yashsingh1/xdaforums huggingface dataset:
[Other SmartWatches] gh0stza:
Interesting point to note: Some of our devices won't unlock bootloader (mine included) because it just hangs on the

fastboot flashing unlock_bootloader xxx.bin

command.

I was convinced that it was because it recursively tried the unlock rsa key and fails - thus custom private key.

But, maybe it's because the manufacturers was too lazy to code screen drivers for that prompt and now we just need to press vol+ to unlock the bootloader. And we can't press it cuz we technically don't have vol+ button - like you.
[Other SmartWatches] mhd 12:
already sent it to you check dm
[Other SmartWatches] mhd 12:
while taking a look on the firmware dump , i see that vbmeta and many other partition have a backup partition
[Other SmartWatches] Xyberdude:
@gh0stza we got another guy @mhd 12 to root his smart watch. Please consider posting the details of your process.
[Other SmartWatches] gh0stza:
Well I failed. That hardly justifies a guide thread. What I can do is make a short post on this thread of what i did but it's basically just the guide on hovatek. Minimal deviation except for trying to make it work beyond the hovatek guides.

All of which btw I linked on thus thread
[Other SmartWatches] Xyberdude:
Yeah, the method he used was "backed up the firmware using unlock tool in case anything happens ,

extracted boot img , patched it using magisk , then signed it using the vbmeta , and reflashed it with the new vbmeta signed file and boot file"
[Other SmartWatches] gh0stza:
Yes but that still assumes a default private key. Otherwise you don't have the private keys to sign the partitions anyway. Only benefit that way is that it's a trusted partition so you don't gave to unlock the boitloader. Unless you can sign the partitions with your own key somehow.

Regardless I have a brick now so I can't even try that. I ABSOLUTELY need that firmware .pac file. Without it I highly doubt my device will ever be functional again.
[Other SmartWatches] Xyberdude:
Didn't you backed up your firmware before? Also your smart watch does seem a bit diff than ours especially it's circle faced and the firmware itself seems a bit diff. Mines and his are very much identical so it might work for me but I just need to get the cable somehow
[Other SmartWatches] mhd 12:
you can get all the private keys from vbmeta , i pasted a program on the telegram group that extract the keys to sign partitions from vbmeta and sign any partition with it take a look there, for the firmware u can contact zeblaze service for their watch firmware since it's the same hardware , they answer fast actually since i contacted them before at least u can get something out of it
[Other SmartWatches] mhd 12:
tell me how did u brick it may be i can help ?
[Other SmartWatches] gh0stza:
Check my earlier posts.... It's all there
[Other SmartWatches] gh0stza:
I'll try to contact zeblaze for their firmware but I actually doubt their firmware will work. The screen isn't working on any other firmware, so my watch has a completely diff screen - 466x466.

I'd love to try it, but I'm dubious whether you can extract private keys from vbmeta ... If it was that easy none of us would ever have to unlock our bootloader. We'd just extract the keys and sign our custom LineageOS (or whateva).

But I am a noob at using AVBTool, so please bring it on lets see what can be done.

And don't forget about the fact that my watch has spoofed partitions - it;s a 16GB but the original partition reported 64GB.
[Other SmartWatches] gh0stza:
Again, all of it is in earier posts but, short recap:

I was making a firmware dump with researchtool and needed FDL1 and FDL2.

The FDL files can be extracted from a stock .pac file but I didn't have that so I took a chance on the closest .pac firmware I could find and used those FDL files.

Because the internal storage is faked to look like 64GB and I think the FDL files act like Unisoc's version of a scatter file - I think the eMMC offsets during the dump was incorrect which resulted in a corrupt dump.

And because SPD does it by flashing the new FDL files I think that also broke the stock firmware.

Long story short - I ABSOLUTELY NEED my watch's original firmware otherwise I doubt any other firmware will work.
[Other SmartWatches] Xyberdude:
Mines are spoofed too 64GB reported, 16GB in reality. P.s I found that my watch supports GSI, it's treble supported.
[Other SmartWatches] gh0stza:
That's awesome but it doesn't change my fundamental problem. I can't do anything unless I can unlock the bootloader (or if your resigning works).

