see the device just because it's advertising itself as BLE device only.
cpfeiffer commented 3 years ago
Owner

A warm welcome from me, too!

I think it’s time we add some kind of tutorial, or, template or skeleton generator for new devices to ease the kickstart - for now we typically do some monkey-see, monkey-do work by looking at the code for other devices. I’ll have a look at that when doing some groundwork for the Polar M400.

The Mi Band settings dialog contains a field to enter a MAC address to be used for the Mi Band. You could “reuse” that for a start and just set a different DeviceType for the GBDevice created in DeviceHelper.

Your btsnoop looks a bit different than others, I don’t see any gatt commands in there.

To answer your questions.

  1. Yes, sounds like a good plan :-)
  2. Good question. I’ll provide the tutorial/template/whatever for a new BLE device in any case, so we can try to connect to the device and discover its services and characteristics. You can also capture hcidumps of Mi Fit on your mobile, make sure to note the expected and actual behavior of the devices though, to correlate with the logs.
  3. No, I’d just go ahead and try to connect.

My questions are
a) how do you get the watch to display the QR code?
b) can you read the MAC address from the QR code?

A warm welcome from me, too! I think it's time we add some kind of tutorial, or, template or skeleton generator for new devices to ease the kickstart - for now we typically do some monkey-see, monkey-do work by looking at the code for other devices. I'll have a look at that when doing some groundwork for the Polar M400. The Mi Band settings dialog contains a field to enter a MAC address to be used for the Mi Band. You could "reuse" that for a start and just set a different `DeviceType` for the `GBDevice` created in `DeviceHelper`. Your btsnoop looks a bit different than others, I don't see any gatt commands in there. To answer your questions. 1) Yes, sounds like a good plan :-) 2) Good question. I'll provide the tutorial/template/whatever for a new BLE device in any case, so we can try to connect to the device and discover its services and characteristics. You can also capture hcidumps of Mi Fit on your mobile, make sure to note the expected and actual behavior of the devices though, to correlate with the logs. 3) No, I'd just go ahead and try to connect. My questions are a) how do you get the watch to display the QR code? b) can you read the MAC address from the QR code?
Tobi-K commented 3 years ago (Migrated from github.com)
Owner

Thank you very much for your comments and greetings.

@danielegobbetti
Neither the BLExplorer nore the gatttool showed me anything.
As far as the BLExplorer goes, I had in running in the background for quite some time while communicating with the watch, however nothing was found. I do not know if I missed anything, but the program seems pretty straight forware, there are literally no buttons ;)
I was toying around with the bluetooth setup of my Laptop yesterday evening for quite some time, but still the only command I got the watch to respond to was the one mentioned in my first post.
I tried a lot of different things, manually connecting to it with bluetoothctl or hcitools first, with a variety of options, using gatttool in interactive mode, and so on, but I could not get a connection.
I will try to get my hands on another BLE device to verify my setup, just to be sure.

@cpfeiffer
Thank you for the hint about the Mi Band settings dialog and the answers to my questions.
The fact that you do not see any gatt commands in there is encouraging, insofar that I did not totally fail in my testing efforts. Of course it is also bad, as anything non-standard makes the implementation more difficult.

Regarding your questions:
a) The only (very subtle) way to do it is by doing a factory reset. Then the watch goes through its initialization again and displays the QR code. Did I mention that the software is not that polished yet?

b) I reset my watch and read the QR code with a standard scanner, this is what it contains:

https://api-watch.huami.com/forwarding/watchUS?mac=Z%3E%5E%7B6%7CXax6% ......

As the dots indicate, the call is longer, I just left out the rest to not publish some detail of my device by accident.
So the MAC address seems to be passed.
This looks like php to me, with a bunch of variables separated by the %-sign passed to some application. None of the values directly corresponds to my MAC-address or serial number however, thats why I think its coded in some way.

We have a long weekend ahead here in Baden-Württemberg, so I’ll not get too much done for the rest of the week. I will try to go ahead with the initial plan of creating some more logs and trying to understand more about the protocol, and then trying to hack some basic connectivity into the code.

Thanks again for your encouragement and answers, have a nice weekend.

