openyou/libfitbit

Using vendor/product (0x0fcf, 0x1008), get Pipe error

Closed this issue · 10 comments

$ dmesg
[34601.057057] usb 4-2: New USB device found, idVendor=0fcf, idProduct=1008
[34601.057064] usb 4-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[34601.057068] usb 4-2: Product: ANT USBStick2
[34601.057072] usb 4-2: Manufacturer: Dynastream Innovations
[34601.057076] usb 4-2: SerialNumber: 038

$ vi fitbit.py
def open(self):
#return super(FitBit, self).open(0x10c4, 0x84c4)
print "super(FitBit, self).open(0x0fcf, 0x1008)"
return super(FitBit, self).open(0x0fcf, 0x1008)

$ python fitbit.py
super(FitBit, self).open(0x0fcf, 0x1008)
Traceback (most recent call last):
File "fitbit.py", line 375, in
sys.exit(main())
File "fitbit.py", line 296, in main
device.init_tracker_for_transfer()
File "fitbit.py", line 187, in init_tracker_for_transfer
self.init_fitbit()
File "fitbit.py", line 170, in init_fitbit
self.fitbit_control_init()
File "fitbit.py", line 146, in fitbit_control_init
self._connection.ctrl_transfer(0x40, 0x00, 0xFFFF, 0x0, [])
File "/usr/lib/python2.7/site-packages/usb/core.py", line 668, in ctrl_transfer
self.__get_timeout(timeout)
File "/usr/lib/python2.7/site-packages/usb/_debug.py", line 53, in do_trace
return f(_args, *_named_args)
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 538, in ctrl_transfer
timeout))
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 353, in _check
raise USBError(_str_error[retval.value])
usb.core.USBError: Pipe error

I want to reverse engineer a Garmin Chirp for linux, ala
http://itunes.apple.com/us/app/geobeacon/id449451508?mt=8
but for linux, not iphone

Any help?

qdot commented

Yeah, you can't use the fitbit base class like that. The fitbit base is the usual nordic ant system along with a special uC to deal with things like charging the tracker, so I send special info to the base that won't work with things like the dynastream key.

I've already gotten the fitbit working with the dynastream, check out the bases.py module in the data-format branch of libfitbit. You can just instantiate that base then do regular old ant stuff.

OK, so I editted in data-format branch:

def main():
base = DynastreamANT(True)
#base = FitBitANT(debug=True)

Now I get:
$ python fitbit.py
Traceback (most recent call last):
File "fitbit.py", line 350, in
sys.exit(main())
File "fitbit.py", line 322, in main
device.init_tracker_for_transfer()
File "fitbit.py", line 167, in init_tracker_for_transfer
self.init_fitbit()
File "fitbit.py", line 152, in init_fitbit
self.init_device_channel([0xff, 0xff, 0x01, 0x01])
File "fitbit.py", line 156, in init_device_channel
self.base.reset()
File "/home/rick/tmp/libfitbit/python/antprotocol/protocol.py", line 151, in reset
self._check_reset_response()
File "/home/rick/tmp/libfitbit/python/antprotocol/protocol.py", line 127, in _check_reset_response
data = self._receive()
File "/home/rick/tmp/libfitbit/python/antprotocol/libusb.py", line 81, in _receive
r = self._connection.read(self.ep['in'], size, 0, self.timeout)
File "/usr/lib/python2.7/site-packages/usb/core.py", line 624, in read
self.__get_timeout(timeout)
File "/usr/lib/python2.7/site-packages/usb/_debug.py", line 53, in do_trace
return f(_args, *_named_args)
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 483, in bulk_read
timeout)
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 581, in __read
timeout))
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 353, in _check
raise USBError(_str_error[retval.value])
usb.core.USBError: Operation timed out

qdot commented

Are you trying to get this to work with a fitbit before you start on the garmin stuff? If so, sometimes this happens. I'm working on the timeout issues right now, see #8.

Well, I wanted to test the USB2 stick first, with no ANT devices attached by radio. Then power up the chirp and listen for anything ...

qdot commented

Well, then, yeah, it's gonna time out at that point because it's sent the beacon signal for the fitbit, and is waiting for a reply, which it'll never get. So for the intent of the library, it's working. :)

OK. So if I power up the chirp I should see traffic? How do I set the debug parms?

qdot commented

You're on your own at that point. I haven't gotten to the point of working with the garmin sensors yet. Will probably need to set up for their network key, but after that, I dunno what the packets look like. I know there's been lots of work on garmin reversing, so I'd just start googling if you don't have a way to trace USB.

Well..

def init_device_channel(self, channel):
# ANT device initialization
print '1'
self.base.reset()
print '2'
self.base.send_network_key(0, [0,0,0,0,0,0,0,0])
print '3'
self.base.assign_channel()
print '4'

$ python fitbit.py
1
--> ['a4', '01', '4a', '00', 'ef']
Traceback (most recent call last):
File "fitbit.py", line 357, in
sys.exit(main())
File "fitbit.py", line 329, in main
device.init_tracker_for_transfer()
File "fitbit.py", line 172, in init_tracker_for_transfer
self.init_fitbit()
File "fitbit.py", line 152, in init_fitbit
self.init_device_channel([0xff, 0xff, 0x01, 0x01])
File "fitbit.py", line 157, in init_device_channel
self.base.reset()
File "/home/rick/src/Ant+/libfitbit/python/antprotocol/protocol.py", line 151, in reset
self._check_reset_response()
File "/home/rick/src/Ant+/libfitbit/python/antprotocol/protocol.py", line 127, in _check_reset_response
data = self._receive()
File "/home/rick/src/Ant+/libfitbit/python/antprotocol/libusb.py", line 81, in _receive
r = self._connection.read(self.ep['in'], size, 0, self.timeout)
File "/usr/lib/python2.7/site-packages/usb/core.py", line 624, in read
self.__get_timeout(timeout)
File "/usr/lib/python2.7/site-packages/usb/_debug.py", line 53, in do_trace
return f(_args, *_named_args)
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 483, in bulk_read
timeout)
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 581, in __read
timeout))
File "/usr/lib/python2.7/site-packages/usb/backend/libusb10.py", line 353, in _check
raise USBError(_str_error[retval.value])
usb.core.USBError: Operation timed out

self.base.reset gets the timeout.

Oh wow. I unplugged and replugged the usb2stick:

$ python fitbit.py
1
--> ['a4', '01', '4a', '00', 'ef']
<-- ['a4', '01', '6f', '00', 'ca']
2
--> ['a4', '09', '46', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'eb']
<-- ['a4', '03', '40', '00', '46', '00', 'a1']
3
--> ['a4', '03', '42', '00', '00', '00', 'e5']
<-- ['a4', '03', '40', '00', '42', '00', 'a5']
4
--> ['a4', '03', '43', '00', '00', '10', 'f4']
<-- ['a4', '03', '40', '00', '43', '00', 'a4']
--> ['a4', '02', '45', '00', '02', 'e1']
<-- ['a4', '03', '40', '00', '45', '00', 'a2']
--> ['a4', '02', '47', '00', '03', 'e2']
<-- ['a4', '03', '40', '00', '47', '00', 'a0']
--> ['a4', '02', '44', '00', 'ff', '1d']
<-- ['a4', '03', '40', '00', '44', '00', 'a3']
--> ['a4', '05', '51', '00', 'ff', 'ff', '01', '01', 'f0']
<-- ['a4', '03', '40', '00', '51', '00', 'b6']
--> ['a4', '01', '4b', '00', 'ee']
<-- ['a4', '03', '40', '00', '4b', '00', 'ac']
aaa