[Other SmartWatches] intika:
EDIT :

Rooting + TWRP == 100 % :

History, Reading, How to, Hack etc... :

Rooting + TWRP == 75 % :

This device is locked from all the places, and it's very hard to get things done on it... i worked 2 days on hacking it but i still did not succeed, i post my current work...

I estimate the work at 70%~80%

i want to root it in a clean way not the bloby kingroot or so...

What is done ? :

- Full access to system partition

- Rooting system partition (Done but selinux block the access to root)

- Dumping all the device

- Extracting the current rom from the device

- Creating the scatter file

- Changing the boot logo / Changing the boot animation

- Reversing oem fastboot commands

What is remaining ? :

- Disabling/Permissive SeLinux to get root working...

- Unlock the bootloader to get TWRP/Kernel/Seemless.Su... (we need to figure out how to press "volume up" to unlock the bootloader)

Required ? :

- Enable developer mode and usb debugging

- Unlock the bootloader from developer settings ? (does not seems to work)

Go to recovery :

adb reboot recovery

Go to fastboot :

adb reboot bootloader

Go to mediatek vcom mode :

at every boot the device start in vcom mode before switching to normal mode, so to use vcom mode just open SP_Flash_Tool set an action and reboot the device, SP tool will then keep the device in vcom mode for flashing or dumping or so...

Dumping/Extracting the current rom :

Backup :

Use SP_Flash_Tool with the "readback" section "add" every partitions from the scatter file according to their start address and lenth...

1. Click "Readback"

2. Click "Add"

3. Double click the added entry and save the file

4. Select Hex

5. Select Region EMMC_USER or Boot1 or Boot2 (the size of boot1 and 2 on this device are just 0 -> 0x400000

6. Click OK

7. Click "Read back"

8. Connect USB and reboot the device

>>> Warning you can not flash back directly the dumped partition you need to edit them to make them flashable in "download" section

Fashing back the extracted rom :

We have 3 different partition type :

- "SV5_BL_BIN" - Binary partition... to flash back you need to remove the empty section at the end of the extracted partition with hex editor or notepad++ (you need to remove 00 00 00... hex value at the end of the file)

- "NORMAL_ROM" - Binary partition... same as first type

- "EXT4_IMG" - Ext4 raw partition... you need to convert it to img format (ext2simg.exe -v parition_ext4_raw_extracted parition_ext4_raw_extracted_flashable.img)

Scatter file (partition table) :

Took me a while to recreate that file... but its done !!!!

BIG WARNING !!!! if you have an error in SP_Flash while flashing/downloading a partition NEVER NEVER NEVER use format !!!!!

What did i also test :

- Patched Kernel with magisk = bootloop

- Edit Kernel command to set Selinux permissive = boot but selinux still enforcing (tested with edited kernel partition and with fastboot command)

Edit system partition :

- Extract dump your system partition

- Copy the partition to an other rooted android device

- Mount it with the command "busybox mount -o loop path_to_extracted_partition path_to_mount_location"

- Edit the partition as you wish

- "busybox umount path_to_mount_location"

- Copy back the partition to the computer

- ext2simg.exe -v parition_ext4_raw_extracted parition_ext4_raw_extracted_flashable.img

- Flash back with SP Tool

Unlocking the bootloader :

- adb reboot bootloader (to get to fastboot mode)

- fastboot oem unlock

After that on the watch screen we are asked to press volume up to confim the unlocking (but of course we don't have volume buttons)

what i did found is how to press volume down i still did not found volume up

How to press volume down : unmount the device with the 4 screw behind then locate the "kcolo" pin out... just next to it we have an unnamed ping it's GND when you shortcut kcolo and GND it generate a "volume down" action...

Knowing that we could have 2 solutions

- Hack the device to swith fastboot commands from volume up to volume down

- Find out how to press volume up

The partition that contain fastboot is "lk"... (the second one)

Fastboot available oem commands :

fastboot oem p2u

fastboot oem reboot-recovery

fastboot oem append-cmdline (append kernel command line)

fastboot oem off-mode-charge

fastboot oem unlock

fastboot oem lock

fastboot oem key

fastboot oem lks

fastboot oem ap_jtag

unlock_erase ???

Partitions and other infos :

Ship
-----------------------------------------------------------
Ship Name : MT6580
Ship Version : 0x0000ca00
Ext Clock : EXT_26M
Extern Ram Type : DRAM
Extern Ram Size : 0x40000000
SRAM Size : 0x00020000
-----------------------------------------------------------

EMMC Flash
-----------------------------------------------------------
Boot1 Size : 0x400000
Boot2 Size : 0x400000
RPM8 Size : 0x400000
GP1 Size : 0x0
GP2 Size : 0x0
GP3 Size : 0x0
GP4 Size : 0x0
UA Size : 0x1c8000000
-----------------------------------------------------------

Backup Files
-----------------------------------------------------------
ROM_0 - EMMC_BOOT_1 - 0 : 0x400000
ROM_1 - EMMC_BOOT_2 - 0 : 0x400000
ROM_3 - EMMC_USER - 0 : 0x1c8000000
End Paritions : 0x1c7f80000
-----------------------------------------------------------

Rom :

I will upload important partitions of the next post

Links - Tools - Documentations :

1 - http://chrsz.com/product/product_detail/186/196

2 - ANDROID IMG REPACK TOOLS

3 - https://forum.xda-deve…owthread.php?t=2540400

4 - http://networkingathom…ed-phones-from-sp.html

5 - Finow Q1 - Обсуждение

6 - https://download.chainfire.eu/969/SuperSU/

7 - https://forum.xda-deve…-supersu-file-t3238991

8 - https://forum.xda-deve…ve-boot-t3034245/page3

9 - https://stackoverflow.…linux-in-android-5-0-1

10 - https://encrypted.goog…arch?hl=en&q=kcolo+vol

11 - https://forum.xda-deve…lem-unlocking-t3598583

12 - https://www.xda-develo…den-fastboot-commands/

13 - https://forum.xda-deve…art-adb-error-t3582571

14 - https://forum.xda-deve…owthread.php?t=2160490

15 - https://forum.xda-deve…phone-1gb-ram-t3693157

16 - Uwatch U11S - Обсуждение

What is need to be done :

I don't have a lot of time for hacking the device

but we need to figure out how to unlock the bootloader

and how to disable SeLinux to get the root working