yashsingh1/xdaforums huggingface dataset:
[Other SmartWatches] gh0stza:
Take matters into your own hands mate.

That's what XDA is all about - people making things better and then sharing their success with the community

Use your off time to research launchers for small screens.

And if you're feeling especially adventurous try finding an open-source launcher and modify it to your liking.

If you find a good one...I can guarantee I will help you adapt it to our watches.... That's my idea anyway

Read the whole thing - a lot of the stuff we discussed here is also discussed there. Still the same old problem keeps sticking it's head out - bootloader unlocking.

And something that keeps bothering me is: people with those watches keep running adb commands (pm uninstall --user 0 com.xxxx.xxx) - if I'm not mistaken user 0 on android is root (or is it 1000? ... if I'm wrong - please correct me). So if it is root then that command shouldn't work.
[Other SmartWatches] benjibetanzorossel:
As I remember, that command does not require root
[Other SmartWatches] gh0stza:
Have you guys tried L-Launcher yet?

https://www.xda-developers.com/l-launcher-non-wear-os-smartwatches/

fullandroidwatch.org support thread: https://fullandroidwatch.org/t/l-launcher-support-thread/50029/596

I've emailed the developer regarding sharing the source and giving permission to add it in my ROM but he hasn't answered yet. I don't think he wants to share the source-code.

I have no idea if it's even worth it. If anyone tests it, please let me know how it is.
[Other SmartWatches] Xyberdude:
Yeah I have tested it, decent enough tho lacks customization features
[Other SmartWatches] gh0stza:
So it would have been worth it if the developer was willing to make it open-source. Or just at the very least share the source.

Pity...

I'm never gonna hear from him.

From the fullandroidwatch.org support thread: "Project source codes are private and will not be published."
[Other SmartWatches] Xyberdude:
Oof, did you receive your watch yet? And btw which one did you ordered?
[Other SmartWatches] gh0stza:
Nope, hasn't even left china yet. :cry:

It's one of the newer one's - not to say that it's new technology :ROFLMAO:

(Like that guy on the other thread that calls it e-waste :whistle: - not everyone has the money to buy an apple/samsung watch)

Servo KOM9

Note: It looks identical to the VP600 - I think it's just a newer revision
[Other SmartWatches] Xyberdude:
I see it looks good, since it's round watch so u can also use universal launcher which has thousands of watchfaces available for round watches but I don't think that's gonna be the case lol we're gonna be on a quest to make these watches have a better firmware. For now I just need root on my watch but I don't think those king root etc apps would work. I remember once trying they didn't seemed to work.
[Other SmartWatches] gh0stza:
Yeah it's a risky endeavour trying those. They could release more malware then whats on the chinese stock roms. However, using them has one big reason ... if it works then it means there is a vulnerability somewhere that works on something that's on that watch. It could be the kernel or an android exploit. SO if it works then you KNOW there is an exploit - you just have to find out which CVE it is.

Ofc the best and safest is to just unlock your bootloader. But if that's not an option then the exploit way may be your only option. That or selling the watch as second hand and getting another one.
[Other SmartWatches] gh0stza:
If I can find a launcher that does what I need it to do and I'm satisfied that it's malware free and doesn't kill the battery I'm open to using it but I have no idea what the licensing would look like though. Would I be allowed to use it in my ROM? Would I need permission from the developer or what?
[Other SmartWatches] Xyberdude:
Yeah could be risky but honestly thee main reason I want root is to change my watchfaces since my smart watch launcher has so many built in watchfaces but don't load em that's why I want to modify the installed launcher and only use those watchfaces which I want and load them....
[Other SmartWatches] Xyberdude:
Altho sad to see that those exploits for rooting don't seem to be developed anymore
[Other SmartWatches] Xyberdude:
And I can 100% guarantee you their are many vulnerabilities in the system cuz even Google pixel and samsung latest flagship phones have in them (Dirty Pipe Exploit)
[Other SmartWatches] Xyberdude:
Mtk root doesn't work yall so don't try it, I need few people including me who will try diff root exploits in these watches I can't do it alone
[Other SmartWatches] gh0stza:
Dirty Pipe was patched in 2016 (or something). Did a whole thing with dirty pipe trying to root my LG G6. As well as dirty cow.

There is prob a few exploits but we live in a new world where zero day exploits are only used by government agencies as backdoors. I sound like a conspiracy nut but just look at pegasus.

