[Other SmartWatches] AI LIFE8:
in this post ill tell you how to root and install custom ROM on S12 and other unisoc SL8541E based smartwatch

thanks to scottsecret0104 and haro.jpg for file and guide

no tft unlock tool needed, without need to open the watch

warning: read the model number of your device carefully, if you flashed the wrong file it will brick, and i am not responsible for it!

requirement:​

smartwatch with SL8541E cpu

a 4 pin cable for data transfer: https://m.tb.cn/h.gROSXnZ90up3Wfu

the one come with the watch will NOT work! it is only for charging​

stock firmware for your model:

some can be found here​

S12A,DW89,KOM7: https://drive.google.com/drive/folders/1FuSUZ4cB8_kTouIMsrcjZJ-pu4GJ9Nil​

S12,S12A,S18+LineageOS: https://sourceforge.net/projects/dw-samrtwatch-flash-file/files/​

H10: https://mega.nz/file/cvBkUI7Q#J3YXTCVTs1HjGS-ixLi9wsKCLWjRZMfnlEGXk4EwwZE​

you need to make sure the file is for correct model, or things like screen may not work​

adb fastboot tool: go find it your self

research download tool: https://www.mediafire.com/file/8qpkhwkk6gdkpt9/SPD_Research_Tool_R23.0.0001.7z/file

enable USB debugging:​

most of these chinese smartwatch have disabled developer option by clicking build number, you can install this app to quickly enable adb

enter spreadtrum download mode:​

install spreadtrum driver

there are 2 ways to enter the download mode

ADB method:​

enable adb with above method

use command adb reboot autodloader

device will be visible as com port

Button method:​

only for dw99

power off watch

hold the digital crown and connect usb

TP method:​

if your watch is already bricked, this is the only option

video tutorial:

power off watch

take out the 4 screw on the back

use a tweezer to short TX testpoint with gnd

plug in the usb cable while test point shorted and watch is off

backup firmware:​

if you have the firmware for your exact model, this step can be skiped

if you have model close to the existing model but not exactly same, you can try to extract the firmware with the existing firmware partition table and fdl file

if the model is very different, you can just ask the seller for original firmware

video tutorial:

open the closest pac file to your watch with research dl tool

uncheck all file to flash except fdl1&2

in flash operation tab check read flash and select all partition

start flashing

​

Flash firmware:​

if you have the S12 or S12A, i have already made a pac file for your watch, you can get straight to flashing

if not, you need to obtain the stock firmware from method above

ready made firmware download s12,s12a

open the pac file

deselect all file to flash

if you want the SL8541E boot logo,check bootlogo(boot animation can just be changed with root like on smartphone)

if you just want to root, check boot and vendor partition

if you want to install lineage os, check boot,vendor,system

start flash

if you used my pre made pac file, you can flash it directly, if you want to replace file with one of your own, you can double click the path and you can select other file on your pc

you can use any gsi with android 8.1 Aonly, i used lineage os

making custom firmware:​

because spreadtrum bootloader kept signature check on even if unlocked, there is no point to unlock the bootloader

custom system file:​

system is not checked by the bootloader for integrety, so you can directly flash it with whatever you like

but it must be in ext4 img format, the one you downloaded online is in sparse image format, which will normally be decompressed by the recovery then flashed, since we are flashing it through download mode we need to decompress it our self with this tool for windows or simg2img for linux

custom boot/recovery file:​

boot and recovery is checked by the bootloader with key in vbmeta, if it does not match it will not boot, so you need to resign them with the same key

haro.jpg already made a toturial about it, but it involve using linux, because the avbtool does not work normally in windows

8541e Smartwatch: Stock Firmware, Unlock Booloader, Root, GSI Roms...

Here is a tutorial about 8541e soc smartwatch, including dump, root, flash GSI rom... and it is universal This is the effect of flashing gsi Before that, the relevant files and tools used are available for download here...

xdaforums.com

Before that Please make sure you have Python installed

1.This step is used to generate the signature file to replace the original boot when repacking vbmeta:

python3 avbtool extract_public_key --key rsa4096_vbmeta.pem --output keys/boot-sign.bin

After this step is completed, the boot-sign.bin file will be generated in the keys folder.

2.After this step is completed, the boot-sign.bin file will be generated in the keys folder.This step is to repackage the scattered files into a vbmeta image, where "boot:1:keys/boot-sign.bin" is to replace the original "boot.bin" with the "boot-sign.bin" image we created. This file stores the key used to verify the boot partition. We replace it with our own key here, so that the signature verification of the boot partition can pass when the device starts.

python3 avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:keys/boot-sign.bin --chain_partition system:2:keys/system_key.bin --chain_partition vendor:3:keys/vendor_key.bin --chain_partition recovery:4:keys/recovery_key.bin --chain_partition l_modem:5:keys/l_modem_key.bin --chain_partition l_ldsp:6:keys/l_ldsp_key.bin --chain_partition l_gdsp:7:keys/l_gdsp_key.bin --chain_partition pm_sys:8:keys/pm_sys_key.bin --padding_size 12288 --output vbmeta_custom.img

After this step is completed, the vbmeta_custom.img file will be generated in this directory. At this time, the production of vbmeta is not completely completed, and the next step needs to be carried out. For a detailed explanation of step 2, please refer to the "Detailed Tutorial, Detailed Explanation and Supplement of Step 2.docx" in this directory."

3.This step is used to fill the "vbmeta_custom.img" file that has just been packaged.

python3 vbmeta_pad.py

This step only needs to be executed once, not multiple times. After completion, there will be no significant changes. It is recommended to wait for more than one minute before executing this command to observe whether the file "modification date" has changed. If it has changed, it is successful. Executing it multiple times will cause the vbmeta size to be abnormal and cannot be flashed in normally!

4.This step will sign the Magisk patched boot using the same signature we just implanted in vbmeta

python3 avbtool add_hash_footer --image 'magisk_patched-boot.img' --partition_name boot --partition_size 36700160 --key 'rsa4096_vbmeta.pem' --algorithm SHA256_RSA4096

After the execution is completed, there will be no significant changes. Please also pay attention to whether the file modification time has changed. If it has changed, the signature is successful.

5.After the execution is completed, there will be no significant changes. Please also pay attention to whether the file modification time has changed. If it has changed, the signature is successful.

You have created vbmeta_custom.img and magisk_patched-boot.img

Now flash them to your device

heres a gui tool that claims to do everything needed in windows, but in my case it does not work normally, you can still give it a try

GitHub - werasik2aa/SPD-VBMETA-TOOL: Spreadtrum vbmeta creation tool for windows! GUI based.

Spreadtrum vbmeta creation tool for windows! GUI based. - werasik2aa/SPD-VBMETA-TOOL

github.com

troubleshoot:​

do not update magisk in the app no matter what it says, because without resign the boot.img it will not be able to boot again

if boot img flash stuck for long time at the end and fail you didnt resign it correctly

if flash fail after 3 second when fdl1 is being downloaded, the test point is not shorted correctly