EDIT: I could just verify that the BLExplorer on my phone works correctly, simply walking down the hallway at work filled up the screen...

Thank you very much for your comments and greetings. @danielegobbetti Neither the BLExplorer nore the gatttool showed me anything. As far as the BLExplorer goes, I had in running in the background for quite some time while communicating with the watch, however nothing was found. I do not know if I missed anything, but the program seems pretty straight forware, there are literally no buttons ;) I was toying around with the bluetooth setup of my Laptop yesterday evening for quite some time, but still the only command I got the watch to respond to was the one mentioned in my first post. I tried a lot of different things, manually connecting to it with _bluetoothctl_ or _hcitools_ first, with a variety of options, using _gatttool_ in interactive mode, and so on, but I could not get a connection. I will try to get my hands on another BLE device to verify my setup, just to be sure. @cpfeiffer Thank you for the hint about the Mi Band settings dialog and the answers to my questions. The fact that you do not see any gatt commands in there is encouraging, insofar that I did not totally fail in my testing efforts. Of course it is also bad, as anything non-standard makes the implementation more difficult. Regarding your questions: a) The only (very subtle) way to do it is by doing a factory reset. Then the watch goes through its initialization again and displays the QR code. Did I mention that the software is not that polished yet? b) I reset my watch and read the QR code with a standard scanner, this is what it contains: > https://api-watch.huami.com/forwarding/watchUS?mac=Z%3E%5E%7B6%7CXax6% ...... As the dots indicate, the call is longer, I just left out the rest to not publish some detail of my device by accident. So the MAC address seems to be passed. This looks like php to me, with a bunch of variables separated by the %-sign passed to some application. None of the values directly corresponds to my MAC-address or serial number however, thats why I think its coded in some way. We have a long weekend ahead here in Baden-Württemberg, so I'll not get too much done for the rest of the week. I will try to go ahead with the initial plan of creating some more logs and trying to understand more about the protocol, and then trying to hack some basic connectivity into the code. Thanks again for your encouragement and answers, have a nice weekend. EDIT: I could just verify that the BLExplorer on my phone works correctly, simply walking down the hallway at work filled up the screen...
daniele commented 3 years ago
Owner

Just a quick correction, you can’t assume the server side is running php, that is just standard encoding for get parameters (%XX corresponds to the char with hex value XX).
I’m fairly sure there must be some relation between the value of the qr code and the Mac address, especially if it cannot be discovered.
Another option, though, is that the android device is creating a GATT server and the watch is connecting to it, and the qr code contains some characteristic that the watch expects to find there.

Just a quick correction, you can't assume the server side is running php, that is just standard encoding for get parameters (%XX corresponds to the char with hex value XX). I'm fairly sure there must be some relation between the value of the qr code and the Mac address, especially if it cannot be discovered. Another option, though, is that the android device is creating a GATT server and the watch is connecting to it, and the qr code contains some characteristic that the watch expects to find there.
cpfeiffer commented 3 years ago
Owner

It appears to me there’s some kind of companion app that communicates with the watch and with web services like api-watch. Using the ingenic watch open platform.

It appears to me there's some kind of companion app that communicates with the watch and with web services like api-watch. Using the ingenic watch open platform.
cpfeiffer commented 3 years ago
Owner

@Tobi-K If you want, come over to #gadgetbridge:matrix.org for easier information exchange.

@Tobi-K If you want, come over to #gadgetbridge:matrix.org for easier information exchange.
NiklausHofer commented 3 years ago (Migrated from github.com)
Owner

Anything happened since the last post in terms of getting that watch to work with Gadgetbridge? Maybe a repository with prototype code one could have a got at?

Anything happened since the last post in terms of getting that watch to work with Gadgetbridge? Maybe a repository with prototype code one could have a got at?
cpfeiffer commented 3 years ago
Owner

I’m still on it, but I don’t have anything to share, yet. It is quite different from anything else we have.

I'm still on it, but I don't have anything to share, yet. It is quite different from anything else we have.
Tobi-K commented 3 years ago (Migrated from github.com)
Owner

Sorry for not writing sooner.
I kept having my hopes up to get something substantial done, but I greatly underestimated the time needed to make myself familiar with android studio, java and the code base.

