Fitbit Sync Decode - Part 1

There are two sync blobs available to us for inspection.  One blob is from the POST to the server, and the other is the server's response.

An example request:

POST http://client.fitbit.com/tracker/client/message?p_lcl=en_US HTTP/1.1

Content-Type: text/xml

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)

Host: client.fitbit.com

Content-Length: 3328

Pragma: no-cache

Cookie: JSESSIONID=...

<?xml version="1.0"?>

<galileo-client version="2.0">

<client-info>

<client-id>...guid...</client-id>

<client-version>1.0.0.2292</client-version>

<client-mode>force-sync</client-mode>

<dongle-version major="1" minor="1" />

</client-info>

<tracker tracker-id="FFFFFFFFFFFF">

<data>...base64-encoded data...</data>

</tracker>

</galileo-client>

An example response:

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Cache-control: no-store, no-cache, must-revalidate

Pragma: no-cache

Content-Type: text/xml;charset=UTF-8

Content-Language: en-US

Vary: Accept-Encoding

Date: Sun, 06 Jan 2013 20:25:11 GMT

Content-Length: 17077

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><galileo-server version="2.0"><server-version>URL: https://wush.net/svn/fitbit/weightsite/branches/Release_20130104

Last Changed Rev: 44872

</server-version><ui-request action="done"><client-display height="450" width="650" minDisplayTimeMs="20000" containsForm="true"> ...html...</client-display></ui-request><commands><connect-to-tracker connection="disconnect" tracker-id="FFFFFFFFFFFF"/></commands><tracker type="megadumpresponse" tracker-id="FFFFFFFFFFFF"><data>...base64-encoded data...</data></tracker></galileo-server>

Comments:

• This is a trace from a forced sync, where I clicked the Sync Now button in the FitbitConnect UI, so it also contains an HTML page for display.
• The blobs are base64-encoded since they are part of an XML body.
• The blob data is also written (not base64 encoded) to the sync log on my desktop

Next up... start digging into these blobs.