Protocol Messages

The Suunto Ambit sports watches communicate with the outside world via messages in a tit-for-tat kind of fashion. Application software sends a request message to the device which then sends a response message in return. Message types abound and their sizes vary but every message consists of a twelve byte header and a message type specific payload. Any multi-byte integers in message headers as well as payloads are encoded in little endian order.

Structure

The header is made up of a two byte message code, a byte of flags and status info each, two byte format and counter fields and a four byte payload size. The payload itself is of the given size and follows immediately after the header.

Lower-level protocol requirements may result in messages getting split up into packets.

Stating this a bit more succinctly in ABNF, that gives

message         ::=  message-header message-payload
message-header  ::=  code flags status format counter payloadsize
message-payload ::=  *OCTET

Schematically, a message looks as illustrated below.

_images/message.svg

While the whole message is of course of interest, the remainder of this section focuses on the red outlined parts which constitute the message header.

Code

code ::=  2OCTET

USB packet captures of Moveslink2 communicating with various Ambit watches have yielded a large number of message codes. Quite a few of these are now well understood. For many others there is an educated guess. Some, however, still remain (a bit of) a mystery.

Message codes are two byte, non-integer entities and found at offset 0 of each message. The codes below have been observed in USB packet captures. Insofar these codes have been reverse engineered, they are documented.

Note

The documentation effort is a work in progress. As long as this is here, there are (partially) “understood-but-undocumented” parts for the various codes.

0x0000

Get Handshake [request]

0x0002

Get Handshake [response]

0x0102
0x0103
0x0200
0x0202
0x0300

Set Date and Time

0x0302

Set Date

0x0306

Get Device Status

0x0700
0x0b00
0x0b01
0x0b02
0x0b03
0x0b04
0x0b05
0x0b06
0x0b07
0x0b08
0x0b0a
0x0b0b
0x0b15
0x0b16
0x0b17
0x0b18
0x0b19
0x0b1a
0x0b1b
0x0b1e
0x0b21
0x0b25
0x0b26
0x0b27
0x0e00
0x0e01
0x1100
0x1101
0x1104
0x1200
0x1201
0x1202

Flags

flags ::=  OCTET
0x01
0x02
0x04
0x08
0x10

Status

status ::=  OCTET
0x00
0x01
0x02

Format

format ::=  2OCTET
0x0000
0x0900

Counter

counter ::=  %d0-%d65535

Payload Size

payloadsize ::=  %d0-%d4294967295

A four byte, little endian integer, this value corresponds to the number of bytes that follows the message-header.