Skip to content

Motoactv HDA API

January 11, 2012

Disclaimer: This information has been derived via experimentation and is by no means official documentation and comes with no warranties whatsoever.

Introduction

The PC program Motocast USB communicates with the Motoactv device in two ways:

  • Via USB mass storage in order to store content in the SD card.
  • Via the HTTP Host Device Agent API (HDA API).

The HDA API is the one in charge of accessing the device’s information and performing upgrades. It’s because of these capabilities, that studying this API is interesting in order to unleash the functionality of Motoactv.

This post collects some of the functions that I have experimented with.

In future updates I hope to be able to document more API calls and use the HDA upgrade API to perform device management (add applications, enable ADB, perform backups, etc) in a non intrusive way, ie. without having to flash a new boot.img via flahsboot.

HDA Architecture

When Motoactv is plugged to the PC USB port, a USB local network connection is created with the name Motorola USB Networking Driver, usually with the IP address 192.168.16.2.

Motoactv then exposes an HTTP server at that address and port 21931. It’s by issuing HTTP requests to this server (HDA server) that HDA functions can be accessed

At the same time, an HTTP server is launched on the PC as well. An HDA client should provide the address and port of this HTTP server to the HDA server. This will allow Motoactv to tether from the PC in order to access the internet, which is required for some of the HDA functions.

The Host Device Agent server is a regular Android application that runs on the Motoactv device servicing HTTP requests while the USB cable is connected.

Note that the HDA server doesn’t have access to the SD card partition, as the Android operating system has it unmounted so it can be accessed via the USB mass storage protocol.

HDA functions

The HDA API exposes the functions via HTTP, a browser can be used by pointing it to the USB local network address, port 21931.

The functions are accessed via the function name appended to the common /hda/ URL.

The functions are described below as HTTP requests and responses.

  • Requests are issued via GET or POST, depending on the function.
  • Responses can be of three types:
    • HTTP return code
    • Plain text
    • JSON objects.

For example, pointing a browser to http://192.168.16.2:21931/hda/devstatus?c=2 will return the current battery level as a JSON object:

  {"BatteryLevel":100}

HDA initialization functions

Meta

Returns information about the HDA API version supported. This can be used to guarantee that the HDA API of client and server match.

GET /hda/meta HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:08:54 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 0

UsbProxy

Provides Motoactv with the PC HTTP proxy address and port for tethering services.
This server is queried by Motoactv as result of some HDA API requests (verify upgrade information, etc).

POST /hda/usbproxy HTTP/1.1
Host: 192.168.16.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 26

ip=192.168.16.1&port=54575

Get Device State

GET /hda/devicestate?c=2 HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:12:47 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

E
{"state":"3"}

0

Check proxy connection

This causes the HDA server to access the proxy provided via the UsbProxy function.

GET /hda/connected HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 05:59:17 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

14
{"connected":"yes"}

0

Motoactv uses the USB proxy to access Motorola’s website main webpage and check the connection.

HEAD http://www.motorola.com HTTP/1.1
Host: www.motorola.com
Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently
Server: AkamaiGHost
Content-Length: 0
Location: /us
Cache-Control: max-age=1800
Date: Sun, 08 Jan 2012 05:59:07 GMT
Connection: keep-alive

GET http://www.motorola.com/us HTTP/1.1
Host: www.motorola.com
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Tue, 29 Nov 2011 01:25:27 GMT
ETag: "29822-5bea-7e80efc0"
servedBy: v02210-greenfield
Content-Type: text/html
Cache-Control: max-age=1800
Date: Sun, 08 Jan 2012 05:59:08 GMT
Content-Length: 23530
Connection: keep-alive

...

....

Get user profile

GET /hda/userprofile HTTP/1.1

HTTP/1.1 200 OK
DATE: Wed, 11 Jan 2012 10:04:54 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

48
{"UserProfile":{"gender":x,"height":xxx.xx,"weight":xx.xxx,"age":xx}}

0

Device information functions

Get Device Version

GET /hda/devstatus?c=1 HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:13:40 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

13D
{"DeviceVersion":{"Media Version":"Unknown","Model":"Motorola-F100","Bootloader":"0311","FingerPrint":"G2-user 2.3.4 4.5.1-26_G2-284_US-xxx-xx xxxxxx release-keys","Device ID":"Unknown","Build ID":"4.5.1-26_G2-284_US-MR4-78","Apps Version":"Unknown","Blur Version":"Blur_Version.4.55.78.Motorola-F100.Retail.en.US"}}

0

Get battery level

GET /hda/devstatus?c=2 HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:14:15 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

15
{"BatteryLevel":100}

0

Get disk free

Returns the free space in all the partitions or in the partition passed via the p URL parameter.

