Gadgetbridge: Automation

[flyingrub]

When you will have reversed the tracker activity, do you think we could use those data to detect some movement like closing your hand ? And then launch an app or do anything we want ?

[danielegobbetti]

I don't think that's possible unless the firmware running on the band itself is modified. Basically we get "historical" data (up to the minute, but still historical) that is already processed by the band's firmware.

Of course it may be that there's some hidden way to get the raw stream of accelerometer data, but it doesn't look like this / this is not what the development is focused about ATM.

[flyingrub]

Thanks for your response, great work btw :)

[1337sup3rh4x0r]

This is highly unlikely. What you describe would require raw accelerometer data. The MiBand does the evaluation of accelerations internally and only communicates the calculated number of steps via BT.
Deeper acceleration analysis would require a custom firmware and goes beyond the focus of this app.

[1337sup3rh4x0r]

Too slow typing on mobile :)

[danielegobbetti]

I'm closing the issue but if you guys discover something interesting wrt this aspect feel free to reopen it :)

[cpfeiffer]

I'd like to reopen this request and remove the "MI Band" bit from it.

There may be other gadgets that we might support in the future and which allow us to implement something like this.

[cpfeiffer]

In fact, before I even bought the Mi Band, I envisioned that I might be able to use it as a watch. I'd shake my hands in a certain way, making the Mi Band vibrate and encode the current time in lighting the three LEDs in some way.

And if it's necessary, hacking the Mi Band firmware might not be out of the question either. The chip on my band is this: http://www.datasheets.com/search/partdetail/DA14580/Dialog+Semiconductor+GmbH with a RivieraWaves BLE stack: http://rivierawaves.com/
And here's the datasheet: http://www.dialog-semiconductor.com/docs/site-pdf/da14580_pb.pdf?sfvrsn=2

[cpfeiffer]

But to make it clear, don't hold your breath, nobody's currently working on this. It's rather a call for help or a TODO for when other more important things are already done.

[danielegobbetti]

Just for the sake of completeness. That is the BLE chip inside the miband. Basically all other component's specs are unknown / not easily greppable from the firmware file.

[cpfeiffer]

That's true, but my speculation was that this chip is used for other things as well:

"The inclusion of a 32-bit ARM® Cortex™ M0 core in combination with on-chip One-Time Programmable (OTP) memory provides exceptional design flexibility and eliminates the need for an external processor in the system while reducing costs."
http://www.dialog-semiconductor.com/media-centre/press-releases/press-releases-details/2013/05/21/dialog-semiconductor-introduces-the-world-s-lowest-power-bluetooth-smart-chip

[1337sup3rh4x0r]

The Microsoft Band might be the easier way to accomplish this. From what I understand, it offers access to detailed acceleration data via the api.

[cpfeiffer]

Microsoft and openness in one sentence? _rub eyes_ :-)

It would certainly be very cool if there was an actual API to such a device. Even if it costs a "little" more than a Mi Band.

[1337sup3rh4x0r]

Well maybe not open open but more open than xiaomi I assume ... :) http://developer.microsoftband.com/

[cpfeiffer]

There is indeed a nice SDK and comprehensive documentation for the Microsoft Band. There is one drawback, though: you _have_ to use the MS Health app. So while you can customize the MS Band and add features to it, all data probably still goes to the MS cloud.

[danielegobbetti]

I think I have news.

By writing [0x12, 0x1] to the CONTROL_POINT characteristic, the band starts notifying on the UUID_CHARACTERISTIC_SENSOR_DATA characteristic a continuous flow of data, which I believe could be live accelerometer data.

I observed messages of 8 or 14 bytes, as far as I can tell they are in pairs and each pair refers to an axis (I tried pointing my arm upwards, downwards, rotating, etc.): probably one of them is the most significant value.
The first two bytes seem to be a counter (messages of 8 and 14 bytes increment the same counter apparently).
The message that is 14 bytes long seems to be a concatenation of two messages (with a single counter increment).