I do not think that I will be able to contribute code in the near future, I just cant find enough time.
However in case anything needs to be tested, I would be glad to at least help out this way.

Sorry for not writing sooner. I kept having my hopes up to get something substantial done, but I greatly underestimated the time needed to make myself familiar with android studio, java and the code base. I do not think that I will be able to contribute code in the near future, I just cant find enough time. However in case anything needs to be tested, I would be glad to at least help out this way.
cpfeiffer commented 3 years ago
Owner

Some progress: I can push basic notifications to the watch while using the somewhat Open Source iwds jar and shared library.

Some progress: I can push basic notifications to the watch while using the somewhat Open Source iwds jar and shared library.
Gerii commented 3 years ago (Migrated from github.com)
Owner

Hey, did you have any success with the device meanwhile? How much work do you think it would be to get it working reasonably?

Hey, did you have any success with the device meanwhile? How much work do you think it would be to get it working reasonably?
cpfeiffer commented 3 years ago
Owner

I have implemented some message dissecting base64, gzip, json to get the actual message contents. I do get activity summary data, for example.

I didn’t do much more, because we still depend on the native .so libs, and, while the ingenic platform is supposed to be Open Source, I didn’t manage to get and compile a version that works with the Pace. So unless we manage to reimplement this without the iwds.so, it would be very inconvenient, to say the least.

Also there’s the Amazfit BIP now, which has an interface very similar to the Mi Band 2 (instead of a completely new, somewhat proprietary, interface).

If there really is interest in support for the Pace, I might spend some more time on it, but some help would also be welcome.

I have implemented some message dissecting base64, gzip, json to get the actual message contents. I do get activity summary data, for example. I didn't do much more, because we still depend on the native .so libs, and, while the ingenic platform is supposed to be Open Source, I didn't manage to get and compile a version that works with the Pace. So unless we manage to reimplement this without the iwds.so, it would be very inconvenient, to say the least. Also there's the Amazfit BIP now, which has an interface very similar to the Mi Band 2 (instead of a completely new, somewhat proprietary, interface). If there really is interest in support for the Pace, I might spend some more time on it, but some help would also be welcome.
Gerii commented 3 years ago (Migrated from github.com)
Owner

I ordered the watch just yesterday as the time was running out on Gearbests flash sale. If I knew that the BIP was that much easier to support, I’d have waited probably, but anyway, now the watch is on its way so I will definitely try to do some tinkering.

Can you push the changes you have made for the watch to some branch or repo? I’d like to play with it a bit once the watch arrives, although I can’t promise anything, especially regarding reverse engineering the native library. (I suppose you got the working .so from the Amazfit Watch apk? The Ingenic site is kind of hard to navigate and I couldn’t get access to their git repo)

I ordered the watch just yesterday as the time was running out on Gearbests flash sale. If I knew that the BIP was that much easier to support, I'd have waited probably, but anyway, now the watch is on its way so I will definitely try to do some tinkering. Can you push the changes you have made for the watch to some branch or repo? I'd like to play with it a bit once the watch arrives, although I can't promise anything, especially regarding reverse engineering the native library. (I suppose you got the working .so from the Amazfit Watch apk? The Ingenic site is kind of hard to navigate and I couldn't get access to their git repo)
cpfeiffer commented 3 years ago
Owner

The Pace is a very fine watch. The Bip’s advantage is battery life: 30+ days vs. 5 days.

Yes, I needed to use both the iwds.jar and the .so file from the apk. Those from Ingenic did not work. Ideally, we would implement the communication part with the plain Android Bluetooth API, but we did not get this to work.

I will push the changes after removing the jar and .so so that others can join. Might take a few days, though.

The Pace is a very fine watch. The Bip's advantage is battery life: 30+ days vs. 5 days. Yes, I needed to use both the iwds.jar and the .so file from the apk. Those from Ingenic did not work. Ideally, we would implement the communication part with the plain Android Bluetooth API, but we did not get this to work. I will push the changes after removing the jar and .so so that others can join. Might take a few days, though.
jairbj commented 3 years ago (Migrated from github.com)
Owner

Hi @cpfeiffer . Where did you find the iwds.jar? I found only the .so from apk.

