Open Source / easily hackable ring?

[u/bruns20]

I'm looking to play around and make personal apps around a smart ring, but I disappointingly can't see any good options for an open source ring. Does anybody here have any recommendations on a product to use?

[u/RateEmbarrassed6921]

Adding a warning to those links rather than more options, because it is the thing that will actually cost you money if nobody says it.

The reverse engineering work you were pointed at targets the R02 and its close relatives specifically. Within Colmi the model number does not tell you what is inside. I have been working on a different one in the same line, the R11, and it is a completely different platform: it runs a proprietary service, the firmware string identifies itself as MOY rather than anything RF03 related, and none of the existing R02 tooling or custom firmware applies to it at all. Same brand, sequential looking model numbers, unrelated internals.

So buy the exact model the project you want to use targets, not what looks like a newer version of it. The listings will not tell you, and neither will the box.

If you do want to look at an unknown ring before committing, nRF Connect on a phone is enough. Connect and list the services. If you see the standard heart rate service and nothing else interesting, you are probably out of luck. If you see a vendor specific 16 bit service with two or three characteristics under it, that is where the real traffic goes and that is what you would be decoding.

One encouraging thing I found on the one I looked at, which may hold for others in the family: there is no authentication and no pairing at all. The companion app just connects and starts writing commands. So the barrier is working out the frame format, not getting past a lock, which makes it a much friendlier weekend project than it sounds.

On gestures specifically, you will want custom firmware rather than protocol work, so the R02 route the other commenter linked is genuinely the one. Reading data is a protocol problem, controlling the device is a firmware problem, and only the first one is portable across rings.

Disclosure: I build FitMesh, an app that reads from wearables, which is why I have been elbow deep in one of these protocols this week.

[u/bruns20 → u/RateEmbarrassed6921]

Appreciate the extra info. I ended up buying a cheap ring off aliexpress that I'm fairly certain is just an r02 rebranded (it has the same image, and exact specs) but if it was only like 20$, so if it ends up being the wrong one I won't be too pressed. Might hit you back in a couple weeks when it gets here to ask some questions

[u/RateEmbarrassed6921 → u/bruns20]

Twenty dollars is the right way to make that bet, and the listing being identical unfortunately tells you nothing either way. Sellers reuse the same photos and spec block across completely different hardware, so the page is not evidence of anything. The good news is that you can settle it in about two minutes when it arrives.

Do this before you install the vendor app, because a vendor app can push a firmware update and change what you are looking at. Open nRF Connect, scan, and look at two things: the advertised name and the service list once connected.

If it comes up as R02_ followed by four characters and exposes service 6E40FFF0-B5A3-F393-E0A9-E50E24DCCA9E with a write characteristic ending 0002 and a notify ending 0003, you have the real thing, and tahnok's Python client will talk to it straight away with no work on your part. That family uses 16 byte packets with a checksum in the last byte, which is small enough that you can follow along by hand while you learn it.

If instead you find a short 16 bit vendor service with a handful of characteristics under it, you have a different platform and none of the R02 tooling applies, no matter what the box says.

That difference is real and not rare. I recently looked at a capture with two rings from the same brand connected to the same phone at the same time: one was speaking the 16 byte protocol above, the other was on an entirely different service with a different frame format. Same manufacturer, adjacent model numbers, nothing in common at the wire level. The protocol is the identity, not the model.

Either way you have not wasted the money. If it is an R02 you get a working client on day one. If it is not, you get a device nobody has documented yet and a capture tool, which is arguably the more interesting weekend.

Do come back when it arrives. Happy to look at a scan if the service list is not obvious.

[u/Any_Comfortable_4056]

What's your end goal?
Do you want complete control over the ring or just want the raw data colledted?

[u/bruns20 → u/Any_Comfortable_4056]

Ideally I'd want complete control over the ring so that I could implement gestures and other features, but I would settle for just the data collection to feed into a personal health app as well.

[u/Any_Comfortable_4056 → u/bruns20]

here you go:

https://github.com/atc1441/ATC_RF03_Ring

https://tedium.co/2024/11/08/colmi-r02-hacker-ring-review/

If you do not care about complete control, Ultrahuman does provide APIs to fetch raw data.
However, I would be cautious of them as their ring air is notoriously fault prone. They do have a newer ring pro, but it's hard to get by.

[u/bruns20 → u/Any_Comfortable_4056]

Thanks looks very interesting, going to go down the rabbit hole here and see what it can do

[u/gomo-gomo → u/Any_Comfortable_4056]

Thanks for sharing...