Examples:

W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): GOT SENSOR DATA WITH LENGTH: 8
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  58
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x   6
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x   e
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  3c
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  d9
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  7f
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  ee
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  bf
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): GOT SENSOR DATA WITH LENGTH: 14
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  59
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x   6
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x   f
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  3c
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  dc
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  7f
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  ee
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  bf
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x   e
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  3c
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  d8
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  7f
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  ef
W/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7029): DATA: 0x  bf

[danielegobbetti]

If my assumptions are right here are some sample (interpreted) data :

I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7726): READ VALUES: counter:3314 step:0 axis1:15384 axis2:32743 axis3:32988;​

arm pointing up​

I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7726): READ VALUES: counter:3351 step:6 axis1:16284 axis2:17171 axis3:33686;​

arm pointing forward

I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7726): READ VALUES: counter:32152 step:12 axis1:32127 axis2:33555 axis3:412;​

arm pointing down

I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7726): READ VALUES: counter:17304 step:12 axis1:48807 axis2:328 axis3:16332;​

Wrist rotated to the left

I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport( 7726): READ VALUES: counter:355 step:12 axis1:16313 axis2:17344 axis3:48944;​

Wrist rotated to the right

[cpfeiffer]

Awesome. Now we need to check how much battery this needs per hour and if this mode disables itself after a while.

[danielegobbetti]

I can push the code in a branch if someone wants to experiment :)

[cpfeiffer]

I'm busy with other things right now, but this is really interesting! So if you don't mind, just push it, eventually I'll check it out :-)

[emailvenky]

The accelerometer code does not seem to work for me, though debug prints say that [0x12, 0x1] has been successfully to the CONTROL_POINT characteristic
All other notifications go through correctly to the Mi band indicating that the connection is up and the toggling on setmusicinfo happens correctly.

07-11 16:26:33.940 13857-13857/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.BluetoothCommunicationService﹕ Service startcommand: nodomain.freeyourgadget.gadgetbride.bluetoothcommunicationservice.action.setmusicinfo

Any thoughts on what I might be missing?
Thanks.

[cpfeiffer]

I just tested it and it worked for me:

07-12 00:13:18.409  25928-25928/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.BluetoothCommunicationService﹕ Service startcommand: nodomain.freeyourgadget.gadgetbride.bluetoothcommunicationservice.action.setmusicinfo
07-12 00:13:18.414  25928-25928/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ about to add: Transaction task: Toggle sensor reading with 1 actions
07-12 00:13:20.049  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic write: 0000ff05-0000-1000-8000-00805f9b34fb (success)
07-12 00:13:20.053  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ handleControlPoint got status:0
07-12 00:13:20.058  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ handleControlPoint GOT DATA:0x      12
07-12 00:13:20.062  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ handleControlPoint GOT DATA:0x       1
07-12 00:13:20.075  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.091  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:0 step:12 axis1:15548 axis2:16838 axis3:48775;
07-12 00:13:20.092  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.093  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:1 step:12 axis1:15552 axis2:16851 axis3:48787;
07-12 00:13:20.094  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.095  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:2 step:12 axis1:15558 axis2:16824 axis3:48785;
07-12 00:13:20.095  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.096  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:3 step:12 axis1:15547 axis2:16832 axis3:48769;
07-12 00:13:20.097  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.098  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:4 step:12 axis1:15547 axis2:16831 axis3:48767;
07-12 00:13:20.098  25928-25945/nodomain.freeyourgadget.gadgetbridge D/nodomain.freeyourgadget.gadgetbridge.btle.BtLEQueue﹕ characteristic changed: 0000ff0e-0000-1000-8000-00805f9b34fb
07-12 00:13:20.099  25928-25945/nodomain.freeyourgadget.gadgetbridge I/nodomain.freeyourgadget.gadgetbridge.miband.MiBandSupport﹕ READ SENSOR DATA VALUES: counter:5 step:0 axis1:15551 axis2:16828 axis3:48774;

etc.

Which firmware version do you have?

[emailvenky]

Firmware version is 1.0.9.65
I have also set he MI address under Settings ->Mi Band Settings ->Developer Options -> Mi Band address. Still no luck getting the output.
Is there anything else that needs to be done?
Otherwise , the app rocks an all other functions work great!
Thanks.

[cpfeiffer]

The setting is only necessary when the Mi Band is not detected automatically, so setting the mac address manually would not change or fix any other behavior.

Just to make sure that you do the right thing:

• you checkout daniele's live-sensor-data branch
• you build it with Android Studio or Gradle directly
• you push the APK to your device
• you connect
• you enter the debug activity
• you press the "set music info" (or something like that, don't have it right now)
• then you see the output in logcat

Might be that they changed the API in that firmware version, but I can't really say before I have a firmware upgrade utility.

