[Other SmartWatches] SifJar:
So I've finally got around to starting to look into some stuff, and here's a few bits and pieces I've got so far:

-Watchfaces are stored on phone in a folder called "DIALS" in the root of the storage (for me it was internal storage, if your phone has an SD card it might be there instead). This folder contains all current watchfaces, as well as preview images. The watchfaces are in .BIN files, the previews are .PNGs.

-Opening the BIN files in a Hex Editor, made some interesting observations:

Couple of things to note here:

1. First 0x14 bytes are largely identical in every dial I've looked at so far [red boxes]

2. Exception are bytes 0x04 & 0x05 which seem to be an "ID" of some sort for the dial, also found in the file name [yellow boxes]

-Closer inspection of dial "0108" shows this:

Obviously this is just a sample, but it's quite clear that this forms the shape of the numbers 22. The files goes through 00, 11, 22...99 and then through them all again, with slight changes (presumably the first are for hours, the second are for minutes?). My guess would be that each of the hex values has a "meaning", it seems like 0xE0 for example comes at the end of a "row", and 0x03 comes at the start. When there's a solid row, it seems to be filled with 0xFF in between the 0x03 and 0xE0, but when only some of the row is filled, different values are used. (Different hex values could correspond to different line thickness perhaps? Just a thought)

And of course, this is just one dial that I have inspected slightly more closely (and still not that closely, really). For reference, here is the preview image from this dial:

I have also not yet tried replacing a dial on the device storage and trying to sync it with the Tommy. I don't know if the app re-downloads the files if they're modified or if it would sync a modified one (if it syncs a modified one, it would obviously be more beneficial to reverse engineer the format, not much point in making custom faces if we can't get them on to it).

Final thing I want to mention is that I have learnt that Android (as of 4.4) includes a built-in bluetooth logging capability. If you go into Developer Options in Settings (if it's not enabled, go into About Phone and tap on Build Number seven times, it'll pop up "you are now a developer" and then go back to settings and Developer Options will be there), there is an option "Enable Bluetooth HCI snoop log", which will dump a log of all packets being sent over bluetooth to the SD card/internal storage. This dump can then be read with a tool like Wireshark. Not sure if it's very useful, but maybe people who know more about bluetooth protocols and whatnot than I do would be able to make some use of it.

EDIT: Woot, first custom watchface (PoC):

EDIT: From this PoC, I can confirm that the first instances of each number are for the hours and the second are for the minutes (for dial 0108, anyways). I added the horizontal lines towards the tops of the first instances and towards the bottom of the second to verify this. I assume also that the "left" number is for the left of the screen and the "right" number is for the right of the screen, although I have not yet verified this (seems logical, editing a dial, transferring to phone and syncing takes time so haven't bothered verifying).

Just to clarify, I got this onto the watch my editing an existing dial and replacing the .bin file in the "DIALS" folder on the root of my internal storage (i.e. the storage accessible over USB).

EDIT: It's probably also important to note that the dials all have different file sizes, so clearly they all have different layouts etc. My guess would be in the 0x16 bytes that follow the 0x14 bytes mentioned above there are details about the layout (size of characters in bytes and such). It seems (although this could be inaccurate) that the actual dial starts at 0x30, and so the first 0x30 bytes (0x00 > 0x2F) are a "header".

EDIT: Figured out part of the header, I believe:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 0A 0B 09 5C 08 01 00 00 10 00 00 00 00 00 00 00 ...\............
00000010 30 00 30 00 30 19 30 19 06 02 4A 02 06 56 4A 56 0.0.0.0...J..VJV
00000020 40 50 40 50 40 50 40 50 00 00 00 00 00 00 00 00 @P@P@P@P........

(from dial 0108)

If you look at offset 0x10, the first 8 bytes are:

30 00 30 00 30 19 30 19

Taking these as two byte "words", and reversing the endianess (basically switching the order of the bytes), you get 0x0030, 0x0030, 0x1930 and 0x1930. Which are the offsets for the beginning of the first digit for the hours (0x0030) and the minutes (0x1930). Of course, as I mentioned before, each digit comes as a pair in this dial, so the first two words (0x0030 and 0x0030) I guess refer to the beginning of both the "0" digits for the hour, even though the second hour digit actually begins at 0x38.

Hope you guys understand what I am talking about here.

EDIT: Current estimate of header:

Offset	Length	Description
0x00	0x04	Magic
0x04	0x02	ID
0x06	0x0A	???
0x10	0x02	Offset for left hour digit
0x12	0x02	Offset for right hour digit
0x14	0x02	Offset for left minute digit
0x16	0x02	Offset for right minute digit
0x08	0x18	???