General Firmware and Combination Firmware and FOTA Delta and CSC change and...

Search This thread

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
Can you please give full infos about Firmware?

*#1234#

This is easiest way to find nearly all usefull Infos Firmware related. Type this Code... like you would call someone...

R870XXU1AUH1 in Google no hits...

Best Regards
@adfree my friend.

Firmwares soon :

For eg. SM-R880/XSA/R880XXU1AUGE/R880OXM1AUGE/R880XXU1AUGE/R880XXU1AUGE - GW4 CLASSIC BLUETOOTH 42mm
SM-R890/XSA/R890XXU1AUGE/R890OXM1AUGE/R890XXU1AUGE/R890XXU1AUGE - GW4 CLASSIC BLUETOOTH 46mm
 
  • Like
Reactions: adfree

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
CSC related...

Somebody tried with ADB to run APKs?

I am new to this so I need some time...

Meanwhile I found only the Verifier...

Code:
D:\Android\ADB>adb shell am start -n com.samsung.sec.android.application.csc/com.samsung.sec.android.application.csc.ui.CscVerifierActivity
Starting: Intent { cmp=com.samsung.sec.android.application.csc/.ui.CscVerifierActivity }

Best Regards
 

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
Code:
D:\Android\ADB>adb shell am start -n com.samsung.android.cidmanager/com.samsung.android.cidmanager.preconfig.PreconfigActivity
Starting: Intent { cmp=com.samsung.android.cidmanager/.preconfig.PreconfigActivity }

Exception occurred while executing 'start':
java.lang.SecurityException: Permission Denial: starting Intent { flg=0x10000000 cmp=com.samsung.android.cidmanager/.preconfig.PreconfigActivity } from null (pid=5489, uid=2000) requires com.sec.permission.preconfig
        at com.android.server.wm.ActivityStackSupervisor.checkStartAnyActivityPermission(ActivityStackSupervisor.java:1058)
        at com.android.server.wm.ActivityStarter.executeRequest(ActivityStarter.java:1050)
        at com.android.server.wm.ActivityStarter.execute(ActivityStarter.java:712)
        at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1217)
        at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1179)
        at com.android.server.am.ActivityManagerService.startActivityAsUserWithFeature(ActivityManagerService.java:3779)
        at com.android.server.am.ActivityManagerShellCommand.runStartActivity(ActivityManagerShellCommand.java:543)
        at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:185)
        at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
        at android.os.ShellCommand.exec(ShellCommand.java:44)
        at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:10930)
        at android.os.Binder.shellCommand(Binder.java:929)
        at android.os.Binder.onTransact(Binder.java:813)
        at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:5070)
        at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2974)
        at android.os.Binder.execTransactInternal(Binder.java:1159)
        at android.os.Binder.execTransact(Binder.java:1123)


No idea if this means Root access required...

Maybe with Watch Face possible...

Look here... on Phones they used Themes...

In Tizen world I was able to perform CSC change via Watch Face and Binary...
But I am absolute Beginner in Android CSC Hacking...

Best Regards
 

marco_lu

Senior Member
Nov 9, 2019
124
144
CSC related...

Somebody tried with ADB to run APKs?

I am new to this so I need some time...

Meanwhile I found only the Verifier...

Code:
D:\Android\ADB>adb shell am start -n com.samsung.sec.android.application.csc/com.samsung.sec.android.application.csc.ui.CscVerifierActivity
Starting: Intent { cmp=com.samsung.sec.android.application.csc/.ui.CscVerifierActivity }

Best Regards
hey man
 

Attachments

  • Screenshot_20210906_110110_csc.png
    Screenshot_20210906_110110_csc.png
    36 KB · Views: 251
  • Like
Reactions: adfree

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
Oh...

Source Code seems online... GW4...