Alternatively, one could sniff the output of the MiFit app.

[flyingrub]

I just received my band, and i saw there is a touch feature. It could be great to reverse this too.

[cpfeiffer]

Crazy idea ahead: would be cool if we could use this to make some kind of PlayStation controller.

[flyingrub]

This is actually possible i think :p

[cpfeiffer]

I just received my band

Congratulations :-)

and i saw there is a touch feature.

Do you mean the "touch gesture" in order to pair the band? I had done some short experiments and we do not get any notifications about the touching. Maybe we need to listen on some other characteristics, but I have no idea about that yet.

If anyone finds out how to get notified by the band when touching it, that would be awesome!

[danielegobbetti]

I'm fairly sure there's no touch sensor, but only accelerometer readings, but I'd be more than happy to be proven wrong. :)

[cpfeiffer]

Yes, not a real touch sensor, the touches are probably detected as a specific gesture of the accelerometer.

Still it could be that the band sends out notifications when it detects such gestures.

[keverets]

The band seems to interpret taps (for cancelling alarms, initiating firmware updates in the "official" app, pairing, etc). It's not clear whether that can be exposed to the phone, however.

[flyingrub]

Yeah it would be great to use it to push information from the band to the
phone, without the phone requesting it. But i think it's only a band
feature. It's purpose it to accept things on the band. We would need to
hack the firmware to change this.

[Sharky88]

If anyone it's interested in the use of acelerometer data, I discovered that firmware version 1.0.9.27 works very well by notifying the sensor data when you write new byte{0x12,0x01} to the gatt characteristic control_point. However, the firmware 1.0.10.11 version doesn't notify sensor data, neither any higher version like 1.0.11.10, which I've tried too.
I believe that from firmware version 1.0.9.65 to the last version don't notify any of them. Because of an emailvenky's comment above.

[Heikofant]

any news on this?
Anyone tried to get Accelerometer data from the 1S (pulse)?

// Edit:
Today, I received my Mi Band 1A with FW 5.15.11.19 and I can receive the SENSOR_DATA.

Question is still valid for the 1S though.

[cpfeiffer]

We should indeed make this feature available. As a first step, just log the data, but maybe even broadcast it so that other apps can make use of it.

[cpfeiffer]

I integrated this as a very basic feature into the next version (0.13.4). You can enter the Debug screen and press "Test New Functionality". Then you will see some output on your console/logcat.

Unfortunately it doesn't work on my 1S with fw 4.16.4.22, i.e. I don't get any sensor data output.

[Heikofant]

did anyone find out how to interprete the sensor data?
Unfortunately, I couldn't. Maybe someone has an older version of the Android .APK and could try to reverse it? I spent one day on the current .APK but couldn't figure out where or how they use the sensor data (however, I'm not the best reverse engineer)

[danielegobbetti]

@Heikofant I'm not sure about the currently merged code, but if you take a look at the one I posted some time ago ( https://github.com/Freeyourgadget/Gadgetbridge/commit/d68a4211b6ce29c5cc2f2c8c442eec7b3d0f2dd9 ) you can find the interpretation of the raw values as X/Y/Z coordinates.

[Heikofant]

@danielegobbetti
I already implemented your code, but I have no clue how to transform those raw values into some kind of G-values.

[cpfeiffer]

You can get older versions from some apk mirror sites. I don't know if the app actually handled and evaluated realtime sensor data at all.

[danielegobbetti]

@Heikofant that's part of the fun: i.e. making sense of data having little to no information :)

[Heikofant]

@cpfeiffer @danielegobbetti and I can proudly present my latest discovery:
In the 1.3.412 version of Mi Fit, they parse and process the sensor data.

This is how they convert the bytes into acceleration values of the x-, y- , and z-axis.
axis = ((data[i++] | data[i++] << 8) & 0xfff) << 20 >> 20;

Below is the complete implementation.

I'm not 100% sure about the float factor = 1000;.
However, the values are not 100% correct when the device is in specific states, sometimes an axis changes when being tilted from +1 to nearly 0 and then to +0.8 again etc..

