UP24 Hacking

Intro

Last month I received a Jawbone UP24 as birthday gift, and after a couple of weeks of standard use I couldn’t resist digging into its technical side to discover how this device actually works.

As far as I discovered, UP24 features a 3 axis accelerometer, 2 notification leds, a vibrating motor and a Bluetooth LE interface to communicate with the companion smartphone app “UP” (available for Android and iOS). Technical readers can find further info and a complete teardown of the low-end version of UP24 (the older UP) here.

The strength of UP24 comes also from the great companion app that let users configure alarms and notifications in response of activities or events. Great features are the smart alarm that chooses the best time to wake you up in the morning, and idle notifications that reminds you to stretch your legs after being too much time idle on the chair.

The UP24 is definitely meant to be an activity band, and I think this is the sole reason why the guys ad Jawbone decided (at the time of writing) to not provide some extra useful features (IMO) like notifications on email/sms/calls/etc…

Beginning

I wanted to use my UP24 as a notification device for messages coming from some of my android phone’s contacts… something simple, like a vibrate on sms.

So, as usual, the first question is

” has someone already solved my problem? ”

Googling around I found something here and here. … Perfect! Just no code available, and wrong OS :)

However, thanks to these blogposts I knew it was possible to make vibrate my UP on command, and it had to be done through some custom Bluetooth LE command.

Learning

After learning the basics of Bluetooth LE (here’s one of the most interesting article I found) I needed to find out how to use it on my Android.

Found a great example and all the necessary documentation here, and after installing Android Studio I was ready to start!

Doing

Using the example from Android SDK I was able to list all the services of my UP24 in matter of minutes… However I still hadn’t a clue of what services, attributes, and values I had to exploit to make the UP24 vibrate.

Then I thought of debugging the process on my phone

to see what was happening behind the scene while issuing a vibrate command. Note, there isn’t any vibrate command in UP application, but I noticed that after a successful bluetooth pairing the band vibrates; and that was exactly the reaction I wanted to use for my custom-notifications app.

After connecting my phone to the Android Studio debugger I did set a breakpoint for UP’s process to break at BluetoothGatt.writeCharacteristic method… This made everything a lot slower both on my old phone and laptop but in the end, after a successful pairing, I got what I wanted :)

-20 32 8 16 4 53 1 0 16 0 1 125.

And by the end of the day I was able to record the video at the top of this page.

Epilogue

I’m still writing my custom-notifications app, nevertheless I’m not releasing any of the source code of this project due to possible legal issues. However, for any mid-level programmer should be easy to achieve the same results just by following the steps of this blogpost.

Assignment

I also managed to make some experiments in order to reverse engineer a couple of the sniffed values… what if you change the previous value to “-20 32 8 16 4 53 1 0 3 0 1 125” ? :)

— 10/11/2014