[Samsung Gear Fit] _Klut:
I did it!

Many thanks to @PaulieP and all the others!

In my case I had to remove the activation lock from a Gear Sport (R600). I was following all the mentioned steps, but I had to improvise. And I want to share that with you.

I was downloading and using the combination file COMBINATION-FT30_R600XXU1AQL1_BoxWares.tar.zip

But I guess I had a little problem with it, as I couldn't turn on root using ADB after successfully connecting to the watch. I was swapping out adb.exe with the latest version and ADB was telling me that turning on root isn't possible. I guess it has something to do with the Firmware on the device I tried to connect to. As I've seen that other people where using SDB instead, I was looking for it.

SDB is the Smart Development Bridge from Samsung. It works like ADB and has the same requirements. So I downloaded and installed Tizen Studio. In my case web-ide_Tizen_Studio_4.1.1_windows-64.exe

Then I was repeating Step 10 with SDB and I was able to connect and change into root on the R600.

As I've carefully read all the posts in this thread, I knew already, that I had to overwrite mmcblk0p17 by using dd and the empty file. But was looking closer to the partitions by entering the syntax "ls -la /dev/mmcblk*" and "cat /proc/partitions"

Output of ls:

brw-rw---- 1 root disk 179, 0 Sep 4 23:10 /dev/mmcblk0

brw-rw---- 1 root disk 179, 8 Sep 4 23:10 /dev/mmcblk0boot0

brw-rw---- 1 root disk 179, 16 Sep 4 23:10 /dev/mmcblk0boot1

brw-rw---- 1 root disk 179, 1 Sep 4 23:10 /dev/mmcblk0p1

brw-rw---- 1 root disk 259, 2 Sep 4 23:10 /dev/mmcblk0p10

brw-rw---- 1 root disk 259, 3 Sep 4 23:10 /dev/mmcblk0p11

brw-rw---- 1 root disk 259, 4 Sep 4 23:10 /dev/mmcblk0p12

brw-rw---- 1 root disk 259, 5 Sep 4 23:10 /dev/mmcblk0p13

brw-rw---- 1 root disk 259, 6 Sep 4 23:10 /dev/mmcblk0p14

brw-rw---- 1 root disk 259, 7 Sep 4 23:10 /dev/mmcblk0p15

brw-rw---- 1 root disk 259, 8 Sep 4 23:10 /dev/mmcblk0p16

brw-rw---- 1 root security_fw 259, 9 Sep 4 23:10 /dev/mmcblk0p17

brw-rw---- 1 root disk 179, 2 Sep 4 23:10 /dev/mmcblk0p2

brw-rw---- 1 root disk 179, 3 Sep 4 23:10 /dev/mmcblk0p3

brw-rw---- 1 root disk 179, 4 Sep 4 23:10 /dev/mmcblk0p4

brw-rw---- 1 root disk 179, 5 Sep 4 23:10 /dev/mmcblk0p5

brw-rw---- 1 root disk 179, 6 Sep 4 23:13 /dev/mmcblk0p6

brw-rw---- 1 root disk 179, 7 Sep 4 23:10 /dev/mmcblk0p7

brw-rw---- 1 root disk 259, 0 Sep 4 23:10 /dev/mmcblk0p8

brw-rw---- 1 root disk 259, 1 Sep 4 23:10 /dev/mmcblk0p9

brw-rw---- 1 root disk 179, 24 Sep 4 23:10 /dev/mmcblk0rpmb

Output of cat:

major minor #blocks name

7 0 14208 loop0

7 1 320 loop1

254 0 286320 zram0

179 0 3817472 mmcblk0

179 1 8192 mmcblk0p1

179 2 512 mmcblk0p2

179 3 28160 mmcblk0p3

179 4 20480 mmcblk0p4

179 5 8192 mmcblk0p5

179 6 8192 mmcblk0p6

179 7 4096 mmcblk0p7

259 0 16384 mmcblk0p8

259 1 16384 mmcblk0p9

259 2 8192 mmcblk0p10

259 3 20480 mmcblk0p11

259 4 1024 mmcblk0p12

259 5 194560 mmcblk0p13

259 6 161792 mmcblk0p14

259 7 1977344 mmcblk0p15

259 8 1337344 mmcblk0p16

259 9 256 mmcblk0p17

179 24 512 mmcblk0rpmb

179 16 4096 mmcblk0boot1

179 8 4096 mmcblk0boot0

253 0 1280000 dm-0

I was guessing that a single block on the file system has a size of 1 kB and given the file size of the empty file of 256 kB, I was looking for a partition of 256 blocks and found mmcblk0p17. Also the file permission of /dev/mmcblk0p17 through the ls command shows a different group than the other mmcblk*. So that might give you the right hint when you don't know which partition you have to overwrite with the empty file.

Afterwards I did a restart into "Download mode" to verify that the lock is "OFF". Then I restarted the watch by hand and selected "Download Mode (Wireless)" to put a good firmware on the R600 using NetOdin3 again.

PS:

- At least one URL for the empty file which was mentioned here in a post was working for me in the early days of September 2021.

- there're combination files for about every device out there. you will most likely find yours when you keep searching/looking hard enough.