GET /hda/devstatus?c=3 HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:14:54 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

20D
{"DF":"Filesystem             Size   Used   Free   Blksize\n\/dev                   121M    44K   121M   4096\n\/mnt\/asec              121M     0K   121M   4096\n\/mnt\/obb               121M     0K   121M   4096\n\/system                155M   110M    44M   1024\n\/data                  146M    54M    92M   1024\n\/cache                  49M     4M    44M   1024\n\/data\/tmp                2M    20K     1M   4096\n\/pds                     3M     1M     2M   1024\n\/preinstall            174M   119M    54M   1024\n"}

0
GET /hda/devstatus?c=3&p=/data HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:15:20 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

72
{"DF":"Filesystem             Size   Used   Free   Blksize\n\/data                  146M    54M    92M   1024\n"}

0

Filesystem status

GET /hda/devstatus?c=4 HTTP/1.1

HTTP/1.1 400 Bad Request
DATE: Wed, 11 Jan 2012 09:37:41 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 17

Partition is null
GET /hda/devstatus?c=4&p=/data HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:16:05 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

5A
{"StatFs":"\/data: 153321472 bytes total, 56777728 bytes used, 96543744 bytes available"}

0
GET /hda/devstatus?c=4&p=/preinstall HTTP/1.1

HTTP/1.1 200 OK
DATE: Wed, 11 Jan 2012 09:35:22 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

61
{"StatFs":"\/preinstall: 183475200 bytes total, 125814784 bytes used, 57660416 bytes available"}

0
GET /hda/devstatus?c=4&p=/system HTTP/1.1

HTTP/1.1 200 OK
DATE: Wed, 11 Jan 2012 09:36:19 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

5D
{"StatFs":"\/system: 162708480 bytes total, 116242432 bytes used, 46466048 bytes available"}

0
GET /hda/devstatus?c=4&p=/tmp HTTP/1.1
Host: 192.168.16.2:21931
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.25) Gecko/20111212 Firefox/3.6.25
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

HTTP/1.1 200 OK
DATE: Wed, 11 Jan 2012 09:36:54 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

53
{"StatFs":"\/tmp: 2097152 bytes total, 24576 bytes used, 2072576 bytes available"}

0

Filesystem functions

Copy a file

Note that not all directories are writeable by the HDA server. /data/tmp is, but /data is not.

When the destination is a filename, HDA responds OK

POST /hda/filesystem HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 77

c=3&src=%2Fsystem%2Fetc%2Flocation.cfg&dest=%2Fdata%2Ftmp%2Fl.cfg&button=Copy
HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 08:00:19 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 0

When the destination is a directory, HDA responds with the full name:

POST /hda/filesystem HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 61

c=3&src=%2Fsystem%2Fbuild.prop&dest=%2Fdata%2Ftmp&button=Send
HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 07:38:03 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

3A
{"FileSystemResp":{"FilePath":"\/data\/tmp\/build.prop"}}

0

Copying without overwriting causes the HDA server to reply with the renamed file.

POST /hda/filesystem HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 77

c=3&src=%2Fsystem%2Fetc%2Flocation.cfg&dest=%2Fdata%2Ftmp%2Fl.cfg&button=Copy
HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 08:00:22 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

38
{"FileSystemResp":{"FilePath":"\/data\/tmp\/l(1).cfg"}}

0

Delete a file

POST /hda/filesystem HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 48

c=2&src=%2Fdata%2Ftmp%2Fbuild.prop&button=Delete
HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 07:42:59 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 0

Trying to delete an nonexistent file

POST /hda/filesystem HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 48

c=2&src=%2Fdata%2Ftmp%2Fbuild.prop&button=Delete

HTTP/1.1 400 Bad Request
DATE: Sun, 8 Jan 2012 07:43:20 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 19

File does not exist

WIFI functions

Scan available WIFIs

GET /hda/wifiscan HTTP/1.1

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:01:41 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:01:41 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

213
{"WifiConf":{"HiddenSSID":[false],"BSSID":[null],"SSID":["\"aaaa\""],"NID":[0]},"WifiScan":{"frequency":[2427,2462],"level":[-56,-72],"BSSID":["aa:aa:aa:aa:aa:aa","bb:bb:bb:bb:bb:bb"],"capability":["[WPA-PSK-CCMP][WPA2-PSK-CCMP]","[WPA-PSK-CCMP][WPS]"],"SSID":["aaaa","bbbb"]}}

0

Connect to a WIFI

POST /hda/wificonnect HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 100

capability=WPA%2DPSK%2DCCMP&shared_key=XXXXXXX&ssid=aaaa

HTTP/1.1 200 OK
DATE: Sun, 8 Jan 2012 04:05:03 GMT
TRANSFER-ENCODING: chunked
CONTENT-TYPE: text/plain
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0

10
{"NetworkID":0}

0

Disconnect from a WIFI

POST /hda/wifidelete HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Host: 192.168.16.2:21931
Content-Length: 12
Cache-Control: no-cache

network_id=0

Music Synchronization

Display start music synchronization

This shows the “Synchronizing Media” screen on the device, it doesn’t really do anything else, the synchronization is done via the USB mass storage.

POST /hda/musicsync HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 8
Cache-Control: no-cache

status=1
HTTP/1.1 200 OK
DATE: Fri, 13 Jan 2012 06:37:46 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 0

Stop displaying music synchronization

Stops displaying the “Synchronizing media” screen on the display.

POST /hda/musicsync HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 8
Cache-Control: no-cache

status=2
HTTP/1.1 200 OK
DATE: Fri, 13 Jan 2012 06:43:47 GMT
SERVER: Linux/2.6.32.9-g5c524e3 HDA-VER/0.13 HDA-API/1.0
CONTENT-LENGTH: 0
About these ads

From → Uncategorized

2 Comments
  1. This is really interesting – Thanks for the work here.

    Loving my MotoActv and looking forward to all manor of custom apps and services for it

  2. jupeos permalink

    Good work!
    Do you think you could email me some tips on how to get started on this? I have a MOTOACTV and want to suck the workout data off the device (or intercept it) before it goes up to the cloud. I’ve been using Fiddler with not much success. Some pointers would be appreciated.
    Keep it up!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: