How to understand the data streaming from the Nike+iPod system
The Nike+iPod widget is a pretty interesting little device. If you're unfamiliar with it, basically it works like this - you take a small module and put it in your shoe. As you run/walk/samba, it sends data wirelessly to a receiver connected to your iPod or via the Bluetooth protocol on your iPhone (EDIT - it doesn't communicate via Bluetooth, but rather the receiver is integrated into the Bluetooth chip. It still communicates over 2.4GHz. Sorry for any confusion!). (3GS, 4 or 4S). Your iPod/iPhone takes this data, interprets it, and spits out some useful information for keeping track of your workouts. Pretty cool.
It's become obvious to many people that having access to this data could open up other possibilities - basically, everyone wants to hack the Nike+iPod. Unfortunately, the packet payload is encrypted and pretty tricky to make much sense of. That's where this customer project from Dmitry Grinberg comes in.
Dmitry knew the Nike+iPod used a nRF2402 transmitter to transmit the data and he used this as a starting point for understanding how the Nike+iPod works. He happened to have a nRF24L01+ transceiver module and he set this up to receive the data. The next step was a lot of data dumping (and using a logic analyzer) to get all the information he needed.
Finally, Dmitry sat down with copies of the iPhone and iPod OS images and an ARM disassembler and worked to decode the data packets. After some serious decoding - he had success! Here's a sample payload:
offset: 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14
data: 06 08 5A E2 2E 01 00 26 00 00 4A 01 00 8D 00 00 A7 EC 02 4B 64
use: ?C B K JK D D D G G G E E E H H H A A AB !! !!
? - [partially] unknown
A - serial number component
B - on hours
C - packet type
D - walking step count
E - running step count
G - lifetime walking miles
H - lifetime running miles
J - some flags (4 known to be used, one not used anywhere)
K - "Tc"
! - unused apparently
Be sure to check out Dmitry's webpage for more detailed information of decoding the Nike+iPod system - he does a great job of documentation. You can also check out our experience dissecting the Nike+iPod and this tutorial about turning your Nike+iPod into an "iFob" for your car. Great work Dmitry!