1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
# zwzn-freefit-re
Reverse-engineering a sketchy Chinese watch app
Documentation/protocols derived from decompiled FereFit Android app (jadx)
(com.czw.freefit, SHENZHEN ZHONGWEI INTELLIGENT TECHNOLOGY Co.,Ltd)
## Disclaimer
I request that none of this code and/or documentation, in part or in full, be hosted on GitHub, SourceForge, or any other proprietary platform. This request is made out of respect for both me, the developer, and you, the user.
## What this is and why it exists
This is a git repo containing protocol documentation of the `freefit` watch app, commonly known as "FereFit", "Lyne_Wearables", "HomieFit", "zwsvibe", and "WIRCASS". It allows us to make our own app implementations for some watches that use these apps. In particular, my testing occurs with the "Watch ULTRA", which I cannot find any more brand information on, though it's a sort of no-name Apple Watch ULTRA knockoff. Although, this protocol should work fine for most other watches that use these apps.
This exists for many reasons, though here are the top few:
- I'm 13 and have too much free time
- I wanted to get into reverse-engineering
- I had an old knockoff "Watch ULTRA" from the arcade, and the original app was spyware
- The RTC on this watch drifts badly, so without an app to periodically synchronize it, it becomes almost unusable
Anyway, talk is cheap, let's get into the documentation!
## BLE characteristics
### Main/"Zk" characteristics (presumably Nordic UART/Nordic semiconductor chips)
- Service UUID: 6E40FC00-B5A3-F393-E0A9-E50E24DCCA9E
- Write characteristic UUID: 6E40FC20-B5A3-F393-E0A9-E50E24DCCA9E
- Notify characteristic UUID: 6E40FC21-B5A3-F393-E0A9-E50E24DCCA9E
### Jieli/JL chip characteristics (untested)
- Service UUID: 0000ae00-0000-1000-8000-00805f9b34fb
- Write characteristic UUID: 0000ae01-0000-1000-8000-00805f9b34fb
- Notify characteristic UUID: 0000ae02-0000-1000-8000-00805f9b34fb
## Protocols/functions
### Generic measurement response
Sent by watch depending on context. For some reason it sends this for a battery percentage if you send an invalid command. TODO find proper trigger for this
```
byte[0] = 0x94 (response code)
byte[1] = measurement result (0-100)
```
### syncTime
Time sync packet structure (write/6E40FC20)
```
byte[0] = 0x01 (command)
byte[1-4] = Unix timestamp (big endian, seconds)
byte[5-8] = timezone offset (big endian, seconds)
byte[9] = i (unknown param, use 0x00)
byte[10] = language code
byte[11] = 0x01 if traditional Chinese, else 0x00
```
Response: 0x81 0x00 (success, notify/6E40FC21)
### switchFindBand (vibrate/find watch)
Find band packet structure (write/6E40FC20)
```
byte[0] = 0x51 (command)
byte[1] = 0x01 to start vibrating, else 0x00
```
Response: 0xD1 0x01 for vibrating, else 0xD1 0x00 (6E40FC21)
### configRealTimeMeasure (heart rate/blood oxygen/blood pressure/blood sugar)
Real-time measurements packet structure (write/6E40FC20)
```
byte[0] = 0x60 (command)
byte[1] = 0x00 if heart rate, 0x02 if blood oxygen, 0x03 if blood sugar, 0x01 if blood pressure
byte[2] = 0x01 to start measuring, else 0x00
```
Heart rate possible responses:
- Generic measurements: `0x94 <measurement>`, e.g. `0x94 0x55`
- Aggregate measurements: `0xE1 <measurement 1> 0x00 0x00 0x00 <measurement 2> <measurement 3> <measurement 4> 0x00`, e.g. `0xE1 0x58 0x00 0x00 0x00 0x57 0x58 0x55 0x00`
Other responses (blood oxygen, blood pressure, blood sugar) have not been tested yet.
### sendMessageByZk (push notification to watch)
Must send `configDeviceSettings` first to enable notifications on the watch, otherwise messages will not display.
Notification enable packet (write/6E40FC20)
```
byte[0] = 0x02 (command)
byte[1] = 0x02 (subcommand)
byte[2] = skype enabled (0/1)
byte[3] = line enabled (0/1)
byte[4] = long time sit reminder interval
byte[5] = long time sit enabled (0/1)
byte[6] = call notice enabled (0/1)
byte[7] = SMS notice enabled (0/1)
byte[8] = WeChat enabled (0/1)
byte[9] = QQ enabled (0/1)
byte[10] = KakaoTalk enabled (0/1)
byte[11] = Facebook enabled (0/1)
byte[12] = Twitter enabled (0/1)
byte[13] = WhatsApp enabled (0/1)
byte[14] = LinkedIn enabled (0/1)
byte[15] = heart rate monitor (0/1)
byte[16] = hands up screen on (0/1)
byte[17] = heart rate loop monitor (0/1)
byte[18] = heart rate monitor interval time
byte[19] = Instagram enabled (0/1)
byte[20] = other push enabled (0/1)
byte[21] = Zalo (bit 0) + Messenger (bit 1) flags
```
Message packet structure (write/6E40FC20), one packet per 17 byte chunk:
```
byte[0] = 0x23 (command)
byte[1] = chunk index (0, 1, 2...)
byte[2] = notification type
0x01 = SMS
0x02 = WeChat
0x03 = QQ
0x04 = DingTalk
0x05 = WhatsApp
0x06 = Facebook
0x07 = Twitter
0x08 = LinkedIn
byte[3-19] = up to 17 bytes of UTF-8 message text
byte[20] = 0xFF end marker (last chunk only, appended after text)
```
Message format from FereFit app: `"Title: Content"`, title truncated to 23 bytes, content to 240 bytes.
In practice, you can just send random arbitrary text. The watch doesn't really care.
Send chunks sequentially with ~100ms delay between each.
### enterMakeDial (watch face)
Watch face header packet (write/6E40FC20)
```
byte[0] = 0xE4 (ZK_DIAL command)
byte[1] = 0x51 (mode flag)
byte[2] = 0x01 (start)
byte[3] = 0x00
byte[4-5] = total packet count (big endian)
byte[6-9] = total image bytes (big endian)
byte[10] = 0x00
byte[11-12] = MTU size (big endian)
byte[13] = rotation flag
byte[14] = 0x01
byte[15] = time text direction
byte[16] = 0x00
byte[17-18] = transparent color (RGB565)
byte[19-20] = checksum (sum of all image bytes, big endian)
byte[21] = show date (0x01 = yes, 0x00 = no)
```
Header packet is followed by chunked RGB565 data, 1 chunk = MTU-14 bytes
This function/protocol has not been tested yet, don't expect this structure of headers and RGB565 data to work at the moment. Could very well change drastically if other parts of the protocol are found
## Scripts and tests
Located in the root of this git repo are some test scripts and files to get you going with your own implementations. BLE implementations are written in Python + the bleak library from PyPI.
The following scripts are available:
- FereFit_syncTime_BLE.py --- synchronizes the time on the watch
- FereFit_switchFindBand_BLE.py --- vibrates the watch for 5 seconds
- FereFit_configRealTimeMeasure_BLE.py --- measures heart rate, TODO add more measurements later
- FereFit_sendMessage_BLE.py --- sends a test message/notification of your choosing to the watch
They are named after FereFit, one of the names of the app, because I am decompiling the FereFit APK (even though it's all one codebase under different names, the app detects which one it's meant to be using functions such as isFereFit() and isHomieFit(), etc and just sets the UI and API to that).
They will probably stay that way because I can't be bothered to rename them to freefit, and therefore future ones will also be named after FereFit for consistency or something like that.
## Status
As of 2026-03-29 (NZDT), I am actively reverse engineering this device. Hopefully, as I continue to take apart the `freefit` app, I can add more test scripts and documentation to this repo.
|
