yashsingh1/xdaforums huggingface dataset:
[Other SmartWatches] AI LIFE8:
@gh0stza

sl8541e is a very good soc imo, it have great performance at low power consumption, way better then mtk, on par with snapdragon with a fraction of the price, if you dont believe me you can try the dt ultra 2, the battery life is just 6 hour, while the cds9/s12 i have can last 2 days if you dont game on it, and the performance of oppo watch with w5 is worse then this cds9 also

ofcourse the hackability of mtk is best, with mtk client you can take full dump and unlock bootloader without permission, but well its not that bad, you can easily enable adb with activity starter, and should be able to root it still without making change to /system

indeed, bluetooth accessory with freeRTOS battery life is always superior to android watch, with great power comes great power drain, if you have phone with you all the time then just use it insted, smartphones are OP, if you still want a bluetooth watch hello watch 3+ may be good

but indeed the hackability of bluetooth watch is worse, it is possible, like the ones based on nrf52832, but every watch have different soc, some chinese one have minimal docs, so android one is still superior in hackability

the watch i have is s12, but it only have lcd screen unfortunately, that means no always on display possibility, all full android watch should be able to do it.

the firmware provided by @Fabinho Tech is close enough to be used as FDL1 and FDL2, but unfortunately either unlocktool or research download tool had a bug and it cause my pc hard drive to fail already, so i cannot do further test without vm

when i get a new pc, i will try again, but i think there is no way to flash without open the watch and use test point, because when i use unlocktool to enter download mode it worked, but when using research download tool to backup it says timeout changing baud, i only have normal unlocktool without spreadtrum expansion, so i cannot pull the firmware from there directly

but it will be very hard to assemble back, because it is hard to buy the seal, and it need to be reinstalled to be water proof

i hope someone can tell me where to download unlocktool with spreadtrum feature, i am using the latest version, as these tool wont allow to be used anyways unless you are up to date
[Other SmartWatches] AI LIFE8:
btw

`com.android.settings/com.android.settings.DwDevelopSetActivity` can open ADB

`com.android.settings/com.android.settings.newsettings.MemoryWriteActivity`can update android version to 9,change ram and rom size,enable 5g celluar,change cpu core number

`com.android.settings/com.android.settings.newsettings.TouchTestActivity`can enable touch dot

(i have not tested if the device specs changer can trick aida64 or deviceinfoHW, but i think it can have some effect, and change require factory reset to take effect)
[Other SmartWatches] gh0stza:
I do agree with you that the SoC isn't bad. Power consumption is comparatively lower then MTK, but that's why MTK usually adds a low power CPU in it's watches. And again the performance is comparatively good but it's cancelled out considering that it heats up as much - much like 20 years ago's AMD CPUs (I'm still a AMD fan BTW :cowboy:).

And yeah I got my KOM9 up to 2 days before the brick too with regular use (no exercise). But 2 days is not good enough for me. This is just my personal opinion but for me I want at least 5 days of battery life from a watch else my semi-smart is more useful for me.

Note: On my tests of the watch - I got an average of about 12mah while in deep sleep, which isn't bad. However I think I could get it down to less then 5 with root - which comes down to about 120 hours ( with wake-ups and extra screen drain - 5mah * 24hours * 5days = 600 ; battery tests gave me 734mah capacity)

Yeah the unlocktool ...

I have asked a few poeple on this thread to share their unlocktool but NO ONE ever did. I was in the same boat as you (except for the HDD failure).

I couldn't unlock my bootloader because when you run the final fastboot flashing unlock command the command just hangs and nothing comes up on the screen. I assumed the generated unlock code was incorrect because of custom private keys but it could also be that the prompt on the screen just doesn't come up and all I need to do is press the "vol+" button. So if the watch doesn't have contact points for the vol+ button on the mobo then I guess it comes down to the same thing - can't unlock bootloader.

That's why I will try the thing you posted to get my watch into fastboot to open the watch and see if I can find the contact points for vol+.

Atleast if I can get the bootloader unlocked I can play with it again - as it is right now I can't change anything while the bootloader is locked.

And the seal: yeah that's a problem. I think to get the water proofing back you will have to decompress the watch as you're closing it up, like old-school water proof diver watches - which I had to go through a few years back - wasn't cheap.

