[Other SmartWatches] Delgoth:
This is my first foray into Wear OS. I seem to always end up with some locked down devices. It Always teaches me a thing or two though! Because all is not lost it seems. I've been trying to compile what I can see from the device into one spot. Information on this series of watches is spread out all over the place. Let me explain what I've found out about The MK Access Bradshaw, that makes me think there is a light at the end of the tunnel. If you have experience with these watches or the Fossil Q sister series, please share. Links to the Fossil Q firmware would be amazing at this point.

----------------------------------------------
Michael Kors Access Bradshaw Device Info
----------------------------------------------

MODEL: MKT5006
CHIPSET: SD Wear 2100
RAM: 512 MB
STORAGE: 4 GB
SCREEN: 1.4 inch
RESOLUTION: 320x290 pixels (309 ppi)
WEAR OS: 2.6
BUILD: fossil/gar/gar
8.0.0/OWD6.180205.022/53356216
user/release-keys

----------------------------------------------
1. FASTBOOT MODE
[adb reboot bootloader]
----------------------------------------------

PRODUCT_NAME - gar
VARIANT - PFW2
PHASE - SA
BOOTLOADER VERSION - GAR.EINSTEIN_0.083.00
BASEBAND VERSION - N/A
HW_CONFIG - 1
SERIAL NUMBER - XXXXXXXXX (9 Digits)

** A Direct Pin Connection is Needed
to utilize the Fastboot Protocol.

** Fastboot appears active and functional
and only missing a physical connection

** A Pin Connection can be made.

Now, when we finally make it into the recovery mode, we are presented with standard Android Oreo Recovery options. Including the Recovery Logs. It is in these logs I have found A LOT of Information. They have the Log Daemon configured to 'eng'. But I noticed that simply using the 'adb reboot recovery' command, would start recovery mode but never show the recovery menu before rebooting back to the system.

The recovery menu only ever appears for me when I boot into recovery mode from fastboot mode.

----------------------------------------------
2. RECOVERY MODE
[Boot to Recovery from Bootloader]
----------------------------------------------
* The Recovery Log displays the Recovery FSTAB
* Build.Prop Contents Can also been seen.
* ro.logd.kernel=eng

It is very verbose. But without actual access to the cache partition there is no way to copy & paste, or pull the logs from the watch. My "last_log" entry is from when I updated the device from WearOS 2.2 to version 2.6. In that log, so much of the nitty gritty partition details are revealed, here are a few I've wrote down so far:

/cache/recovery/last_log:
-----------------------------
0 /system ext4 /dev/block/platform/soc/7824900.sdhci/by-name/system 0
1 /cache ext4 /dev/block/platform/soc/7824900.sdhci/by-name/cache 0
2 /data ext4 /dev/block/platform/soc/7824900.sdhci/by-name/userdata -16384
3 /sdcard vfat /dev/block/mmcblk1p1 0
4 /boot emmc /dev/block/platform/soc/7824900.sdhci/by-name/boot 0
5 /recovery emmc /dev/block/platform/soc/7824900.sdhci/by-name/recovery 0
6 /misc emmc /dev/block/platform/soc/7824900.sdhci/by-name/misc 0
7 /oem ext4 /dev/block/platform/soc/7824900.sdhci/by-name/oem 0
8 /tmp ramdisk ramdisk 0

ro.sys.fw.use_trim_settings=true
ro.sys.fw.trim_enable_memory=1073741824
ro.sys.fw.trim_empty_percent=100
ro.sys.fw.trim_cache_percent=100
ro.sys.fw.empty_app_percent=50
ro.sys.umsdirtyratio=20
ro.boot.hardware=gar
ro.boot.baseband=apq
ro.boot.console=null
ro.boot.ceibootmode=0
ro.boot.bootdevice=7824900.sdhci
ro.board.platform=msm8909
ro.build.host=abfarm648
ro.product.cpu.abi=armeabi-v7a
ro.boot.verifiedbootstate=green
ro.boot.authorized_kernel=true
ro.logd.kernel=eng
ro.bootimage.build.date=Thu Aug 9 00:39:05 UTC 2018

[11.364486]Verifying update package...
I:comment is 1476 bytes; signature is 1458 bytes from end.
I:signature (offset: 10127db, length: 5ac):

That log continues on with all of the signature, but on the watch screen it is quite a few pages long. But continues on during the whole verification process. And it really does say in so many words what it is doing and when. The log explains exactly what data it is putting where, and where the developers forgot to set expected values that the system must choose a default for.

What I need to do now is go through the log with an OCR App that can take pictures of the screen and extract the text. I believe the two most recent log files on my watch could explain just how to get at the bootloader & kernel. They definitely tell you where to go find the eFuse. Because even though it has Green Verified Boot Status, the boot log shows a few things for verified boot were never actually implemented. I'm working on getting these logs now.

Enable Developer Options:

Settings > System > About > Tap Build Number until it unlocks.

Connecting to ADB:

1.) Enable Developer Options

2.) Disable Bluetooth

3.) Connect Device to Wi-Fi

4.) Settings > Dev Options > ADB Debugging

5.) Settings > Dev Options > Debug Over Wi-Fi

6.) From a command line, start the adb server and then use this command with the watch's wifi ip address: "adb connect <ip_address>:5555"

7.) Run command "adb devices" and hit the yes button on the watch face to accept the connection.