Hi @cpfeiffer . Where did you find the iwds.jar? I found only the .so from apk.
cpfeiffer commented 3 years ago
Owner

You can create the jar yourself by taking all com.ingenic.iwds.* classes from the apk.

You can create the jar yourself by taking all com.ingenic.iwds.* classes from the apk.
ScrambleTheRamble commented 2 years ago (Migrated from github.com)
Owner

I was wondering if progress has been made on this? Currently considering getting one of these.

I was wondering if progress has been made on this? Currently considering getting one of these.
tekkeitserktok commented 2 years ago (Migrated from github.com)
Owner
Is this link related? http://git.ingenic.cn/en/develop/api-guide/api-guide-iwds-jar/
tekkeitserktok commented 2 years ago (Migrated from github.com)
Owner

And this one too (implementation is iOS)
https://github.com/zheoO/Iwds

And this one too (implementation is iOS) https://github.com/zheoO/Iwds
technodrome commented 2 years ago (Migrated from github.com)
Owner

Hi guys,

I got Amazfit Stratos and would love to somehow decouple the watch from the proprietary app. I mean having your heart stats and paths you take to work and home every day is not exactly safe as this data is absolutely certainly transferred to China. And no-one can control what happens to your personal info after that.

@cpfeiffer If it is not too much trouble, could you publish some blogpost/howto to actually help noob users understand how to transfer data from/to watch? Doesn’t need to be fully working, just how to setup stuff, what to compile and transfer to spark up the future progress? I mean hints what to do are really confusing and having one nice ZIP archive with everything inside to compile stuff, .so and .jar files to distribute to other users would be really helpful. If it is not too much trouble, of course.

@tekkeitserktok First link is dead and the other repo is for iphone only. Majority of users will probably go with Android. Did you manage to make any progress yourself?

@Tobi-K could you please publish your findings? Would be really helpful for other Pace/Stratos users.

Thanks everyone, your work is much appreciated!

Hi guys, I got Amazfit Stratos and would love to somehow decouple the watch from the proprietary app. I mean having your heart stats and paths you take to work and home every day is not exactly safe as this data is absolutely certainly transferred to China. And no-one can control what happens to your personal info after that. @cpfeiffer If it is not too much trouble, could you publish some blogpost/howto to actually help noob users understand how to transfer data from/to watch? Doesn't need to be fully working, just how to setup stuff, what to compile and transfer to spark up the future progress? I mean hints what to do are really confusing and having one nice ZIP archive with everything inside to compile stuff, .so and .jar files to distribute to other users would be really helpful. If it is not too much trouble, of course. @tekkeitserktok First link is dead and the other repo is for iphone only. Majority of users will probably go with Android. Did you manage to make any progress yourself? @Tobi-K could you please publish your findings? Would be really helpful for other Pace/Stratos users. Thanks everyone, your work is much appreciated!
stanleigh commented 2 years ago (Migrated from github.com)
Owner

Hi guys,
I have a question.

Is the Amazfit Pace supported or the support is still coming in a long time? or never?

Hi guys, I have a question. Is the Amazfit Pace supported or the support is still coming in a long time? or never?
diegombeltran commented 2 years ago (Migrated from github.com)
Owner

Hello,

Any progress on this?

Thank you!

Hello, Any progress on this? Thank you!
prototux commented 1 year ago (Migrated from github.com)
Owner

Hello,

About the Ingenic JNI and java sdk, maybe this would help, it defintively looks like the iwds.so and jar source code (at least, the structure and the classes/function names seems to match):
https://github.com/liaokesen168/slpt_send_big_picture/tree/master/iwds/iwds/jni/src
https://github.com/liaokesen168/slpt_send_big_picture/tree/master/iwds/iwds-jar/src/com/ingenic/iwds

There’s even the examples that are provided in apk only at git.ingenic.com.cn

Of Course, this still doesn’t provide the huami-specific parts (such as the QR-code that seems customized by huami, and the data transferred using the iwds protocol, as it seems also specific to huami, though amazfit’s app seems to not be very obfuscated (especially the pre 3.x versions that only contains the code to work with the watches, and thus are way smaller and easier to understand)

The ingenic SDK does seems to really be open source, as the headers indicate that the code is released under GPLv2. Maybe there’s a way to negociate/force huami to release their modifications to this source code, but i wouldn’t count on it given that they didn’t even release their kernel...

