HEC Posted September 23, 2016 Share Posted September 23, 2016 13 minutes ago, JumpMaster said: No data received from the wheel though. Might have to try some of the other characteristics before trying to decode that app another way. I'll be here for a while so just ask if anything else will be ready for the testing Link to comment Share on other sites More sharing options...
JumpMaster Posted September 24, 2016 Author Share Posted September 24, 2016 @HEC Looking through the InMotion source I was very nearly there. Added three extra lines of code. Lets see what this yields... https://drive.google.com/file/d/0B_qIN0Xd80hCbDV5Ujc3V2lXcDA/view?usp=sharing Link to comment Share on other sites More sharing options...
HEC Posted September 24, 2016 Share Posted September 24, 2016 2 hours ago, JumpMaster said: Lets see what this yields... Here we go ... though seems same to me as the last one. V8Dan.txt Link to comment Share on other sites More sharing options...
JumpMaster Posted September 27, 2016 Author Share Posted September 27, 2016 @HEC Yep there's no improvement there. I'm listening to the right characteristic now but it's not sending data. From looking at the decompiled app it sends a request for data. It looks like this is sent every 500ms. Does the app appear to update speed/current/etc twice a second? It's very hard to decipher the decompiled app. They've obscured the code so a nicely named function like 'InitialiseWheel()' is now called a(). A variable called 'isWheelConnected' is now called a. The next variable/function is b and so on. As the app is so large and obscured the decompilers don't do a great job. I've used two different decompilers and have to look between both sets of code to figure out what's correct. I've even made a Bluetooth LE server using the services and characteristics from your wheel but the InMotion app isn't fooled by it. I think that must be something to do with the password. I'll get there! Link to comment Share on other sites More sharing options...
HEC Posted September 27, 2016 Share Posted September 27, 2016 36 minutes ago, JumpMaster said: @HEC Yep there's no improvement there. I'm listening to the right characteristic now but it's not sending data. From looking at the decompiled app it sends a request for data. It looks like this is sent every 500ms. Does the app appear to update speed/current/etc twice a second? Currently the app shows only speed, board temperature, battery percentage, trip and total distance. And it will not display trip distance if the wheel is not connected to the app before ride so it might be that this value is not even sent by wheel but rather calculated from total millage figure instead. The refresh rate seems pretty low - could be about 2 Hz. The app itself is massive download and apart of the SCV / EUC section it contains lot of other stuff like social section, discovery section (with events, clubs, rankings a route recordings) as well as Me section for your own profile, list of registered vehicles (not only EUCs but all IM products) and trophies, coins, medals and so on so it's no wonder it's a mess to decompile ... In the SCV section you can control (apart of the configuration where you set the lights, sounds button function and speed limits) connect / discontent (app doesn't connect automatically), switch on / off head light and even turn of the EUC itself. There is also option to run the diagnostic of the wheel. The latest app version is v6.1.0 (released on the day the V8 arrived). I don't know if you've noticed (or even installed the app) but there are actually two apps in one. The main one with all features and also the notification bar "applet" (don't know the correct name tor for that?) which starts up together with the main up but remains active even after main app is closed / exited. It has a small red "I" in the left corner of the notification bar and when you pull down the bar it has four circles / buttons there to connect to the wheel, switch on / off head light, power off the wheel and to display battery level with small cross on the right to close it. This can be closed / exited even when main app is running. Maybe this would be a good start to poke around as it's much smaller with only minimum option included? I believe the process is called com.inmotion.ble Finally I've changed the password form default "000000" to my own but indeed I can reset it back if you'd need to send password by app though I don't think that's the case here. Link to comment Share on other sites More sharing options...
JumpMaster Posted September 28, 2016 Author Share Posted September 28, 2016 @HEC I'm pretty excited about this attempt... https://drive.google.com/file/d/0B_qIN0Xd80hCbWg3b1Brb1c5eDg/view?usp=sharing Link to comment Share on other sites More sharing options...
HEC Posted September 28, 2016 Share Posted September 28, 2016 1 hour ago, JumpMaster said: @HEC I'm pretty excited about this attempt... Seems same ... it connects and after 10 seconds get disconnected again. I've also killed all IM background services on the phone just in case the original app is a bit possessive but no difference. Maybe it needs constant pooling otherwise it drops connection? I can also try to revert password back to "000000" but I doubt it would make any difference. V8Ean.txt Link to comment Share on other sites More sharing options...
HEC Posted September 28, 2016 Share Posted September 28, 2016 So - I've tried again - this time with app connected - some "noise" on the line So first official app (either of them - full or notification bar one) needs to be disconnected so KEVTEST can locate and connect to the V8. After the 10s timeout when KEVTEST disconnects I'll connect via official app (again either of them) then KEVTEST reconnects automatically and stay connected as long as official app is running and connected. Official app is unable to connected to the wheel while KEVTEST is connected. Wheel was stationary only powered on during this test. So it seems like the official app is using some kind of "keep alive" / handshake to keep the wheel connected to mobile ... let me know @JumpMaster if you'll figure out anything from this log or if you want more with wheel moving and so on. V8Fan.txt Link to comment Share on other sites More sharing options...
JumpMaster Posted September 29, 2016 Author Share Posted September 29, 2016 @HEC Thanks for that test. At least I know I'm listening to the right characteristic. Like you said it could be a 10 second timeout or that I don't send the passcode within 10 seconds. I'm having trouble finding anything in the app mentioning a passcode but I'll keep looking. I've changed the characteristic I'm sending data to in this version. It seems there's a dedicated characteristic for writing data but just in case I'm wrong this will send the data to the same characteristic that reads the data. This is how it works on KingSong and Gotway but I don't think they put as much thought into it as Inmotion has. https://drive.google.com/file/d/0B_qIN0Xd80hCUmhJUlhJVU5UTzA/view?usp=sharing Link to comment Share on other sites More sharing options...
