HowTo: Downgrade Scosche Rhythm+ Firmware

REVISED 20180116

In my previous article, HowTo: Upgrade Scosche Rhythm+ Firmware, I showed how to update Scosche Rhythm+ firmware via their Fitness Utility iOS app. Some people have had issues with the 3.01 firmware installed by the latest V2 Fitness Utility, notably incompatibility with certain apps, and/or flaky readings.

I contacted Scosche via live chat, and they told me that there was no way to downgrade from 3.01, except for sending the unit back to them. The V2 Fitness Utility no longer has a Firmware Update button, so there’s no way to use it to install any firmware other than v3.01. Instead of sending mine back to them, I decided to try to get a hold of an older version of Fitness Utility, in order to downgrade the firmware. It turned out to be a very laborious and time consuming procedure. I was hoping that I could share the IPA file of Fitness Utility 1.4.1 so everyone else could save a lot of time, but as reader Hap noted in the comments below, IPA files are tied to specific Apple IDs.

If you want to downgrade your firmware yourself, rather than send it back to Scosche, follow the rather lengthy and complicated procedure below.

To obtain the older version of Fitness Utility, I loosely followed the procedure from How to legally download any previous version of an App Store app through iTunes, but it was somewhat outdated, so I will summarize my own procedure below. I am not going to explain the nuts and bolts of what each step does, since that’s covered in the linked article.

Current versions of iTunes no longer support app installs, so you need to downgrade to an older version. The linked article states that there’s yet another hurdle, in that as of iTunes 12.5, Apple is using certificate pinning, which nullifies the ability of Fiddler to snoop HTTPS traffic. I tried an older version of iTunes, but it was no longer able to communicate with the App Store (Apple just LOVES to put up hurdle after hurdle for us!). After much searching, I discovered that in December 2017, Apple quietly released iTunes 12.6.3 for enterprise users who still need the ability to do app installs. Because it uses certificate pinning, I had to devise a procedure to get around that.

Note for Mac users: You can probably follow the same basic procedure using Charles Proxy, but I don’t have the ability to walk you through that.

WARNING: THE PROCEDURE BELOW IS PROVIDED AS A RESULT OF MY OWN FINDINGS. THERE IS ABSOLUTELY NO WARRANTY, AND THERE IS A SMALL POSSIBILITY THAT YOUR DEVICE CAN BECOME BRICKED DURING A FIRMWARE UPDATE. MAKE SURE THAT YOUR DEVICE IS FULLY CHARGED BEFORE STARTING. IN FOLLOWING THE INSTRUCTIONS BELOW, YOU AGREE TO RELEASE ME FROM ALL LIABILITY, AND PROCEED AT YOUR OWN RISK.

How to download Fitness Utility 1.4.1 and use it to downgrade your Rhythm+ to firmware 2.62:

    1. Find your current iTunes folder, and rename it to iTunes.sav, or just move it to a new location. On Windows 10, it’s located at C:\Users\<yourusername>\Music\iTunes. (Don’t worry, after you’re done, you can reinstall the latest iTunes, and restore your old iTunes folder).
    2. Download and install iTunes 12.6.3
    3. Download and install Fiddler. DO NOT START FIDDLER YET
    4. Launch iTunes 12.6.3 and download any random app. iTunes will prompt you to log in with your Apple ID. This is the loophole we use to get around the certificate pinning. It turns out that iTunes 12.6.3 only checks the certificate during the login process, and doesn’t detect when we later swap in Fiddler‘s fake root certificate so that it can snoop HTTPS traffic.
    5. Before proceeding, it’s best to kill any programs on your computer that access the web, because they will pollute your Fiddler capture. If you have your web browser open in order to read this article, kill all of your other tabs that might be accessing the web in the background.
    6. Launch Fiddler.
    7. In Fiddler, go to the File menu and uncheck File->Capture Traffic
    8. From the Fiddler menu, go to Tools->Options->HTTPS. Check the Capture HTTPS CONNECTs and Decrypt HTTPS traffic checkboxes. A dialog box will pop up asking if you want to Trust the Fiddler Root certificate. Select Yes to it, and all of the ensuing dialog boxes. Don’t worry, after we’re done, we will remove the fake certificate, and restore your original.
    9. In Fiddler, go to the menu to check Rules->Automatic Breakpoints ->Before Requests
    10. Launch iTunes and search for Fitness Utility in the App Store
    11. In Fiddler, go to the File menu and check File->Capture Traffic
    12. In iTunes, click the button to download Fitness Utility
    13. A few requests with red icons on the left will appear in the Fiddler capture pane. Select
      HTTP Tunnel to upp.itunes.apple.com:443  and click the green Run to Completion button in the right pane. Next, select
      HTTP Tunnel to p14-buy.itunes.apple.com:443 in the left pane, and click the green Run to Completion button in the right pane
    14. A new request should appear in the Fiddler capture pane: HTTPS p14-buy.itunes.apple.com /WebObjects/MZBuy.woa/wa/buyProduct  Select it in the capture pane, and then in the right pane, click the TextView tab, look for

