kronaby

Kronaby watch API research

1. Why?

I have Kronaby watch and I want to enhance the webhook triggering feature to the absolute maximum. So I can trigger a set of webhooks using any button on the watch, not only one. This will require protocol reverse-ngineering and creating a mobile app.

2. Tools and resources

• https://github.com/joakar/kronaby - old, but releavant implementation of kronaby protocol
• Official Kronaby App - to sniff data from
• Wireshark
• Apple PacketLogger + iphone - because it allows live log viewing. On Android this would require rooting.

3. Notes

Kronaby watch uses MsgPack https://msgpack.org/ to communicate over BLE.

My watch is Apex 43mm. Firmware version is 20180911.01.03 and I found no way to update it.

4. Observation

Watch can send events:

• Top pusher
  • Single short press 0x8108920001
  • Double short press 0x8108920003
  • Triple short press 0x8108920004
  • Quadruple short press 0x8108920005
  • Long press start 0x8108920002
  • Long press end 0x810892000C
  • Single short + Long press start 0x8108920006
  • Double short press + Long press start 0x8108920007
  • Triple short press * Long press start 0x8108920008
• Crown
  • Single short press 0x8108920101
  • Double short press 0x8108920103
  • Triple short press 0x8108920104
  • Quadruple short press 0x81-08-92-01-05
  • Long press start 0x8108920102
  • Find my phone long press for 3 sec 0x810892010B
  • Long press end 0x810892010C
  • Single short + Long press start 0x8108920106
  • Double short press + Long press start 0x8108920106
  • Triple short press * Long press start 0x8108920107
• Bottom pusher
  • Single short press 0x8108920201
  • Double short press 0x8108920203
  • Triple short press 0x8108920204
  • Quadruple short press 0x8108920205
  • Long press start 0x8108920202
  • Long press end 0x810892010C
  • Single short + Long press start 0x8108920006
  • Double short press + Long press start 0x8108920206
  • Triple short press * Long press start 0x8108920207

5. Protocol reference

On application layer protocol supports following commands:

Code	Command
0	map_cmd
1	onboarding_done
2	config_base
3	status_buildinfo
4	status_buildinfo_bl
5	status_crash
6	status_diag
7	cap
8	fastmode
9	id_apperror
10	id_error
11	id_hardfault
12	id_forced_hardfault
13	crash
14	map_error
15	map_buildinfo
16	map_diag
17	map_settings
18	map_diag_event
19	error
20	datetime
21	weekly_sync
22	periodic
23	forget_device
24	conn_int_change
25	rssi
26	postmortem
27	dump_uart
28	settings
29	diag_event
30	vbat
31	vbat_sim
32	upgrade_occurred
33	button
34	triggers
35	btn_trigger
36	btn_feature
37	dnd
38	daylight
39	auto_edst
40	dfu_ready
41	config_debug
52	command_52
71	command_71

map_cmd

onboarding_done

Assumption: Stops watch hands from continuous movement after pairing and connection.

config_base

Assumption: Sends list of 4 values to the watch:

• Time resolution in minutes - integers Assumption: period between sending steps count from watch to phone
• Enable step counter - boolean
• Unknown1 - boolean/integer
• Unknown2 - boolean/integer

status_buildinfo

status_buildinfo_bl

status_crash

status_diag

cap

fastmode

id_apperror

id_error

id_hardfault

id_forced_hardfault

crash

map_error

map_buildinfo

map_diag

map_settings

map_diag_event

error

datetime

Confirmed: Sends date and time to the watch

• Year - YYYY
• month - 1 - 12
• day of month - 1 - 31
• hour 0 - 23
• minutes 0 - 59
• seconds 0 - 59
• day of week - 0 - 6

weekly_sync

periodic

forget_device

Tells watch to unpair from current phone

Example: 811700 - {23:0}

conn_int_change

rssi

postmortem

dump_uart

settings

diag_event

vbat

Assumption: Request battery voltage

vbat_sim

Assumption: Force watch to report specified voltage (simulate)

upgrade_occurred

button

triggers

btn_trigger

btn_feature

dnd

Disable notifications in specified period

• Argument 1: on/off
• Argement 2: DND start hour
• Argument 3: DND start minute
• Argument 4: DND end hour
• Argument 5: DND end minute

Examples

Set DND 22:00 - 06:00 8125950116000600 - {37:[1,22,0,6,0]}

Set DND 23:00 - 06:00 8125950117000600 - {37:[1,23,0,6,0]}

Set DND 23:00 - 06:05 8125950117000605 - {37:[1,23,0,6,5]}

Unset DND 23:00 - 06:05 8125950017000605 - {37:[0,23,0,6,5]}

daylight

auto_edst

dfu_ready

config_debug

command_52

command_71

Hand position adjustment.

• Argument 1: dial number, range [0:2]
  • 0 - main dial
  • 1 - right dial on Apex
  • 2 - left dial on Apex
• Argument 2: hand number, range [0:1]
  • 0 - hour hand (or sole hand if dial has only one)
  • 1 - minute hand
• Argument 3: adjustment value (seen values in range [-6:6])
  • positive - clockwise
  • negative counter-clockwise

Examples

Minute hand clockwise adjust (+1)

814793000101 - { 71: [0,1,1] }

Minute hand counter-clockwise adjust (-1)

8147930001ff - { 71:[0,1,-1] }

Hour hand clockwise adjust (+1)

814793000001 - { 71: [0,1,1] }

Hour hand counter-clockwise adjust (-1)

8147930000ff - { 71:[0,1,-1] }

Right dial hand counter-clockwise adjust

8147930100ff - { 71: [1,0,-1] }

Right dial hand clockwise adjust

814793010001 - { 71: [1,0,1] }

Left dial hand counter-clockwise adjust

8147930200ff - { 71: [2,0,-1] }

Left dial hand clockwise adjust

814793020001 - { 71: [2,0,1] }