What CPU is that watch? I didn't know Project Treble supported Unisoc chips 🤯
[Other SmartWatches] Xyberdude:
Ikr I never thought the same too, it's a Spreadtrum SC9832e also, I just found that some budget phones, made by companies like itel use this CPU in their phone. The phone is a rlly big screen, and the CPU works just fine, so it gotta be a beast in a small screen. Like one example is itel vision 1 pro. It runs android 10 Go edition.
[Other SmartWatches] mhd 12:
i hope ur partition table is not corrupt , well if the partition table is okey there is a chance u save the watch , try unlocktool to extract the firmware the way it is through spd diag , if the partition table is not broke at least u get the vbmeta file so u can sign what ever boot , system , recovery... also noticed when extracting the rom spd watchs have a backup of most sensitive partitions on the watch encluding vbmeta u still can save the watch to sign the files of the new firmware with the vbmeta use the tool i pasted in telegram group
[Other SmartWatches] gh0stza:
Man then share that TFT Unlocktool!!!!

I have been asking something like 7 times over the course of this thread.
[Other SmartWatches] gh0stza:
Oh and I have a vbmeta.img. Haven't run it through AVBTool so I dunno if the integrity is good or not but I have it. Tell me how to sign it and I'll check if I can make it happen

And I'm pretty confident my partition table is fine. It boots into several ROMs just without screen. I can tell it's booted because it recognizes in windows as "H10" MTP device (depending on the ROM)
[Other SmartWatches] Xyberdude:
Bro link stuff here not everyone has telegram and directing people to third party services like these isn't allowed on XDA as well
[Other SmartWatches] gh0stza:
And ofc that means I don't have my stock ROM on the watch anymore. Just the dumps I made - made 2 so I have 2 copies of each of the partitions
[Other SmartWatches] mhd 12:
the problem is that u can't post other people work on xda and even links :/ that's whay telegram is better , since everyone there share what they have
[Other SmartWatches] Xyberdude:
Links are allowed if they do not require some type of logging hassal. Also you are free to post stuff here of other people as well as long as you mention their work or they don't mind you posting their work on XDA. Most of the people won't even be able to find the telegram group, 90% of the people would be on XDA so why not help them here instead of making stuff difficult for future users
[Other SmartWatches] gh0stza:
I don't see any other options for me. I need my watches firmware to do anything else.

I can't unlock bootloader - even if the watch has default keys, I can't get to fastboot without the

adb reboot bootloader

command.

I can't parse the fdl files - If someone knows the format of the fdl files or has a tool to parse it, I would be really interested. I don't even know exactly what the function of the fdl files are.
[Other SmartWatches] gh0stza:
Can someone confirm whether I stumbled onto the kernel source for these watches?

https://github.com/strongtz/linux-sprd
[Other SmartWatches] Xyberdude:
MEGA

MEGA provides free cloud storage with convenient and powerful always-on privacy. Claim your free 20GB now

mega.nz

I came across the twrp for my device same kernel same soc

TWRP Recovery for SC9832e,Android Version: 8.1

(25-11-2019, 03:59 AM)X3non (24-11-2019, 04:41 AM)ahnaf i flashed this twrp but it doesn't even show anything,,my phone just automatically turned off try this @ https://mega.nz/#!kaRgBKoJ!9FTIuaxdt1Cf

www.hovatek.com
[Other SmartWatches] Xyberdude:
And since kernel is same so it means the boot img and recovery img etc should also be the same for my watch
[Other SmartWatches] gh0stza:
And I think I just stumbled on the device tree too.

https://github.com/josefeliuf/device/tree/master/sprd/sharkle/sp9820e_1h10

@AlaskaLinuxUser You mind just confirming for me whether these are legit and workable
[Other SmartWatches] Xyberdude:
My watch has SC9832e soc
[Other SmartWatches] gh0stza:
And here is a CVE github project targeting spreadtrum SoC's - 9832e included

It's mostly geared towards phones but it might work on these watches too

https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader
[Other SmartWatches] Xyberdude:
@mhd 12 https://xdaforums.com/t/iplay-7t-sc9832e-processor-root-unlock-bootloader-suggestions.4045699/