And then finally: the main reason why I need my firmware is for the FDL files. Evidently all other firmware's FDL files I have isn't close enough to my watch. Someone else on this thread said that theoretically the wrong FDL file CAN physically damage the hardware of the watch - so I just hope it didn't break anything on my KOM9
[Other SmartWatches] AI LIFE8:
@gh0stza​

there is a factory testing app in the watch, and it says when screen off the current draw must be lower then 5ma, or the motherboard is faulty, there is a charge counting app too if you want to test power draw when using other app
[Other SmartWatches] gh0stza:
Never noticed that menu. Maybe my engineerMode doesn't have that.

Regardless, I used batteryguru to do my tests. My watch has a charge controller (which I'm pretty impressed about), it only updates every 15s but still it's incredible that a device this small would include a charge controller.

I did a short test with external USB power tester - just to verify the accuracy of the built-in charge controller and it gave me almost identical results so the charge controller seems really accurate too.
[Other SmartWatches] AI LIFE8:
you dont need to unlock bootloader on spreadtrum, it makes no difference, you either flash a bootloader with secure boot off or just use the locked bootloader with secure boot, and re sign the boot.img with vbmeta(which idk how to do yet, hope someone can steal the tool out of the telegram group so i can use it)

there is no vol+- button on the watch, but you can use the OTG pin to enter download mode without unlocktool, it is what fabinho used in the video

here is a picture of the internal of the watch
[Other SmartWatches] gh0stza:
I have that tool for you if you want it.

The problem with it is that it still uses the private keys to resign the images. So if you have the default private keys.

It is preferable that way for me as secure boot is still enabled with a trusted OS. I have to give UniSoc props for that even if they probably didn't intend for that to happen - so I guess I have to give the credit to Hovatek Devs not Unisoc.
[Other SmartWatches] AI LIFE8:
ofcourse it does, because the PMIC must generate the voltage for cpu,ram and other acessories(like high voltage for lcd display), nowadays its a all in one chip, but the charging may be done with linear regulator, thats why it heat up so much when charging
[Other SmartWatches] gh0stza:
Interesting
[Other SmartWatches] AI LIFE8:
can it be used in windows or it need linux

i have seen the toturial video of rooting cds9 (if you wanted i can download it and sent it to you somehow), they need to use unlocktool with spreadtrum extension and linux to modify the boot and vbmeta

it is really preferable to have secure boot off, because that means if you did any modification to /system it soft brick, but flashing bootloader is not very easy i think just use the default private key is ok

idk what difference itll have with using the custom private key or default one, because we can extract it from vbmeta anyways
[Other SmartWatches] gh0stza:
It's a windows tool that was developed by a hovatek dev (can't remember his alias now to give credit) but a lot of anti-virus software detects some suspicious code (so run in sandbox).

I'm trying to find it now but I can't find it, so give me a few hours to track it down again. I think I downloaded it in a VM that broke on a windows update.

No not the way I understand it. 1. You can't pull the private key from vbmeta - if you could then android verified boot would be REALLY stupid. The key you can pull from vbmeta is the public key that was signed by the private key. If you have a custom key on your watch then you will HAVE to get that custom key before you can change the AVB.

Everything revolves around that private key.

I have an LG that works the same and without LG's private key not a single dev on XDA has found a way to unlock the bootloader on the H870 in all the years after it's been released.
[Other SmartWatches] AI LIFE8:
@gh0stza

here is the video toturial of how to root cds9

maybe it is helpful for you

https://upos-hz-mirrorakam.akamaize...build=0&f=u_0_0&agrr=1&bw=82802&logo=80000000

and actually yes in the toturial he re signed the vbmeta and boot with the public key so they work together, theres no need to use the private key
[Other SmartWatches] gh0stza:
dude, I have heard so many people say that. Go try it...

In the tool from hovatek they use the default private key. You can copy-paste your own but they use the default. If you read the hovatek tutorials VERY CAREFULLY you'll see they mention the private key but 'small print'.

They don't sign the partitions with the public key. The private key is used behind the scenes to generate the public key that is written into the vbmeta. So yes the keys in the vbmeta are public keys - not private keys..

Only way you'll convince me otherwise is if you know cryptography AND have done it on a watch with known custom private keys.

When you open the tool from hovatek (which I can't find right now) you'll see in the top they give a combo box that has the private key options. There is default 4096bit key and the default 2048bit key
[Other SmartWatches] Fabinho Tech:
This link is giving an error!
[Other SmartWatches] Fabinho Tech:
O seu S12A dura dois dias de autonomia?

