yashsingh1/xdaforums huggingface dataset:
[Other SmartWatches] mougino:
In Wireshark, the important information for each BT frame are contained in the fields

Bluetooth Attribute Protocol > Handle > UUID

and in Bluetooth Attribute Protocol > Value

The very first -easiest- command I was able to identify is the one to Get and Set the Home City and the 5 World Time (WT) Cities.

When you analyse the BT packets, you can see the name of the cities written in all letters in the Value field:

0000 1f 01 48 4f ..HO
0010 4e 47 20 4b 4f 4e 47 00 00 00 00 00 00 00 00 00 NG KONG.........

We can observe that to GET the Home City, we send a Write command with the value 1F00 to the service 0x26EB002C (aka Custom Service #2C). In return, we will receive a notification through the service 0x26EB002D (aka Custom Service #2D) containing an echo of the Command ID (1F00) followed by the name of the Home City in upper-case (e.g. "PARIS").

To SET the Home City is just as easy: we send a Write request to the service 0x26EB002D (Custom Service #2D) with the value 1F00 followed by the name of the new Home City on 18 Bytes (e.g. "PARIS"), tailed with 0x00.

GETting and SETting the 5 World Time Cities is very similar: you only need to use the Command IDs 1F01 to 1F05...
[Other SmartWatches] mougino:
The next command I reverse engineered is the one to set the date and time.

I started to search for the hexadecimal value "07 E4" in the traces (2020 in decimal = the current year). The search returned zero result... If finding a WORD (value encoded on 2 bytes) in big endian* fails, you gotta try searching it in little endian* ;) so I did another search for "E4 07" this time, and bingo! It appears in a SET command starting with the ID 0x09.

* search Wikipedia for "Endianness"

The full structure of the binary value is:

([B]09[/B]) YYYY MM DD HH mm ss ?? ?? 01	?? ?? is the milliseconds in big endian(?)

[B]Mon.13-JAN (15:54:10) traces[/B]
([B]09[/B]) E4 07 01 0D 0F 36 0B 01 F2 01	--> 2020-01-13 15:54:11 (,498?)

[B]Wed.15-JAN (15:29:27) traces[/B]
([B]09[/B]) E4 07 01 0F 0F 1D 1E 03 44 01	--> 2020-01-15 15:29:30 (,836?)

You can notice there's a difference in the trace timestamp and the time sent, respectively 1 second and 3 seconds. That is quite normal: I disabled the time synchronization in the watch settings, so the watch time can deviate from the atomic time by a few seconds (the user guide states a tolerance of +/- 15s per month average).
[Other SmartWatches] seanlano:
Hey, did you ever manage to get any further with this @mougino ? I've also got one of these watches, and have been playing around with the BLE connection to it. I've managed to successfully set the alarm times and on/off state – but so far haven't had any luck with setting the actual time. I tried writing with the op-code you suggested of 0x09, but it doesn't seem to actually do anything for me.
[Other SmartWatches] pokol:
Up its interesting.
[Other SmartWatches] izivkov:
Hope somebody can help me. I'm having trouble getting/setting time on my Casio GW-B5600BC-2BJF. I can get and Set most other things like alarms, home city, etc using the #2D command (Characteristic: 26eb002d-b012-49a8-b1f8-394fb2032b0f), but when I try to set the time, it has no effect. The command does not complain, but does not change the time. Should I be using a different characteristic? Here are supported BLE services on my watch:

[CD:85:24:01:62:17][LE]> connect

Attempting to connect to CD:85:24:01:62:17

Connection successful

[CD:85:24:01:62:17][LE]> characteristics

handle: 0x0003, char properties: 0x02, char value handle: 0x0004, uuid: 00002a00-0000-1000-8000-00805f9b34fb

handle: 0x0005, char properties: 0x02, char value handle: 0x0006, uuid: 00002a01-0000-1000-8000-00805f9b34fb

handle: 0x0008, char properties: 0x02, char value handle: 0x0009, uuid: 00002a07-0000-1000-8000-00805f9b34fb

handle: 0x000b, char properties: 0x04, char value handle: 0x000c, uuid: 26eb002c-b012-49a8-b1f8-394fb2032b0f

handle: 0x000d, char properties: 0x18, char value handle: 0x000e, uuid: 26eb002d-b012-49a8-b1f8-394fb2032b0f

handle: 0x0010, char properties: 0x18, char value handle: 0x0011, uuid: 26eb0023-b012-49a8-b1f8-394fb2032b0f

handle: 0x0013, char properties: 0x14, char value handle: 0x0014, uuid: 26eb0024-b012-49a8-b1f8-394fb2032b0f