Code:
SM-R885F_EUR_RR_Opensource.zip
SM-R865F_EUR_RR_Opensource_R865FXXU1BUH9_diff.zip
SM-R875F_EUR_RR_Opensource_R875FXXU1BUH9_diff.zip
SM-R895F_EUR_RR_Opensource_R895FXXU1BUH9_diff.zip

SM-R870_NA_RR_Opensource.zip
SM-R860_NA_RR_Opensource_R860XXU1AUGE_diff.zip
SM-R880_NA_RR_Opensource_R880XXU1AUGE_diff.zip
SM-R890_NA_RR_Opensource_R890XXU1AUGE_diff.zip
SM-R865N_KOR_RR_Opensource_R865NKOU1AUGE_diff.zip
SM-R875N_KOR_RR_Opensource_R875NKOU1AUGE_diff.zip
SM-R885N_KOR_RR_Opensource_R885NKOU1AUGE_diff.zip
SM-R895N_KOR_RR_Opensource_R895NKOU1AUGE_diff.zip
SM-R865U_NA_RR_Opensource_R865USQU1AUGC_diff.zip
SM-R875U_NA_RR_Opensource_R875USQU1AUGC_diff.zip
SM-R885U_NA_RR_Opensource_R885USQU1AUGC_diff.zip
SM-R895U_NA_RR_Opensource_R895USQU1AUGC_diff.zip
SM-R860_CHN_RR_Opensource_R860ZCU1AUGF_diff.zip
SM-R870_CHN_RR_Opensource_R870ZCU1AUGF_diff.zip
SM-R880_CHN_RR_Opensource_R880ZCU1AUGF_diff.zip
SM-R890_CHN_RR_Opensource_R890ZCU1AUGF_diff.zip

Only as info...

Best Regards
 

Willjim

Member
Mar 30, 2019
7
10
R860XXU1BUI5/R860OXM1BUI5

BUI5 for OXM region public... for instance:
KOO
XAA

No idea about changelog...

Best Regards
This update is only rolling out to Galaxy Watch4.

What’s new:
Improved usability of the following applications or features: Touch bezel.
Improved system stability and reliability.
 
  • Like
Reactions: adfree

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
A quick search :

Responses​

**​

Request URL​

**

Server response​

CodeDetails
200

Response body​

Download

{
"latest": "R860XXU1BUI5/R860OXM1BUI5/R860XXU1BUI5/R860XXU1BUI5",
"alternate": [
"R860XXU1AUGE/R860OXM1AUGE/R860XXU1AUGE/R860XXU1AUGE",
"R860TBU1AUGL/R860OXT1AUH1/R860TBU1AUGL/R860TBU1AUGL",
"R860XXU1BUH9/R860OXM1BUH9/R860XXU1BUH9/R860XXU1BUH9"
]
}

Response headers​

connection: keep-alive content-length: 240 content-type: application/json date: Sat,11 Sep 2021 00:50:43 GMT server: uvicorn via: 1.1 vegur

Responses​

No links

This is for XAA CSC. Doesnt look like the firmwares are on the same samsung servers like other firmwares, best to do a packet capture on the phone and understand the full server address and then modify via a script.
 

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
CSC change...

Somebody tried with Watch Face """ Hacking""" ?

Or by modifying existing WF...

?

Only idea...

Best Regards
Posting here

"
source_ap_file=AP_R860XXU1AUGE_CL22197329_QB41769962_REV00_user_low_ship_MULTI_CERT_meta_WATCH_OS11.tar.md5
source_bl_file=BL_R860XXU1AUGE_CL22197329_QB41769962_REV00_user_low_ship_MULTI_CERT.tar.md5
source_cp_file=
source_csc_file=CSC_OMC_OXM_R860OXM1AUGE_CL22197329_QB41769962_REV00_user_low_ship_MULTI_CERT.tar.md5

target_ap_file=AP_R860XXU1BUH9_CL22353390_QB42369001_REV00_user_low_ship_MULTI_CERT_meta_WATCH_OS11.tar.md5
target_bl_file=BL_R860XXU1BUH9_CL22353390_QB42369001_REV00_user_low_ship_MULTI_CERT.tar.md5
target_cp_file=
target_csc_file=CSC_OMC_OXM_R860OXM1BUH9_CL22353390_QB42369001_REV00_user_low_ship_MULTI_CERT.tar.md5 "

Anyone access to Samsung servers, these are the files to look for...

