[Samsung Galaxy Watch] adfree:
My Plan for today...

It is Delta aka FOTA update related... for investigation/research... :cyclops:

I have only SM-R820... no LTE...

A

Downgrade from CTH8 DBT to BTF3 KOO

B

Use as Standalone... NO Phone...

Because I am toooo stupid to work with Phone... to catch FOTA package... on my not rooted SM-G920F

C

After FOTA file downloaded...

Plan to dump whle 4 GB eMMC. :angel:

Lets go...

Later more. :cyclops:

Best Regards

Edit 1.

Downgrade from CTH8 DBT to BTF3 successfull. :good:

Flashed all 3 files in netOdin...

Will just for fun check if BTF3 update in Standalone... DBT...

Edit 2.

As expected... FOTA update from BTF3 DBT...

Now I will flash my rooted BTF3 files for CSC change...

Edit 3.

Flashed successfully my rooted BTF3 in 2 rounds with netOdin...

Now enemenemu if I should change to KOO or XAR... hmmm... from DBT... hmmmmmmmmmmmmmmmmmmmm...

IMHO good idea to backup all files from CSA folder...

Edit 4.

Backup of all files from CSA partition for later analyse...

D:\SDB\SDB260>sdb root on
Switched to 'root' account mode

D:\SDB\SDB260>sdb pull /csa .\fota
pulled 00000000.authtokcont 100% 152 B
pulled skpm_FACTORY_OCF_ECC_P256 100% 1KB
pulled .mac.info 100% 20 B
pulled .bd_addr 100% 14 B
pulled .local_irk 100% 16 B
pulled sem_data 100% 42 B
pulled sem_sk.dat 100% 2KB
pulled ssp_data 100% 124 B
pulled csc-active-customer.inf 100% 3 B
pulled ecg_ac_test_5hz_zig 100% 17 B
pulled baro_cal_data 100% 1 B
pulled baro1_cal_data 100% 1 B
pulled hrm_eol_data 100% 149 B
pulled hrm_xtalk_data 100% 10 B
pulled ecg_ac_test_5hz_device 100% 11 B
pulled gyro_cal_data 100% 12 B
pulled wpa_supplicant.log.1 100% 256KB
pulled wpa_supplicant.log 100% 241KB
pulled dmesg.log.old 100% 395KB
pulled wd_log.old 100% 265KB
pulled wpa_supplicant.log.0 100% 256KB
pulled hostapd.log 100% 64KB
pulled wifi_mf.log 100% 22KB
pulled dmesg.log 100% 389KB
pulled wd_log 100% 124KB
pulled prodcode.dat 100% 14 B
pulled smsn.dat 100% 27 B
pulled serialno.dat 100% 11 B
pulled 00000000.authtokcont 100% 152 B
pulled battery_full_count 100% 4 B
pulled nad_data 100% 5 B
pulled hwver 100% 8 B
pulled default_bt_state 100% 1 B
pulled dfms_failhist_RDM 100% 43 B
pulled cal_date 100% 10 B
pulled default_wifi_state 100% 1 B
pulled battery_cycle 100% 4 B
pulled production_country 100% 4 B
pulled batt_cable_count 100% 3 B
pulled .nv_created 100% 0 B
pulled .ksb 100% 2 B
pulled mic_only_data 100% 15 B
pulled battery_cisd_data 100% 93 B
pulled dfms_conntest_backup 100% 2 B
pulled wpc_data 100% 5 B
pulled atd.log.old 100% 256KB
pulled hist_nv 100% 0 B
pulled fdata 100% 4 B
pulled .nv_ready 100% 0 B
pulled test_nv 100% 1KB
pulled motor_data 100% 17 B
pulled atd.log 100% 246KB
pulled default_nfc_state 100% 1 B
pulled dfms_failhist 100% 4 B
pulled earjack_count 100% 1 B
pulled echo_data 100% 8 B
pulled .imei_done 100% 1 B
pulled libdevkm.lock 100% 0 B
pulled issued.log 100% 294 B
pulled knox.dat 100% 3KB
pulled dcm.dat 100% 3KB
pulled .reset 100% 1 B
pulled dev_root.dat 100% 2KB
63 file(s) pulled. 0 file(s) skipped.
/csa 403 KB/s (2597847 bytes in 6.280s)

I made subfolder fota... this is why .\fota

Edit 5.

Skipped the pull part... because I have allready on my PC...

Push done:

D:\SDB\SDB260>sdb push csc-active-customer.inf /csa/csc/
pushed csc-active-customer.inf 100% 3 B
1 file(s) pushed. 0 file(s) skipped.
csc-active-customer.inf 0 KB/s (3 bytes in 0.200s)

D:\SDB\SDB260>sdb push prodcode.dat /csa/imei/
pushed prodcode.dat 100% 14 B
1 file(s) pushed. 0 file(s) skipped.
prodcode.dat 0 KB/s (14 bytes in 0.220s)

Now reboot... FUctory Reset... :D

I love to use the way over Recovery... in Reboot menu...

Edit 6.

Uuupsi... FOTA check with rooted Firmware...

But made mistake... now fighting with Korean language to connect SDB... i missed RSA... because stupid me placed into charger... :rolleyes:

Edit 7.

Damn RSA... was forced to reboot to connect again...

IMHO I lost files from tmp folder... :rolleyes:

D:\SDB\SDB260>sdb root on
Switched to 'root' account mode

D:\SDB\SDB260>sdb pull /tmp .\fota
pulled ttrace_tag 100% 8 B
error: failed to copy: '/tmp/keytone' is not a file
skipped: /tmp/keytone -> .\fota/keytone
pulled dbus_launch 100% 5 B
error: failed to copy: '/tmp/.ode_helper_server.socket' is not a file
skipped: /tmp/.ode_helper_server.socket -> .\fota/.ode_helper_server.socket
error: failed to copy: '/tmp/.knoxenrollmentservice-in.socket' is not a file
skipped: /tmp/.knoxenrollmentservice-in.socket -> .\fota/.knoxenrollmentservice-in.socket
error: failed to copy: '/tmp/.nfc-hce.sock' is not a file
skipped: /tmp/.nfc-hce.sock -> .\fota/.nfc-hce.sock
error: failed to copy: '/tmp/.ode_helper_server_secure.socket' is not a file
skipped: /tmp/.ode_helper_server_secure.socket -> .\fota/.ode_helper_server_secure.socket
error: failed to copy: '/tmp/.cert-server.socket' is not a file
skipped: /tmp/.cert-server.socket -> .\fota/.cert-server.socket
error: failed to copy: '/tmp/.central-key-manager-api-ocsp.sock' is not a file
skipped: /tmp/.central-key-manager-api-ocsp.sock -> .\fota/.central-key-manager-api-ocsp.sock
error: failed to copy: '/tmp/.csr-cs.socket' is not a file
skipped: /tmp/.csr-cs.socket -> .\fota/.csr-cs.socket
error: failed to copy: '/tmp/.central-key-manager-api-control.sock' is not a file
skipped: /tmp/.central-key-manager-api-control.sock -> .\fota/.central-key-manager-api-control.sock
error: failed to copy: '/tmp/.central-key-manager-api-storage.sock' is not a file
skipped: /tmp/.central-key-manager-api-storage.sock -> .\fota/.central-key-manager-api-storage.sock
error: failed to copy: '/tmp/.central-key-manager-api-encryption.sock' is not a file
skipped: /tmp/.central-key-manager-api-encryption.sock -> .\fota/.central-key-manager-api-encryption.sock
error: failed to copy: '/tmp/.csr-wp.socket' is not a file
skipped: /tmp/.csr-wp.socket -> .\fota/.csr-wp.socket
error: failed to copy: '/tmp/.device-policy-manager.sock' is not a file
skipped: /tmp/.device-policy-manager.sock -> .\fota/.device-policy-manager.sock
error: failed to copy: '/tmp/.download-provider.sock' is not a file
skipped: /tmp/.download-provider.sock -> .\fota/.download-provider.sock
error: failed to copy: '/tmp/.csr-admin.socket' is not a file
skipped: /tmp/.csr-admin.socket -> .\fota/.csr-admin.socket