I’m also working on it for wiecosystem, my findings are here: https://github.com/wiecosystem/Amazfit-RE (and https://github.com/wiecosystem/Getting-Started/blob/master/amazfit.md also)

UPDATE: it seems that huami did indeed made some modifications to the iwds.so and jar, as the amazfit’s app calls another jni functions that doesn’t exists in the original source (nor in any apk/jar from ingenic): ‘classInitNative’ (after the ‘nativeInit’ from ingenic)

The functions that doesn’t seems to exists in the Ingenic’s JNI but do exist in the Amazfit’s one:

  • _Z15classInitNativeP7_JNIEnvP7_jclass
  • _Z22iwds_acquire_wake_locki
  • _ZN11DataChannel12setConnectedEb
  • _ZNK11DataChannel11isConnectedEv
  • _ZNK4Link14getDataChannelEv
  • _ZSt13get_terminatev
  • _ZSt14get_unexpectedv
  • _ZSt15get_new_handlerv
  • _ZN6Server26acquireWakeLockWithTimeoutEi
  • _ZTV19WaitConnectWatchDog

The classInitNative(_JNIEnv *env, _jclass class) seems to try to get the “acquireWakeLock” from the iwdsInitializer java function:

   (added to the original java code)
    import android.os.PowerManager;
    import android.os.PowerManager.WakeLock;
    private static WakeLock lock;
    public static boolean acquireWakeLock(int timeout) {
        WakeLock wakeLock = lock;
        if (wakeLock == null) {
            return false;
        }
        if (wakeLock.isHeld()) {
            return true;
        }
        lock.acquire((long) timeout);
        return true;
    }

There’s also some added code to the initialize function:

        if (deviceDescriptor.devClass == 0 && deviceDescriptor.devSubClass == 1) {
            a = (PowerManager) IwdsApplication.getAppContext().getSystemService("power");
            PowerManager powerManager = a;
            if (powerManager != null) {
                b = powerManager.newWakeLock(1, "UniconnServer");
            }
        }
        (and of course, the call to classInitNative at the end)
        classInitNative();

I would guess that beside that, there isn’t any substantial difference, and that the wakelock thing was added because of some bug/glitch that hapenned to amazfit if the device went to sleep while the jni was doing something...

UPDATE2: Apparently, the modifications to the jni are completly useless... the WakeLock thing is declared (basically, the classInitNative just get the method ID and put it in a global variable, a global function calls it, and this global function is called in a new method in Server, Server.acquireWakeLockWithTimeout, that... is never called, neither in the JNI nor in the java code...)

The WatchDog things are 2 classes, “ConnectWatchDog” and “WaitConnectWatchDog” that are instanced from Client.run and Server.run respectively, but... they’re empty, beside the constructor that destroy the parent’s thread, it’s called in the case of the connection failed (so, in amazfit’s case, the whole client/server dies instead of retrying)

There’s still the array_lenght functions, but they seems more like debug things than having a real usage, so, i’m becoming increasingly confident than the JNI is mostly the same between amazfit and ingenic.

@cpfeiffer if you have time, could you try to display notifications on the watch, using the JNI and the java library i’ve linked? Ideally, first trying to compile and use that JNI with the iwds.jar you already have, and if that’s working, also using the java sources as well.

