How I Hacked the Lenovo Carme HW25P Smartwatch

In this tutorial I am going to tell you how I hacked Lenovo Carme smart watch using Python3 in less than 100 lines of code and with basic knowledge of BLE (Bluetooth Low Energy). This code has been tested on Ubuntu 18.04. It will not work on Windows. You can find the source code for the same in my Github repository . here Prerequisites Concepts of Object Oriented Programming and some knowledge of how BLE works. What tools I’ve used? I used Gatttool for identifying the correct characteristic to communicate with the device. How I hacked? Before I started to work on this project I had to read about BLE communication, Damn it went bouncer to understand the concept when I read it first but then after reading couple of times I thought I know it very well. But did I? Lets find it out. I fired up Gatttool to search all UUIDs of this device and got the list which I'm showing in below image. Now the questions was what I want to do and what I need for that. I started with the basic things first and that is battery level. I used nrf connect to find the handle of battery level which is and in response I got “X” and i was like … 0x0030 I searched little bit and found response of BLE devices. So it was a 1 byte string which is ASCII equivalent of . So when we unpack the byte value we will get 88 and finally which is battery level data. So lets check the code that I wrote in python below. 0x58 self.battery_char = self.readCharacteristic(int(UUIDS.BATTERY_INFO_HND, )) self.battery_level = struct.unpack( , self.battery_char)[ ] self._log.info( ) : def battery_data (self) 16 "<B" 0 f"Battery Level: " {self.battery_level} Now after that I become hungry for Heart Rate Monitor. I started to dig into UUIDs and I am really lazy to do these things then I suddenly realized that I have learned previously that UUIDs are universal so there must be some thing related to heart rate. I go through the UUIDs of HW25P and found that there are no service available for Heart Rate Control (HRC). I then think of just to subscribe the HRM notify handle and retrieve data from it. So i wrote a code with the help of examples of to subscribe to notify handle. For subscribing I sent 2 byte data \x01\x00to notify sensor to turn it on. You can find the code below. bluepy def heart : self.hr_countdown = None : service, = _ = service.get ) desc = self.get d, = self.write def print : self.hr_countdown = time.perf self. info(data ) self.delegate.handleNotification = print_hr self. info( ) True: : self.hr_countdown (time.perf - self.hr_countdown) >= : self. info( ) break : self.wait except KeyboardInterrupt: self. info( ) self.write break except BTLEException btlE: self. error(f ) _rate_data( ) self try [ . () . . ] s for s in self getServices if s uuid == self hrmid Characteristics( = ( . ) forUUID str self hrmmid Descriptors( . , . ) service hndStart service hndEnd [ . . ] d for d in desc if d uuid == self cccid Characteristic( . , '\ \ ') d handle b x01 x00 _hr( , ) cHandle data _counter() . _log [ ] 1 . _log "Waiting for Heart Rate notification ..." while try if and _counter() 3 . _log "HRM completed" else ForNotifications(3.) . _log "HRM operation closed by user" Characteristic( . , '\ \ ') d handle b x00 x00 as . _log "{btlE}" Here is the class I made and inherit Bluepy.btle class Peripheral to make a working code. : def : FORMAT = '%(asctime)- s %(name)s (%(levelname)s) > %(message)s' logging.basic log_level = logging.WARNING not debug logging.DEBUG self._log = logging.get self. set self. info('Connecting ' + mac_address) isSecure: self, mac_address) : self, mac_address) self.cccid = client_characteristic_configuration self.hrmid = heart_rate self.hrmmid = heart_rate_measurement self. info('Connected') self.timeout = timeout self.mac_address = mac_address class HW25P(Peripheral) __init__( , , =0.5, =False, =False) self mac_address timeout isSecure debug 15 Config( =FORMAT) format if else Logger( . . ) self __class__ __name__ . _log Level( ) log_level . _log to if . Peripheral ( __init__ else . Peripheral ( __init__ . AssignedNumbers . AssignedNumbers . AssignedNumbers . _log And finally you can check the working code screenshot below. Hope you like this tutorial. Do share your thoughts and feedback with me. If you find any issue then do let me know to overcome that.