Maybe someone can enhance my findings :)

 private void handleSensorData(byte[] data) {
        int counter=0, step=0, axis1=0, axis2=0, axis3 =0;
        float axis1Conv = 0, axis2Conv = 0, axis3Conv = 0;
        if((data.length - 2) % 6 != 0) {
            LOG.warn("GOT UNEXPECTED SENSOR DATA WITH LENGTH: " + data.length);
            for (byte b : data) {
                LOG.warn("DATA: " + String.format("0x%4x", b));
            }
        }
        else {

            int i = 0;
            counter = (data[i++] & 0xff) | ((data[i++] & 0xff) << 8);

            while(i < 20){

                axis1 = ((data[i++] | data[i++] << 8) & 0xfff) << 20 >> 20;
                axis2 = ((data[i++] | data[i++] << 8) & 0xfff) << 20 >> 20;
                axis3 = ((data[i++] | data[i++] << 8) & 0xfff) << 20 >> 20;
            }
            LOG.info("READ SENSOR DATA VALUES: counter:"+counter+" convX:"+ convertAccToG(axis1)+" convY:"+ convertAccToG(axis2)+" convZ:"+ convertAccToG(axis3)+";");

        }
    }

 /**
     * Converts the given integer acceleration value into float value in terms of G.
     * @param data
     * @return
     */
    private float convertAccToG(int data) {
        float factor = 1000f;

        return (float) data / factor;
    }

[martinhampton]

@cpfeiffer Should the sensor data work with the 1S fw 4.14.4.22 - mine doesn't seem to be?

[dmitryfisko]

@danielegobbetti Does your known way to get accelerometer data from Mi Band 2?

[danielegobbetti]

I'm sorry I have no clue about how it could work on the miband 2.

[cpfeiffer]

@Heikofant I totally missed your findings. Very nice. It would be really cool to use that with current firmware versions as well. Needs some digging, I guess.

@martinhampton I had no luck with recent firmwares either :-/

@dmitryfisko I don't know of a way either (yet).

[olegamour]

Hello guys,

I'm trying to get accelerometr data from my Mi Band using BLE protocol on my PC. But for now I can get only pure information from my Mi Band^ Name, Signal Level, ServiceUuids. Is it any possibility to get accelerometr data from my Mi Band on PC(.NET)? not Android. For now I'm using Windows.Devices.Bluetooth BluetoothLEAdvertisementWatcher.

Thanks a lot.

[eshkoliGilad]

@danielegobbetti @Sharky88

Hi, guys. I'm trying to get the accelerometer data also from the MiBand 2 and I tried following your steps to get it done but I simply can't get how to write 'new byte{0x12,0x01}' to CONTROL_POINT.

Any code example will be great, thanks.

[cpfeiffer]

@eshkoliGilad That code was for Mi Band 1 and will not work for Mi Band 2, sorry.

[palitu]

The application Mi Band Master can view the raw accelerometer and heart beat monitor data. Is it possible to see how it is doing it?

I want to see if we can use this to monitor my father in Laws parkinsons tremors. When we viewed the data there were almost perfect sinusoidal waveforms in all three axis.

[Heikofant]

@palitu where do you see the realtime accelerometer data in Mi Band Master?

you could just ask the author of Mi Band Master how he accesses the raw accelerometer data. Or you download the APK and reverse it :)

[treo]

Following a DMCA takedown notice, we agreed upon removing this content from our issue tracker.
The counter notice is available here:
https://github.com/github/dmca/blob/master/2017/2017-06-20-MiBandTools-Counter-Notice.md

[palitu]

@Heikofant open the menu, and go to statistics, G-sensor, then Start Measurement.

[Heikofant]

@palitu do you use the pro version?
which Mi Band do you use? 1A, 1S, 2?
I tried Mi Band Master with my Mi Band 1A and in Statistics, I do not have the Tabs "G-Sensor" or "PPG"

[palitu]

I have the Mi Band 2. and i have paid for the pro version.

[palitu]

so - I can get the raw mi band 1x accelerometer data using gadget bridge?

[Heikofant]

@palitu Yes, you can access the accelerometer data from a Mi Band 1A with Gadget-Bridge and the code from my post of Octobre 13th, 2016.

However, my transformation from raw values into acceleration values is somehow flawed

[palitu]

This should give me at least somewhere to start, if we end up going for a wearable device. Thanks.

