Skip to main content
The first step in reverse engineering the Whoop 4.0 is discovering what BLE services and characteristics the device exposes. This reveals how the device communicates with the mobile app.

​
Scanning with BLE Scanner

The easiest way to discover services is using a BLE scanner app on your Android phone.
1

Open BLE Scanner

Launch the BLE Scanner app on your Android device.
2

Scan for Devices

Start scanning and look for your Whoop device. It should appear with a recognizable name.
3

Connect and Explore

Tap on the Whoop device to view its services and characteristics.

​
Discovered Services

​
Heart Rate Service

The Whoop exposes the standard BLE Heart Rate Service, which means you can read heart rate data without any reverse engineering:
  • Service UUID: 00002a37-0000-1000-8000-00805f9b34fb
  • Properties: Readable, Notifiable
This is a standard Bluetooth SIG service, so any BLE heart rate monitor app can read from it.

​
Custom Service

Most communication happens through a custom service with UUID pattern 6108xxxx-8d6d-82b8-614a-1c8cb0f8dcc6. This service contains five characteristics:
UUIDNameWritableReadableNotifiableHandle
0x61080002CMD_TO_STRAP✓--0x0010
0x61080003CMD_FROM_STRAP--✓0x0012
0x61080004EVENTS_FROM_STRAP--✓0x0015
0x61080005DATA_FROM_STRAP--✓0x0018
0x61080007MEMFAULT--✓0x001b
Characteristic names were obtained by decompiling the Whoop Android APK.

​
Characteristic Roles

​
CMD_TO_STRAP (0x61080002)

This is the only writable characteristic and is used to send commands to the device:
  • Setting alarms
  • Starting/stopping activities
  • Enabling heart rate broadcast
  • Triggering data sync
  • Device management (reboot, erase)
All commands must include a valid CRC-32 checksum or they will be rejected.

​
CMD_FROM_STRAP (0x61080003)

Receives command responses and acknowledgments from the device. This characteristic notifies when:
  • Commands are processed
  • Device sends status updates
  • Certain operations complete

​
DATA_FROM_STRAP (0x61080005)

The main data stream for:
  • Real-time heart rate and respiratory rate during activities
  • Historical data during sync operations
  • Health monitoring data
When you start an activity or open “Health Monitor” in the app, notifications on this characteristic arrive every second.

​
EVENTS_FROM_STRAP (0x61080004)

Receives event notifications from the device. The exact purpose of these packets is still being researched, but they contain:
  • Unix timestamps
  • Event codes
  • Various status flags

​
MEMFAULT (0x61080007)

Likely used for crash reporting and diagnostics via the Memfault service.

​
Scanning with Python

You can also discover devices programmatically using Python: 
from pygatt import GATTToolBackend, BLEAddressType

adapter = GATTToolBackend(hci_device='hci0')
adapter.start()

print("Scanning for BLE devices...")
for device in adapter.scan(timeout=5):
    print(f"Device: {device['address']} - {device.get('name', 'Unknown')}")

adapter.stop()
Replace hci0 with your Bluetooth adapter name. Use hciconfig to list available adapters.

​
Discovering Characteristics

Once connected, you can enumerate characteristics: 
from pygatt import GATTToolBackend, BLEAddressType

adapter = GATTToolBackend(hci_device='hci0')
adapter.start()

# Replace with your Whoop's MAC address
device = adapter.connect('XX:XX:XX:XX:XX:XX', address_type=BLEAddressType.random)

print("Discovering characteristics...")
characteristics = device.discover_characteristics()

for char in characteristics:
    print(f"UUID: {char['uuid']}")
    print(f"Handle: {char['handle']}")
    print(f"Properties: {char['properties']}")
    print("---")

adapter.stop()

​
Capturing Communication

Now that you know the services and characteristics, you can capture actual communication between the app and device.

​
Method 1: ADB Bugreport

Extract HCI logs from your Android phone: 
# Capture logs (use the Whoop app during this time)
adb bugreport logs

# Extract the bug report
unzip logs.zip

# Open in Wireshark
wireshark FS/data/log/bt/btsnoop_hci.log

​
Method 2: Live Wireshark Capture

For real-time packet analysis:
1

Connect Phone via ADB

adb devices -l
2

Launch Wireshark with Sudo

sudo wireshark
3

Select Android Bluetooth Interface

Choose Android Bluetooth Btsnoop from the interface list.
4

Apply BLE Filter

Use the filter: btatt to show only Bluetooth Attribute Protocol packets.
5

Capture App Communication

Use the Whoop app and watch packets appear in real-time.

​
Filtering for Commands

To see only commands sent to the device, use this Wireshark filter: 
btatt.handle == 0x10
This filters for writes to the CMD_TO_STRAP characteristic (handle 0x0010).
Handles are in hexadecimal. Convert the handle from your BLE scanner (e.g., 0x0010) to use in filters.

​
Example: Opening the App

When you open the Whoop app, you’ll see in Wireshark:
  1. Write to CMD_TO_STRAP (handle 0x0010): 
    aa0800a823461600699b4cfb
  2. Notification on CMD_FROM_STRAP (handle 0x0012): Response confirming command received
  3. Multiple notifications on DATA_FROM_STRAP (handle 0x0018): Device sends current status and recent data
All commands follow a specific packet structure with headers, command codes, and CRC checksums.

​
Next Steps

Now that you’ve discovered the services and characteristics, you can start connecting to the device and sending commands.

Build docs developers (and LLMs) love

Get started for freeTalk to us