Quais configurações você fez?
[Other SmartWatches] Fabinho Tech:
Does your S12A last two days of autonomy?

What settings did you make?
[Other SmartWatches] espionage724:
Does anyone know anything about a HK28 watch? It connects to the Android FitCloud Pro app. The Watch itself doesn't look like it's running Android, but I don't know what it's running exactly (could be Android and look very convincing like it isn't :p)

Also if I want to flash something to a cheap Watch right now (less than $100 on Amazon US), does anyone have any recommendations? I don't know much about development on Watches, but I can test stuff without regard of bricking it :p

Is AsteroidOS still a thing? I remember flashing that to an LG and Sony watch some years ago and it was kind of cool.

That watch has to be gigantic if that's the actual motherboard size?
[Other SmartWatches] Fabinho Tech:
There is a Chinese member of the Telegram group who managed to install LineageOS on the Full Android Smartwatch, via TWRP
[Other SmartWatches] Fabinho Tech:
This has nothing to do with Full Android
[Other SmartWatches] gh0stza:
@Lorenz1969 has an HK66 and an HK Ultra. Don't know if they are at all similar hardware wise but I have the firmware if you want it.

And those are Android

The HK66 is a Yuho Y1 Star port

and the HK Ultra is also a Yuho Y1 star port

Both Android 8.1 - Full android as far as I know - can't confirm that but looking at the firmware it looks like full android

*** EDIT ***

Just registered the part there you say it connects to fit cloud pro.

No that's definitely not android-anything

There is nothing you can flash to it.

Even flashing anything is gonna be challenging. The manufacturer is going to have the only firmware for you. Unless you want to develop something entirely from scratch ... Imagine writing that interface for an Arduino - that's what you're up against.
[Other SmartWatches] gh0stza:
For the life of me I can't find that signing tool. I think it was on an old VM that I deleted. If you want it really bad, I'll track it down for you again. I found it by following links from somewhere on this thread.

I did however find these private keys ... they are the default ones used by that tool. They are also the default Unisoc keys.
[Other SmartWatches] AI LIFE8:
视频去哪了呢？_哔哩哔哩_bilibili

undefined, 视频播放量 undefined、弹幕量 undefined、点赞数 undefined、投硬币枚数 undefined、收藏人数 undefined、转发人数 undefined, 视频作者 undefined, 作者简介 undefined，相关视频：

www.bilibili.com
[Other SmartWatches] AI LIFE8:
yes,my s12 last 2 day, i have enabled gravity wake, i only installed 1 app it is discord

it is a LCD display unfortunately, so no always on function

if you need accessbility on none supported watch you can tell me ill tell you how to enable
[Other SmartWatches] AI LIFE8:
it is true, i have opened mine
[Other SmartWatches] AI LIFE8:
the s12 have this labeled 1280mah battery, i dont know if its possible, the dimension on the marking is accurate i have measured
[Other SmartWatches] AI LIFE8:
it is very unlikely, as android 8 doesnt have GSI yet, but vendor is indeed seperate
[Other SmartWatches] AI LIFE8:
@gh0stza

i have extracted the full rom of my watch, now only need to resign it and flash it back
[Other SmartWatches] AI LIFE8:
it is freeRTOS watch, very hard to hack, it is likely using JL or realtek chip
[Other SmartWatches] AI LIFE8:
the reason the watch is named Yuho Y1 Star S is to trick google services into trust this OS, so they dont need to register it again

there is no connection between the actual firmware, they just change the build.prop to match a existing device
[Other SmartWatches] gh0stza:
This looks like a ResearchTool dump. Where did you find the FDL files?
[Other SmartWatches] AI LIFE8:
Yes, I ended up opening it and use research download tool, I found another tool that looked promising but after waiting for few hours all the file is 0kb so it doesn't work

I use the fdl file provided by fabinho
[Other SmartWatches] AI LIFE8:
Using 115200 baud with research download tool takes about 2 hours to create full dump, so it's a good idea to increase it a bit, and also do not backup the userdata
[Other SmartWatches] AI LIFE8:
I think for the size a 1280mah is not realistic, it is probably 600~800mah, I can't find someone selling the exact same sized ones

It's very disappointing as when I took it out the battery feels very dense and heavy, it feels like a high quality one

At least it's bigger then the real apple watch, and last longer also
[Other SmartWatches] haro.jpg:
This post explains in detail

8541e Smartwatch: Stock Firmware, Unlock Booloader, Root, GSI Roms...