[CD:85:24:01:62:17][LE]>

Here is the command I'm sending:

Wrote to characteristic 26eb002d-b012-49a8-b1f8-394fb2032b0f | value: 0x09 E6 07 03 19 0B 29 07 05 4F 01

Thanks in advance.
[Other SmartWatches] izivkov:
Same here. Did you resolve this? See my message above. Thanks.
[Other SmartWatches] seanlano:
Nah I kind of dropped it, and haven't picked it up again for quite a while. I'd love to get it working though!
[Other SmartWatches] izivkov:
OK, I will let you know if I figure it out.

Just curious, are you wring an Android app for the watch?
[Other SmartWatches] seanlano:
I was planning on having something running on a Raspberry Pi Zero W – I can program, but I've never made an Android app. My plan was to do something in Python, ideally having the Pi Zero running somewhere in my bedroom so that the Casio watch can do the time synchronisation at night. If I can get that working I'd also thought about setting some alarms and reminders for the day ahead, like maybe connect it to a calendar and put any important events into the reminders function of the watch, things that the existing Casio app can't do. An Android app would be a better way of doing this, but I figured I'd get it working in Python first since it's faster for me.
[Other SmartWatches] izivkov:
Ok, thanks for the info.

I more or less figured out how to set the time. It involves setting the DST for all world locations first. I guess makes sense, since the casio will update the time for all locations. I still don't understand some things so I will need to figure it out first, and I can share if you are interested.

I am working on an open source Android app to integrate the Casio watch with Google services on android, such as calendar and Alarm ckock. It will not replace the official app. I have been working on this app for about a month now, and got the alarms and now the time setting working. I think the callender integration will be the most challenging, since I don't know what the data means to Casio.

Currently the github is private, because it is WIP, but I will make it public when it is ready.
[Other SmartWatches] seanlano:
That would be very cool! I'll be happy to do some beta testing if you end up getting to that stage. :) Good luck!
[Other SmartWatches] izivkov:
@seanlano I have the basic app running, except for the reminders. If you like to try it, here is the github:

GitHub - izivkov/CasioGShockSmartSync

Contribute to izivkov/CasioGShockSmartSync development by creating an account on GitHub.

github.com

It is private, so not sure if you can access it, so let me know.

If you don't want to bother building the APK, I have put it on on my Google drive:

Google Drive: Sign-in

Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).

drive.google.com

I'm curious to see if for you the local time works properly, and the battery level is correct. Where are you located?

Of course, use at your own risk. It might screw up some settings on your watch. In that case, you may have to reset it like this:

Google Drive: Sign-in

Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).

drive.google.com

Ivo
[Other SmartWatches] seanlano:
Hey @izivkov, I tried it out and it seems to mostly work! :D

The time setting worked correctly (I made sure by manually setting the time to be very wrong, and your app brought it back to the correct time). The home time zone (Sydney) was correct too.

However, the battery level didn't work – the Casio app shows my watch at 100% but your app shows only maybe 20%.

The alarms worked well too, although I found that any time I set the alarms it turns off the hourly signal, and the app doesn't have a way to turn it back on (this isn't a big deal though, since it's only a couple of buttons to press on the watch).

Keep up the good work!
[Other SmartWatches] izivkov:
Hey, thanks for the feedback.

- I did not notice the hourly signal setting and will fix it. Possibly add a setting to the app to turn it on/off.

- For the battery level, I was not sure I was getting the right value, but for me seemed to be about right. Obviously, should look at other ways to set it.

- I'm working on Calendar events integration with Watch's reminders, and when I finish this and fix these issues you mentioned I will have another version and will let you know.

Cheers
[Other SmartWatches] izivkov:
Hay, thanks for starring my github. I moved the code to another repository: https://github.com/izivkov/CasioGShockPhoneSync, which is now public. Feel free to star the new one. ;-)

Basically, I added Google calendar event support, and fixed the issue with hourly chime getting reset. Still cannot figure out how the battery level is read. I get a value using command 0x28, but the value does not make sense. I get back something like 0x28 0x0f 0x17 0x00 for about 25% charged battery, and 0x28 0x13 0x19 0x00 for almost fully charged one. I think I will disable the battery icon until I can figure what is going on.

Anyway, adding some documentation now. Hope other people can contribute to this project and possibly support more watch models.
[Other SmartWatches] izivkov:
I'm a bit stuck. I'm trying to detect the difference between GW-B5600 long-press lower left button and short-press lower-right button as far at connection to the Android device is concerned. The app on the phone should be able to tell the difference, becase the official app acts differntly when the right button is pressed, i.e. sets the current location. This does not happen for left-button connection. But the data sent to the phone from the watch is identical. If somebody has figured this out, please let me know.
[Other SmartWatches] izivkov:
For those who are interested in how to communicate with the Casio G-Shock 5600 BT watches, here is the latest github I created:

GitHub - izivkov/CasioGShockSmartSync

Contribute to izivkov/CasioGShockSmartSync development by creating an account on GitHub.

github.com

And you can get the android app on PlayStore:

G-Shock Smart Sync - Apps on Google Play

Casio G-Shock Connection with Smart Functions.

play.google.com

Enjoy
[Other SmartWatches] drunkenHiker:
I've been working on a very similar app but for a slightly different Casio model. I'm not very familiar with the BLE and getting to a point where I'd happily pay someone for investigating the communication.

Would anyone be willing to figure it out?
[Other SmartWatches] izivkov:
Sure, I can take a look. You can contact me by email directly at izivkov@gmail.com, or better still you can post to the github repository:

izivkov CasioGShockSmartSync · Discussions

Explore the GitHub Discussions forum for izivkov CasioGShockSmartSync. Discuss code, ask questions & collaborate with the developer community.

github.com
[Other SmartWatches] drunkenHiker:
I've just DMed you here on xda.
[Other SmartWatches] drunkenHiker:
Direct Message (meaning a private chat).
[Other SmartWatches] szilamer:
Hi Guys,

Do you know that G-Shock Connected app's database can be downloaded / modified ?

It's a matter of "patching" the app and it's a simple realm database. Unfortunately the solution can't be released because it's against the license agreement.

I have a Casio GPR-B1000 watch and reading the database looks like easier ( I have a ready solution ) than catching the BT packets. But I really appreciate your efforts and work you did here. I've also checked your source code.

Do you also have a GPR-B1000 ?
[Other SmartWatches] drunkenHiker:
Yes.

I've just replied to your thread on watchuseek but let's continue here.

Yes, I have this watch and use it regularly.

I've seen how you neatly extracted the data. Very impressive. I'll go and try the same.

The problem is that when you move the app to the SD those files disappear and when you click your route you don't see any data.

You see, the problem is the app. It's awful. The ESRI maps suck.

On top of that, they share or your routes and locations with amazon servers. It's not private at all.

I've started building my own app with Open Street Maps but izivkov and I have been struggling with figuring out the BLE communication.
[Other SmartWatches] izivkov:
Thanks for the info. No, I did know that, but my goal was not just modify the official app. I wanted to make another app winch will integrate with Google services better. That is why make the Gshock Smart Sync app.
[Other SmartWatches] drunkenHiker:
Yeah. For me the privacy issues are also a thing.

I couldn't get past the communication issues. The last thing I noticed was that it yields all actions to the console log. But I didn't abandon the project.

I'm seriously considering paying a company specialised in BLE to figure it out the details.
[Other SmartWatches] szilamer:
Just don't move the app to the SD card.

Here are the main steps of extracting the realm DB from the GShock app:

1. Use apktools for decompiling the apk

2. Modify the manifest xml to make it backupable

3. Modify some smali files to return true (1) from packageMatchesToken methods. This is needed to bypass the cert check during app's startup

4. Use apktools for rebuilding apk

5. Use apktool gui to easily realign and resign the apk

6. Reinstall the generated apk on your phone

7. Use apk backup command to create a backup of GShock app. Id = com.casio.gshock...

8. Use abp.jar to create a .tar file from the previously created backup file.

That's all. You can also use the above method for making the Gshock app debuggable. That's needed to make adb push work, so it will be possible to push a modified db to your phone.

I don't think a company is needed here, that's too expensive :) The communication is complicated but it looks understandable based on the decompiled apk, logcat logs.