      <plist version=”1.0″>
      <dict>
      <key>appExtVrsId</key>
      <string>821322483</string>

      and replace 821322483 with 813634417.

    15. In Fiddler, go to the menu to check Rules->Automatic Breakpoints ->Disable
    16. Make sure the HTTPS p14-buy.itunes.apple.com /WebObjects/MZBuy.woa/wa/buyProduct request is selected in the Fiddler capture pane, and click the green Run to Completion button.
    17. After iTunes shows that Fitness Utility is downloaded, verify that you have the Fitness Utility 1.4.1.ipa file in C:\Users\<yourusername>\Music\iTunes\iTunes Media\Mobile Applications
    18. Connect your iOS device to your computer, and use iTunes 12.6.3 to install the Fitness Utility 1.4.1 to your iOS device, or use iFunBox instead as described below in Update 20170112
    19. Launch Fitness Utility 1.4.1 on your iOS device and turn on your Rhythm+. WARNING: MAKE SURE YOUR RHYTHM+ IS FULLY CHARGED BEFORE UPGRADING THE FIRMWARE. IF IT DIES DURING A FIRMWARE UPGRADE, IT MAY BE RENDERED UNUSABLE.
    20. Tap the Commands button at the top right of the screen, and then tap the Start button next to Firmware Update.
    21. After the update is completed, power cycle your Rhythm+
    22. You can check that the firmware version is now 2.62 by tapping the Attributes button at the top left of Fitness Utility.
    23. VERY IMPORTANT: Once you verify proper operation of Fitness Utility, on your computer, have Fiddler restore your original root certificate with Tools->Options->HTTPS->Actions->Reset All Certificates.
    24. Copy your Fitness Utility 1.4.1.ipa file somewhere so that you can reuse it in the future if you wish.
    25. Delete the new iTunes folder, restore your old iTunes folder by renaming iTunes.sav to iTunes, uninstall iTunes 12.6.3, and reinstall your original version of iTunes.

Now that you have your own copy of Fitness Utility 1.4.1.ipa, you are free to try any future firmware upgrades from Scosche, because it’s easy to go back to a working version if you don’t like the new one. If you use iFunBox, you don’t even have to mess with swapping out iTunes versions.

If you prefer to downgrade to firmware v2.4, you can use Fitness Utility 1.4.1 and follow the procedure below:

*** WARNING: DOWNGRADING TO FIRMWARE V2.4 DISABLES THE ABILITY TO UPDATE FIRMWARE VIA FITNESS UTILITY. IF YOU LATER CHANGE YOUR MIND, AND WANT TO INSTALL A DIFFERENT VERSION, YOU WILL HAVE TO SEND THE UNIT BACK TO SCOSCHE. ***

  1. download firmware 2.4 and unzip it.
  2. send the unzipped HEX file to an e-mail address accessible from your iOS device
  3. open the e-mail you sent on your iOS device, tap the attachment, and then scroll through the on screen icons until you find Copy to Fitness Utility, and tap the icon.
  4. Turn on your Rhythm+ and follow steps 19-22 above.

The above method actually works with any version of firmware HEX file that you are able to obtain.


Update 20180112: I tried installing Fitness Utility 1.4.1.ipa with iFunBox instead of iTunes, and it also works. Launch iFunBox with your phone connected to your computer, and install the app by clicking the Install App(*.ipa) from the main screen. Firmware 2.4: scosche-rhythmplus-2_4.zip

 

Downloads:
iTunes 12.6.3 (allows App installs): https://support.apple.com/en-us/HT208079

 

Previous article: HowTo: Upgrade Scosche Rhythm+ Firmware

HowTo: Upgrade Scosche Rhythm+ Firmware

rhythmplus

The Scosche Rhythm+ is an optical BLE/ANT+ armband heart rate monitor that’s highly recommended by DC Rainmaker. There are many posts around the Internet which claim that it doesn’t have updateable firmware, but that’s not always the case. Prior to firmware V2.5, the Rhythm+ had to be sent back to Scosche for firmware updates, but if you’re lucky to have firmware 2.5+ installed, you can update the firmware yourself with your phone and Scosche’s Fitness Utility.

