[Other SmartWatches] SifJar:
Is there no way to exit OTA mode if the phone is unable to connect to the watch? I went into OTA mode to try and flash the update to 3.18, then following the instructions in the first post deleted the pairing in my phone's settings, and now can't seem to get it to connect. I can't try using an iOS device as I do not own one. I'd kinda just like to get my watch working again if anyone has any advice.

EDIT: Found a solution in the other big thread, using an old version of the app (the oldest version from wtf.li, 1.24.3162), I opened the app and tapped on the watch icon in the centre of the screen (with "disconnected" beneath it) 5 times, which prompted to "enter OTA mode" or something to that effect, I hit OK and then got to the upgrade screen. I then did the standard process for selecting a firmware .bin from the phone storage and it has flashed. [EDIT: Just found that "in silico" posted this a few posts above mine. Would have been helpful if I'd read the thread perhaps :o]

However, I didn't use a completely standard firmware .bin. I modified it slightly. This is just a PoC (proof of concept), but it proves that we can easily flash custom firmwares, and that the firmware is not encrypted or signed, as it can be modified easily. Here's a pic:

[IMG="PoC "custom" firmware"]http://s11.postimg.org/pl5zwsjw1/2015_02_13_14_57_17.jpg[/IMG]

It's just a hex edit of the "no content" string in the firmware file, but I thought it was perhaps a little neat. It's probably possible, in theory at least, to create patches for the firmware to change certain things e.g. increase font size in notifications or whatever. But that would require a deeper understanding of the firmware most likely.

By far the longest part of this process was figuring out how to connect to the phone in OTA mode.

EDIT: Also been looking a bit more at watchfaces. Building upon the header description I posted before, here's my current estimate:

Offset	Length	Description
0x00	0x04	Magic
0x04	0x02	ID
0x06	0x0A	Face "type" *
############
0x10	0x02	Offset for left hour digit
0x12	0x02	Offset for right hour digit
0x14	0x02	Offset for left minute digit
0x16	0x02	Offset for right minute digit
0x18	0x08	???
0x20	0x08	Dimensions for each digit [0x02 per digit]

*Face "type" - it seems that here there are a few bytes which identify what type of watch face this is. Unlike how they're listed in the app, there seems to be two types here. The first (for "digital" faces) looks like this:

00 00 10 00 00 00 00 00 00 00

while the second (for both "pointer" and "graphical" looks like this):

10 00 20 00 00 00 00 00 00 00

(Of course, these two styles both have a background image and then either digits or watch hands).

It also seems that the second section of the header (separated by the line of #s above) differs between the two types (which makes sense given they will different layouts). The above is for the digital faces. Presumably this "secondary" header for the second type of watch face will contain some identifier between "pointer" and "graphical" dials.

EDIT: BTW, now my watch is running v3.18, it seems the latest version of the app can connect in OTA mode just fine via the method of tapping the in-app watchface 5 times (or maybe 6).