Thank you @adfree
 

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
Some boot logo files for mods. Please note if you dont know what you are doing dont do it :p

A lot of info available though .. For eg..
 

Attachments

  • Param.zip
    860.1 KB · Views: 65

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
BUI5 still only for KOO and XAA... means Korea and USA...

Meanwhile Samsungworking on "new" MAGIC...

CUI9
Could be some "magic" One UI update... or only Securiy increased...

Code:
ACR: R860XXU1BUHF
AFR: R860XXU1BUHF
ARO: R860XXU1BUH9
ATO: R860XXU1BUH9
AUT: R860XXU1BUH9
BGL: R860XXU1BUH9
BRI: R860TBU1BUHD
BTU: R860XXU1BUH9
BVO: R860XXU1BUH9
CAC: R860XXU1BUH9
CAM: R860XXU1BUHD
CHC: R860ZCU1BUHG
CHO: R860XXU1BUH9
COO: R860XXU1BUH9
DBT: R860XXU1BUH9
ECT: R860XXU1BUHF
EUR: R860XXU1BUH9
ILO: R860XXU1BUHF
CHC: R860ZCU1BUHG
ITV: R860XXU1BUH9
KOO: R860XXU1BUI5
KSA: R860XXU1BUH9
LUX: R860XXU1BUH9
MID: R860XXU1BUHF
MWD: R860XXU1BUHF
MXO: R860XXU1BUH9
MYM: R860XXU1BUHD
NEE: R860XXU1BUH9
PAK: R860XXU1BUHF
PEO: R860XXU1BUH9
PHE: R860XXU1BUH9
PHN: R860XXU1BUH9
ROM: R860XXU1BUH9
SEB: R860XXU1BUH9
SEE: R860XXU1BUH9
SEK: R860XXU1BUH9
SER: R860XXU1BUH9
SKZ: R860XXU1BUH9
TGY: R860XXU1BUHD
THO: R860XXU1BUHD
TPA: R860XXU1BUH9
TPH: R860XXU1BUH9
TTT: R860XXU1BUH9
TUN: R860XXU1BUHF
TUR: R860XXU1BUH9
UPO: R860XXU1BUH9
XAC: R860XXU1BUH9
XAA: R860XXU1BUI5
XEF: R860XXU1BUH9
XEH: R860XXU1BUH9
XEO: R860XXU1BUH9
XEZ: R860XXU1BUH9
XFA: R860XXU1BUH9
XJP:
XME: R860XXU1BUH9
XNZ: R860XXU1BUH9
XSA: R860XXU1BUH9
XSE: R860XXU1BUH9
XSG: R860XXU1BUHF
XSK: R860XXU1BUH9
XSP: R860XXU1BUHD
XTC: R860XXU1BUHD
XXV: R860XXU1BUH9
ZTO: R860XXU1BUH9

Only as info.

Best Regards
 

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
com.samsung.android.cidmanager
Code:
com.samsung.android.action.SECRET_CODE



android_secret_code




android:name="com.samsung.android.cidmanager.receiver.PreconfigReceiver" android:permission="com.sec.permission.preconfig">
            <intent-filter>
                <action android:name="com.samsung.android.action.SECRET_CODE"/>
<data android:host="\ 83052020100812173552301071192687"



<data android:host="27262826"

<data android:host="\ 22623277326634424320"

<data android:host="\ 272837883"

android:name="com.samsung.intent.action.CHAMELEON_PRECONFIG"/>
<data android:host="\ 3472867046185743"

In Manifest...

Edit 1.
Memo to me...
 