You're right exploits aren't being developed anymore but I think that's only because people realized that selling exploits is much more profitable then helping the community.

If you really want to pursue a root exploit like that - a zero day exploit. I'd start with the stock system apps on the watches. When going after a zero day exploit you generally target the weakest link in the system, and that's prob gonna be some app developed by a chinese dev. Main goal when developing those apps is time - they generally don't code for security but code to get a working version asap. And then when they finish it, it's almost always the final version - they never update it unless it's a semi-respectible company like lzakmr.

I'm almost tempted to to help you just for the love of game. But, trying to find a zero-day exploit is very time consuming and you might not even find anything. And most of the time they are discovered completely by accident by researchers just probing buffer overflows etc.

If you're just talking known exploits - then just go through all of the root software like kingroot. they don't really update it anymore but most of the known working CVE's are in their scripts so if they don't work then you're going to have to go down the zero-day exploit route.
[Other SmartWatches] gh0stza:
Also if I were to commit the time to an exploit - I'd commit to rooting my LG G6: there is a vulneribility in their keyboard app and if you down-grade to Android7 that version is exposed.

I theorized that, that keyboard exploit could be used to get root on the G6 but never commited to coding the exploit.
[Other SmartWatches] gh0stza:
Here is the UniSoc page for the 9832e and 9863a SoC's

https://www.unisoc.com/en_us/home/TZNSJ-9832E-9-0
[Other SmartWatches] Xyberdude:
But I'm rlly certain lol that king root etc needed accessibility perms too tho
[Other SmartWatches] gh0stza:
Is that a problem?

I mean except for the obvious reason regarding accessibility permission.
[Other SmartWatches] Xyberdude:
Yeah since it gets stuck on getting root so we give it some perms to make it work I used vpn but didn't work was stuck at getting root I tried one click root king root kingoroot frama root root and Towel Iroot they all failed
[Other SmartWatches] gh0stza:
King-o-root and one click root pulls scripts off of their servers at random ( as far as I can tell ). so trying multiple times sometimes gets different scripts ( at least that's what they say on their site - I have no idea how the devs thought that was a good idea )
[Other SmartWatches] Xyberdude:
Seems cap prob or maybe not
[Other SmartWatches] gh0stza:
Well then if you still want to search some more for exploits then what you're gonna have to do is:

Start searching for CVE's and comparing that to stuff on the watch.

So check what kernel version is running and check what CVE's there are for that kernel. If you find something you can first search github to check if someone else has coded an exploit for that CVE. If there is a github project you can try it, modify it and try it and if it doesn't work you could start coding your own.

But without a pretty good background in cracking you're gonna have a hard time coding your own, as exploits are usually REALLY complicated and just because there is a CVE for that exact exploit doesn't mean they explain the exploit in detail. They usually just list the exploit and then give exact details to the people that's supposed to patch it (obviously for security reasons).

It's a good learning experience but just know the chances of you being successful at finding an exploit and then successfully deploying that exploit to root a device is slim (at best).

And not to discourage you at all but even if you do find an exploit, deploy the exploit and gain root (temp-root). You still have to find a way to make it permanent and deploy a root manager like SuperSU. And you have to do all that and not trigger the avb.

Honestly I'd say my project is less ambitious :ROFLMAO:.

But hell dude please go for it, don't listen to me
[Other SmartWatches] Xyberdude:
Eh honestly I'll see if I can lol otherwise I'll just go with the stock launchers. All I need is good watchfaces that's all which i do have in my watch but yk trash launcher doesn't loads all watch faces haha but the problem is time is rlly against me I have one of my most imp exams next month and I am busy currently but will be more busy as time passes. But for now the worst issue that I'm having is that my watch (after exactly 1 ringtone) picks up the call 💀💀💀 too scary man I went in my watch settings app and it said auto answer is off and also auto answer in eng mode is off too maybe the best I can do is re insert sim or maybe factory reset (but hell lot of my data gonna be erased if I do so, gonna be a pain in ass)
[Other SmartWatches] Xyberdude:
I'll just factory reset now
[Other SmartWatches] Xyberdude:
Damn even after factory reset auto pickup call won't resolve
[Other SmartWatches] gh0stza:
Just be patient.

Gimme a while to play with my unisoc watch. Maybe in a few months we can unlock it and get root properly or maybe I will even do my ROM thing.

Let's wait and see where this goes.
[Other SmartWatches] gh0stza:
I didn't really get a ton of support from the community for the custom rom thing but, I mainly want to do the ROM thing because I want to trust my smart watch 100%.

and before someone jumps in here and yells at me: "JUST GET A SAMSUNG GALAXY WATCH"....

I don't even trust samsung with my smartwatch (or even my phone - that's why all my devices are rooted and heavily firewalled)

So as long as I don't have to commit 2 years to the ROM or run into an un-overcomable obstacle my ROM is going to happen.
[Other SmartWatches] Xyberdude:
I see well will see you after 2 months once my exams start and finish
[Other SmartWatches] Mozhuyi🍥:
I am a Chinese user and successfully root the DW98/JC02 watch

The most important point is keep the Android VBMETA defined partitions(system,boot,recovery and other partitions in vbmeta.img) signature is consistent with vbmeta.img

Long press Power button and Whell button in poweroff status to enter Spreadtrum Download Mode(Just like the Qualcomm 9008 QDL Mode) Windows Device Manager will shows a COM port device “SPRD U2S DIAG”

In this mode, Bootloader Lock cannot stop you do everything, you can use “TFT Unlocktool” to readback boot.img and patch it, then use Android AVBTool to resign all these partitions with your customed vbmeta.img and flash them back
[Other SmartWatches] Xyberdude:
How did you unlock dev options?
[Other SmartWatches] Xyberdude:
Like do we need to enable dev options for this to turn on USB debug and bootloader unlock option or I can just turn USB debug on from engineering mode. Also one more thing did you try to install custom rom in it. I would try to root mines too but I sadly don't have magnetic cable to connect with pc
[Other SmartWatches] Mozhuyi🍥:
We do not need unlock Development Options, OEM Unlock, ADB Debug or Bootloader

All operations are completed in Spreadtrum Download Mode, bootloader or system cannot stop you do everything in this mode.
[Other SmartWatches] Xyberdude:
Well I just wanna test if my watch has speadtrum download mode and if it does I will order a cable for my smart watch and root it. So again, I have to hold both smart watch buttons for how long while it's turned off
[Other SmartWatches] Mozhuyi🍥:
You do not need to unlock Bootloader, readback or flash partitions can use TFT Unlocktool in Spreadtrum Download Mode

The Android Verified Boot only rely on vbmeta partition, solve this point and you will succeed
[Other SmartWatches] Xyberdude:
How long I need to press wheel and power button to enter download mode and how will I know I entered download mode
[Other SmartWatches] Mozhuyi🍥:
About 3s and device keep blackscreen ,device not show logo boot into the system immediately.
[Other SmartWatches] Xyberdude:
When I press both buttons nothing happens no light green light comes on it just restarts after a while maybe it does work but well I don't have cable does the cable that comes with smart watch work when connected to pc? I once tried but it doesn't get detected on PC. I can't test without having 4 pin magnetic cable
[Other SmartWatches] Mozhuyi🍥:
It's normal that the new model won't turn on the lights and the 2pin magnetic of course cannot transmit data, Windows Device Manager not show the COM port device either
[Other SmartWatches] Xyberdude:
I see well I'll have to order another ones but I have mi watch too with magnetic charger maybe it can work with pc, I'll try if it doesn't I'll just oder the cable
[Other SmartWatches] Xyberdude:
Well also you should try getting custom rom on the watch and be sure to let us know that would you succeed in it or not
[Other SmartWatches] gh0stza:
No he means you enter EDL mode by pressing the power button and the wheel button with device off. I think he means that's the mode you need to have the watch in for TFT Unlock tool to function.

That is really good. Thank you so much I will def try that. It sounds like it might just work. But will it only work with default private keys? or do you somehow sign the partitions with the vbmeta.img?