[Heikofant]

@palitu then I would advise you to get a Sony SWR10. It has a 10Hz acceleromter that can easily be accessed (just google for it, e.g. https://github.com/fbarriga/sony-smartband-open-api)

[palitu]

@Heikofant Thanks, and they look quite cheap as well.

[freezed-or-frozen]

Maybe it could help... Mi Band 1A embed an ADXL362 accelerometer which use 12bits in its ADC. Range of values should be between 0 and 2^12=4096 using twos complement.
My assumption is that sensor data sent by Mi Band comes directly from SPI FIFO buffer of the ADXL362 sensor.

Here what one can read on the page 38/43 of the ADXL362 documentation :

When reading data, the least significant byte (Bits[B7:B0]) is
read first, followed by the most significant byte (Bits[B15:B8]).
Bits[B11:B0] represent the 12-bit, twos complement
acceleration or temperature data. Bits[B13:B12] are sign
extension bits, and Bits[B15:B14] indicate the type of data

So we have :

• raw value : Bits[B11:B0] encoded using twos complement. Meaning that B11 is also a sign bit
• sign of the raw value : Bits[B13:B12]
• type of data : Bits[B15:B14] (00=x-axis, 01=y-axis, 10=z-axis, 11=temperature)

The 12 bits raw value can be convert in a true acceleration value by dividing raw value with a magic_factor. According to the documentation this accelerometer can operate in differents ranges :

• +/- 2g : 1mg/LSB => scale_factor = 1000
• +/- 4g : 2mg/LSB => scale_factor = 500
• +/- 8g : 4mg/LSB => scale_factor = 250

I guess Xiaomi have chosen the first one.

Here my Python code implementation for z-axis :

scale_factor = 1000
z_raw_value = ((data[step+7] * 256) + data[step+6]) & 0x0fff
z_sign = (data[step+7] & 0x30) >> 4
z_type = (data[step+7] & 0xc0) >> 6
if z_sign == 0:
    z_acc_value = (z_raw_value & 0xfff)
else:
    z_acc_value = ~((z_raw_value & 0xfff) - 4097)
z_acc_value = (z_acc_value / scale_factor) * 9.81

I did a few tests with the Mi Band laying on a table :

• recto side : z-axis = 10.89 m.s^-2 (it must be 9.81 m.s^-2)
• verso side : z-axis=-10.88 m.s^-2 (it must be -9.81 m.s^-2)

Because I am not living on a strange planet, values seems to be a little bit wrong. Sensitivity calibration error is +/- 10% so wrong values are in the error range. Perhaps Mi Band add a few post processing to the raw data even if they really seem to come directly from SPI interface. Temperature may also affects values.

I am working on a Python lib to access sensor data and activity data recorded in the device. I will upload it in a few days.. Have a look at : https://github.com/freezed-or-frozen/pymb1a

Gadgetbridge is a great work. Congratulations.

[cpfeiffer]

Wow, very cool! Too bad that this is only available in older firmware versions, but at least we can freely up- and downgrade.

Also very interesting that one can read the temperature! I didn't know that.

[freezed-or-frozen]

Really we can downgrade firmware ? How do you do that trick ? Is there a risk to brick the Mi Band ?

[cpfeiffer]

There's always a risk, but

• it has never happened to me
• nor have I heard of anyone bricking it

See https://github.com/Freeyourgadget/Gadgetbridge/wiki/Mi-Band-Firmware-Update

[freezed-or-frozen]

Great job !
I will try it because when trying official Mi Band app for Android, firmware was upgraded. Usually upgrading a firmware is known as a good thing...

[freezed-or-frozen]

@cpfeiffer Do you want me to add a decoding method for the accelerometer ? I already did it in Python, I can add a Java method in MiBandSupport.java.

[cpfeiffer]

@freezed-or-frozen Yes, sure, please do!

[Heikofant]

@freezed-or-frozen do you also encounter the strange "tilting jumps"? So when you tilt the device slightly, the calculated acceleration values make unpredictable jumps, for example from +1G to 0.1 and then to 0.8 again etc.

[freezed-or-frozen]

@Heikofant no, I have already test 2 wristbands and everything looks fine.

[freezed-or-frozen]

@cpfeiffer maybe it is a stupid question... I clone the repo, create a branch, modify the handleSensorData() method to decode accelerometer data, commit and push but 403 error. Did I forget something ? Or am I totally on the wrong way ?