Last edited:

adfree

Senior Member
Jun 14, 2008
10,615
6,172
Samsung Galaxy Watch 4
Samsung Galaxy S22
Strange... or normal... no changelog

Code:
AP_R860XXU1CUIE_CL22353390_QB44028222_REV00_user_low_ship_MULTI_CERT_meta_WATCH_OS11.tar.md5
BL_R860XXU1CUIE_CL22353390_QB44028222_REV00_user_low_ship_MULTI_CERT.tar.md5
CSC_OMC_OXM_R860OXM1CUIE_CL22353390_QB44028222_REV00_user_low_ship_MULTI_CERT.tar.md5

Only as info...

So we have to wait for CUIE or someone post details about changes...

Best Regards
 
  • Like
Reactions: Willjim

Jsigno

New member
Sep 30, 2021
3
0
I just bought my watch 4 in China I work here, and it doesn't even connect with the phone (S21 ultra not chinese). I guess the only way is to install the firmware (wireless) but the problem is where to find it and is compatible? Cause the name of my watch is SM-R870NZSACHC and reading all the post nobody mentioned this serial number. :cry::eek::eek:
Thanks everybody
 

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
So it seems that normal recovery present on the watch. more headroom for TWRP. Also was able to go to fastboot however no way to connect over WiFi. What also seems as a potential to unlock bootloader. ( fastboot oem unlock ) confirmed via parma inages posted before.
Download mode has an option to unlock bootloader, however will need to have oem unlock option in developer options which is not the case.

How to go to bootloader :

adb reboot bootloader. -> will take you to fastboot mode. however wont connect over wifi, need physical connection to poco pins on watch.

once in fastboot mode. procedure is same like previous watch.
 

Attachments

  • IMG_2021-10-01-19-31-20-595.jpg
    IMG_2021-10-01-19-31-20-595.jpg
    3.9 MB · Views: 188
Last edited:

tids2k

Senior Member
Apr 21, 2009
2,739
955
Sydney
Google Pixel 6 Pro
In regards to CSC, decompiling CSC.apk, AndroidMafiest.xml

<intent-filter> <action android:name="android.provider.Telephony.SECRET_CODE"/> <data android:host="9920" android:scheme="android_secret_code"/> </intent-filter>

We know that 9920 will trigger CSC , however tried both via dialer and adb shell

adb shell am start -a android.intent.action.CALL -d tel:%2A%23%2A%23%39%39%32%30%23%2A%23%2A

Did not appear to work, maybe less *#9920*# ?
 
  • Like
Reactions: adfree

vijai2011

Retired Recognized Developer
Oct 24, 2011
1,000
498
@adfree Where you able to capture any of the fota delta? Just curious to find its contents.

I was hoping for frija to pull fw for watch 4 since it's update mechanism is similar to galaxy phones but ended in disappointment
 
  • Like
Reactions: adfree

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Finally found free way to extract files from GW6/Android 13 super.img... system.img etc...

    Tested short on my SM-G965F with Android 10...

    Code:
    star2lte:/data/local/tmp # ./aa1 product.img /sdcard/xxx/
    erofsUnpack 1.3.220207 Linux
    Extracting product.img...
    Unpack done. 3s

    I have renamed tool...

    Later i will add name and link...

    As soon I will find...

    Best Regards

    Edit 1.

    Simple Google Trick... by reading with open eyes...

    Leads to this:

    I download this:
    erofsUnpackRust_arm64android.zip
    1
    Finally found free way to extract files from GW6/Android 13 super.img... system.img etc...

    Tested short on my SM-G965F with Android 10...

    Code:
    star2lte:/data/local/tmp # ./aa1 product.img /sdcard/xxx/
    erofsUnpack 1.3.220207 Linux
    Extracting product.img...
    Unpack done. 3s

    I have renamed tool...

    Later i will add name and link...

    As soon I will find...

    Best Regards

    Edit 1.

    Simple Google Trick... by reading with open eyes...