Or where do I find the customized vbmeta? Can you explain to me in a bit more detail about the avbtool usage please.
[Other SmartWatches] gh0stza:
The one I bought also only have the 2 pin. My plan is to take an old broken usb cable and connect the power + and - to the correct pins and just connect the other two wires to the remaining 2 wires of the USB cable. One has to be Rx and the other Tx. 50% chance and won't break anything if I get it wrong the first time. Because I can;t find that magnetic cable for the round pins on the inside of the watch. I can only find the 2 pin cable.
[Other SmartWatches] Mozhuyi🍥:
Wheel Button — USB D+ — USB 5V-

Power Button — USB D- — USB 5V+

(for DW88/DW89/X8/CDS9/S26/DW98/JC02)
[Other SmartWatches] gh0stza:
See mine is different.
[Other SmartWatches] Xyberdude:
Yeah that I understood he was talking about the download mode which is like EDL/BROM in Qualcomm I'm just saying that I wish I had the 4 pin cable rn to test it out but I don't
[Other SmartWatches] Xyberdude:
I can't rlly seem to find the data cable for my smart watch is it somehow possible for me to connect it with my pc wirelessly but I don't think that would work since it won't receive a connection when I prob enter download mode
[Other SmartWatches] Xyberdude:
Seems like a good idea for me too but u hope doing it so won't break our smart watches battery lol
[Other SmartWatches] Lorenz1969:
Hi Mozhuyi🍥 the point is which version of TFT Unlocker did you use, I tried with two watches HK One Ultra and X8 Ultra and TFT Unlocker 3.1.1.2 but it doesn't work, you need to know exactly which version of the software you used to have a starting point of tft unlocker in internet is full
[Other SmartWatches] Xyberdude:
What happens with you when you connect watch with the pc while in download mode? I don't receive the port on ur pc?
[Other SmartWatches] Lorenz1969:
What watch do you have? did you modify the cable so that the 4 pins are connected? can you connect via Adb?
[Other SmartWatches] Xyberdude:
I have TK6 ultra and no I didn't try it yet since I don't have the cable but I'm just asking from u that u don't receive the port on ur pc when u go to download mode on ur watch?
[Other SmartWatches] Lorenz1969:
I see the port as I see it, to go into download mode just do adb reboot bootloader
[Other SmartWatches] gh0stza:
No no, remember I just take a multimeter and check the default pins for positive and negative. Then I have the correct 5V pins. Then I just need the Rx and the Tx. And reversing them shouldn't break anything.

And IF I were to worry about breaking anything I'd worry about breaking my development pc, not that cheap watch :rolleyes:

:eek:. But alas that shouldn't happen
[Other SmartWatches] Xyberdude:
I see well good luck
[Other SmartWatches] Xyberdude:
Wdym
[Other SmartWatches] gh0stza:
He's talking about another way to go into download mode. However I'm not sure if it's the same mode as that user @Mozhuyi🍥 describes.

Lorenz turns on debugging mode and then issues the

adb reboot bootloader

command.

That usually results in the device going to download mode. EDL is something entirely different - it's an emergency mode that isn't impacted by any eMMC partition.

It's usually only accessable by test-points.
[Other SmartWatches] Xyberdude:
Ah yeah, I figured out @Mozhuyi🍥 uses adb to go into bootloader and that's not correct. You have to go to EDL mode that is a separate mode, an emergency download mode completely different from bootloader, and according to me Qualcomm devices seem to have different way to flash a rom or Atleast these watches. You have to fully power off your device, and then hold both wheel and power buttons on your watch for a few seconds. Then connect to your PC.
[Other SmartWatches] gh0stza:
That's how I understood @Mozhuyi🍥 too.

Question is ... : does it work? and does it work on all devices or does it differ greatly across unisoc devices?

And sometimes the EDL mode is also dependant on an active data connection - so it has to be plugged into a device with Rx and Tx active (a PC for instance).

Note: my watch should be landing in my country any hour now.
[Other SmartWatches] gh0stza:
@Mozhuyi🍥

Thank you very much for sharing how you rooted your device.

But could you please share the TFT Unlock Tool you used

And explain how you signed the boot partition after you said you patched it with magisk.

If you could create an entire [ROOT][GUIDE] For UniSoc device (or for that specific model you used) that would be even better.
[Other SmartWatches] Xyberdude:
@gh0stza forgot to ask which smart watch did you order?
[Other SmartWatches] Xyberdude:
Nevermind found ut
[Other SmartWatches] gh0stza:
You did ask and I answered...
[Other SmartWatches] Xyberdude:
Yeah just scrolled up couldn't find it but eventually found it
[Other SmartWatches] gh0stza:
Here is a guide I found on hovatek regarding the signing of the images requested from user @Mozhuyi🍥 .

I'm sure he followed the same guide. I will also be using this tutorial as a reference in my research.

And as we were speculating earlier... it seems the bootloader unlock private key IS indeed the same private (default) key used by Spreadtrum/UniSoc to sign the partitions.