Complicated but try checking it out?
[Other SmartWatches] gh0stza:
I know but all these ROMs are 1h10 - I think it might be compatible
[Other SmartWatches] Xyberdude:
The cve is a good pick. It might be built for phones but it's enough to be used on watches. According to mhd 12 after rooting "am gonna share my experience with system apps , u can't unistall system apps or replace them , even with root , the signature check will hunt u , tried to change the settings app and the watch got stuck in boot logo , reflashed system partition and tried to do everything i can , any modification to system apps results in watch stuck on boot , if u install an app with the same signature of a system app but a higer version u can't downgrade and u gonna get the app to be crushing , and u'll have to restore the watch or reflash system again , the best thing is to extract system partition and make change to it , resign the partition and flash it so it works , only if u find a way to unlock the bootloader through root , or volume buttons which doesn't exist , tried unlocking it with unlocktools , it shows unlocked but when i check it still locked ... "
[Other SmartWatches] gh0stza:
Well my watch is hard brick now. Without that stock firmware I'm done.

No way to revive my watch unless....

I can custom build for the watch and sign all the partitions over. That needs kernel source and a workable device tree. Ofc that would still mean months of work to get all the finer hardware drivers to work like the screen and heart rate sensor but atleast it's an upgrade from hard-brick to soft-brick.

Cuz I'm out of sources - Aliexpress is useless - forget about buying a smartwatch on Aliexpress unless you want to waste your money. The hosting provider (abupdate.com) is uncooperative in giving me the firmware. No other manufacturer with a similar watch is cooperative either. I have no more sources - short of buying another KOM9 and gettign the firmware that way.
[Other SmartWatches] Xyberdude:
"except SC9832e"
[Other SmartWatches] Fabinho Tech:
Depois é só via ponto de teste, como mostro no vídeo!!
[Other SmartWatches] Fabinho Tech:
In this video I show how to make a 4-pin data cable for data transfer and also how to update the firmware of the Smartwatch S12A CDS9 Ultra
[Other SmartWatches] tancreded:
have you made yourself a custom charger ?

if so piccy please, because i'm holding of doing mine for the time being, not to mention my 'ultra one' seem's to have a different type pad than others, it's resisting all my efforts to gently pry it apart
[Other SmartWatches] tancreded:
this is the firmware i believe my ultra one firmware was based on, as you can see, modified from an MTK phone, of course i might be wrong, (i extracted the launcher, which failed to boot on my device), but just on the offchance it might have what you need !
[Other SmartWatches] gh0stza:
Yo @Fabinho Tech That is a nice video, good explanations.

Consider making one in english too.

Anyway, it's not the U2S DIAG mode I need, I need fastboot. I think there will be testpoints for it but, I'm hesitant to open it up. It will break the waterproof seal and with all the phones and devices I've opened up over the years, I've seen that no matter how good you close it back up, it's always less waterproof. And with a device of this nature I would prefer to keep my IP68 rating - if I can.

My plan is to get the firmware and then just adb reboot bootloader it.

I have a lead on how to obtain my firmware

But it looks like I will get it in .zip format. I think it will need to be flashed with recovery so my next problem is how do I get to recovery.

I'm thinking I will extract the recovery.img from the zip, flash that and try to get into recovery somehow

or:

Maybe I will be able to extract all the partitions and flash it with researchtool.

We'll see.
[Other SmartWatches] Xyberdude:
U can use yt translate feature it's working well for understanding in English.

Also there should be some TWRPs available for your specific hardware, consider checking them out.
[Other SmartWatches] gh0stza:
I came across that too. I think you're right. I came across a few others too that looks like it was based on MTK firmware. The YUHO Y1 Stars firmware (the Spreadtrum modified one) boots on my watch and I can access the internal storage through MTP but no screen drivers.
[Other SmartWatches] Xyberdude:
Oh so basically other watches firmware seems to be working for you?
[Other SmartWatches] gh0stza:
Yes and no.

It boots yes

But without a screen it's basically useless - so also no
[Other SmartWatches] Fabinho Tech:
Você pode converter .zip em .PAC usando o software ResearchDownloader e alterar todos os arquivos manualmente e depois convertê-los.
[Other SmartWatches] Fabinho Tech:
Para colocar o firmware MTK para funcionar em um Spreadtrum você tem que ser um desenvolvedor extraordinário, para mudar TODOS os drivers
[Other SmartWatches] gh0stza:
Agreed. It's a big job.

