Fitbit

Just got a fitbit force. My first instinct was to install the windows-only sync software in wine, but wine rates the software as garbage.

The simple solution is to ignore the usb dongle and sync with an android phone. That works just fine.

But if you really want to use the USB dongle on a Linux machine, you can keep reading and see what I tried and how it failed.

I'm not alone trying to solve this problem: https://lwn.net/Articles/532410/

That makes it look like there isn't a very good solution.

Here is what the fitbit USB dongle looks like when inserted:

[   23.908099] usb 4-1: new full-speed USB device number 2 using ohci-pci
[   24.088179] usb 4-1: New USB device found, idVendor=2687, idProduct=fb01
[   24.088183] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   24.088185] usb 4-1: Product: Fitbit Base Station
[   24.088187] usb 4-1: Manufacturer: Fitbit Inc.
[   24.088189] usb 4-1: SerialNumber: \xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf\xffffffef\xffffffbf\xffffffbf\xffffffbf\xffffffbf
[   24.098279] hid-generic 0003:2687:FB01.0005: hiddev0,hidraw4: USB HID v1.11 Device [Fitbit Inc. Fitbit Base Station] on usb-0000:00:12.1-1/input0
[   24.106274] hid-generic 0003:2687:FB01.0006: hiddev0,hidraw5: USB HID v1.11 Device [Fitbit Inc. Fitbit Base Station] on usb-0000:00:12.1-1/input1

The comments in the article referenced above indicates that the current generation of fitbits are using bluetooth LE to transmit data.

treat the fitbit as a bluetooth device

A naive attempt to enable bluetooth in Ubuntu 13.10 does not work: No bluetooth adapters found.

Silly to hope that the base station is a generic bluetooth device. But if it were, I'd be able to do something like this to snoop on the fitbit:

hcitool scan
bluez-simple-agent hci0 00:11:12:09:XX:XX
rfcomm bind rfcomm0 00:11:12:09:XX:XX
screen /dev/rfcomm0

Here's what I see:

root@ferret:~# hcidump
HCI sniffer - Bluetooth packet analyzer ver 2.5
Can't open device: No such device

snoop fitbit usb traffic

Reference for usb snooping:

• http://biot.com/blog/usb-sniffing-on-linux
• https://www.kernel.org/doc/Documentation/usb/usbmon.txt

lsusb shows it here:

Bus 004 Device 002: ID 2687:fb01

cat /sys/kernel/debug/usb/devices has this in it:

T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=32 #Cfgs=  1
P:  Vendor=2687 ProdID=fb01 Rev= 1.00
S:  Manufacturer=Fitbit Inc.
S:  Product=Fitbit Base Station
S:  SerialNumber=����������������
C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr= 50mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
E:  Ad=81(I) Atr=03(Int.) MxPS=  32 Ivl=2ms
E:  Ad=01(O) Atr=03(Int.) MxPS=  32 Ivl=2ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
E:  Ad=82(I) Atr=03(Int.) MxPS=  32 Ivl=2ms
E:  Ad=02(O) Atr=03(Int.) MxPS=  32 Ivl=2ms

I want to snoop on bus 4.

cat 4u

But now, how do I trigger the fitbit to sync? Or do anything?

There is only one button on the fitbit and it seems to just turn on the display and toggle through display modes.

So I unplug and replug the usb dongle to get this:

