SR116 · JY-Y3 · LoraFit rings — reverse engineered
A $30 AI ring, freed.
Heart rate, SpO₂, a microphone and a radio on your finger — and a vendor app in the way. The protocol byte for byte, a Python driver, tiny as the app.
- HR3918 optical sensorinner face · HR, SpO₂, temperature
- DA14xxx radio · mic · flashone GATT service
- Touch padtap four times, talk
The inscription · ten bytes
Speak to it in ten bytes.
FEFC
0700
0100
0100
0000
- FE FCmagic — 0xFCFE, little-endian
- 07 00cmd 7 — open heart rate
- 01 00total — 1
- 01 00index — 1
- 00 00len — no payload, no checksum
←
FE FC 0B 00 01 00 01 00 07 00
29 FA 65 69 00 00
5F
95 bpm — cmd 11, one tick per 5 s
Every byte, decoded.
Fourteen captured frames; the needle reads them.
…
The loop · ring → phone → tiny
Tap four times. Talk.
“what is the battery of my silver ring?”
tiny +28 s
Your silver ring is at 99% battery
Pulled over BLE, transcribed, answered by your agent — proven.
Live · Web Bluetooth
Have one? Talk to it.
56FFone GATT service · write
33F3 · notify 33F410 Bheader
FE FC · cmd · total · index · len + payloadOpus16 kHz mono, 12 × 40 B frames per packet
0 keysno auth, no checksum — anyone in range
Three things it does.
Vitals →
Heart rate every 5 s, SpO₂, temperature, steps, sleep — into /health on your account.
Proven: → 07 then ← 0B … 85 bpm live; 28 commands with JSONL evidence.
Memos →
The Opus memo waits on the ring; your phone pulls it, tiny transcribes and answers.
Proven: "what is the battery of my silver ring?" → push notification with the answer in 28 s.
Voice & agent →
Your agent reaches the ring — find, battery, measure, record, pull memos — through the phone.
Proven: ring_command memo_pull claimed in 6 s, done in 14 s.
$ pip install git+https://github.com/cagataycali/lord-the-ring
$ ring-cli scan --seconds 10
E4:…:9A SR116-088D -61 dBm
$ export RING=E4:…:9A
$ ring-cli battery -a $RING
{"battery_percent": 100, "charging": 0}
$ ring-cli hr --seconds 15 -a $RING
[{"ts": 1758300000, "hr": 85}, {"ts": 1758300005, "hr": 86}]
$ ring-cli audio-state -a $RING
{"state": 0, "files": 1}
$ ring-cli audio-pull -a $RING
captures/memo.opus captures/memo.wav (6 min 05 s)It works from a terminal.
Scan, battery, live heart rate, your memo as a WAV — no vendor app, no account. ring-cli bridge posts vitals every minute.
How the pieces fit.
flowchart LR R["`**💍 ring** SR116 / JY-Y3 GATT 56FF`"] -- "BLE · notify 33F4" --> P["`**📱 phone gateway** tiny iOS / Android or ring-cli bridge`"] P -- "POST /api/health/ingest vitals · memos (Opus)" --> W["`**☁️ worker** health store · transcript ring_commands queue`"] W -- "one-shot job" --> A["`**🤖 your agent** health_* · ring_command`"] A -. "find · battery · measure_hr record · memo_pull" .-> W W -. "claim loop" .-> P P -. "write 33F3" .-> R
BLE to the phone, HTTPS to your account, a job to your agent — commands return the same way. The tiny side →
→ 07 open heart rate ← 0B ts6 55 85 bpm ← 0B ts6 56 86 bpm ← 11 session ended → 3D ← 3D 01 00 one memo waiting → 40 · 34 pull it ← 34 × 1522 6 min 05 s of Opus ← 36 01 00 → 36 01 00 delete it
Proven, not guessed.
Three sources had to agree — the decompiled app, an HCI capture, our own evidence/*.jsonl. When they disagreed, the bytes won.