Also you need a lot of source-code and an HDK doesn't hurt. But as this whole thread has proven Spreadtrum is much like Allwinner in the way that it doesn't have community support at all.

If all the device trees etc was available there would already be custom roms. Still, if those github projects I shared turns out to be workable templates it might just be possible.
[Other SmartWatches] verycoolus:
@Fabinho Tech i watched you video. Thank you. I have exact same watch CDS9 with 8541E chip.

I am confused. So we need a .pac file to dump the real .pac file from the real watch????

Where did u get the .pac file if you have not dump it at the first place?
[Other SmartWatches] PCKnight:
hi sorry i read the messages but i still dont understand, will we be able to get custom roms with speadtrum smartwatches? Or is it unlikely?

Has anyone found a watch model with default keys where we can sign anythign? Or does the keys not matter at all now with the tool?
[Other SmartWatches] Fabinho Tech:
Exatamente! Comprei de um fabricante
[Other SmartWatches] verycoolus:
Just asking. Where did u find the .pac file initially?

Did u find on website somewhere?

Edit. Alright.. You got it from manufacturer. Somehow google translate didnt translate well earlier
[Other SmartWatches] verycoolus:
Company Overview - Shenzhen War Group Technology Co., Ltd.

The basic information about Shenzhen War Group Technology Co., Ltd.

zhantuan.en.alibaba.com

Company Overview - Shenzhen Shunxiang Industry Co., Ltd.

The basic information about Shenzhen Shunxiang Industry Co., Ltd.

dykj.en.alibaba.com

some information. u can see the processes
[Other SmartWatches] Benni231990:
Hello Guys :)

I have a little Question i Bought the HK9 Ultra one with sl8541e

Can somebody tell me how can i add watch faces to the watch or give it a launcher that the watch looks like Apple watch OS10??
[Other SmartWatches] PCKnight:
I found the Q668 Android 9 smartwatch which seems to be recent but its based on MTK6761 so it should be easy to flash with SP flashtool.

What are the chances of getting a Custom ROM on that (without source code and the scatter file)?

Also some alibaba sellers offer customizations for speadtrum smartwatches. They told me they can for example put my custom apps in the preinstalled app store on the watch (meant for resellers) and for the watches you can customize "Sdk Api Size" whatever that means. Maybe someone needs to write them as a "reseller" to get certain files and options for this project?
[Other SmartWatches] verycoolus:
That also means they can reverse engineer your app. Some of us doesn't want to risk that. Some is ok with obfuscation. And MOQ is 1000 pcs the last time I asked them.

Custom ROM is possible if you can put the watch to read mode. Modify the .img and resign it with its public key. Then, recompile the .pac file and reflash it into the watch. Credits to @Mozhuyi🍥
[Other SmartWatches] qaz015393:
Yeah exactly why I don't want to connect my generic Chinese/AliExpress smartwatch to my phone and hope I could connect it to my laptop to scan for any of that stuff and to see if I can add more wallpapers to it (to find a good one I really like).
[Other SmartWatches] Paul_Piad:
Any chance to update firmware? I want Google wallet and doesn't let me.
[Other SmartWatches] jknzj:
I don't know enough about the Android internals, but does this link have source code?

sharkle · master · jiang hong / Device Sprd

GitLab Enterprise Edition

gitlab.rosoperator.com

For instance, I have an Android watch that says the board is sl8541e_1h10
[Other SmartWatches] verycoolus:
Anyone has the DW89 watch can dump the .pac file and send it here?
[Other SmartWatches] tancreded:
for those interested, here's a cheap charger/data transfer cable aimed at:

Vwar S9 Ultra/ S9 Ultra 2

DW89 DW99

JC01 JC02

DT Ulltra 2 2024 Version

Magnetic USB Dock Charger 4pin Charging Cable Power Adapter For Vwar S

4pins magnetic suction charger cable (Support data transmission)for: Vwar S9 Ultra/ S9 Ultra 2 DW89 DW99 JC01 JC02 DT Ulltra 2 2024 Version Free shipping over $30

vwar.fit
[Other SmartWatches] The.Blerd:
Hello all. I recently bought a generic S9 ultra looking smartwatch from aliexpress. I'm going to purchase the data transfer cable @tancreded suggested. No experience rooting but I want to know what are my options in terms of custom roms, updating to android 9, data security, etc. Sorry for my lack of knowledge but any information is useful.