pulled sm-cleanup-tmp-flag 100% 0 B
error: failed to copy: '/tmp/sn' is not a file
skipped: /tmp/sn -> .\fota/sn
error: failed to copy: '/tmp/ReactivationlockSocket' is not a file
skipped: /tmp/ReactivationlockSocket -> .\fota/ReactivationlockSocket
pulled .murphyd.pid 100% 4 B
pulled .sdbd.pid 100% 5 B
pulled .mobicore_ready 100% 0 B
pulled .muse-server.pid 100% 4 B
error: failed to copy: '/tmp/.ode.sock' is not a file
skipped: /tmp/.ode.sock -> .\fota/.ode.sock
pulled .muse_core.lock 100% 0 B
error: failed to copy: '/tmp/.muse_server_socket' is not a file
skipped: /tmp/.muse_server_socket -> .\fota/.muse_server_socket
error: failed to copy: '/tmp/.muse_server_data_socket' is not a file
skipped: /tmp/.muse_server_data_socket -> .\fota/.muse_server_data_socket
pulled .muse_server_ready 100% 0 B
pulled sdbd_initial_bt_setup 100% 1 B
error: failed to copy: '/tmp/sdbd_socket' is not a file
skipped: /tmp/sdbd_socket -> .\fota/sdbd_socket
pulled media-server 100% 15 B
error: failed to copy: '/tmp/.msgfw_socket' is not a file
skipped: /tmp/.msgfw_socket -> .\fota/.msgfw_socket
error: failed to copy: '/tmp/.pulse_debug' is not a file
skipped: /tmp/.pulse_debug -> .\fota/.pulse_debug
pulled .pa_ready 100% 0 B
error: failed to copy: '/tmp/.csr-popup.socket' is not a file
skipped: /tmp/.csr-popup.socket -> .\fota/.csr-popup.socket
error: failed to copy: '/tmp/.focus_server.socket' is not a file
skipped: /tmp/.focus_server.socket -> .\fota/.focus_server.socket
pulled .sound_server_ready 100% 0 B
pulled .focus_server_ready 100% 0 B
error: failed to copy: '/tmp/phlock' is not a file
skipped: /tmp/phlock -> .\fota/phlock
pulled .deviceBootCheck 100% 4 B
pulled at-spi-bus-launcher.log 100% 28 B
pulled shealth_pref_accessed 100% 1 B
pulled agent_fw_noti_omadm_fota_u 100% 12 B
error: failed to copy: '/tmp/agent_fw_event_omadm' is not a file
skipped: /tmp/agent_fw_event_omadm -> .\fota/agent_fw_event_omadm
pulled esd_ready 100% 0 B
pulled pressure_event.log 100% 120 B
pulled setting_service_bootup 100% 0 B
error: failed to copy: '/tmp/FOCUS.3604.1.wch' is not a file
skipped: /tmp/FOCUS.3604.1.wch -> .\fota/FOCUS.3604.1.wch
error: failed to copy: '/tmp/FOCUS.3604.1.wchr' is not a file
skipped: /tmp/FOCUS.3604.1.wchr -> .\fota/FOCUS.3604.1.wchr
pulled mm_session_3604 100% 4 B
pulled ip 100% 14 B
pulled proxy 100% 0 B
pulled config 100% 3 B
pulled status 100% 3 B
pulled 0_data-provider-master.2904 100% 52 B
27 file(s) pulled. 29 file(s) skipped.
/tmp 0 KB/s (283 bytes in 1.280s)

BTG1 Delta from BTF3 is on device...

Now I prepare to dump whole 4 GB eMMC.. to simplify the search for Delta...

Edit 8.

Seems to work to dump 4 GB eMMC with dd and netcat... but need 1 or 2 hours for final result over WiFi....

Edit 9.

Saw red ! in Korean...

IMHO still impossible to use heavy WiFi Action and Charger at same time... also on GWA2... :rolleyes:

IMHO battery hot warning... :eek:

Edit 10.

Seems success... need to check with WinHex...

Faster dump as expected... :cowboy:

sh-3.2# dd if=/dev/mmcblk0 | /home/toybox-aarch64 netcat -6 0:0:0:0:0:myIP 1234
7634944+0 records in
7634944+0 records out
3909091328 bytes (3.9 GB) copied, 1184.56 s, 3.3 MB/s