[Other SmartWatches] mougino:
Hello all, this is my first post here! :)

In this article I will explain my method of hacking the Square G-Shocks that make use of a Bluetooth module (I have a GW-B5600, but it should theoretically work on the GMW-B5000 too) with the goal to create our own Android app that will allow to get info and set the watch via BLE (Bluetooth Low Energy) commands/requests.

The tools I am using are: (sorry no link I am too new)

nRF Connect for Android by Nordic Semiconductor from the Play Store

Wireshark desktop (Windows/Mac) from the official website

The official "G-Shock Connected" Android app from the Play Store

And adb that can be found in the Android platform tools (by default in "C:\Users\usrname\AppData\Local\Android\Sdk\platform-tools")

Your phone does not need to be rooted but needs the Developer options enabled.

1 Discover the services offered by the G-Shock

I am using nRF Connect installed from the Play Store to scan for BT devices.

Long-press the (C) (bottom left) button on the B5600 to enable BT on the watch.

Hit Scan in nRF and search for "CASIO GW-B5600" and tap it to show the following details:

Device BT Name:	CASIO GW-B5600
Device BT Address:	[B]EB:1C:FF:90:C2:34[/B]
Offered services:	0x1801	Generic Attribute
0x1800	Generic Access
0x2A00 (R)	Device Name
0x2A01 (R)	Appearance
0x1804	Tx Power
0x2A07 (R)	Tx Power Level
0x26EB00 0D	Unknown Service
(UUID 0x2902 for all)
[B]0x26EB002C (W*)	Custom Service #2C[/B]
[B]0x26EB002D (NW)	Custom Service #2D[/B]
0x26EB0023 (NW)	Custom Service #23
0x26EB0024 (NW*)Custom Service #24

(R) is read only (W) write (W*) write no response (N) notify.

The important information has been set in bold: the BT address that we will use to analyze the packets, and the 2 services that I called #2C and #2D that are used by the official G-Shock app to get and set info from/to the watch.

2 Enable Bluetooth traces on the phone

After that, open the phone Developer options > Enable Bluetooth HCI snoop log.

Or use the USB debugging mode, plug the phone to the computer and type the following command in a prompt:

adb shell settings put secure bluetooth_hci_log 1

To know where the BT traces will be stored, type the following command:

adb shell cat /etc/bluetooth/bt_stack.conf

and look at the line starting with 'BtSnoopFileName=' to locate the BT log files.

3 Capture BT activity and save the logs on computer

Install and run the "G-Shock Connected" app on your phone from the Play Store.

Do manipulations between the watch and the app, take note of the time you make them.

Then plug the phone and type:

adb pull /data/log/bt/btsnoop_hci*.log

Note: the place and name of the logs are for my Huawei Mate 10. You will need to adapt the path with the one you got at step 2.

4 Analyze the BT traces in Wireshark

Open Wireshark and drag and drop one of the "btsnoop_hci*.log" files pulled to the computer onto the program.

Add a filter on the G-Shock BT address we got from nRF Connect at step 1:

bluetooth.addr==EB:1C:FF:90:C2:34

And hit enter to see the BLE activity on the watch.

Now the fun (or the boring part, it depends ;)) begins... Understanding the BT requests/answers (get info) and BT commands (set info)!