Link to watch: https://a.aliexpress.com/_mOdhzem
[Other SmartWatches] XZYawa:
Hi. Does anyone know where the contact point corresponding to the volume button on the motherboard is? As is well known those versions of elastic cameras like the CDS9(YUHO_Y1_StarS) only have one button......
[Other SmartWatches] Luiwammes:
Think the hardware is of vwar's cds9 (a.k.a. s12a) is based on a phone called "yuko y1 star"?

ROM Yuho Y1 STAR | [Official] add the 12/02/2019 on Needrom
[Other SmartWatches] gamba66:
I have one of these aliexpress watches with an unresponsive state once started, touchscreen doesn't seem to react.

via software I can boot into fastboot or recovery mode but there isn't much I can do since the bootloader is locked.

Is there anyway to unlock the bootloader? I can't use the menu on the phone in recovery mode since there are no volume up or down buttons btw
[Other SmartWatches] AI LIFE8:
mtk one you have a 99% chance of sucess

you can not only use one click root, but also use mtkclient to force unlock bootloader and extract boot.img
[Other SmartWatches] AI LIFE8:
here is a toturial of how to flash the cds9 and maybe the pac file

here is a toturial of how to unlock and root sl8541e

help with root Sp9832e / SL8541e vbmeta-sing.img impossible to update.

Greetings to all since I am new to this forum. to start I would like to thank for the information and tutorials since they have helped me a lot. the issue is that for days I've been trying to root a r

www.hovatek.com

maybe someone can help make a rooted debloated firmware
[Other SmartWatches] AI LIFE8:
安卓user版本默认开启debug模式，默认adb能连接_userdebug版本adb-CSDN博客

文章浏览阅读3.1k次。亲测有效! 在展锐sl8541e android8.1代码包上面测试，只需修改两点1.默认为debug打开模式,默认ro.debuggable=1（默认允许debug）build/make/core/main.mkifeq (true,$(strip $(enable_target_debugging))) INCLUDE_TEST_OTA_KEYS := true else # !enable_target_debugging # Target is less debuggab_userdebug版本adb

blog.csdn.net

this modification will allow you to use it with scrcpy without a screen,with adb on by default and auto authorize
[Other SmartWatches] AI LIFE8:
from here
[Other SmartWatches] AI LIFE8:
i have got my watch and i have found all the secreat code/hidden settings (including adb, edit device specs, accessbility), i will share them later, unfortunately no luck for root
[Other SmartWatches] gh0stza:
@AI LIFE8

Thnx for that.

Gonna try it maybe tomorrow ... or soon ...

My personal final opinion regarding UniSoC as a system-on-chip: Don't buy it !!!

Any chip maker company that works this hard to keep its bootloader locked obviously has something to hide ...

Apart from that I can say that the performance of the chip itself is acceptable - bordering on OK. It does tend to heat significantly when under moderate-to-heavy load but in a watch that's not really a big problem (unless you're a watch gamer ... i can't imagine why you would want to play a game on your watch but hey - to each his own).

And even though the watch I got on Ali isn't all bad I'm still back to my "semi-smart" watch that has a 12 day battery life, records my health stats to within ~3% inaccuracy,, has a perfectly working exercise mode and weighs almost nothing - I don't even feel it on my wrist.

And I would probably still always go back to my semi-smart watch.

My conclusion: Watch and battery tech just aren't there yet - even something like a pro samsung model still has an endurance rating of about 4 days, that's IMO just not acceptable. Taking the watch off that often destroys most non-metal straps in months. And the IP rating is worse on full android smartwatches too...

And then lastly I just want to mention the security concerns: semi-smart watches are "ALMOST unhackable" while android watches has all the same security concerns as regular android and in these cheap chinese watches it's WAY worse as the OS is out-dated ports/mods of older phones with no security patches and in all the cases I've seen old vulnerable kernels.

Still haven't found my firmware so my watch is just sitting in it's box. Someone else here on XDA is taking a crack at finding that firmware for me; but I doubt he'll be able to find it so I have a strong suspicion that this KOM9 is going to be my 2nd ever hard-brick.

So if whomever is reading this is dead set on buying one of those smart chinese watches only buy one that you know you can find firmware for.