DaFitDesktop

A Windows C++ command-line tool that fetches health data from Da Fit / MOYOUNG smart bands via Bluetooth LE — and displays a beautiful terminal dashboard.

Tested with Marv Neo (MOYOUNG-V2 platform, firmware MOY-BJQ3-2.3.5).

---

Three Operating Modes

1. scan — BLE Device Scanner

Scans for nearby Bluetooth LE devices for 10 seconds. Use this to find your band's MAC address.

2. ble <address> — Smart Band Dashboard

Connects to the band via Bluetooth LE, reads GATT services (battery, activity, device info), sends MOYOUNG V2 protocol commands, subscribes to notifications, and renders a formatted health dashboard with ANSI colors and Unicode box-drawing.

3. ble-raw <address> — Raw Packet Stream

Same BLE connection as above but streams every raw hex packet to the console (and to build/dafit_ble_log.txt). Useful for protocol analysis and reverse engineering.

4. db <path.db> — SQLite Database Reader

Reads a Da Fit SQLite database pulled from an Android device via ADB. Extracts steps, heart rate, and sleep records.

---

Prerequisites

Requirement	Details
OS	Windows 10 or 11 with a Bluetooth LE adapter
Compiler	Visual Studio 2022 — "Desktop development with C++" workload
Windows SDK	10.0.17763 or newer (for C++/WinRT headers)
CMake	3.20+
SQLite3	Optional — auto-detected, or place sqlite3.c + sqlite3.h in third_party/

Download the SQLite amalgamation from https://sqlite.org/download.html if you want DB mode.

---

Building

git clone <repo-url>
cd DaFitDesktop
mkdir build
cd build
cmake .. -G "Visual Studio 17 2022"
cmake --build . --config Release

The binary is produced at build\Release\DaFitDesktop.exe.

Build Options

Option	Default	Description
DAFIT_ENABLE_BLE	ON	Bluetooth LE support (requires Windows SDK)
DAFIT_ENABLE_SQLITE	OFF to disable	SQLite database reader

cmake .. -DDAFIT_ENABLE_BLE=OFF        # Disable Bluetooth LE
cmake .. -DDAFIT_ENABLE_SQLITE=OFF     # Disable SQLite reader

---

Usage

Important: Disconnect your band from the Da Fit phone app before connecting with this tool. BLE only allows one active connection at a time.

Scan for devices

.\DaFitDesktop.exe scan

Output:

  Scanning for BLE devices (10s) ...
  [1]  Marv Neo       FB:36:0B:37:18:37   RSSI: -52
  [2]  Mi Band 5      C4:29:A1:0D:88:12   RSSI: -71
  Found 2 devices.

Connect and show dashboard

.\DaFitDesktop.exe ble FB:36:0B:37:18:37

The tool will:

1. Connect to the band via Bluetooth LE
2. Read Device Information (serial, hardware, firmware, manufacturer)
3. Read Battery Level (standard BLE 0x180F service)
4. Read Activity Snapshot (steps, distance, calories from MOYOUNG 0xFEE1)
5. Send request commands for Heart Rate and SpO2
6. Listen for 8 seconds for notification responses
7. Render the dashboard with ANSI colors and box-drawing characters

Stream raw packets

.\DaFitDesktop.exe ble-raw FB:36:0B:37:18:37

Subscribes to every notify characteristic and prints raw hex. Packets are also logged to build\dafit_ble_log.txt.

Read a SQLite database

# Show steps, heart rate, and sleep data
.\DaFitDesktop.exe db dafit_data.db

# List all tables (for exploration)
.\DaFitDesktop.exe db dafit_data.db tables

---

Pulling the Database from Android

Requires a rooted device or ADB root access:

adb shell su -c "cp /data/data/com.crrepa.band.dafit/databases/*.db /sdcard/"
adb pull /sdcard/dafit_data.db .

Then read it:

.\DaFitDesktop.exe db dafit_data.db

---

MOYOUNG V2 Protocol

This tool speaks the MOYOUNG V2 BLE protocol used by Da Fit / CRREPA bands.

GATT Services

Service	UUID	Purpose
MOYOUNG Data	0000feea-0000-1000-8000-00805f9b34fb	Activity data, commands, notifications
Standard Heart Rate	0000180d-0000-1000-8000-00805f9b34fb	BLE SIG Heart Rate (0x2A37)
Battery	0000180f-0000-1000-8000-00805f9b34fb	BLE SIG Battery Level (0x2A19)
Device Info	0000180a-0000-1000-8000-00805f9b34fb	Serial, HW rev, FW rev, manufacturer

MOYOUNG Characteristics

Characteristic	UUID	Direction	Purpose
Activity snapshot	0000fee1-...	Read/Notify	Steps, distance, calories
Command write	0000fee2-...	Write	Send AB-header request commands
Response notify	0000fee3-...	Notify	Responses to commands
Status/keepalive	0000fee7-...	Notify	Real-time heartbeat/keep-alive

Packet Format

Band → Phone (response/notification):

FE EA <type> <subtype> <value...>

Phone → Band (command request):

AB 00 04 00 <cmd> 00 FF

Data Packet Examples

Raw Bytes	Meaning
5A 0A 78	Heart Rate: 120 BPM
5A 0B 62	Blood Oxygen: 98%
5A 20 4B 01	Battery: 75%, charging
5A 01 xx xx	Step count (16-bit)
5A 10 ...	Sleep segment data

---

Project Structure

DaFitDesktop/
├── CMakeLists.txt           # Build config (C++20, WinRT, SQLite options)
├── README.md
├── .gitignore
├── include/
│   ├── BleScanner.h         # BLE scanning, connection, FetchBandInfo()
│   ├── DaFitProtocol.h      # Protocol constants, packet structs, Command enum
│   └── DbReader.h           # SQLite reader (steps, heart rate, sleep)
├── src/
│   ├── main.cpp             # CLI entry point, ANSI dashboard rendering
│   ├── BleScanner.cpp       # WinRT BLE implementation (GATT services)
│   ├── DaFitProtocol.cpp    # Packet parser (0x5A and standard HR)
│   └── DbReader.cpp         # SQLite queries with multi-schema support
└── third_party/             # Place sqlite3.c + sqlite3.h here

---

Troubleshooting

Problem	Solution
Band not found during scan	Disconnect from Da Fit phone app first. Only one BLE connection at a time.
All values show N/A	Band may need to be on your wrist with good skin contact. Try moving it.
Heart rate shows "keep still"	HR measurement takes a few seconds. Wear the band and stay still during the 8s listen window.
Build error: sqlite3.c not found	Download from https://sqlite.org/download.html and place in third_party/.
Build error: WinRT headers missing	Install Windows 10 SDK (10.0.17763+) via Visual Studio Installer.
LNK error: windowsapp.lib	Ensure "Universal Windows Platform development" workload is installed.

---

Finding Your Band's BLE Address

1. Run DaFitDesktop.exe scan to list nearby BLE devices
2. Or install nRF Connect (Android/iOS) and scan there
3. Look for your band's name (e.g., "Marv Neo", "D20", "M5 Band")
4. Copy the AA:BB:CC:DD:EE:FF address

---

License

MIT