Now I just pray my watch uses the default keys, else I'm screwed because getting any information out of the AliExpress seller is proving futile.

https://www.hovatek.com/forum/thread-32674.html
[Other SmartWatches] tancreded:
just on the off chance this helps, while fooling around with 'ex explorer' from the playstore i came across these files, which appear to show some info on the device tree, and also that my device appears to have USB debugging enabled, which, if true, i must have done via engineer mode !

my device is a HK one ultra, with a 4 pin spherical charging cradle, of which, only the power points work, it's a lovely watch but like 'xyberdude' i'm most frustrated at not being able to load new faces, i've tried other launchers i've been able to extract from various firmware's to no joy, and while the universal launcher does boot up, and works for adding faces, it's buggy

so at the mo my thoughts are to extract the launcher on my watch and see if i can reverse engineer it, unfortunately, every time i try to use an 'apk extractor' app, my file manager app crash's, frustrating or what ! anyway, IF you ever get yours, (mine came in 6 days), and can make your launcher available that would be great
[Other SmartWatches] Xyberdude:
Yeah man that's the problem, we can't modify these launchers if we don't have root, and even if we extract the launcher, and modify the stock launcher as different package and reinstall, it says app not installed, possibly there is some kind of security on these launchers. They don't even work "without modifications" if extracted from another watch.
[Other SmartWatches] tancreded:
i guess i'm just trying to get a launcher which i think by default ought to run, i.e. one used for the same android version and the same cpu, if it does run then it's a candidate for reverse engineering in my book, and before i spend the rest of my life learning to code, i'd just like to bottom that step first, and of course, given how light the firmware appears to be, i'm hoping that means the launcher will be light on code as well, because the one i've seen on the 'android developers' site is horrendous

i also think the UI on the launcher i have, which is also similar to the one on the new zeblaze thor ultra, is pretty great compared to any other launcher i've used on these full android watch's, so hopefully most of these unisoc watch launchers will be similar, and won't require much reverse engineering anyway
[Other SmartWatches] Xyberdude:
Yeah universal launcher is good but I don't really like it
[Other SmartWatches] gh0stza:
Will do, mine has now checked in with customs but unfortunately my countries customs are slow as hell. Expect 1-2 more weeks.

Well I haven't received mine yet so I'm eager to see how well my launcher performs.

Listening to you guys I can tell the launcher is the weak link on these generic chinese watches.

And I can c why you guys are complaining about it. It looks like launchers for these screensizes are scarce and the ones that are available are 'incomplete', unpolished or just given-up-on alpha's (or beta's).

So I think I might make finding/coding a launcher top-priority while I test the stock ROM ( just for review purposes and 'good science is good observation' and before I try rooting the watch). Of course that's a huge undertaking and going at it alone will take months.

If I could just work with LineR who coded L-Launcher, things would go way smoother. But, he hasn't answered me and I don't expect I will hear from him. :cry:
[Other SmartWatches] 672899312:
Hello everyone,i met a problem on software.I can't join in the unlocktool forums,if someone get the same problem or not,please help me port this bug.

我unlocktool论坛不知道咋发帖，验证邮箱收不到，能劳驾大佬帮我问问软件闪退的问题吗…spread 9832e(8541e) dw98_android 8.1,software suddenly crushed and closed,when do anything leading to "reading device".version 2024.03.01,the ui became dead can't click anywhere,and the window disappeared in a second.This caused me couldn't unbrick the android watch.Else anyone can run it in debug or catch the log?I am the noob dont know hou to do
[Other SmartWatches] Lorenz1969:
I managed with infinity box to unlock the bootloader in hk one (I modified the charging base), using magisk I modified the boot.img of the firmware (infinity box allows you to save the fmw) but using 'fastboot flash boot boot.img' it doesn't work what can I do now to get root?
[Other SmartWatches] Mozhuyi🍥:
Unisoc Platform always force enabled Secure Boot and cannot disable

Secure Boot will check these partitions signature is consistent : vbmeta,boot,recovery

You must use AVBTool to resign them and flash resigned partitions again
[Other SmartWatches] Xyberdude:
Dude @Mozhuyi🍥 if you mind creating a whole guide for everyone on xda for this, that will be very much appreciated by us and the community and you will also be well recognized.

Regards,
[Other SmartWatches] Lorenz1969:
OK can you provide us with help to do this or where to find it