Here is a tutorial about 8541e soc smartwatch, including dump, root, flash GSI rom... and it is universal This is the effect of flashing gsi Before that, the relevant files and tools used are available for download here...

xdaforums.com
[Other SmartWatches] haro.jpg:
Unisoc's secure boot cannot be turned off
[Other SmartWatches] gh0stza:
Careful.

That's what I did. There's a very good chance those firmware dump files are corrupt because you didn't use your original FDL files.

If your watch has ANY emmc offset differences your partitions are gonna overlap

Imagine you have a linux box and you partitioned your SSD with these partitions in this order:

Part1: /boot

Part2:/home

Part3:/var

Part4:/opt

Part5:/

Now imagine you do a dd backup but you forget /opt comes before the root partition. Dd has no way of knowing what comes where. So now you create .img files but with overlapping parition info.

I had to go dig in my dump files for hints about the API calls to ABup.com to find my original firmware.
[Other SmartWatches] AI LIFE8:
is your file size correct, and how long it take
[Other SmartWatches] AI LIFE8:
if you have same soc,the fdl is likely compatiable, i mean tft unlock also use same fdl for the soc, not per device

this tool looked promising, but it didnt work for me, it says success but not actually doing anything
[Other SmartWatches] AI LIFE8:
@gh0stza​

i think my partition table is similar, because the only difference is one have amoled one have lcd, and it actually is possible to pull the partition table from the device insted of from the pac file, but the research tool cant
[Other SmartWatches] gh0stza:
Your wrong. Tftunlocktool (i think, can't prove it) has a library of fdl files for a lot of devices. I think it chooses one before the dump.

Remember the 2nd FDL file I think acts like a MTK scatter file that is supposed to tell it where to find each partition on the emmc. So even a small change like a different order or 2gb/16 vs 2gb/32gb is going to be incompatible.

But if you believe your files are good then I guess you know what your yalking about.

I dumped on more then one baudrate. The 115000 took just over an hour (if i remember correctly) and the 2mil one took just a little while shorter
[Other SmartWatches] AI LIFE8:
cuz tft unlocktool only display the partition table after the fdl is flashed, and you can only select cpu type, so i think you can pull partition table from device with just fdl
[Other SmartWatches] gh0stza:
Ok I don't want to argue about it. I just gave you a heads-up.

If you believe it's good then fine. Unfortunately theres no quick way to verify all those partitions. Just looking at size is not gonna confirm ANYTHING. You're to have to open it up with HxD and inspect the thing or try to mount it. With parts like system thats fine. But verifying parts like modem (in binary format) is MORE difficult.
[Other SmartWatches] gh0stza:
And just for interests sake. I used FDL files from the HK66 and HK Ultra. Identical soc, identical memory and very close hardware specs but got conpletely different results so no. fDL files are NOT per soc. It's per device
[Other SmartWatches] AI LIFE8:
ok, i have fount the spreadtrum vbmeta tool and patched the vbmeta and boot img, i also tried to flash with researchdownload, the vbmeta flashed fine but boot cannot be flashed, after transfering it stuck at the end and time out

i can flash the extracted boot back no problem and make the device boot again

but with patched one it cant

idk if the patch tool is malfunctioning or i cant flash with research download must use tft unlock
[Other SmartWatches] AI LIFE8:
btw, the overall build quality is ok for the price, but all the solder joint is terrible, because they used lead free solder, and the multilayer board is very heat conductive, it is very hard to disconnect the battery, it dont have a connector
[Other SmartWatches] AI LIFE8:
tool:
[Other SmartWatches] AI LIFE8:
i tried to use modded vbmeta and original boot, then the original boot also fail to flash, so seems like the loader check the key

and i have opened the modded vbmeta with hxd, it looks like it is patched correctly, idk why it doesnt work
[Other SmartWatches] gh0stza:
I think AVB is failing.

Have you tried unlocking your bootloader? And what was the result?
[Other SmartWatches] gh0stza:
If I were you ... this would be my cutoff point. If you can't unlock your bootloader the 'hovatek' method.