Yes, I think this is the best solution if you wouldn't like to find yourself being sued by Casio. It's against the license agreement to release a modified GShock Connected
[Other SmartWatches] drunkenHiker:
Do you think you could do that? In principle we need to find out which method the app uses to decode coordinates from the watch. I have a couple of guesses. DM me if you'd like to try that.
[Other SmartWatches] szilamer:
Do you have a basic skeleton app for downloading the "raw" byte data / array from the watch ?
[Other SmartWatches] izivkov:
So, according to this thread, it is possible to decompile the official APK and then use it to debug exactly how geo-point are sent and received. This could be a good starting point got your watch. I will look into it as well.
[Other SmartWatches] szilamer:
Exactly. I can send you some classes , method names to make it quicker for you, If you are interested.

I'm also interested in trying out the read operation from a custom built app, but first of all I would need a simplest skeleton app to establish the basic connection. I'm a .net / c# backend developer, so I will need a few steps to set up the dev environment for this purpose.
[Other SmartWatches] drunkenHiker:
No, I've made a skeleton app for routes.

I was also able to identify certain methods that might be responsible for working with that data from the watch but with @izivkov we were unable to definitely point to exact methods - the reason being, we struggled with compiling/decompiling process.

Can we move to some sort of a chat?
[Other SmartWatches] izivkov:
I basically know how the B5600's work, but @drunkenHiker would like to get his Ranger1000 (I think) to send and receive geo points. I do not have this watch, so I cannot test it. But if we can decompile the original app, we can look at the data exactly and figure it out.
[Other SmartWatches] izivkov:
So, after decompiling the APK, are you able the load the code into Android Studio and rebuild it? I had problem rebuilding the app from the decompiled sources. Could you please let me know how you decompiled the app, and how you were able to compile from the sources. Thanks.
[Other SmartWatches] szilamer:
No, to be honest I don't know Android Studio at all. I'm a C# backend developer.

Just use apktools / apktools gui , it also has a build option. Smali modification is needed if you'd like to try changing anything. Jadx can be also useful for viewing.
[Other SmartWatches] szilamer:
Check the attached video.

I've managed to extract the data., so It's working !

Lots of things are still missing, and I'm a backend dev, so the GUI is also ugly. :)

This app currently shows one of my old routes in the summer. The coordinates were downloaded from my watch.
[Other SmartWatches] szilamer:
This is a Xamarin based C# application running on my phone.

It was difficult to find a really working BLE nuget package for Xamarin / C#.
[Other SmartWatches] szilamer:
The BT connection is built up once you click the Casio GPR-B1000.

I think this will also need some improvement.
[Other SmartWatches] drunkenHiker:
Whoah! Man!

This is incredible. Can you guide us a bit on the mechanics of this app?

I have the gui with route planning, GPX export/import etc.
[Other SmartWatches] szilamer:
Which programming language are you using ?

Is it possible to connect your code with a Xamarin / .NET based lib ?
[Other SmartWatches] drunkenHiker:
I'm using Kotlin in Android Studio.

I'll do some research.

If that doesn't work, we could set up a zoom and gradually translate my code into Xamarin.

Although in Kotlin I have the advantage of using ready libraries for many features. I don't know if they exist in your language. In such a case we would have to write those block anew.
[Other SmartWatches] izivkov:
OK, thanks. I was hoping it would be possible to rebuild the app from decompiled sources, as this would give us great way to put breakpoints and see exactly what they are sending and what these values mean for all watches. But I don't think this is easy to do or practical.
[Other SmartWatches] szilamer:
The logcat log is very talkative and you can even enable logging ( if it's disabled ) by using some minor smali changes
[Other SmartWatches] szilamer:
Ok.

The Xamarin translation of your app sounds painful.

What do you think about creating a background app / service in Xamarin for handling the watch connection ?

Would that be possible ?

And would it make sense in that case to use any IPC technique to communicate between my and your process ?

Do you have experience in this ? As I mentioned I'm not an Android developer so this is a brand new territory for me.
[Other SmartWatches] drunkenHiker:
It might be difficult but I'm determined to do it. This way or another. We're gonna do it, brother.

How about you explain it to @izivkov so he can write it in Kotlin?
[Other SmartWatches] szilamer:
Let's wait for @izivkov first. I would be interested in hearing his opinion on Xamarin - Kotlin integration or the IPC idea.
[Other SmartWatches] szilamer:
Mapsui looks like a very good library / nuget package for using OpenStreetMap in Xamarin
[Other SmartWatches] drunkenHiker:
I've sent you a private message regarding comm features.
[Other SmartWatches] szilamer:
Yes, sorry for the delayed response, I was on a family holiday this weekend.

