Live data from Hacker News

Nike+ FuelBand SE BLE Protocol Reversed

evilsocket.net

11–20 of 31 posts

Re: Nike+ FuelBand SE BLE Protocol Reversed

#11

This might be helpful for anyone wanting to play with low level BT traffic: http://ubertooth.sourceforge.net/

I'm seriously thinking about buying/building one of those

FYI, I've recently worked on a similar project, and I tried both the ubertooth and this TI development kit device [1]. The TI device and software was much more reliable and is pretty much plug in and go. Did you do all of this through an Android phone? Very cool.

[1] http://www.ti.com/tool/cc2540emk-usb

Re: Nike+ FuelBand SE BLE Protocol Reversed

#12
So I'm confused.. was author just not able to follow thru code path to find that the auth token was just spamming 1's? or was it a bit more cryptic than that?

the real code in the APK for computing the auth_token was probably some developers some pride and joy, worked weeks on it.. but when it came time to ship, damn thing wouldnt work with the shipped hardware.. so they buried a small assignment which overwrote the original computed auth token just to make the thing work? where is THAT code, i'd like to see it! If so, that is one of those great snippets where you can visually see the developer gave up. We should have a name for that sort of thing (I'm guilty of the same.. in my.. older works).

Re: Nike+ FuelBand SE BLE Protocol Reversed

#15

Imagine how much fun you could have with sending messages to runner's bands at Nike branded half and full marathons! :) Not that I would do that.

Or you could use Cmd_UploadGraphic and upload some filthy splash screen to their bands... Not that I would do that.

Re: Nike+ FuelBand SE BLE Protocol Reversed

#18
post #8

on a related note, is the act of decompiling jars legal if the software was obtained legally, ie bought?

Even if you are allowed to reverse engineer software in certain cases, directly taking what you learned from the effort and using it to write other code by yourself is another matter. It's the sort of situation we have "clean room" reverse engineering[1] procedures for.

[1] http://en.wikipedia.org/wiki/Clean_room_design

Re: Nike+ FuelBand SE BLE Protocol Reversed

#19
Very interesting, I've not yet ventured in to the BLE protocol world yet. I'd love to see what the Fitbit protocol looks like, they require a special USB dongle just to connect to Macs that already have BLE built-in, yet iOS hardware works on its own. Strange.

My first opportunity to reverse engineer undocumented hardware was Ubiquiti Networks Airview2 900MHz/2.4GHz spectrum analyzer USB sticks, the cheap $39 ones that hit the market back when Wi-Spy sticks were really the only comparable hardware and were quite a bit more expensive. They have an undocumented serial protocol for controlling the device and getting RF power level readings (and the proper info to parse it).

Once I got the basic command set figured out I wrote up documentation and a Python library[1]. Without reverse engineering the device firmware or the original software it was basically blind guessing (and later automated guessing). Finding a new command and being able to put more and more of the puzzle pieces together to see the big picture is really fun :)

[1] http://infincia.github.io/pyairview/

Re: Nike+ FuelBand SE BLE Protocol Reversed

#20
Thanks for writing this. I think I'll try reversing Fitbit beyond Galileo. Also, for those who don't know, Wireshark can sniff the Fitbit dongle using usbmon module incase you don't have a BTLE enabled device. MITMProxy is also great for making dumps to be studied.
Post reply on HN