Hello, About the Ingenic JNI and java sdk, maybe this would help, it defintively looks like the iwds.so and jar source code (at least, the structure and the classes/function names seems to match): https://github.com/liaokesen168/slpt_send_big_picture/tree/master/iwds/iwds/jni/src https://github.com/liaokesen168/slpt_send_big_picture/tree/master/iwds/iwds-jar/src/com/ingenic/iwds There's even the examples that are provided in apk only at git.ingenic.com.cn Of Course, this still doesn't provide the huami-specific parts (such as the QR-code that seems customized by huami, and the data transferred using the iwds protocol, as it seems also specific to huami, though amazfit's app seems to not be very obfuscated (especially the pre 3.x versions that only contains the code to work with the watches, and thus are way smaller and easier to understand) The ingenic SDK does seems to really be open source, as the headers indicate that the code is released under GPLv2. Maybe there's a way to negociate/force huami to release their modifications to this source code, but i wouldn't count on it given that they didn't even release their kernel... I'm also working on it for wiecosystem, my findings are here: https://github.com/wiecosystem/Amazfit-RE (and https://github.com/wiecosystem/Getting-Started/blob/master/amazfit.md also) UPDATE: it seems that huami did indeed made some modifications to the iwds.so and jar, as the amazfit's app calls another jni functions that doesn't exists in the original source (nor in any apk/jar from ingenic): 'classInitNative' (after the 'nativeInit' from ingenic) The functions that doesn't seems to exists in the Ingenic's JNI but do exist in the Amazfit's one: * _Z15classInitNativeP7_JNIEnvP7_jclass * _Z22iwds_acquire_wake_locki * _ZN11DataChannel12setConnectedEb * _ZNK11DataChannel11isConnectedEv * _ZNK4Link14getDataChannelEv * _ZSt13get_terminatev * _ZSt14get_unexpectedv * _ZSt15get_new_handlerv * _ZN6Server26acquireWakeLockWithTimeoutEi * _ZTV19WaitConnectWatchDog The classInitNative(_JNIEnv *env, _jclass class) seems to try to get the "acquireWakeLock" from the iwdsInitializer java function: ```java (added to the original java code) import android.os.PowerManager; import android.os.PowerManager.WakeLock; private static WakeLock lock; public static boolean acquireWakeLock(int timeout) { WakeLock wakeLock = lock; if (wakeLock == null) { return false; } if (wakeLock.isHeld()) { return true; } lock.acquire((long) timeout); return true; } ``` There's also some added code to the initialize function: ```java if (deviceDescriptor.devClass == 0 && deviceDescriptor.devSubClass == 1) { a = (PowerManager) IwdsApplication.getAppContext().getSystemService("power"); PowerManager powerManager = a; if (powerManager != null) { b = powerManager.newWakeLock(1, "UniconnServer"); } } (and of course, the call to classInitNative at the end) classInitNative(); ``` I would guess that beside that, there isn't any substantial difference, and that the wakelock thing was added because of some bug/glitch that hapenned to amazfit if the device went to sleep while the jni was doing something... UPDATE2: Apparently, the modifications to the jni are completly useless... the WakeLock thing is declared (basically, the classInitNative just get the method ID and put it in a global variable, a global function calls it, and this global function is called in a new method in Server, Server.acquireWakeLockWithTimeout, that... is never called, neither in the JNI nor in the java code...) The WatchDog things are 2 classes, "ConnectWatchDog" and "WaitConnectWatchDog" that are instanced from Client.run and Server.run respectively, but... they're empty, beside the constructor that destroy the parent's thread, it's called in the case of the connection failed (so, in amazfit's case, the whole client/server dies instead of retrying) There's still the array_lenght functions, but they seems more like debug things than having a real usage, so, i'm becoming increasingly confident than the JNI is mostly the same between amazfit and ingenic. @cpfeiffer if you have time, could you try to display notifications on the watch, using the JNI and the java library i've linked? Ideally, first trying to compile and use that JNI with the iwds.jar you already have, and if that's working, also using the java sources as well.
PRIHLOP commented 1 year ago (Migrated from github.com)
Owner

Hello. I found that support for Amazfit GTR was added recently, but GTR is the same like Pace and Stratos(this watches the same OS platform). Maybe it can help to support Pace and Stratos?

Hello. I found that support for Amazfit GTR was added recently, but GTR is the same like Pace and Stratos(this watches the same OS platform). Maybe it can help to support Pace and Stratos?
ashimokawa commented 1 year ago
Owner

@PRIHLOP

This issue is about android based watches, GTR is not, it is a different platform

@PRIHLOP This issue is about android based watches, GTR is not, it is a different platform
Sign in to join this conversation.
No Milestone
No Assignees
3 Participants
Notifications
Due Date

No due date set.

Dependencies

This issue currently doesn't have any dependencies.

Loading…
There is no content yet.