[Google Pixel Watch] breaddisease:
Google Pixel Watch Root Guide using Magisk​

Readme​

Note that this rooting process was performed with a special USB-C cradle provided by the Google Team. I would not recommend flashing the device without a stable connection to the pins under the wrist strap. I might attempt to make a 3D printed enclosure that uses pogo pins. Additionally, this process will wipe the device.

New Root Process​

This method was created after I discovered the original no longer worked on the latest version of WearOS 4 around 05/2024. Google seemed to have broken file managers and thus Magisk no longer could pick a boot.img file to patch from the GUI. As such, I go through extracting the Magisk scripts from the APK and use them via the command line to patch the file instead of the GUI.

Enable developer options on the watch by going to Settings > System > About > Versions > Tap Build number until you unlock developer mode

While here, note down the Build Number. It will look like RWD9.XXXXXX.XXX.XX.

Download the appropriate (LTE or Bluetooth/WIFI) firmware at the link below on a computer, making sure to download the version that matches the build number from Step 2.

https://developers.google.com/android/images-watch

Verify the checksum of downloaded firmware using

sha256sum name-of-firmware.zip

Install the latest version of ADB and Fastboot tools on a computer

https://developer.android.com/tools/releases/platform-tools

Go into Developer options on the watch and enable ADB debugging

Connect watch to computer using USB/wireless debugging and allow permanent ADB debugging access on the watch

Verify your access works by running

adb devices

Unzip the downloaded firmware zip, then unzip the image-rXX zip inside the original zip. Then, transfer the boot.img file to the watch using

adb push boot.img /data/local/tmp/

Download the latest version of the Magisk APK from the Github link below and and change it to a .zip file

mv magisk.apk magisk.zip

https://github.com/topjohnwu/Magisk/releases

Push the name-of-magisk.zip file to the watch

adb push magisk.zip /data/local/tmp/

Enter an adb shell

adb shell

Change directories to /data/local/tmp/

cd /data/local/tmp/

Unzip the magisk.zip file

unzip magisk.zip

Copy the shared object files for the correct architecture to the assets folder

mv lib/armeabi-v7a/* assets/

Rename the relevant files so the boot_patch.sh script can find them

mv libmagiskboot.so magiskboot; mv libmagisk32.so magisk32; mv libmagiskinit.so magiskinit; mv libmagiskpolicy.so magiskpolicy; mv libbusybox.so busybox

Make all the files executable

chmod +x *

Push the stock boot.img file of your watch's version to the watch

adb push boot.img /data/local/tmp/assets/

Run the boot_patch.sh script with the boot.img

./boot_patch.sh boot.img

Pull the patched boot.img to your computer

adb pull /data/local/tmp/assets/new-boot.img .

Reboot the watch into the bootloader

adb reboot bootloader

Verify the device shows up by using

fastboot devices

If your bootloader isn't unlocked yet, unlock the bootloader of the watch using

fastboot flashing unlock

Confirm the message on the watch to unlock and wipe the device

Flash the boot image using fastboot

fastboot flash boot new-boot.img

Start the watch from the fastboot menu

Once booted, reinstall the Magisk app if you wiped your device

adb install name-of-magisk.apk

To prevent the broken Superuser request popup where the grant button is off the screen, open the Magisk app, go to settings, and scroll down to Automatic Response. Change the setting from "Prompt" to "Grant" by swiping up.

Then, verify you have root by running su in an adb shell

su

​

Spoiler content hidden.

​

Bypassing SafetyNet​

Download the YASNAC - SafetyNet Checker APK from GitHub:

https://github.com/RikkaW/YASNAC/releases

Install it on the watch using

adb install name-of-yasnac.apk

(Optional) Open the app and run the SafetyNet Attestation to verify your device fails

Download the SafetyNet Fix Magisk module from GitHub:

GitHub - Displax/safetynet-fix: SafetyNet & Play Integrity API workarounds for Magisk

SafetyNet & Play Integrity API workarounds for Magisk - Displax/safetynet-fix

github.com

Transfer it to watch using

adb push safetynet-fix-v2.4.0.zip /sdcard/Download

Start an adb shell with the watch using

adb shell

Elevate to root privileges with

su

Install the module with

magisk --install-module /sdcard/Download/safetynet-fix-v2.4.0.zip

Once installed, restart your watch

Now, run YASNAC SafetyNet Attestation again, and you should pass!

Interfacing with the USB Pins​

The USB pins are under the watch band closest to the secondary button. From left to right, the pins are voltage, data+, data-, and ground. Google's VRP program provides the watch cradles by invitation only. As such, a DIY solution needs to be created to make this process more accessible.

View attachment 5933267

Picture courtesy of @ShinyQuagsire​

The pins have a 1.27mm spacing which you can find headers for online. That in combination with some helping hands and a USB breakout board could give a connection.

Troubleshooting​

If booting the Magisk image results in a bootloop, you can unbrick the device by flashing the corresponding stock boot.img image using

adb flash boot boot.image

If Magisk doesn't see the file, try doing the following to your file browser app:

Settings > Apps & Notifications > App permissions > Files and media > AppName > Allow all the time

Tips​

You can get into FastBoot mode by tapping on the top left and bottom right of the screen at the same time as the device is booting when the white "G" logo appears.

Wireless debugging allows you to do almost all of this guide except booting the patched boot.img file in Magisk. To enable wireless debugging, go to Settings > Developer options > Check Debug over Wi-Fi. Then, in developer options still, go to Wireless debugging and turn it on. From here, you can connect to your watch remotely from your PC using

adb connect watchip

Thanks​

Shoutout to the OGs who first obtained root! Thanks to Tiebe and ShinyQuagsire for their help! You can find the info in this thread:

https://xdaforums.com/t/pixel-watch-successfully-bootloader-unlocked.4508253/

Huge thanks to Asmita Jha (Twitter @aj_0x00) who was there during the first 2 days of the rooting attempts and helped troubleshoot throughout. Additionally, big thanks to Stack Smashing (Twitter @ghidraninja) for giving us the idea to patch the Magisk file on the watch itself, instead of patching the boot image on another device running Magisk. Additionally, thanks to the Google team who gave us access to device and the prototype cradles to interface with the watch reliably. They've now sent me my cradle as well!

Future Plans​

To make the process more accessible, a cheap interfacing solution needs to be created. Please reach out if have any questions, concerns, or information that would make the process easier. You can find me on Twitter @breaddisease

https://twitter.com/breaddisease

Thanks!