Android Question How to make sense of Casio G-Shock BLE data.

[fancyJoggler]

Hi. I'm building a custom app to connect my G-Shock via Bluetooth Low Energy. I've extracted some data and for the past couple of days been hitting a wall.
I've tried many different solution, to no avail.
Is anyone familiar with any of the patterns that the information is stored in g-shocks?
Here's is an example of three data measurements taken from one place, one minute apart each.

7e 19 f8 fa f1 f5 d3 f8 f7 bd 6a 6f e8 1f 1a b7 bf b4 0f 64 52 71 3d 00 c0 d9 63 84 bc d3 d8 03 ff ff 00
7e 19 f8 fa f1 f5 d2 d6 f7 ec 85 ba 5a 24 1a b7 bf c2 77 45 b6 ca 3d 00 c0 fd c9 84 bc d2 d8 f4 fe ff 00
7e 19 f8 fa f1 f5 d1 cd f7 d2 a8 70 e3 1b 1a b7 bf 5a 77 70 8f 3d 3d 00 c0 c8 e9 84 bc d2 d8 f4 fe ff 00

In those, there must be:
DATE (one minute difference, ascending),
GPS COORDINATES (all three very similar),
ALTIMETER DATA (251m for all three),
ATMOSPHERIC PRESSURE (1002 hpa for all three),
TEMPERATURE (25.2C, 26.7, 26.7).
The last two numbers are: an icon and isLocked.

Any tip would be much appreciated.

 

[Andrew (Digitwell)]

A quick google pulled up this site:

Hacking the Casio G-Shock GW-B5600 BLE

Hello all, this is my first post here! :) In this article I will explain my method of hacking the Square G-Shocks that make use of a Bluetooth module (I have a GW-B5600, but it should theoretically work on the GMW-B5000 too) with the goal to...

forum.xda-developers.com

Hope it helps.

 

[DavideV]

Hi, try to convert hex do decimal values to see if data fits what you have got.

 

[fancyJoggler]

Hi, try to convert hex do decimal values to see if data fits what you have got.

Yeah, I've tried on all sort of ways.

Look at the first bytes, for example.
7e 19 f8 fa f1 f5 d3
7e 19 f8 fa f1 f5 d2
7e 19 f8 fa f1 f5 d1

I would suppose it's date and time but it's descending! I know for a fact that those three were appearing in the memory one after another.
Isn't it strange?
Also, its decimal value doesn't correspond with anything I know. Not even UNIX time.

 

[barx]

What was the time? 11:45, 11:46, 11:47?

 

[fancyJoggler]

What was the time? 11:45, 11:46, 11:47?

GMT +1 12:44, 12:45, 12:46
How did you figure it out?

 

[Johan Schoeman]

11:37 , 11:36, 11:35.....?

 

[fancyJoggler]

11:37 , 11:36, 11:35.....?

Close! plus one hour (GMT+1), but that's added automatically by the watch.
How did you calculate it?

In fact it was 11:34, : 35 and :36. There might be another byte for seconds because your calculations.
7e 19 f8 fa f1 f5 d3 f8 ?

 

[barx]

I tried using 2's compliment. obviously not quite correct though. even though it seems to be only one out, it's either right or wrong and probably a wild goose chase of wishful thinking.
The thing that led me to try 2's compliment is incrementing numbers typically decrement in 2's compliment.

I couldn't find any of the other data, but that is likely to be down to them being non-integer values, so the mantissa and exponent are likely to be stored a bit different.

Keep in mind the data could also be encrypted.
Also, keep in mind that the data you are thinking is in there, actually isn't. How are you getting the data, out of interest.

 

[fancyJoggler]

I tried using 2's compliment. obviously not quite correct though. even though it seems to be only one out, it's either right or wrong and probably a wild goose chase of wishful thinking.
The thing that led me to try 2's compliment is incrementing numbers typically decrement in 2's compliment.

I couldn't find any of the other data, but that is likely to be down to them being non-integer values, so the mantissa and exponent are likely to be stored a bit different.

Keep in mind the data could also be encrypted.
Also, keep in mind that the data you are thinking is in there, actually isn't. How are you getting the data, out of interest.

But I think you've got it right! +1 hour is added automatically afterwards, depending on the current time zone.
I just that you were off by one minute. Maybe we need to take one more byte into account for precise seconds (and milliseconds?)

Do you think that the rest of the bytes can be calculated the same way? I'll certainly try doing it tonight.

I've got them by intercepting the packets between the watch and the app (that is horrendous, by the way).
Also, could it be that it's in Little Endian? Other packets are transmitted exactly that.
Also, I don't think it's encrypted since you were that close.

 

[barx]

But I think you've got it right! +1 hour is added automatically afterwards, depending on the current time zone.
I just that you were off by one minute. Maybe we need to take one more byte into account for precise seconds (and milliseconds?)

Do you think that the rest of the bytes can be calculated the same way? I'll certainly try doing it tonight.

I've got them by intercepting the packets between the watch and the app (that is horrendous, by the way).
Also, could it be that it's in Little Endian? Other packets are transmitted exactly that.
Also, I don't think it's encrypted since you were that close.

maybe get another couple of packets of data and I will apply the same approach and guess the time. See if it is relatable.
Be sure to make a note of the hours / minutes of the packets.

As above, I tried a couple of ways of converting the expected values (251, 1002, 26.7) not found any correlations yet I'm afraid. Tries little endian and big endian. This is what makes me think it could be encrypted / obfuscated. Just adding another unknown number to all values is enough to throw you off for a good while.

 

[Johan Schoeman]

Close! plus one hour (GMT+1), but that's added automatically by the watch.
How did you calculate it?

In fact it was 11:34, : 35 and :36. There might be another byte for seconds because your calculations.
7e 19 f8 fa f1 f5 d3 f8 ?

Log shot was to take decimal values of F1, F5, D3 and add them together. That gives 697.

697/60 = 11.6167

.6167 x 60 = 37

Thus 11:37