root@ferret:/sys/kernel/debug/usb/usbmon# cat 4u
ffff880223c0e9c0 2526657075 C Ii:4:001:1 0:128 1 = 02
ffff880223c0e9c0 2526657090 S Ii:4:001:1 -115:128 2 <
ffff88021c9e0240 2526657100 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff88021c9e0240 2526657111 C Ci:4:001:0 0 4 = 00010300
ffff88021c9e0240 2526657113 S Co:4:001:0 s 23 01 0010 0001 0000 0
ffff88021c9e0240 2526657114 C Co:4:001:0 0 0
ffff88021c9e0240 2526657114 S Co:4:001:0 s 23 01 0011 0001 0000 0
ffff88021c9e0240 2526657115 C Co:4:001:0 0 0
ffff88021c9e0240 2526657634 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff88021c9e0240 2526657639 C Ci:4:001:0 0 4 = 00010000
ffff8801bad3ed80 2526687242 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8801bad3ed80 2526687254 C Ci:4:001:0 0 4 = 00010000
ffff8801cb5ff6c0 2526719236 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8801cb5ff6c0 2526719245 C Ci:4:001:0 0 4 = 00010000
ffff8801cb5ff240 2526751226 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8801cb5ff240 2526751234 C Ci:4:001:0 0 4 = 00010000
ffff8801cb5ff240 2526783232 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8801cb5ff240 2526783236 C Ci:4:001:0 0 4 = 00010000
ffff880223c0e9c0 2526783249 C Ii:4:001:1 -2:128 0
ffff8801bad3e240 2554255244 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8801bad3e240 2554255255 C Ci:4:001:0 0 4 = 01010100
ffff8801bad3e240 2554255257 S Co:4:001:0 s 23 01 0010 0001 0000 0
ffff8801bad3e240 2554255257 C Co:4:001:0 0 0
ffff8801bad3e240 2554255259 S Ci:4:001:0 s a3 00 0000 0002 0004 4 <
ffff8801bad3e240 2554255281 C Ci:4:001:0 0 4 = 00010000
ffff8801bad3e240 2554255282 S Ci:4:001:0 s a3 00 0000 0003 0004 4 <
ffff8801bad3e240 2554255284 C Ci:4:001:0 0 4 = 00010000
ffff880223c0e9c0 2554359234 S Ii:4:001:1 -115:128 2 <
ffff88021c9e0240 2554511240 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff88021c9e0240 2554511250 C Ci:4:001:0 0 4 = 01010000
ffff88021c9e0240 2554511256 S Co:4:001:0 s 23 03 0004 0001 0000 0
ffff88021c9e0240 2554537172 C Co:4:001:0 0 0
ffff880223c0e9c0 2554541128 C Ii:4:001:1 0:128 1 = 02
ffff880223c0e9c0 2554541132 S Ii:4:001:1 -115:128 2 <
ffff88021c9e0240 2554591233 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff88021c9e0240 2554591242 C Ci:4:001:0 0 4 = 03011000
ffff88021c9e0240 2554647233 S Co:4:001:0 s 23 01 0014 0001 0000 0
ffff88021c9e0240 2554647241 C Co:4:001:0 0 0
ffff88021c9e0240 2554647251 S Ci:4:000:0 s 80 06 0100 0000 0040 64 <
ffff88021c9e0240 2554648245 C Ci:4:000:0 0 18 = 12010002 00000020 872601fb 00010102 0301
ffff88021c9e0240 2554648258 S Co:4:001:0 s 23 03 0004 0001 0000 0
ffff88021c9e0240 2554673180 C Co:4:001:0 0 0
ffff88021c9e0240 2554727232 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff88021c9e0240 2554727240 C Ci:4:001:0 0 4 = 03011000
ffff880223c0e9c0 2554735236 C Ii:4:001:1 0:128 1 = 02
ffff880223c0e9c0 2554735239 S Ii:4:001:1 -115:128 2 <
ffff88021c9e0240 2554783232 S Co:4:001:0 s 23 01 0014 0001 0000 0
ffff88021c9e0240 2554783240 C Co:4:001:0 0 0
ffff88021c9e0240 2554783242 S Co:4:000:0 s 00 05 0003 0000 0000 0
ffff88021c9e0240 2554784246 C Co:4:000:0 0 0
ffff88021c9e0240 2554803234 S Ci:4:003:0 s 80 06 0100 0000 0012 18 <