HEC Posted September 29, 2016 Share Posted September 29, 2016 33 minutes ago, JumpMaster said: @HEC That's for that test. At least I know I'm listening to the right characteristic. Like you said it could be a 10 second timeout or that I don't send the passcode within 10 seconds. I'm having trouble finding anything in the app mentioning a passcode but I'll keep looking. Here we go. I don't think it's a PIN but rather some "keep alive" protocol being used. The moment I click disconnect on official app (notification bar version) it drops the connection for KEVTEST as well. Wheel was again stationary only during test. V8Gan.txt Link to comment Share on other sites More sharing options...
JumpMaster Posted September 29, 2016 Author Share Posted September 29, 2016 @HEC That last test was with both apps open? What happens if you only connect using KEVTEST? That random data at the bottom of the file is good but I want it to be caused by KEVTEST. At the moment I only send the request for data once after which it's possible the keep-alive times out. Hopefully as it makes 1 request it should receive 1 reply. Link to comment Share on other sites More sharing options...
HEC Posted September 29, 2016 Share Posted September 29, 2016 8 minutes ago, JumpMaster said: @HEC That last test was with both apps open? What happens if you only connect using KEVTEST? That random data at the bottom of the file is good but I want it to be caused by KEVTEST. Yes the procedure is the same as before: 1. Connect via KEVTEST while official app is disconnected (but running) 2. Connection drops after 10 seconds 3. Connect via official app -> KEVTEST reconnects 4. Disconnect official app and KEVTEST drops connection right away as well. Link to comment Share on other sites More sharing options...
JumpMaster Posted September 30, 2016 Author Share Posted September 30, 2016 @HEC I've set the app to send the command every 500ms as per the original app. Let me know if it still drops the connection. Test it without having the official app open if possible. https://drive.google.com/file/d/0B_qIN0Xd80hCMDZjOXJ0ZWViWG8/view?usp=sharing I've also emailed info@invmotionsvc so hopefully they may be willing to help. Link to comment Share on other sites More sharing options...
HEC Posted September 30, 2016 Share Posted September 30, 2016 44 minutes ago, JumpMaster said: @HEC I've set the app to send the command every 500ms as per the original app. Let me know if it still drops the connection. Test it without having the official app open if possible. Unfortunately the moment the app connects to the V8 it displays the error that KEVTEST has stopped (same as earlier). Original IM apps are stopped. Link to comment Share on other sites More sharing options...
stevenvo Posted October 27, 2016 Share Posted October 27, 2016 @JumpMaster, will you plan to open source the work so we can test and contribute? Link to comment Share on other sites More sharing options...
Paco Gorina Posted November 8, 2016 Share Posted November 8, 2016 Hi I am doing the same with 9BMetrics and having the same type of problems. Just to help I add the services/characteristics detected. I also tried to fool the wheel with a BLE server with the same characteristics but the application doesn't accept it. I have acces to a v3 sometimes. Log Inmotion.txt Link to comment Share on other sites More sharing options...
Paco Gorina Posted November 8, 2016 Share Posted November 8, 2016 I supose I am repeating data that yopu already know but from the decompileng seems that : Subscribing characteristic is Service FFE0 Characteristic FFE4 but it may fallback to other ones if they don't exist Write characteristic is Service FFE5 Characteristic FFE9 but alñso may fallback to others. Link to comment Share on other sites More sharing options...
Paco Gorina Posted November 10, 2016 Share Posted November 10, 2016 Finally got it running. I add a file with the Swift code and protocol tested with a v5. Now capable of reading speed. Connection is usually good but sometimes it drops. Original application also drops connection ocasionally. Protocol_0.txt Link to comment Share on other sites More sharing options...
Cedric Hauber Posted December 29, 2016 Share Posted December 29, 2016 Hi, I'm trying to adapt this code to the WheelLog app, @JumpMaster did you tried yet ? Link to comment Share on other sites More sharing options...
Paco Gorina Posted December 29, 2016 Share Posted December 29, 2016 Yes, it is more or less working although I have many disconnects. Link to comment Share on other sites More sharing options...
Cedric Hauber Posted December 30, 2016 Share Posted December 30, 2016 I've something working: https://github.com/cedbossneo/WheelLogAndroid but needs some adjustments and still a lot of disconnects. Thanks to Paco Gorina for his work on 9BMetrics Link to comment Share on other sites More sharing options...
Cedric Hauber Posted December 30, 2016 Share Posted December 30, 2016 It works now without disconnects ! Link to comment Share on other sites More sharing options...
Cedric Hauber Posted January 2, 2017 Share Posted January 2, 2017 If somebody want to try, the APK is attached. Happy new year app-debug.apk Link to comment Share on other sites More sharing options...
HEC Posted January 2, 2017 Share Posted January 2, 2017 1 hour ago, Cedric Hauber said: If somebody want to try, the APK is attached. Happy new year app-debug.apk It connects to my V8 but: - still have lot of disconnections - doesn't actually read and display any values Link to comment Share on other sites More sharing options...
Cedric Hauber Posted January 3, 2017 Share Posted January 3, 2017 Sorry, it's because i've put my wheel pincode in the source code so it doesn't work correctly. I will push a version with a prompt instead. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.