Lenovo HW01

Library to work with Lenovo HW01. To be used in place of Android Lenovo Healthy app.

Dependencies

• bluepy

Traffic analysis

In order to analyse communication between official Android app Lenovo Healthy and Lenovo HW01 device, additional app NordicSemiconductor/Android-nRF-Connect is used to perform traffic logging.

It allows us to write an API library to interact with the watch without using the official Android app.

Debugging

Scan for Bluetooth devices:

$> sudo hcitool lescan
LE Scan ...
XX:XX:XX:XX:XX:XX HW01

Connect to Bluetooth device:

sudo gatttool --device=XX:XX:XX:XX:XX:XX -I -t random
[XX:XX:XX:XX:XX:XX][LE]> connect
Attempting to connect to XX:XX:XX:XX:XX:XX
Connection successful

List device characteristics:

[XX:XX:XX:XX:XX:XX][LE]> primary
attr handle: 0x0001, end grp handle: 0x0007 uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle: 0x0008, end grp handle: 0x0008 uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle: 0x0009, end grp handle: 0x000e uuid: 0000190a-0000-1000-8000-00805f9b34fb
attr handle: 0x000f, end grp handle: 0x0014 uuid: 0000190b-0000-1000-8000-00805f9b34fb
attr handle: 0x0015, end grp handle: 0xffff uuid: 0000fee7-0000-1000-8000-00805f9b34fb

Documentation

hw01’s documentation

Test

pip install -r dev-requirements.txt
./setup.py nosetests

References

• creotiv/MiBand2
• My journey towards Reverse Engineering a Smart Band — Bluetooth-LE RE
• Xiaomi Mi Band BLE Protocol reverse-engineering and API
• How I hacked my Xiaomi MiBand 2 fitness tracker — a step-by-step Linux guide
• Get Started with Bluetooth Low Energy on Linux
• NordicSemiconductor/Android-nRF-Connect