Teardown: Misfit Shine Activity Tracker
Nick Poole 
The Unexplained
I tried to find some way of hacking the firmware on this, but I didn't have any luck identifying a point of entry. I probed every test pin and package lead that I could reach, but I couldn't find anything interesting on the logic analyzer. The controller, being a BGA package, wasn't very accessible from a hardware hacking standpoint. Ultimately I gave up hope on trying to figure things out on the device side.
Because the Shine is a Bluetooth Low Energy device, however, I figured it might be possible to get some information on the host side. I downloaded a utility for my smartphone that reads BLE device attributes and connected to the Shine. Unfortunately, there didn't seem to be any way for me to access the sensor data form that end either. For anyone interested, though, here's what I was was able to find out using the BLE utility...
After connecting to the device, you have access to 4 services, which are basically categories of attributes that can be read, written, or otherwise manipulated. Generic Access, Generic Attribute, and Device Information are all standard services on the BLE protocol and will give you things like this:
Device Name (UUID 0x2A00): Shine
Appearance (UUID 0x2A01): [1088] Generic: Running Walking Sensor
Firmware Revision String (UUID 0x2A26): 0.0.50r
Not very interesting. You can also get your device serial number and stuff like that. There's another service on the device, and it's a proprietary service with its own UUID that I won't bother typing here. It has writable characteristics, but, without knowing what I'm doing, I'm reluctant to try writing to them. They may not even be related to the primary function of the device.
I guess some things will remain a black box. I threw the device back together, and I'm going wear it for a while to see how it holds up! After all, even if you can't hack it, Misfit has hinted at the release of an API in the future, and we can all look forward to that.