Here’s How I Send a Notification to Smart band.

Gusfian Hamzah
MII Cyber Security Consulting Services
7 min readMar 7, 2021
Smart band

I recently just started to learn about an IoT. So on this article I want to share my experience on sending a notification to a smart band using 3 different methods. It’s not something too advanced hope you guys can learn something after reading this article. In this test, I’m using 2 smart bands, the cheap one called M4 and Xiaomi Mi band 3 that commonly used.

Introduction

Before it started, Let’s take a look some basic theory that related on this test.

BLE

BLE stands for Bluetooth low energy that are being used on many IoT devices. The Bluetooth Low Energy radio is designed for very low power operation. To enable a reliable operation in 2.4 GHz frequency band, it leverages a robust frequency-hopping spread spectrum approach that transmits data over 40 channels. The Bluetooth LE radio provides developers a tremendous amount of flexibility, including multiple PHY options that support data rates from 125 Kb/s to 2 Mb/s, multiple power levels, from 1mW to 100 mW, as well as multiple security options up to government grade. BLE is being used because it has less power consumption and the size relatively small so, it can be embedded on small IoT devices like Smart band. — Bluetooth.com

Services

A Service is a container for logically related Bluetooth data items. Those data items are in fact called Characteristics. — Bluetooth.com

Characteristics

Characteristics are items of data which relate to a particular internal state of the device or perhaps some state of the environment which the device can measure using a sensor. — Bluetooth.com

Services & Characteristics

Let’s get started

The first step is getting communication data that you can get on your android phone by accessing developer options then enable Bluetooth HCI snoop log so, you can capture all Bluetooth packets in a file. For getting the log you can use adb.

adb shell dumpsys bluetooth_manager
adb bugreport > BUG_REPORT.txt

I don’t know if this way work for you but at least it’s work for me for getting my btsnoop_hci.log. After getting the log you can analyze it using Wireshark. After a while, I found a packet that responsible for getting an alert.

btsnoop_hci.log

As you can see I can get a handle, UUID, and also the value itself.

Before we’re sending a notification, we need to connect to our smart band beforehand. For connecting to a smart band, we need to know the mac address that is being used on our device. We can use a tool called hcitool that you can get by installing bluez package.

hcitool lescan

Hcitool

GATTTOOL

After knowing the MAC Address, I use gatttool to connecting my smart band (on this tool I’m using M4) with this simple command.

gatttool -b <BLE MAC Address> -I

b = for specify MAC Address

I = for interactive mode

Connecting using gatttool

With this tool you can list services & characteristics that your smart band use and you also can read and write specific characteristics.

For getting the services use command

primary

Gatttool — services

For getting the characteristics use command

characteristics

Gatttool — characteristics

Maybe some of you wondering what all of this number for. Here is a reference from Bluetooth Assigned-numbers so, you can find and match UUID that you get using gatttool with predefined number from it.

For an example, on the top list of services it has UUID 0x1800 and 0x1801 these numbers stands for Generic Access and Generic Attribute. And then, for characteristics 0x2a00 for Device Name and 0x2a19 for Battery Level.

For reading a value on the characteristics use command

Char-read-hnd <handle>

For an example you want to read Battery Level so, you need to find it’s UUID then use char value handle to read the value. So, here I know that my Battery Level using 0x2a19 and have a handle 0x0021.

Read Battery Level

It replies with hex value, so you guys need to decode it to decimal. 5f on hex = 95 on decimal.

It’s also same if you want to read Device Name, but the difference is you needed to decode hex value to ASCII. 4d 34 on hex = M4 on ASCII.

Read Device Name

Here’s the interesting part that you can send a notification on your smart band by using command

Char-write-req <handle> <value>

Write an Alert

From the data that I get from btsnoop_hci.log. I know the handle and also the value that responsible sending an alert. And it’s successfully sending an alert to my M4 smart band.

Alert Notification

As the saying goes, All roads lead to Rome. Gatttool is not the only way for sending a notification.

GitHub

Yes, you read it right, GitHub. Credits to yogeshojha for making the code.

But for your information this code works only on MiBand 2 and MiBand 3, I don’t know if it’s also works on later version of MiBand.

With using this code it’s so simple for connecting and sending a notification. First, you need to connect using command.

python main.py <BLE MAC Address> — init

Connecting to MiBand 3

Then it will display a Menu for you sending a notification.

Menu

After you choose the option you need to input the sender name. Then, it will successfully send a notification to your Mi Band.

Message Notification
Call Notification

nRF Connect

nRF connect it’s an amazing application for you to list all services and characteristics that your smart band use, read and write characteristics, also see the logs events, that you can get on your mobile phone.

First, to connect to your smart band you need to scan your smart band. Then it will show and you simply tap the connect button.

Connect using nRF Connect App

After it connected you will find a bunch list of services, you can tap it and it will display the characteristics.

Services & Characteristics on nRF Connect App

To write on the characteristics, you can tap the up arrow on the right and then it will display a pop up box for choosing an alert category, number of alerts, and notification value.

Write notification on nRF Connect App

After you send, you also can see how the notification being sent, to which characteristics, and the value. By, swipe your mobile screen from left to right.

Logs on nRF Connect App

By the logs, you can see when sending a SMS notification it’s written to 0x2a46 with a value 05-01-4e-72-66.

Let’s reverse the value.

The first two bytes for notification type.

01 = Email

03 = Call

04 = Missed Call

05 = SMS/MMS

Second two bytes for number of alert.

The rest for the message on hex value.

4e = N

72 = r

66 = f

So, the message that I send is Nrf.

Message Notification using nRF Connect App

--

--