[cpfeiffer]

@freezed-or-frozen Sorry for the late reply -- totally missed it.

With github, you "fork" the repo, that is, you create a clone not only on your own computer, but also a clone on github. Then you clone your own "fork" where you can push your changes to. When you're ready, you create a "pull request" on github from your fork to our repository.

If that's too much for you, you can also just send a git diff or git format-patch.

[freezed-or-frozen]

@cpfeiffer I try to apply your workflow. I hope it is correct. Have a look at the pull request #703 and let me know.

[jaag12]

Hello, I am interested in knowing how to access the accelerometer data in mi band, I have searched for alternatives in other bracelets such as MS Band or Pebble, but they are not manufactured and not supported.
Are the accelerometer data read correctly and interpreted correctly?
Oh, thank you.

[freezed-or-frozen]

@jaag12 have a look at pull request #703 for Android code or at pymb1a a Python library which can access accelerometer raw values. As far as I know these values come directly from the ADXL362.

[forkoz]

I too do not see measurements on the 1s when I hit "enable new functionality".

Thing is [0x12, 0x1] to the CONTROL_POINT sounds like it can be brute forced. Just fire
0x12, 0x1 record data
0x13, 0x1 record data
etc.
And then move the band or leave it still and see which data looks like it could be right.

The accelerometer in 1s the same?, bluetooth soc is slightly newer (680vs580).
from pic
http://chengdaguandao.com/uploads/allimg/c151123/144RO04520230-25M64.jpg

Figured out how to disassemble the firmware. Look for F0 B5 00 and remove everything before it.
I've been able to open miband 1 and 1s with ida no problem.

[angelhunt]

could this method work for miband2? Has anyone tested it?

[thePanz]

@angelhunt for MiBand2 have a look at #894

[ghost]

Does this work for MI Band HRX

[arielroque]

Has anyone that got the raw sensor data from miband 2 ? if yes, cold show me how got it?

[ebellumat]

MiBand 3, anyone?

[jaeminjjung]

MiBand3, anyone?

[ragcsalo]

Any progress on reading realtime accelerator data from Mi Band 2 or 3?

I have found this article for Mi Band 2:
https://medium.com/machine-learning-world/how-i-hacked-xiaomi-miband-2-to-control-it-from-linux-a5bd2f36d3ad

[ragcsalo]

So it works with the Mi Band 2 this way (probably works with the Mi Band 3 the same way):

• complete the authentication process with the Mi Band (if you need help, ask me)
• write (without response) data "010119" to service "fe00" characteristic "00000001-0000-3512-2118-0009af100700"
• write (without response) data "02" to service "fe00" characteristic "00000001-0000-3512-2118-0009af100700" to start getting sensor data
• start listening (notify) service "fee0" characteristic "00000002-0000-3512-2118-0009af100700"
• write (without response) data "03" to service "fe00" characteristic "00000001-0000-3512-2118-0009af100700" to stop getting sensor data
• sensor data will stop being sent after 1min14sec, so if you need more, you can send "010119" followed by "02" again and again... I tried sending it every 30 sec, and the data just kept coming for minutes :-)

You will get approx. 10 data packets in 1 sec intervals. A data packet looks like this:
01203900ce0047005c009f003300880083005800

first byte is always 01
second byte is a counter, starting with 00 and going up
next 2 x 3 bytes are the hexa values for X, Y, Z vectors. I think the first byte for each vector is the value, the second byte is either "00" or "ff", which might represent positive or negative values (so 3900 is 57, 15ff is -21 ???)
in a data packet there can be 1, 2 or 3 XYZ vector values

example:
0120 [3900 ce00 4700] [5c00 9f00 3300] [8800 8300 5800] (this packet has 3 times the XYZ values)

I hope this makes sense. :-)
What I want to do now, is to get data every 1/10th second, instead of getting 10 packets every second. If someone can figure out how to do that, please let us know! :-)

[pinpinrouge]

Hello, has anyone succeeded in getting the accelerometer data from the Mi Band 1S (pulse) ?
I had no luck writing [0x12,0x1] on the CONTROL_POINT and listening to notifications on the 0xff0e characteristic.

[aytunch]

@ragcsalo Thanks for the clear explanation. Would you help me get real time heart rate info just like you did with the accelerometer value? Which steps do we need to follow? I could not find the code for MiBand2&3 inside this library.