[Other SmartWatches] quackgoesduck:
I'm trying to get the Ticwatch Pro 4g Verizon (WF11026V) working on a non-Verizon carrier. From other threads, it seems that by faking the SIM of the phone to the officially supported carrier, it's possible to scan an eSIM QR code and it typically works - or at least for the EU versions. I've had no such luck on the Verizon one. Does anyone know more? And does anyone have a EU modem firmware image they can share, in case that is the main difference? (and maybe also modemst1 - though note that this probably includes your IMEI config)

Random technical notes below, which might be useful for people trying similar things:

Janjan's EU ROM (at least the December version) flashes fine on the US version. Without an active Verizon subscription I can't test if the wireless works. Interestingly, Janjan's US ROM just bootloops on the US watch. I did not flash aboot (which contains the fastboot bootloader) out of an abundance of caution, but it seems everything still works with stock aboot.

On the EU versions, there's TicEsimFix, which uses Xposed to change the CarrierId to 28 (Vodafone UK). For those wondering how it works - although sadly it's not open-source (or at least the source isn't easy to find) - it seems to use Xposed's findAndHookMethod to replace the result of TelephonyManager.getSimCarrierId with 28.

This has no effect on the Verizon watch, either in the Mobvoi app or the WearOS app, and either using id=28 or with a Verizon MVNO SIM that reports id=1839 (Verizon). In fact, the WearOS debug logs suggest that the watch is not eSIM capable - 'no eSIM devices found'.

It also appears EU versions have an eSIM assistant app on the watch that doesn't appear on the US version - but even though it's running an EU ROM that isn't showing up. So what if we made it think it was an EU watch? The main differentiator seemed to be in the model number, and it turns out if you change the model to the EU one (WF11018) in the /oem partition, that app shows up after a factory reset. (note - you'll have to remount oem as rw, by default it's mounted as ro - IF YOU TRY THIS MAKE SURE TO BACK UP YOUR PARTITIONS - you can directly adb pull partition images from /dev/block/by-name if in TWRP, it's more complicated from WearOS since adb does not have root permissions)

For the curious, changing props ro.boot.hardware.sku and ro.oem.tw.cmodel (through MagiskHidePropsConf) do not seem to be effective

But launching the app causes it immediately crash. ADB logcat shows this:

Spoiler content hidden.

The Mobvoi app also allows "Scan QR code", but the watch just says "Download Fail". ADB logcat shows this:

Spoiler content hidden.

This would suggest that it is able to communicate with the eSIM, but it's getting an invalid response. So the possibilities I can think of are:

1) There's some firmware issue between the app and the eSIM that is causing issues. Perhaps the modem firmware is blocking something - so I'm interested in acquiring an EU modem firmware and trying to flash it. This would be weird in that it's not blocking communication with the SIM completely, but blocking certain functionality.

2) The Verizon watch has a different eSIM chip (or different hardware in general), and it's not possible to use it with a different carrier without hardware mods like soldering in a new eSIM. Could the eSIM just mean a non-rewritable SIM that's just embedded onto the board?

3) The eSIM is somehow locked (is this even a thing? - can it be unlocked and reset? - especially if we have root we can probably send arbitrary commands to the eSIM). The logs above suggest every APDU command - even benign ones like get profiles and EID - is returning 6985, which apparently is an error code.

Any ideas?