LA10 smartwatch (Linwear/Kingwear/Lige/etc...). tools, watchface structure, direct connect via BT

[vxsw]

hi all.
at first, sorry for my english - it's not my first language.
so...

you can find a few chines vendors with identical device named as "LA10 smartwatch" (Lige even not try to naming this model - just "smartwatch"), even you may order a lot with your own logo.
but all of it would have an identical characteristics, uses one app "ffit" and identifies via BT as "LA10_XXXX" where "XXXX" would be a last 2 bytes of a mac.
also all of vendors use an identical promo images, so you'll easily detect it. few of it:

as I'd understood, the original developer was a Linwear, in case "LA" seems may means "Linwear AMOLED", also Linwear have as usual description in promo images, as manual, as link to all of applications. if you'll interesting, you can learn more here https://www.linwear.com/article/1321.html
btw. Lige have a variant with stainless steel strap (I have an exactly this).

ok. I'll think that's enough for intro, so let's start...

Spoiler: about watchfaces.

while default watchfaces with a clock hands, uploadable seems can be only a digital, or it must have a different structure. as I have no one of watchface (further "wf") with clock hands, I can talk about digitals only.
structure is a bit easy:

0000-0009	header with bits of used options
00A-019F	parameters of an options. every option have a personal offset and similar structure
01A0-...	graphical resources in rgb565 format (2 bytes per pixel)

structure of a parameters are:

2 bytes	X position
2 bytes	Y position
2 bytes	frame width
2 bytes	frame height (not of texture)
1 byte	frames count
4 byte	texture offset. numerics of steps, pulse and calories have a few of offsets equal maximum possible digits, what theoretical may use different textures but with identical parameters

while I'd investigate wf structure, I'd make a little excel with full descriptions and wf model. all is automated, all what you need, just insert a sequence of first hex-bytes 0000-01F9.
feel free to use it if you want

Spoiler: images

excel

Spoiler: wf editor

a little tool, what allow you modify wf or make your own
I did not tried to make an integrated photoshop, so you must import/export bitmaps via clipboard.
keep in mind:
- a clear black (0, 0, 0) would be treated as a transparent color by your watch, while editor not support transparency.
- all unused resources would not be saved in wf file.
- parameters have no any correctness check (frames count for sample), so you may set any, but it may works incorrect.
- background layer must be exactly 454x454, or it'll be looks lake a damaged. but you may disable bg layer and get just a black screen as a bg.
- file open dialog would appear on right click of a text field.

Spoiler: images

LA10WFTool.zip

Spoiler: direct working via BT

original "ffit" app will not allow you to upload any wf, so you must upload it manually.

Spoiler: upload algorithm

at first, you must enable notifications of a "00001603-0000-1000-8000-00805f9b34fb" characteristic (further "1603")
all packets must be sent to a "00001602-0000-1000-8000-00805f9b34fb" characteristic (further "1602")
- prepare header:

00-02	first 3 bytes are zero
03-06	4 bytes of a wf file size
07	size of MTU
08-09	size of a "page"
0A	must be = 1

- increase MTU. in original to 244
- split the file
- - at first, split by "pages". in original, page size is a 4096. so you must split your file on a chunks of 4096 bytes.
- - now split the pages on blocks with size of (MTU - 2) i.e. by 242 bytes (244-2=242). keep in mind, what last chunk in page would be a 224 byte of size instead of 242 in case 4096 mod 242 = 224.
- - for every block, add a 2 bytes counter (starts from "01") at forward.
now you are ready to send wf. all packets must be send at 1602, any callbacks catch at 1603.
- send a header.
- wait 4 changes at 1603. last two wold be a "00 00 13 00", then "00 00 12 00".
- start sending a blocks sequentially.
- after every 17 blocks, before sending a next, you'll must send "00 00 17" at 1602 and wait a response from 1603. usually it's a "00 00 14", but I don't check, just wait an any.
- after sending a last part, you must send "00 00 17" for the finish.
if all is ok, you'll see your wf else - default wf.

of course you need an app.
algorithm are described, so you may make your own app, or use my. but actually I'm not a programmer (just an angry customer), so don't blame me about rugged code, I write it as can. in excuse - I even never listen about kotlin before((
so I've got an existed sample as a base and add required functional. the best way what I'll found is a "BLE Starter" of a Punch Through (team?). very thanks them for it.
sources are here https://github.com/PunchThrough/ble-starter-android big article about BT working are here https://punchthrough.com/android-ble-guide/

Spoiler: the app

at first unbound your smartwatch in ffit. in case device may be bounded to only one app.
- bound via app and look at 1602 characteristic. you don't need to enable 1603 manually in app, it would be enabled automatically. MTU would be set automatically too.
- tap 1602 characteristic and chose any write method
- in payload dialog, type just only one letter "w" (w/o quotes). tap "ok" and select your wf in open file dialog.
- now just wait. I make it by callbacks, so process would have a long time ~15 minutes per megabyte. I'll try to rewrite it latter from callbacks to blind write (write with no response via timer), but not soon. just have no time for it now.

the app BLE_Starter_base.zip
source ble-starter-android_srs.zip

Spoiler: View and download watch faces directly from ffit server

I've finish a little tool, what allow you to discover watch faces directly on ffit server.
at this time, it have an only 100 of different sizes. useful as resources only and editable via my LA10WFTool

now you can scan ffit server for watch faces by ID. it's allow you to get over 45k items, but a lot of it are duplicated. seems not compatible with la10, but may be used as resources for customizing.

FFitWFDownloader.zip

I have a figured out how to send messages, so if someone interesting, I'll add later.
also all stuff would be available at my gdrive.




that's all. have fun. hope it would be useful for someone.


*********
LA10WFTool - updated (removed check for import image more than 454x454)
*********
LA10WFTool - minor bug fixes and ui improvement (mostly scrolls over nud's)
*********
16/11/22 - FFitWFDownloader
- added "Investigation" ability, to "discover" watch faces by ID. over 45k, but a lot of duplication.
*********
23/11/22 - FFitWFDownloader
- reworked "Investigation" section.
- added "Download Range" ability.

 

[the_cipo]

Hey VXSX, great stuff! I was exactly looking in this direction but I had still not much time and was just starting. I believe many of those smartwatches come from the same manufacturer or seem to have very similar HW. Your watch and mine seem very similar to those from the dtno1.com

Anyway, first of all. Can you say something about the filenames in use? In the app (FitCloudPro) used with my phone I can see a set of 4 files for every wf, they seem to be in pairs based on their sizes. One pair is quite large (e.g. hundreds of KB) and one is much smaller. Any idea? How is it for you?

Will look into our files and will try to use your findings as well.
Thanks and keep posting!

 

[vxsw]

Can you say something about the filenames in use? In the app (FitCloudPro) used with my phone I can see a set of 4 files for every wf, they seem to be in pairs based on their sizes. One pair is quite large (e.g. hundreds of KB) and one is much smaller. Any idea? How is it for you?

at first time, I'd tried to replace wf file for ffit app "on the fly" via proxy, but had fail. app download my file, but didn't to upload in the watch. seems app check crc and treat my file as corrupted. manual uploading have no mater for the name of a file. anyway, watch even don't know about name in case you upload file data only, not the name.

 

[the_cipo]

at first time, I'd tried to replace wf file for ffit app "on the fly" via proxy, but had fail. app download my file, but didn't to upload in the watch. seems app check crc and treat my file as corrupted. manual uploading have no mater for the name of a file. anyway, watch even don't know about name in case you upload file data only, not the name.

But do you also have more files in the app dir for every single wf?

 

[vxsw]

app have no accesable dir. but seems have a some sort of hidden cache, in case it'll not redownload wf every time. as I've understood through sniffing, wf have stored on server "body" and "preview" image separatelly. both downloadable via direct http link both have a names, but it's actual for vendor app only. exactly device requires only content of a wf file ("body") what must be correctly prepeared and upload by algorithm what I've described above. device did not get any info about names and/or preview.

 

[the_cipo]

App has an accessible dir on the phone. In my case is "\Internal shared storage\Android\data\com.topstep.fitcloudpro\files\Download"
In this dir I can find 4 files for every wf:

Here I selected 4 belonging to the same wf. I did a few tests and this dir gets 4 more files for every new wf.

 

[vxsw]

ffit have no similar dirs. and/or I had not find any method to get access to it.
looks pairs of files have an identical size. what about content? attach something pls, I would like to look at this. also some sort of preview would be nice too.

 

[the_cipo]

Sure, this is the smallest I found.

With its 4 files following. As you can see the wf (above pic) has a reported size of 192KB which matches the two files below. So this data is consistent.

 

[the_cipo]

And these are the small ones (related to the same wf). Maybe this file is the picture of the wf presented in the UI (attached above).

CONFIRMED: both the 2 small files are the PNG of the wf (res 368x368). Probably that one used in the preview.

 

[the_cipo]

ffit have no similar dirs. and/or I had not find any method to get access to it.
looks pairs of files have an identical size. what about content? attach something pls, I would like to look at this. also some sort of preview would be nice too.

Do you have the phone USB set in sebug mode? It might help

 

[vxsw]

first two looks like a wf, but seems have a some sort of compression. in case even 368*368=135424 and it's only bg pixels count, while file size is only 186496.
also pairs are identical, so not sure what name have meaning for device. may be for app only as some sort of check.

Do you have the phone USB set in sebug mode? It might help

I use a wi-fi debugging, but for why?

 

[the_cipo]

Yeah, the two pairs are identical. probably the name is used for some check.
I am looking with HEX editor and you can see some blocks (in the wf file). E.g. from 00x0 to 1ffx0 and from 200x0 to 5ffx0. One more starting at 4f00x0 (or 4f20x0) with many zeros before that.
The block 0600x0 starts with ASCI "TBUI" and ends with the last 4 ASCI bytes in the file (at 2d87fx0) with again "TBUI" string.

 

[the_cipo]

I use a wi-fi debugging, but for why?

Just thinking about what would cause you not to see hidden files.

 

[the_cipo]

first two looks like a wf, but seems have a some sort of compression. in case even 368*368=135424 and it's only bg pixels count, while file size is only 186496.

Why would you expect to be exactly 135242? I have bin wf files of almost 1 MB. I don't think it has to do with screen resolution. Can you try to identify the protocol and blocks inside the bin?

 

[vxsw]

Why would you expect to be exactly 135242?

it's just a pixels count. you said:

(res 368x368)

so I'd suggest, what wf have a background with 368x368 resolution and it's an exactly square of a 135424 pixels (368x368=135424). if it would be a plaine bmp, it must have a [size] = [quantity of all pixels] x [bytes per pixel]. so even it would have at least 2 bytes per pixel, it'll must have size = 368x368x2 = 135424x2 = 270848 bytes only for bg texture. + header + some parameters. so as it have an only 184k bytes it must have a some sort of compression or it's something other, what at least have no bg texture.

Can you try to identify the protocol and blocks inside the bin?

I can try, but have no enough time at now. try to gather 5-10 wf with previews, each wf in personal folder. more prefer with easy elements on textures (less colors, even solid).
it would be easy, if it would be a plain bmp (in my case), but seems it's not for type of your wf.
so I would not promise anything, but I'll try.

 

[the_cipo]

I don't think so, I agree on the pixel count but the bin contains other info besides the bg data. So it must be bigger than 135424 bytes (considering 1 byte per pixel). As you found out, there are sections related to other clock info. In fact, I got the example with a simple bg image with a few colors to help that out. Will look for more
I liked your excel but I cannot still figure out all info there, for example, the column "S" in the second tab (to start with).

 

[vxsw]

the column "S" in the second tab (to start with).

offset of a first byte of a parameter. one parameter is a red+green(+gray if exist). red is an exactly parameters, green is a main offset of a texture, grey is a "suboffsets" (offsets of a "sockets" - independent part of a layer. i.e. layer "steps num" is a numeric of steps, it have a 5 digidts ("sockets"). sockets draws sequential from left to right, defined position in red field is a position of a first socket.)

So it must be bigger than 135424 bytes (considering 1 byte per pixel

I tried to explain exactly this)) what 186k is to low size for wf with 368x368 resolution)) 186k is not enough even for bg texture.

 

[the_cipo]

Here are two sets of simple wf, will do more later.

 

[the_cipo]

Here are two sets of simple wf, will do more later.

 

[vxsw]

it's just a png, not a wf file.
--------------
sorry, found it. didn't saw a prew. post.
as I understood it have an only by 3 clockhands and nothing more?