    Leads to this:

    I download this:
    erofsUnpackRust_arm64android.zip
    I didn't realize that android 13 or newer used erofs. If I realize earlier, I could unpack them 3 months ago.
    1
    i need it too please for my SM-R880u


    can he help with the stock rom for SM-R880U ?
    Yes
  • 6
    Screenshot_20230814_023225_cidmanager.pngScreenshot_20230814_023228_cidmanager.pngScreenshot_20230814_023231_cidmanager.pngScreenshot_20230814_023233_cidmanager.png

    @adfree

    We will feast and celebrate with the Gods, as another victory was finally found and claimed.
    6
    I want to make a small contribution to the thread in question, I have a gw4 ldu which did not allow any device configuration. I downloaded the SM-R890 EVA8 file and unzipped it with 7zip and then retransformed in tar format again with 7zip. I then connected the gw4 with netodin and uploaded the file to the device. Finished the job everything works wonders, it also received the latest update released by samsung. Tanks to Adfree for his hard job
    5
    No idea when Full firmwares for study leak...

    Meanwhile to understand maybe more about funny Region... helpfull this Android App to check Firmware:

    It is possible to decrypt from Test Server...

    Then maybe more clear...


    OXM seems also for DBT ZTO and so on...

    A
    In theory linked FOTA Delta should work for AUGE DBT or SER or ZTO...

    Question is only how to update manually...

    B
    Roll out official could be in waves... but could be also more funny like we allready knows...

    We will see the future of GW4 support.

    Best Regards
    5
    Tiny progress...

    Searched in system.img... 3 GB File for text string:
    Code:
    sdk_gwear_x86

    27 hits... then I changed few of them and renamed...
    Now I see:
    Code:
    sdk_gwear_x05

    05 is inside:
    Code:
    # begin common build properties
    # autogenerated by build/make/tools/buildinfo_common.sh
    ro.product.build.date=Thu Dec 16 16:58:02 UTC 2021
    ro.product.build.date.utc=1639673882
    ro.product.build.fingerprint=google/sdk_gwear_x86/generic_x86_arm:11/RWD4.211013.004/8008904:userdebug/dev-keys
    ro.product.build.id=RWD4.211013.004
    ro.product.build.tags=dev-keys
    ro.product.build.type=userdebug
    ro.product.build.version.incremental=8008904
    ro.product.build.version.release=11
    ro.product.build.version.release_or_codename=11
    ro.product.build.version.sdk=30
    ro.product.product.brand=google
    ro.product.product.device=generic_x86_arm
    ro.product.product.manufacturer=unknown
    ro.product.product.model=sdk_gwear_x05
    ro.product.product.name=sdk_gwear_x06
    # end common build properties
    #
    # ADDITIONAL PRODUCT PROPERTIES
    #
    ro.build.characteristics=emulator,nosdcard,watch
    persist.traced.enable=1
    ro.com.google.ime.system_lm_dir=/product/usr/share/ime/google/wear_lms
    dalvik.vm.systemservercompilerfilter=speed-profile
    ro.product.vndk.version=30


    Okidoki:
    Code:
    ro.product.product.model=sdk_gwear_x05


    Need few attempts...

    But good I can edit system.img without crash... so no Hash check or something in this Direction...

    Edit 1.

    Step 1 done in funny riddle... puzzle...

    Need more time to correct the other props...

    Goal is to enter exact Playstore for GW4... and/or Samsung Apps...

    In Emulator on PC...
    5
    "We" have still tiny problems...

    My problemS

    A
    I have NO device nor plan to buy in near future...

    B
    + no full Firmware for Odin/netOdin nor study...
    + no Combination Firmware...

    C
    No Service Manual leak...

    D
    Community to find solution is sooooooo f. huge...
    This problem is not new... something like this I know since years...

    Feel free to find solution for us. :cowboy:


    Thanx in advance.


    No joke.

    Feel free to do something.

    Best Regards