Skip to content

Instantly share code, notes, and snippets.

@Robbe7730
Created July 14, 2019 20:13
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Robbe7730/1791dca20a29df8342879c4450a10e10 to your computer and use it in GitHub Desktop.
Save Robbe7730/1791dca20a29df8342879c4450a10e10 to your computer and use it in GitHub Desktop.

Skagen Hybrid communication

Basics

Every command starts with 1 byte indicating if the command is a request-, write- or response-command. (All bytes are hexadecimal). Every group of bytes is little endian.

A request-command starts with 01 and gets a response-command from the watch, starting with 03. (See Requests for more info)

A write-command starts with 02. (See Writes for more info)

Requests

Every request has the form 01 XX, where XX is the byte indicating which piece of info is being requested (see below) The response to this request has the form 03 XX data, where the XX is the same as in the request and data a varibale amount of data, depending on the request (see below).

01 (Unknown)

Response:

  • 1 byte: unknown

02 (Unknown)

Response:

  • 1 byte: unknown

03 (Unknown)

Response:

  • unknown

04 (Current timestamp)

Response:

  • 4 bytes: current timestamp in seconds
  • 2 bytes: unknown (possibly 100th's, hard to check)
  • 2 bytes: timezone in minutes after UTC

05 (Step goal)

Response:

  • 1 byte: unknown
  • 3 bytes: step goal

06 (Current step count)

Response:

  • 1 byte: unknown
  • 3 bytes: step count

07 (Unknown, something to do with configuration, writes are notifications)

This request-command takes another byte as argument, so the command is 01 07 YY, where YY is a byte from the following list:

  • 01: unknown, response: 11 bytes unknown (looks similar to the response to 01 0a)
  • 02: clockState, response: 1 byte unknown
  • 03: tripleTapEnable, response: 1 byte unknown (probably 0 or 1)
  • 04: unknown, response: 1 byte unknown
  • 05: unknown, response: 1 byte unknown

08 (Battery level)

Response:

  • 1 byte: battery level (0-100)

09 (Unknown)

Response:

  • Unknown

0a (Connection parameters)

Response:

  • 1 byte: status (unkown, found in obfuscated code)
  • 2 bytes: connection interval divided by 1.25
  • 2 bytes: connection latency
  • 2 bytes: supervision timeout divided by 10

0b - 0f (Unkown)

Response:

  • Unknown

10 (Step goal)

Response:

  • 4 bytes: step goal

11 (Current step count)

Response:

  • 4 bytes: current step count

12 (Other timezones)

This request-command takes another byte as argument, so the command is 01 12 YY where YY is the index of the extra timezone.

Response:

  • 2 bytes: timezone (in minutes after UTC)

13 (Countdown)

This request-command takes another byte as argument, so the command is 01 13 YY. The purpose of YY is unknown, but I could only get it to respond with YY = 01, but it is probably used to indicate the correct countdown.

Response:

  • 4 bytes: start time in UTC seconds
  • 4 bytes: end time in UTC seconds
  • 2 bytes: timezone (in minutes after UTC)
  • 1 byte: progress (unknown, found in obfuscated code)

Returns all FF if no countdown is set.

14 (Goal tracking)

This request-command takes another byte as argument, so the command is 01 14 YY. The purpose of YY is unknown, but I could only get it to respond with YY = 01, but it is probably used to indicate the correct goal.

Response:

  • 1 byte: goalIdNumber
  • 1 byte: goalTrackingState (boolean)

Writing

To write data to a specific setting, the write-command must be formed as 02 XX data, where XX is a byte from the list in Requests and data is formatted like the response to the corresponding request. (THIS NEEDS TO BE CHECKED). Special cases like notifications are documented below:

07 (Notifications)

Format: 02 07 0e 0a 00 VV 05 CC 00 00 [HH HH] [MM MM]

Where:

  • VV = vibration type (these are hard to type out into text)
  • CC = number of extra bytes (4 if only setting hour- or minute-hand, 6 if setting both)
  • HH HH = degrees of hour-hand
  • MM MM = degrees of minute-hand

0b (Buttons)

There's two types of button-settings, one for "normal" actions and one for media actions. Both start with 02 0b 32 BB where BB is the index of the button to set: (1 for top, 2 for middle, 3 for bottom). Sending just this prefix clears the button.

"Normal" actions

Format: (prefix) 72 YY ZZ ZZ

Where

  • YY= BB + 29
  • ZZ ZZ = the action, twice the same byte:
    • 00: Date
    • 01: Timezone one
    • 02: Timezone two
    • 03: Last notification
    • 04: Alarm (?)
    • 05: Twentyfour hour (?)
    • 06: Twelve hour (?)
    • 07: No mode (?)
    • 08: Step progress
    • 09: Seconds (?)
    • 0a: Countdown (?)
    • 0b: Defaults (?)
    • 0c: Sequenced Nodes (?)
    • 0d: Stopwatch
    • 0e: Dial spin (?)

(Actions with a (?) are found in obfuscated code, but I've not figured out what they do exactly)

Media actions

Format: (prefix) XX ZZ ZZ 00 01

Where

  • XX = Button code (top: 30, middle: 38, bottom: 40) (+1 for hold, +2 for double-click)
  • ZZ ZZ = Action (Volume Up: 14e9, Play/Pause: 14cd, Volume Down: 14ea, Next: 0fb5)

f1 (Animation)

By sending 02 f1 YY, an animation plays. Currently known values for YY are:

  • 05 (Pairing animation): spins the hands clockwise once
  • 06 (Sync animation): spins the hands clockwise once

Files

TODO

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment