How to communicate to Casio Watch

[izivkov]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[harlock974]

Hello,

I am a G-Shock user since decades and recently I have bought two models with Bluetooth abilities, the GBX-100 and the GA-B2100.
But I have been disappointed by Casio smartphone apps : you need to install 2 different apps for these 2 models, they are slow, they need you to have a Casio account, they need to connect to internet, and (why on earth ?) they need your location to merely connect to the watch.
So I was pleased to learn than two open source alternatives have been created, Gadgetbridge and G-Shock Smart Sync from Ivo.
More, Ivo developed a Python api, and now we can play with G-Shock Bluetooth communication from a computer.

Reading Ivo's code triggers my curiosity about BLE protocol and I would like to attempt some basic commands to communicate with the watch from a shell or a bash script. As I am a complete beginner in Bluetooth it was not that easy so I first tried a very basic thing : getting the button pressed with gatttool, a bluez utility. Unfortunately, gatttool is considered deprecated, there is no replacement, and the documentation is parse.
What is working :

# Name of the watch : 
$ gatttool -b D3:60:4F:9A:33:29 -t random --char-read -a 0x04
Characteristic value/descriptor: 43 41 53 49 4f 20 47 41 2d 42 32 31 30 30 00 00
$ echo "43 41 53 49 4f 20 47 41 2d 42 32 31 30 30 00 00" | xxd -r -p;echo
CASIO GA-B2100

# Type of device : 
$ gatttool -b D3:60:4F:9A:33:29 -t random --char-read -a 0x06
Characteristic value/descriptor: c1 00
# 0x00C1 = Sports watch
# See https://www.bluetooth.com/specifications/assigned-numbers/ p.30

To get the button pressed, the command should be in theory :

$ gatttool -b D3:60:4F:9A:33:29 -t random --char-write -a 0xc -n 10

But it doesn't work, the command didn't react to button press.
What is strange is that this command works when gatttool is used interactively :

$ gatttool -b D3:60:4F:9A:33:29 -I -t random
[D3:60:4F:9A:33:29]      connect
Attempting to connect to D3:60:4F:9A:33:29
Connection successful
[D3:60:4F:9A:33:29][LE]> char-write-cmd 0xc 10
Notification handle = 0x000e value: 10 29 33 9a 4f 60 d3 7f 04 03 0f ff ff ff ff 24 00 00 00

Here the "04" after the "7f" indicate the right button.
I don't understand why gatttool doesn't work non interactively with the same parameters.

[izivkov]

OK, glad to see you are making progress.

So, a couple of thoughts on why this may not work, keeping in mind I have not user gatttool:

1. In non-interactive mode, maybe there is not a connection to the watch. In interactive mode, you make the connection first, but not from the command line. Are you sure you are still connected?

2. In interactive mode, the data comes to the console after you have issues the command. In command-line mode, nobody is waiting for the data to come back. The command is executed, and the gatttool exits, nobody is reading the data.

3. Finally, you should enable notification from the watch, otherwise the watch will not send you back data. Take a look at line 28 in connection.py. Each time a connection is made, we send:

await self.client.start_notify(
CasioConstants.CASIO_ALL_FEATURES_CHARACTERISTIC_UUID,
self.notification_handler,
)

start_notify() is part of the BLE library I am using, so I am not sure what is the equivalent in gatttool.

Point 3. may not be needed, since it works for you interactively, but something to keep in mind if everything else fails.

It seems to me, that single command using gatttool may not work. You will need a sequence of commands. Does gatttool support scripting? If so, create a file of commands and run them sequentially.

BTW, at this time, there are not too many visitors to this repository, so this discussion will most likely be between you and me only, but it is good idea to keep a record here for future reference.

[harlock974]

I have watched Bluetooth traffic with btmon using interactive and non-interactive mode of gatttool. In interactive mode the exchange is clearly seen :

< ACL Data TX: Handle 3585 flags 0x00 dlen 8                                                                                                                             #22 [hci0] 40.604292
      ATT: Write Command (0x52) len 3
        Handle: 0x000c
          Data: 10
> HCI Event: Number of Completed Packets (0x13) plen 5                                                                                                                   #23 [hci0] 41.427791
        Num handles: 1
        Handle: 3585
        Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 26                                                                                                                            #24 [hci0] 41.824688
      ATT: Handle Value Notification (0x1b) len 21
        Handle: 0x000e
          Data: 1029339a4f60d37f01030fffffffff3e010400

But with non-interactive mode the command is not even sent to the watch, so maybe there is a bug somewhere. I tried to understand the code of gatt_write_cmd() but it is a nearly impossible task as it is not commented and the documentation is sparse...

[izivkov]

Most likely, it is not a bug with gatttool. I think you need to run gatttool as a script, to be able to read and write to the watch. Take a look at this: https://stackoverflow.com/questions/51086932/ble-gatttool-interactive-shell-script Ivo

…

On Mon, Jul 3, 2023 at 11:53 PM Pierre Brial ***@***.***> wrote: I have watched Bluetooth traffic with btmon using interactive and non-interactive mode of gatttool. In interactive mode the exchange is clearly seen : < ACL Data TX: Handle 3585 flags 0x00 dlen 8 #22 [hci0] 40.604292 ATT: Write Command (0x52) len 3 Handle: 0x000c Data: 10 > HCI Event: Number of Completed Packets (0x13) plen 5 #23 [hci0] 41.427791 Num handles: 1 Handle: 3585 Count: 1 > ACL Data RX: Handle 3585 flags 0x02 dlen 26 #24 [hci0] 41.824688 ATT: Handle Value Notification (0x1b) len 21 Handle: 0x000e Data: 1029339a4f60d37f01030fffffffff3e010400 But with non-interactive mode the command is not even sent to the watch, so maybe there is a bug somewhere. I tried to understand the code of gatt_write_cmd() but it is a nearly impossible task as it is not commented and the documentation is sparse... — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7M37QAKJ2BKZ5DWPQL7SLXOOHTJANCNFSM6AAAAAAZZ462MA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[harlock974]

Smart !
This guy has apparently the same problem than me and try to "communicate" with the interactive mode of gatttool. I will have a look at this.

[izivkov]

But really, I would just write a Python script using a BLE library. gatttool is not designed to send multiple command to BLE. If you are going to set time, you need to read and write a bunch of commands, and if you need to load gatttool each time, this will be too slow.

…

On Tue, Jul 4, 2023 at 12:03 AM Ivo Zivkov ***@***.***> wrote: Most likely, it is not a bug with gatttool. I think you need to run gatttool as a script, to be able to read and write to the watch. Take a look at this: https://stackoverflow.com/questions/51086932/ble-gatttool-interactive-shell-script Ivo On Mon, Jul 3, 2023 at 11:53 PM Pierre Brial ***@***.***> wrote: > I have watched Bluetooth traffic with btmon using interactive and > non-interactive mode of gatttool. In interactive mode the exchange is > clearly seen : > > < ACL Data TX: Handle 3585 flags 0x00 dlen 8 #22 [hci0] 40.604292 > ATT: Write Command (0x52) len 3 > Handle: 0x000c > Data: 10 > > HCI Event: Number of Completed Packets (0x13) plen 5 #23 [hci0] 41.427791 > Num handles: 1 > Handle: 3585 > Count: 1 > > ACL Data RX: Handle 3585 flags 0x02 dlen 26 #24 [hci0] 41.824688 > ATT: Handle Value Notification (0x1b) len 21 > Handle: 0x000e > Data: 1029339a4f60d37f01030fffffffff3e010400 > > But with non-interactive mode the command is not even sent to the watch, > so maybe there is a bug somewhere. I tried to understand the code of > gatt_write_cmd() but it is a nearly impossible task as it is not commented > and the documentation is sparse... > > — > Reply to this email directly, view it on GitHub > <#2 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AA7M37QAKJ2BKZ5DWPQL7SLXOOHTJANCNFSM6AAAAAAZZ462MA> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >

[harlock974]

You are right. I am not comfortable with Python but finally it will be easier to build some shell commands from your api...

The fun things with get_pressed_button() on a Raspberry pi is that you can interact with the GPIO library to remote drive some leds or other things with your watch :)

[izivkov]

You know what would be neet - if we make this server into a web server. Then simple clients would connect to it, and communicate using http request even remotely. Then you can even build a web interface to do similar things like the Android app

…

On Tue., Jul. 4, 2023, 12:28 a.m. Pierre Brial, ***@***.***> wrote: You are right. I am not comfortable with Python but finally it will be easier to build some shell commands from your api... The fun things with get_pressed_button() on a Raspberry pi is that you can interact with the GPIO library to remote drive some leds or other things with your watch :) — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7M37VH6BUAOEGYPTPZYU3XOOLWTANCNFSM6AAAAAAZZ462MA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[izivkov]

If your watch is set to auto-time update, (which BTW you can set programmatically), you can determine that by looking which button was pressed. Then you can turn on a green light on your raspberry pi

…

On Tue., Jul. 4, 2023, 7:40 a.m. Ivo Zivkov, ***@***.***> wrote: You know what would be meet - if we make this server into a web server. Then simple clients would connect to it, and communicate using http request even remotely. Then you can even build a web interface to do similar things like the Android app On Tue., Jul. 4, 2023, 12:28 a.m. Pierre Brial, ***@***.***> wrote: > You are right. I am not comfortable with Python but finally it will be > easier to build some shell commands from your api... > > The fun things with get_pressed_button() on a Raspberry pi is that you > can interact with the GPIO library to remote drive some leds or other > things with your watch :) > > — > Reply to this email directly, view it on GitHub > <#2 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AA7M37VH6BUAOEGYPTPZYU3XOOLWTANCNFSM6AAAAAAZZ462MA> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >

[harlock974]

I did huge progress on the understanding of GShock GA-B2100 API and I can now set a given time with gatttool.
Gatttool can't be used non-interactively because commands are one shot : gatttool connects, send a write command, and disconnects. But with the watch you have to send multiple commands between connect and disconnect. Fortunately, gatttlib interactive mode can be scripted with expect-lite. The absolute minimal script to set time is the following :

#!/usr/bin/env expect-lite
>gatttool -b D3:60:4F:9A:33:29 -I -t random
>connect
<.+successful

# Set DST state of watch
>char-write-req 0xe 1d000102025b000000ffffffffffff
<.+successfully

# Local DST and time zone
>char-write-req 0xe 1e005b00100400
<.+successfully

# WT DST and time zone
>char-write-req 0xe 1e010000000000
<.+successfully

# Set local time zone name :
>char-write-req 0xe 1f004458423a4455424149000000000000000000
<.+successfully

# Set WT time zone name :
>char-write-req 0xe 1f01555443000000000000000000000000000000
<.+successfully

# Set time
>char-write-req 0xe 09e707061d0f0e18030001
<.+successfully

>disconnect

Some explanations :

• Setting parameters is done with a write request on handle 0xe. Getting parameters is done with a write command on handle 0xc but it is not mandatory for setting the time.
• Here the local time zone is DXB:DUBAI and the world time (WT) time zone is UTC
• Time encoding is explained in class TimeEncoder of Ivo's casio_watch.py
• ">" are commands sent and "<" are regex of expected answer before to run the next command
• fun fact : you can put any fictitious name in WT time zone name. The time zone characteristics are described before in 1e01 sentence.

I am now trying to understand the encoding of DST settings and will post my findings here.

A question : when scanning bluetooth traffic of Ivo's gshockserver, just after connection and characteristics requests, there is a write request on handle 0xf with data 0100. I can't find these values in the code. What is the purpose of this command ?

[izivkov]

@harlock974 Great, nice to see you talking to the watch with your own script.

Would you like to contribute your script to the project, so other people can use it? The usual way to do this to to fork this repository, create a pull request, and I will merge it in the code.

If you find this too much trouble, you can post your script in a comment here, and I will add it to the repository.

In order to get credit for your work, you can add your name and email in a comment on top if your script, if you like.

I'm not sure what this command "0100" is, but I can take a look later. If you don't need it, just ignore it.

[harlock974]

Hello Ivo,
Great idea !
I have planned to write a doc about the communication protocol of the watch. If it doesn't bother you I could add it to the project.

[izivkov]

Yes, I would encourage you to do it. Do you know how to fork the project, and add pull requests? This is the best way to add to it. This type of documentation probably belongs to this project: https://github.com/izivkov/GShockAPI, which is an API for writing Android programs for the g-shock. There is docs for the API already. But let us start with the python project, and we can eventually move it over there later.

…

On Sun., Jul. 16, 2023, 3:06 a.m. Pierre Brial, ***@***.***> wrote: Hello Ivo, Great idea ! I have planned to write a doc about the communication protocol of the watch. If it doesn't bother you I could add it to the project. — Reply to this email directly, view it on GitHub <#2 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7M37QKJYG2OBEANFXAEC3XQOHF3ANCNFSM6AAAAAAZZ462MA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[harlock974]

Yes, I see your doc in GShockAPI. It's great you took the time to document it.
For now I try to understand the protocol and the meaning of data packets. I am now on packet 1E which contains time zone parameters. May be you could help me to decode it. Here is what I found :

Example packet from time zone DEL (DELHI) :
0 1 2 3 4 5 6
1e 01 52 00 16 04 00

0 : packet identifier (1e = time zone parameters)

1 : TZ index :

• 00 : local
• 01 : WT

2-3 : TZ (or cities) identifier ? Some values :

• 00 00 : UTC
• 13 00 : ATH
• 16 01 : THR
• 5b 00 : DXB
• 85 00 : JED
• a0 00 : LON
• ca 00 : NYC
• dc 00 : PAR

I can't see the logic here... Any ideas ?

4 : signed byte : time difference in quarter of an hour (divide by 4 to get it in hour)

5 : ? : 00 for UTC and 04 for other TZ tested

6 : DST parameters ? Tried values :

• 00 : UTC and cities without DST
• 01 : NYC
• 02 : LON, PAR, ATH
• 2b : THR

[izivkov]

Well, I'm no expert in this, but it is pretty well documented here: https://codeberg.org/johannesk/Gadgetbridge/src/branch/casio-gw-b5600/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/service/devices/casio/gwb5600/CasioGWB5600TimeZone.java As it happens, I'm talking to this person about the exact thing. I may have to add some DST code checking in my application. Ivo

…

On Mon, Jul 17, 2023 at 12:17 AM Pierre Brial ***@***.***> wrote: Yes, I see your doc in GShockAPI. It's great you took the time to document it. For now I try to understand the protocol and the meaning of data packets. I am now on packet 1E which contains time zone parameters. May be you could help me to decode it. Here is what I found : Example packet from time zone DEL (DELHI) : 0 1 2 3 4 5 6 1e 01 52 00 16 04 00 0 : packet identifier (1e = time zone parameters) 1 : TZ index : - 00 : local - 01 : WT 2-3 : TZ (or cities) identifier ? Some values : - 00 00 : UTC - 13 00 : ATH - 16 01 : THR - 5b 00 : DXB - 85 00 : JED - a0 00 : LON - ca 00 : NYC - dc 00 : PAR I can't see the logic here... Any ideas ? 4 : signed byte : time difference in quarter of an hour (divide by 4 to get it in hour) 5 : ? : 00 for UTC and 04 for other TZ tested 6 : DST parameters ? Tried values : - 00 : UTC and cities without DST - 01 : NYC - 02 : LON, PAR, ATH - 2b : THR — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7M37X2ONJCHP6D27XBTZTXQS4FDANCNFSM6AAAAAAZZ462MA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[harlock974]

Great !
I wonder how were chosen the byte values A and B for the cities... I try to sort by offset or by name and nothing match...

[harlock974]

Well I finally found it : if you compute C = 256 × B + A and sort by C, cities are sorted alphabetically, with some exceptions for islands :

5 Adelaide
12 Anchorage
19 Athens
28 Bangkok
...

These values doesn't seem related to a standard.

[izivkov]

Amazing! 👍

…

On Mon., Jul. 17, 2023, 2:09 p.m. Pierre Brial, ***@***.***> wrote: Well I finally found it : if you compute C = 256 × B + A and sort by C, cities are sorted alphabetically, with some exceptions for islands : 5 Adelaide 12 Anchorage 19 Athens 28 Bangkok ... These values doesn't seem related to a standard. — Reply to this email directly, view it on GitHub <#2 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA7M37X2AN6ZHH4FQCXBV6LXQV5VZANCNFSM6AAAAAAZZ462MA> . You are receiving this because you authored the thread.Message ID: ***@***.***>