VIFIT PEDOMETER

I’m currently trying to read the data from a Medisana ViFit connect via Bluetooth LE so that I don’t have to share them with a T-Mobile cloud where god-knows-what happens to it.

After enabling an hcitool dump on my Android phone and running a sync from in there, I got some pretty nice data out of it already:

gatttool -b aa:bb:cc:dd:ee:ff -I
[aa:bb:cc:dd:ee:ff][LE]> connect
Attempting to connect to aa:bb:cc:dd:ee:ff
Connection successful
[aa:bb:cc:dd:ee:ff][LE]> char-write-req 0x0035 3c4d65646973616e613030303100001f
Notification handle = 0x0038 value: 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 
Characteristic value was written successfully
[aa:bb:cc:dd:ee:ff][LE]> char-write-req 0x0039 0100
Characteristic value was written successfully

These seem to be necessary to be able to get any data out of the device in the first place.
Now, if we write 43000…00043 to the address 0x0035 again, we get what looks like actual pedometer data:

[aa:bb:cc:dd:ee:ff][LE]> char-write-req 0x0035 43000000000000000000000000000043
Characteristic value was written successfully
Notification handle = 0x0038 value: 43 f0 15 04 29 00 ff 01 01 01 01 01 01 01 00 7b 
Notification handle = 0x0038 value: 43 f0 15 04 29 01 ff 01 01 01 01 01 01 01 01 7d 
Notification handle = 0x0038 value: 43 f0 15 04 29 02 ff 01 01 01 01 01 01 01 00 7d 

Taking a guess here, this looks like sleep data, assuming that this reflects todays measurement. In total, I get 28 lines starting with “43 f0 15 04 29”, then a counter of some sort starting from “00” and counting to “1b”, then “ff”.
As I turned the device from sleep-mode to pedometer mode at around 7 AM, this would mean 4 lines per hour. Not sure if this is correct, though, just guessing at this point.

Notification handle = 0x0038 value: 43 f0 15 04 29 1c 00 2b 01 46 00 04 00 00 00 07 
Notification handle = 0x0038 value: 43 f0 15 04 29 1d 00 5f 01 62 00 07 00 00 00 5b 
Notification handle = 0x0038 value: 43 f0 15 04 29 1e 00 fa 05 c1 01 20 00 00 00 74 

This looks like pedometer data. Again the start indicator with “43 f0 15 04 29”, then the counter starting at 1c here, then fixed “00”, then probably pedometer data, MAYBE terminated by a kind of checksum. Why I think this is a checksum is a result of the last few lines, which would be the rest of the day:

Notification handle = 0x0038 value: 43 f0 15 04 29 5d 00 00 00 00 00 00 00 00 00 d2 
Notification handle = 0x0038 value: 43 f0 15 04 29 5e 00 00 00 00 00 00 00 00 00 d3 
Notification handle = 0x0038 value: 43 f0 15 04 29 5f 00 00 00 00 00 00 00 00 00 d4 
[aa:bb:cc:dd:ee:ff][LE]> disconnect
[aa:bb:cc:dd:ee:ff][LE]> 

Again the prefix and counter, lots of zeroes, and again something that looks like a counter.

If I put in 43010000000000000000000000000044 instead of the 43000000000000000000000000000043, I get another set of measurements, probably yesterdays. This goes on until 430e0000000000000000000000000051, 15 sets of data, which corresponds to the Android app telling me that it just synced 15 days from the pedometer. Not sure which way it’s counting, though. Is 4300 today or two weeks ago?

I’ll post updates as I learn more about this device.

EOF

Category: blog

Tags: vifit pedometer medisana bluetooth