*** WARNING WARNING READ BEFORE UPDATING: Read all of the updates at the bottom of this article before attempting a firmware update. Sometimes, a unit has gotten bricked by the procedure, but apparently, it has been fixed in Version 2 of the app. Also, read the comments left by other users. It seems that the data in the newer firmware 3.0+ also causes issues with data corruption in certain apps.  Before starting a firmware update, make sure that your device is fully charged, because it can be rendered unusable if the battery dies during the procedure ***

The procedure is quick and easy. Pair the Rhythm+ to your phone and launch the Fitness Utility. You will be presented with the Attributes screen, which lists the current firmware version:

IMG_4795

If you have Firmware Revision 2.5 or higher, tap the Commands button, and you’ll be presented with this screen:

IMG_4794

Tap the Firmware Update Start button, and the utility will update you to the latest firmware.

I got a nice new feature when I upgraded mine to firmware 2.62. Now, after setting my HR Zone Min and HR Zone Max via the Fitness Utility, the LED on the Rhythm+ blinks blue when my HR is below HR Zone Min, purple when I’m between HR Zone Min & Max, and red when I’m above HR Zone Max. I guess if you only use ANT+, and want to save some battery life, you can turn off the BLE Radio as well, but I haven’t tried playing with any of the other functions yet, and I have no idea how you would turn BLE on again, since the app communicates via BLE.

Update 2016-07-11: Reader Atle posted below that v2.62 adds another function for iOS users … click the button on the unit once to start/stop music, and double click to advance tracks in the playlist. I wonder if this works on Android, as well.

*** 20170327: WARNING: I HAVE RECEIVED MULTIPLE REPORTS OF THEIR UNITS WITH NEWER FIRMWARE GETTING BRICKED BY APPLYING THE FIRMWARE UPDATE. IF YOU HAVE A UNIT WITH NEWER FIRMWARE >2.62, APPARENTLY, THE UTILITY IS BADLY DESIGNED, OR HASN’T BEEN UPDATED IN A LONG TIME, AND CAN CORRUPT UNITS WITH NEWER FIRMWARE. AT THIS TIME, I *DO NOT* RECOMMEND UPDATING YOUR UNIT IF IT HAS NEWER FIRMWARE. IF YOUR UNIT GETS BRICKED, CONTACT SCOSCHE CUSTOMER SUPPORT … IT IS THEIR FAULT IF THEIR SOFTWARE BRICKS YOUR UNIT ***

** 20170509: A reader below said: “If you see blinking Red-blue led so seems like bricked but don’t be upset just put on charge unit and the device will be reset.” Please leave a comment below if it works to resurrect your bricked unit ***

Update 2017-06-16: As reader Occamsrazor states below, the Fitness Utility has been updated to Version 2. The description on iTunes shows that it has some new features, but it’s rather cryptic. I was able to use it to update my 2.62 FW to 3.01. You no longer have to press a firmware upgrade button. If your unit is eligible for updating the firmware, it will automatically prompt you when you connect your device. The new app has several new undocumented functions. I tried to enter my birthday, height, etc, but it doesn’t seem to work. If anyone figures out the advanced features, please post below. Apparently, it’s possible to record a workout in the band itself, and then export a CSV file, but I can’t get any of the functionality to work. Also, there are some reports that the new version is a lot less likely to brick your unit, but YMMV. It worked OK for me.

Update 2018-01-09: 1) I’m not absolutely certain, but I feel that my Rhythm+ has gotten flaky since updating to v3.01 firmware. The heart rate is often very low or very high. I decided to try downgrading my firmware. If you are having issues, and want to try a different version of firmware, I have documented how to downgrade in a new article: HowTo: Downgrade Scosche Rhythm+ Firmware. 2) I was wrong above. You don’t need v2.62 firmware to get the feature that setting the Min & Max heart rates make your LED flash purple/blue/red when the heart rate is below Min/in between Min & Max/Max HR. v2.4 firmware actually supports that feature.