ffff88021c9e0240 2554804245 C Ci:4:003:0 0 18 = 12010002 00000020 872601fb 00010102 0301
ffff88021c9e0240 2554804261 S Ci:4:003:0 s 80 06 0600 0000 000a 10 <
ffff88021c9e0240 2554806241 C Ci:4:003:0 -32 0
ffff88021c9e0240 2554806248 S Ci:4:003:0 s 80 06 0600 0000 000a 10 <
ffff88021c9e0240 2554808245 C Ci:4:003:0 -32 0
ffff88021c9e0240 2554808259 S Ci:4:003:0 s 80 06 0600 0000 000a 10 <
ffff88021c9e0240 2554810241 C Ci:4:003:0 -32 0
ffff88021c9e0240 2554810256 S Ci:4:003:0 s 80 06 0200 0000 0009 9 <
ffff88021c9e0240 2554812245 C Ci:4:003:0 0 9 = 09024900 020100a0 19
ffff88021c9e0240 2554812254 S Ci:4:003:0 s 80 06 0200 0000 0049 73 <
ffff88021c9e0240 2554815246 C Ci:4:003:0 0 73 = 09024900 020100a0 19090400 00020300 00000921 11010001 22360007 05810320
ffff88021c9e0240 2554815264 S Ci:4:003:0 s 80 06 0300 0000 00ff 255 <
ffff88021c9e0240 2554817246 C Ci:4:003:0 0 4 = 04030904
ffff8801bad3e240 2554817262 S Ci:4:003:0 s 80 06 0302 0409 00ff 255 <
ffff8801bad3e240 2554819242 C Ci:4:003:0 0 40 = 28034600 69007400 62006900 74002000 42006100 73006500 20005300 74006100
ffff88016e0a8300 2554819253 S Ci:4:003:0 s 80 06 0301 0409 00ff 255 <
ffff88016e0a8300 2554821245 C Ci:4:003:0 0 24 = 18034600 69007400 62006900 74002000 49006e00 63002e00
ffff88016e0a8300 2554821259 S Ci:4:003:0 s 80 06 0303 0409 00ff 255 <
ffff88016e0a8300 2554823245 C Ci:4:003:0 0 34 = 2203ffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
ffff88016e0a80c0 2554823378 S Co:4:003:0 s 00 09 0001 0000 0000 0
ffff88016e0a80c0 2554825246 C Co:4:003:0 0 0
ffff88016e0a8cc0 2554825306 S Ci:4:003:0 s 80 06 0303 0409 00ff 255 <
ffff88016e0a8cc0 2554827239 C Ci:4:003:0 0 34 = 2203ffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
ffff88021fc0d180 2554827269 S Co:4:003:0 s 21 0a 0000 0000 0000 0
ffff88021fc0d180 2554829244 C Co:4:003:0 0 0
ffff88021fc0d180 2554829258 S Ci:4:003:0 s 81 06 2200 0000 0036 54 <
ffff88021fc0d180 2554831245 C Ci:4:003:0 0 54 = 060aff09 01a10109 02a10006 00ff0903 09041580 257f3500 46ff0075 08952081
ffff88021fc0d000 2554831408 S Ci:4:003:0 s a1 01 0100 0000 0020 32 <
ffff88021fc0d000 2554833245 C Ci:4:003:0 -32 0
ffff8802074ec240 2554833419 S Ci:4:003:0 s 80 06 0303 0409 00ff 255 <
ffff8802074ec240 2554835245 C Ci:4:003:0 0 34 = 2203ffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
ffff88016e0a8780 2554835270 S Co:4:003:0 s 21 0a 0000 0001 0000 0
ffff88016e0a8780 2554837244 C Co:4:003:0 0 0
ffff88016e0a8780 2554837258 S Ci:4:003:0 s 81 06 2200 0001 0036 54 <
ffff88016e0a8780 2554839249 C Ci:4:003:0 0 54 = 060aff09 01a10109 02a10006 00ff0903 09041580 257f3500 46ff0075 08952081
ffff8802074ec3c0 2554839381 S Ci:4:003:0 s a1 01 0100 0001 0020 32 <
ffff8802074ec3c0 2554841245 C Ci:4:003:0 -32 0
ffff8802074ec240 2554841402 S Ci:4:001:0 s a3 00 0000 0001 0004 4 <
ffff8802074ec240 2554841406 C Ci:4:001:0 0 4 = 03010000

I don't like trying to read that, so let's load that into wireshark. Dang, my wireshark says it doesn't understand the format. Even though I followed the directions here: http://wiki.wireshark.org/CaptureSetup/USB

Grrr. I've run out of time to poke at this. I'll just set it aside for awhile and see if anyone else happens to push this forward in the next few weeks.