Replacement 1st Gen Fossil Watch Chargers (2016-2017 Watches):

1.) 1st Party Marc Jacob's MJT0001/MKT0001

2.) 3rd Party Soarking Fossil Charger

Once I find a repair manual or schematic to this thing, I think I'm going to work on creating a cable to connect to the board for fastboot access.

MEMINFO

MemTotal: 455000 kB
MemFree: 8228 kB
MemAvailable: 179528 kB
Buffers: 2216 kB
Cached: 179400 kB
SwapCached: 7136 kB
Active: 153580 kB
Inactive: 154504 kB
Active(anon): 63348 kB
Inactive(anon): 64340 kB
Active(file): 90232 kB
Inactive(file): 90164 kB
Unevictable: 256 kB
Mlocked: 256 kB
SwapTotal: 338936 kB
SwapFree: 222520 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 125548 kB
Mapped: 78400 kB
Shmem: 1216 kB
Slab: 41732 kB
SReclaimable: 13440 kB
SUnreclaim: 28292 kB
KernelStack: 8544 kB
PageTables: 20392 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 566436 kB
Committed_AS: 26409868 kB
VmallocTotal: 499712 kB
VmallocUsed: 95544 kB
VmallocChunk: 291668 kB

MOUNTS

rootfs / rootfs ro,seclabel,size=205932k,nr_inodes=51483 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,size=221356k,nr_inodes=55339,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime,gid=3009,hidepid=2 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,seclabel,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt tmpfs rw,seclabel,relatime,size=221356k,nr_inodes=55339,mode=755,gid=1000 0 0
none /config configfs rw,relatime 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
pstore /sys/fs/pstore pstore rw,seclabel,relatime 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0

/dev/block/platform/soc/7824900.sdhci/by-name/system /system ext4 ro,seclabel,relatime,discard 0 0
/dev/block/platform/soc/7824900.sdhci/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/soc/7824900.sdhci/by-name/persist /persist ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/soc/7824900.sdhci/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/platform/soc/7824900.sdhci/by-name/oem /oem ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/soc/7824900.sdhci/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,errors=panic,data=ordered 0 0
tmpfs /storage tmpfs rw,seclabel,relatime,size=221356k,nr_inodes=55339,mode=755,gid=1000 0 0
/data/media /mnt/runtime/default/emulated sdcardfs rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid 0 0
/data/media /storage/emulated sdcardfs rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6,derive_gid 0 0
/data/media /mnt/runtime/read/emulated sdcardfs rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=23,derive_gid 0 0
/data/media /mnt/runtime/write/emulated sdcardfs rw,nosuid,nodev,noexec,noatime,fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7,derive_gid 0 0

PARTITIONS

major - minor - #blocks name
-------------------------------------
254 - 0 - 262144 zram0
179 - 0 - 3817472 mmcblk0
179 - 1 - 65536 mmcblk0p1
179 - 2 - 512 mmcblk0p2
179 - 3 - 512 mmcblk0p3
179 - 4 - 512 mmcblk0p4
179 - 5 - 512 mmcblk0p5
179 - 6 - 768 mmcblk0p6
179 - 7 - 768 mmcblk0p7
179 - 8 - 1024 mmcblk0p8
179 - 9 - 1536 mmcblk0p9
179 - 10 - 1536 mmcblk0p10
179 - 11 - 1536 mmcblk0p11
179 - 12 - 1 mmcblk0p12
179 - 13 - 1024 mmcblk0p13
179 - 14 - 8 mmcblk0p14
179 - 15 - 10240 mmcblk0p15
179 - 16 - 32 mmcblk0p16
179 - 17 - 16 mmcblk0p17
179 - 18 - 32768 mmcblk0p18
179 - 19 - 32768 mmcblk0p19
179 - 20 - 512 mmcblk0p20
179 - 21 - 1024 mmcblk0p21
179 - 22 - 1024 mmcblk0p22
179 - 23 - 32768 mmcblk0p23
179 - 24 - 32768 mmcblk0p24
179 - 25 - 1024 mmcblk0p25
179 - 26 - 512 mmcblk0p26
179 - 27 - 512 mmcblk0p27
179 - 28 - 16384 mmcblk0p28
179 - 29 - 256 mmcblk0p29
179 - 30 - 256 mmcblk0p30
179 - 31 - 256 mmcblk0p31
259 - 0 - 256 mmcblk0p32
259 - 1 - 65536 mmcblk0p33
259 - 2 - 655360 mmcblk0p34
259 - 3 - 2310127 mmcblk0p35
179 - 32 - 4096 mmcblk0rpmb

DF Utility

Filesystem 1K-blocks Used Available Use% Mounted on
---------------------------------------------------------------------------
rootfs 205932 3460 202472 2% /
tmpfs 221356 532 220824 1% /dev
tmpfs 221356 0 221356 0% /mnt
/dev/block/mmcblk0p34 645056 630224 0 100% /system
/dev/block/mmcblk0p33 60400 1632 57460 3% /cache
/dev/block/mmcblk0p1 65488 22240 43248 34% /firmware
/dev/block/mmcblk0p28 12016 64 11628 1% /oem
/dev/block/mmcblk0p35 2237680 690400 1530896 32% /data
/data/media 2237680 690400 1530896 32% /storage/emulated