 

Next article: HowTo: Downgrade Scosche Rhythm+ Firmware

Review: Mobility Rev Bluetooth Heart Rate Monitor

I recently discovered the PCD Mobility Rev Bluetooth HRM on Amazon.com, for the ridiculously low price of $7.95 including shipping (currently also available on eBay for $9.95). This is a Bluetooth 4.0 (Bluetooth Smart/Bluetooth Low Energy) HRM with strap, for half the price of a replacement strap for a Garmin or Polar HRM! Despite the 1 star reviews on Amazon, I figured that if the HRM was total trash, I would still have a decent spare HRM strap. It arrived a few days ago, and I put it through its paces on a couple of workouts. I wasn’t expecting much, given the bad reviews, and was pleasantly surprised to find that it’s actually a decent piece of hardware.

Specifications

  • strap length: 70-120cm
  • battery life: 1800 hrs (5 yrs x 1 hr/day)
  • battery: CR2032
  • range: ~10 meters
  • waterproof: IPX7
  • operating temperature: -10C – 50C
  • weight: 47g (transmitter+strap)
  • SKU: LHX0021Q

The company seems to be out of business, as their website is dead: http://www.pcdphones.com

The receiver is a bit chunkier and clunky looking compared to my Garmin HRM:

hrmfront

Note how it uses industry standard metal snaps, spaced that the standard distance, so the receiver and strap are compatible with Garmin/Polar/Wahoo/etc.

hrmback

The Mobility Rev uses a CR2032 battery (included). The battery door has a rubber o-ring to seal out moisture from your sweaty chest. I don’t know how water resistant it is, however, and am not going to try immersing it. Unlike the Garmin, which requires a small Philips screwdriver to replace the battery, the Mobility Rev’s battery cover easily comes off with a twist of a coin.

The Mobility Rev strap (bottom) is the same quality and of similar design to my Polar strap (top):

hrmstrapfronthrmstrapback

I use the Polar strap with my Garmin HRM, because the fancy strap that it came with has rather sharp and hard edges that chafe during a long workout.

So far, I have taken the Mobility Rev HRM out for a 1.5 hour bike ride and a 3.5 mi trail run, using the Wahoo Fitness app on an iPhone 6, and it has worked quite well. Here are the metrics I use for evaluating wireless heart rate monitors:

  1. accuracy: Since this is a cheapo HRM, I’m not going to do detailed testing with graphs. At steady state, the heart rate reading is identical to that from my fingertip SpO2 meter. On my 1.5 hour bike ride, I didn’t bother to bring another HRM to compare against, but the heart rate readings looked consistent with my experience, and there were no dropouts or spikes, even when I was riding over very bumpy pavement. On my 3.5 mi trail run, I brought along my Garmin HRM, and did concurrent recordings. I was disappointed to find that during the first minute of recording, the Mobility Rev spiked up abnormally to 144 bpm before stabilizing at my true HR of 109 bpm. This phenomenon, however, is a regular occurrence with my optical HRM’s (Wahoo Rhythm+ and Garmin Forerunner 225 built-in). Since I was wearing two heart rate straps, making the sensor placement less than ideal, it’s possible that this glitch was due to poor contact with my chest. After this initial spike, it settled down, and had identical readings to the Garmin during the rest of the workout, deviating by 1 bpm on occasion, even when my heart rate was fluctuating, due to my switching back and forth between hiking and running. My Pyle strap often spikes up to unrealistically high HR’s when there is intense vibration from my running. The Mobility Rev displayed no such aberrant behavior. For the most part, I was impressed by the accuracy and consistency of its readings.
  2. signal stability: During use, the signal was rock solid and never dropped out.
  3. range: my iPhone 6 was able to reliably receive the signal 40 feet away from the HRM even while indoors.
  4. overall fit and finish: The plastic casing seems of decent quality, and the strap is of comparable quality to the Polar HRM strap.
  5. reliability: Since I have only had it for a day, I don’t yet know if it will crap out after just a few uses. I will update this article after more testing.

Using the free LightBlue Explorer iOS app, I found that it identifies itself as BLUETOOTH SMART HRM, and reports the following device information:

bthrminfo

The manufacturer string is Maxwell Guider. It’s a nice touch that it seems to support reporting of battery status, but I don’t have any partially dead batteries to test with, so I don’t know if it actually outputs anything besides 100% [Update: see below, it always outputs 100% even with bad batteries].

One caveat of the Mobility Rev HRM is that it only outputs heart rate, so you can’t use it for HRV analysis, which requires R-R interval data. I tried to use it with the Elite HRV app on my iPhone, and it wasn’t able to read any HRV data. As a cross check, I took a look at the raw heart rate data output, and found that it indeed only reports 8-bit heart rate and nothing else.  Most people, however, are only interested in heart rate, and won’t find this to be a problem.

I have only had the Mobility Rev BT HRM for a day, so I don’t yet know if it will stop working after only a short period of use. If there are any changes to its performance, I will update this article. Even if it does fail, I’ll still be happy to have an extra $8 Garmin/Polar/Wahoo/etc compatible strap.

Update 2015-11-24: After only 3 days of use, it died. I tried putting several new CR2032’s into it, and it was still dead. I was ready to write it off as a piece of junk until I finally found one that works. Now, it’s working perfectly again. I think the people who are reporting on Amazon that it connects inconsistently or fails after a couple of days are just suffering from weak cells. This device seems to need a higher voltage than others in order to function properly. The functional cell has an open circuit voltage of 3.25V, while another that reads 3.21V doesn’t work. This makes me question the manufacturer’s claim of 1800hrs battery life. Also, during this testing, I found that the Battery Level service is fake, and always outputs 100%. Some of the weak cells would actually operate it for a few seconds at at time before cutting out, and it still outputted a Battery Level of 100%.

 

Update 2015-12-03: I’ve used the Mobility Rev HRM for at least 8 hours of cycling and running workouts now, and the readings have been absolutely rock solid. No spiking up of HR during the start of a workout, no spiking up of HR during running, and no dropouts. The HR readings are totally glitch free. One problem I’ve had, however, is that sometimes, it’s a bit difficult to get the unit to wake up. I wetting the strap contacts usually helps. One time, I had it mounted upside down on the strap, and it woke up when I inverted it. I’m surprised that it seems to be sensitive to L/R, but unit is actually labeled for left & right sides on the back. In the meantime, the price dropped to $6 on Amazon, so I ordered a 2nd one to keep as a spare.

GPX and TCX output from GPS Master Software

A couple of years ago, I bought a Pyle PSWGP405BK GPS watch with Heart Rate Monitor.

PSWGP405BK

It’s been a great device, though it’s big, and a bit ugly. The battery far outlasts my wife’s Garmin watches, and I love the customizable screens. My main problem has been the lack of a useful way to extract heart rate data. The problem is that the GPS Master software offers only two ways to export heart rate data: 1) TKL format, which is an undocumented file format used only by GPS Master, and 2) CSV format, which isn’t compatible with any web sites or software that I use.  Although GPS Master can directly export GPX files, they do not include the heart rate data.

I finally got sick of it today, and after wasting some time looking for an easy way to adapter existing converter software to work w/ GPS Master’s CSV files, I gave up, and decided to write my own programs. So, I give you csv2gpx, and csv2tcx. csv2gpx takes a GPS Master CSV file as input, and outputs a GPX file with heart rate data embedded. csv2tcx takes a GPS Master CSV file as input, and outputs a TCX file with heart rate data. Both programs have a simple command line interface. I have supplied full source code on github, so anyone can compile them to run on their own platforms. For Windows users, I have supplied EXE files. The command line syntax is quite simple:

csv2gpx workout.csv

or

csv2tcx workout.csv

The output will automatically be generated as workout.gpx and workout.tcx, respectively.

Here is a sample session:

C:\git\csv2gpx\test>csv2gpx 20150125074851.csv
Lincomatic GPS Master CSV to GPX Converter v0.2

Converting 20150125074851.csv -> 20150125074851.gpx
Avg HR: 131
Max HR: 159
Trackpoints 2398

Note that the output file is the same as the input file, but with GPX extension. csv2tcx works in a similar fashion.

I think csv2gpx and csv2tcx should work with any other watches that work with GPS Master, as well. Runtastic’s watch looks identical to my Pyle, as well as several other models that I’ve seen. For instance, the New Balance NX990 also uses GPS Master, and looks identical. As I’ve stated in a previous article, the watch is built by Latitude Limited, and the OEM calls it the Nav Master II.

Update 2015-01-27: Argh! I just confirmed that the fancy new updated version of GPS Master bundled with the New Balance NX990, aka NB 900 GPS, now exports HRM data inside its GPX files! So I wasted my time writing the utilities above yesterday! It has some nice UI enhancements, as well. Highly recommended! You can read my detailed description: Pyle PSWGP405GK Software and Firmware Updates.

Downloads: csv2tcx and csv2gpx executables for Windows