I will answer your message later today.

The next thing regarding this project should be find out what's sent to the watch when the transfer route is selected from Casio's app. So curently only the other direction is working: downloading log data ( tracked route ) and / or point memo.
[Other SmartWatches] drunkenHiker:
Good point. Do you think the WireShark logs would be helpful?
[Other SmartWatches] szilamer:
I don't think so. Logcat log is better for this watch.
[Other SmartWatches] drunkenHiker:
Yeah, it seems so. That's what comes to my head when I look at your achievements.

Counting on the WireShark was a dead end. It was confusing.

I'm gonna be doing the logcat research in the next couple of days focusing on the upload communication.

Let's move to the private conversation, all three of us. This thread becomes hard to look through with all those details. I'm setting up a separate convo for us three.
[Other SmartWatches] szilamer:
OK, private conversation is a good idea.

Just a small update: I think I understand the upload data structure now. Two separate byte arrays are needed:

Header : This one has the transit point count, node count.

Data: This has the GPS coordinates. (8+8 bytes), it's a little bit tricky because some interim points are inserted automatically between the way points.

Header and Data are sent to the common BLE characteristic by using ~ operator and some CRC calculation. There is also a complex workflow under the hood to handle the errors / data chunks.
[Other SmartWatches] drunkenHiker:
I've found the method responsible for this in the app. I'll see its mechanics and let you know in the chat.
[Other SmartWatches] szilamer:
I only had limited time to work on this project but it seems I have a working version for only two points : start, end/goal.
[Other SmartWatches] xand3r42:
Hello guys,

interesting topic,

Actually, it is...

Group Header

contains info about the 100 memory locations, if a log exists and it's status (for the Casio app)

Log Header

contains memory location for the log data and summary of the workout

like start and end date, duration, steps, calories, cadence, and pace

and then the data files

Log Data

Lap Data

GPS Data
[Other SmartWatches] drunkenHiker:
Excellent. Do you have the watch?

The BLE is a complete mess in and of itself and then there is this original app...
[Other SmartWatches] xand3r42:
Yes I do, I'm working on an app myself,

True, that! The watches are excellent but their app is really BAD...

For my purposes downloading the headers is enough,

it has all I need.
[Other SmartWatches] drunkenHiker:
awesome! it's much needed.

Is there any way to map the characteristics and find out if there are any additional features available, like uploading Points?
[Other SmartWatches] xand3r42:
Of course :-) it is just a matter of time. Exploring right now,

Why would you want to upload Points to the watch? Do you mean GPS Lat, Lon ?
[Other SmartWatches] drunkenHiker:
AWESOME!!!!

Right now it's the only thing that is unavailable in the app. You know the Points, right? It's this option to save a point (just one point) in which you're right now. It's extremly useful when you want to return to a certain place.

The problem is that the app doesn't allow the creation of Points, only Points that you are in.

Imagine you could upload just one point towards which you wanna walk but without the route. Just the target, the destination.

Many people have complained that the app doesn't allow that. I'm one of them.
[Other SmartWatches] szilamer:
I don't think you can find out how to upload point memo items to the watch. And the reason is the missing sample functionality in the factory app. I highly doubt Casio left unused code in the released version. Unused codes codes end up in compiler warnings and those can be also a problem on dev team code reviews.

By the way my app is working correctly on Windows 11 as well 😀

Check out this video about downloading a route as GPX format:
[Other SmartWatches] drunkenHiker:
Unbelievable, man. So cool.
[Other SmartWatches] xand3r42:
Correct, the app on the phone detects a button press and than saves the phones current location, nothing is actually happening on the watch except from that it writes to a GATT characteristic when the button "Receiving" is pressed.

Oh, and sorry my previous statements, the app I'm currently working on is for the GBD-100, GBD-200 and GBD-H1000 watches.
[Other SmartWatches] drunkenHiker:
On GPR-B1000 you can save a current point that you're in without a phone. It's stored in the watch and then you can download it to the phone. The problem is that currently you can create ANY point on the phone and then upload it to the watch.
[Other SmartWatches] drunkenHiker:
I was just thinking... Is there any way to find a Casio programmer, maybe I could get some more info on this and other issues.