Then most likely your watch uses custom keys. If you keep going you have a high chance of bricking it. Hard-bricking.

If your firmware stops working now - you better pray that firmware dump was good cuz else it's gonna end up in the same place mine did.
[Other SmartWatches] AI LIFE8:
Cds9 cannot unlock bootloader, it only have 1 button, the generic `fastboot oem unlock` is enough to trigger the prompt
[Other SmartWatches] AI LIFE8:
The firmware dump is good, when I flash the original vbmeta and boot it can enter system again, I think the file may not be patched correctly, the vbmeta is also re signed with the private key so it'll work with newly patched boot
[Other SmartWatches] haro.jpg:
Unlocking requires a dedicated fastboot and related files need to be made
[Other SmartWatches] haro.jpg:
A bootrom exploit is needed to force unlock the bootloader
[Other SmartWatches] gh0stza:
Yes exactly
[Other SmartWatches] gh0stza:
Ok not gonna give anymore feedback.

Just do yourself a favor and go read up on "Android Verified Boot".

*** EDIT ***

See this page: https://wiki.postmarketos.org/wiki/Android_Verified_Boot_(AVB)

Quote from the first and second paragraphs':
[Other SmartWatches] AI LIFE8:
so is unlock the bootloader necessary?because the avb cannot be turned off, previous user that have rooted his watch say it is not necessary to unlock bootloader or use adb

if it is necessary to unlock, without volume button can the tx test point be used insted or what procedure needs to be done
[Other SmartWatches] AI LIFE8:
@haro.jpg

all the process in detailed toturial is done automaticly by the tool(supposely), the tool also feature auto unlock bootloader, but it does not work(says sucess on the tool, thats using the method you described , but it is still locked)
[Other SmartWatches] gh0stza:
No it's not necessary. I was asking to see what the fastboot would return. If you could unlock your bootloader then it means your device is using default keys, and the signing was incorrect somehow.

But the fact that it fails outright is basically a dead give a way that your device uses custom keys.

The tool ( shell script .sh ) is basically just a shell script to automate some of the openssl commands.

In short what it does is: it uses the custom fastboot binary to get the device identifier then uses the default private key to sign that identifier (using openssl), just copies that into a .bin file and then finally issues the fastboot flashing unlock command with that unlock 'key'.

In my case it just hangs (and then fails after the default 5 min timeout) and it looks like in your case it fails almost immediately.

If you want to keep going you can make sure you are using the latest openssl on ubuntu 18.04 LTS and instead of using the script - issue the commands manually and inspect the signature.bin file.

If everything executes without error and only the final fastboot flashing unlock command fails (not hangs) then your device is using a custom key.

If that's the case then you have three options:

1. Get the custom key from the seller - GOOD LUCK WITH THAT!!!

2. Try exploit temp-root techniques like framaroot - but you have a low chance of success as everyone here has about the same OS and none of the rest of us had any success with that.

3. Use it as it is and when you purchase a new one (whenever) just make sure you get something that can be unlocked.

And as a last sidenote: The other guy you were talking about that just resigned his partitions.

Only way he could have done that is if his device used default keys. So if he wanted he probably would have been able to unlock his bootloader too but he chose to go the re-signing method instead. If I could, that's what I would have done too. But when I flashed the re-signed images I got the same error.
[Other SmartWatches] AI LIFE8:
Ok, so the bootloader not only check if vbmeta and boot key matched, but also check if the key in bootloader match the one in vbmeta, is that correct

If so, then yes it definitely requires the default key to be used, which is quite annoying, seems like dw89/dw99 is the only one hackable
[Other SmartWatches] gh0stza:
***DUPLICATE DELETED***
[Other SmartWatches] gh0stza:
So far on this thread there has been very few default key watches yes. And also yes...thats VERY annoying.

Still the unisoc supporters have to be grateful that even the default key got leaked somehow. LG supporters aren't that lucky. I think it had to have been a disgruntled employee at unisoc :ROFLMAO:.

There is a few implementations of AVB out there and I don't understand all of them nearly as well as I'd like. Some of them are embedded so deep that the actual device can NEVER be unlocked without that key like LG and little kernel.
[Other SmartWatches] haro.jpg:
Everything is resolved in the file I uploaded, you can stop arguing
[Other SmartWatches] gh0stza:
??? What :ROFLMAO:

:ROFLMAO::ROFLMAO: