Question Rooting Galaxy Watch4

Search This thread

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Maybe this could help to get closer to Root...

Code:
COMBINATION_FAC_FBR0_R860XXU1AVE2_FACFAC_CL24349936_QB52279843_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R865USQU1AVE2_FACFAC_CL24349936_QB52279850_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R870XXU1AVE2_FACFAC_CL24349936_QB52279853_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R875USQU1AVE2_FACFAC_CL24349936_QB52279860_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R880XXU1AVE2_FACFAC_CL24349936_QB52279865_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R885USQU1AVE2_FACFAC_CL24349936_QB52279872_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R890XXU1AVE2_FACFAC_CL24349936_QB52279874_REV00_user_mid_noship_MULTI_CERT.tar.md5
2022-06-22
COMBINATION_FAC_FBR0_R895USQU1AVE2_FACFAC_CL24349936_QB52279880_REV00_user_mid_noship_MULTI_CERT.tar.md5

Only as info.

Best Regards
 

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
I have now 2 Victim SM-R870 for stupid tests...

1 seems dead dead... will see after Soldering wires...

But second SM-R870 is alive... EVA8 Firmware...

Ready for stupid Action(s).

Best Regards
 
  • Like
Reactions: galaxys

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Found this today... for signing vbmeta...


My tiny "progress"...

A

Soldered wires to dead dead SM-R870... but still dead...

B

So I was able to take the 2 Hardware Keys to repair my halfdead SM-R870...

So I have now 2 HW Keys... the red Key(s)...

C

After soldering wires... I lost 1 wire... during movement...
So this is known danger... so I have to prepare few things... BEFORE I solder wires to my alive SM-R870...

I wish to prevent such accident like happens to me long time ago with SM-R730... ripped off 1 golden TP...

Best Regards

Edit 1.

Few Photos about my Soldering Adventure...

Edit 2.

More funny Photos and weired idea(s)...
 
Last edited:
  • Like
Reactions: spart0n and galaxys

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
My last Patching attempts long time ago with Magisk Version 24.3...

Now seems something new... 25.1

Only as info...

Will try both:
24.3
and
25.1

I have to prepare SM-R870 files... EVA8...

Best Regards
 
  • Like
Reactions: spart0n

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
IMHO in 1 hour I can test...

My Checklist...

Code:
A

Reset SM-R870 Standalone
No WiFi


B

*#9900#

Upload enabled
+
Debug HIGH

C

Full charging


D

Bootloader unlock



E

netOdin Action

I need 45 minutes for C... Charging...

Then Bootloader Unlock... then I can try Magisk patched files... Version 25.1...
 

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
I have forgotten Bootloader unlock is doing Factory Reset...

So I have to do again Debug HIGH etc...


First result... same like we know from Magisk 24.3...


I need now some time to check Log Files... taken via *#9900#

Best Regards

Edit 1.

Fail with netOdin also Reset Debug HIGH...
 
Last edited:

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Tiny progress...

Flashed successfully only patched vbmeta...

This forced me to do Factory Reset from Recovery... necause some Error blabla...

Bootloader unlock shows Warning Pic... blabla Custom...

Now I have the second blabla not Samsung Official...

So IMHO Knox is now dead...

Code:
D:\Android\ADB>adb shell getprop ro.boot.warranty_bit
1

Bootloader unlock alone not kill Knox... IMHO...
Code:
D:\Android\ADB>adb shell getprop ro.boot.warranty_bit
0
 

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Still no absolute success...

But tiny progress... very tiny...


Maybe problem is inside last "few" Bytes... in Footer...

For instance Combination Firmware crap is identified by FAC...

And normal boot.img have text string MRK... maybe like Market...


Magisk etc. removes all human readable Samsung text...

IMHO this seems why f%&ing DL wireless detect:
On Watch:
Code:
Secure Failed:Boot


In Odin Mode I see:
Code:
ODIN MODE (Boot: Load Fail
Load_boot_images: Invalid Magic

Only as info...

Best Regards

Edit 1.

Btw...

Footer from patched Magisk boot.img is much shorter...
So file length is wrong IMHO...
 

Attachments

  • AVB_BootFooter_v1.zip
    48.2 KB · Views: 4

TacoDeMuerte

Member
Feb 16, 2021
48
41
Few mistakes later I am here...

Code:
'BOOT' Image size is too big!

Result of replace Footer from Original boot.img to Magisk patched Version...
Thanks for all your work! I wish I could help, but wouldn't know where to start. I have to wonder if there is a post somewhere that explains the general process of rooting. Not just the end result, but the work that goes into figuring it out in the first place. I have a background in app development and electronics engineering, and have been following the road to root posts for the GW4. So far, it all makes sense, but I am wondering, what needs to be done to complete the process? I wouldn't mind pitching in here and there, but would need to be brought 'up to speed', so I'm not sure if it's worth anyone's time to explain it on here. If there is a post/website out there, let me know and I will read up on it. Thanks again!
 
  • Like
Reactions: mrfatiga22

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4

Here is Ramdisk of EVA8...

In wirelessd Binary we can find the Error messages...

Btw... this is the Binary which is called by Recovery Kernel to perform Download Wireless...

sboot.bin Bootloader shows text strings in Odin Mode...


@TacoDeMuerte
Really sorry.


I have not enough time nor enough energy to collect Links for 1 click solution for you...

In main I am using "search function"...
search in Google
search in XDA

At the moment I am fail to bypass Security... with netOdin only

Rumour... because not really confirmed in public...
With USB cable connected and Odin use less Security check...

Search Strings...
Code:
AVB
vbmeta

No idea if you allready know Magisk?

Best Regards
 

TacoDeMuerte

Member
Feb 16, 2021
48
41

Here is Ramdisk of EVA8...

In wirelessd Binary we can find the Error messages...

Btw... this is the Binary which is called by Recovery Kernel to perform Download Wireless...

sboot.bin Bootloader shows text strings in Odin Mode...


@TacoDeMuerte
Really sorry.


I have not enough time nor enough energy to collect Links for 1 click solution for you...

In main I am using "search function"...
search in Google
search in XDA

At the moment I am fail to bypass Security... with netOdin only

Rumour... because not really confirmed in public...
With USB cable connected and Odin use less Security check...

Search Strings...
Code:
AVB
vbmeta

No idea if you allready know Magisk?

Best Regards
Thanks! I figured it would be a longshot, but thought I would ask. Searching things like, "How to root..." only produces the end result and not the process/work involved. I will search vbmeta and Magisk. I have used Magisk, but am unfamiliar with how it does it's "magic". I think I will also read some of your older posts on other roots to get an idea of what it takes. Anyway, I don't want to waste anymore of your time, so I will just say, thanks again for your work!
 
  • Like
Reactions: mrfatiga22

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Tried few more stupid things... but out of luck to bypass Security with netOdin only...

So I have no more ideas as USB...


Checklist...

Windows Driver needed (for my Test Notebook)

Found this:

Leads to this:

Odin I have somewhere on my PC... I hope...

Now charging Battery to 100 % before I will solder wires...
 

adfree

Senior Member
Jun 14, 2008
9,715
5,777
Samsung Galaxy Watch 4
Tiny progress...

Soldered wires with my old fat fingers...

2 times dump with RDX Tool...

First attempt with Odin unmodified TAR from Magisk 25.1

Flashing no problem... but Upload Mode comes...

So I will check the custom Kernel(s)...

Best Regards
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    A

    NO
    1 click Solution

    B

    netOdin
    AND
    Odin


    So at the moment USB connection required. Means 4 wires soldered to Watch...

    Feel free to find Solution without USB...
    My brain is too small.

    C

    Success only with old EVA8 and my SM-R870...

    If I have enough tested... then maybe 1 day in future will check newer Firmware(S)...


    D

    Magisk
    Version 24.3 patched successfully 2 files from Stock Firmware EVA8

    Code:
    boot.img
    vbmeta.img

    D.1

    My mistake was to use other device to Patch... SM-A202F Android 11...
    But this is wrong

    Better same or similar device...

    In my case I performed the Magisk step with SM-R860 FVD4

    D.2

    BUT
    additional step required to make it GW4 Security "compatible"...

    With Hex Editor of your choice... search for text string:
    Code:
    seandroid

    Remove last 11 MB... included the search text string...

    Look at attached boot.img

    E

    After Bootloader Unlock blabla stepS...

    netOdin for vbmeta TAR

    This force you to do Factory Reset in Recovery...

    WARNING!
    This is exact the step which kills Knox... so byebye warranty and some Apps...

    F

    NEXT/SECOND
    step is with ODIN and USB cable

    boot.img TAR

    G

    In next post(s) I will try to give more infos...
    Maybe Video Upload for Magisk step... because additional File Manager needed...


    Best Regards
    3
    Can I ask, why would root be good for thus device? What could we achieve from a actual root of a wear os watch?
    The same reason we root any device; to have full access to system resources without a naggy nanny telling us what we can and can't do with our own devices. With root, we can be creative. Without root, we have to follow rules.
    3
    Hmmm...

    If I search for verity I can find few Binaries...

    1 contain this for instance...

    Code:
    setup Overlayfs %s for %s failed with error %s
     : ERROR:  204 external/avb/libavb_ab/avb_ab_flow.c external/avb/libavb/avb_util.c : Too many loaded partitions.
     92 219 New OS instance detected - changing from 'eio' to 'restart' mode.
     Error getting unique GUID for partition.
     androidboot.veritymode.managed 158 Error loading footer from partition ' Error getting verity state. Try adb root first? 166 Error reading data.
     295 894 : Encountered chain descriptor not in main image.
     bootloader Cannot use A/B with a persistent root digest.
     sha256 androidboot.vbmeta.hash_alg 53 Descriptors not inside passed-in data.
     Invalid tag for kernel cmdline descriptor.
     Public key is not entirely in its block.
     244 %s only works for userdebug builds
     Error allocating memory for AvbABOps.
     48 Error reading A/B metadata.
     686 '.
     1067 87 : Hash of data does not match digest in descriptor.
     Invalid data in descriptors array.
     Error loading from partition ' Could not open block device %s (%s).
     Error setting verity 209 128 external/avb/libavb/avb_slot_verify.c assert fail: ret == AVB_SLOT_VERIFY_RESULT_OK
     728 798 856 376 : Persistent values are not implemented.
     212 215 1295 $(ANDROID_SYSTEM_PARTUUID) androidboot.vbmeta.device_state unlocked ignore_corruption Length is smaller than header.
     assert fail: (((uintptr_t)image_data) & (AVB_ALIGNMENT_SIZE - 1)) == 0
     set-verity-state called with empty argv " partition.
     210 1432 vbmeta 1163 sha512 assert fail: *out_image_buf == NULL
     Error getting device lock state.
     : Error initializing persistent digest.
     yes foreach_func is NULL
    . 164 Overflow while computing size of boot image.
     Error writing to partition ' 227 assert fail: dest == ret + total_length
     ERROR_OOM 1748 753 : Descriptor is invalid.
     997 sha1 androidboot.vbmeta.size eio 110 Mismatch between image version and libavb version.
     Invalid key.
     verity is already %s
     Could not set verity %s flag on device %s with error %s
     151 assert fail: avb_strcmp(slot_data->vbmeta_images[0].partition_name, "boot") == 0
     ERROR_IO 711 : Invalid rollback_index_location.
     136 : Persistent digest does not exist.
     255 75 AVBf assert fail: ops->validate_vbmeta_public_key != NULL
     : Error verifying vbmeta image: invalid vbmeta header
     772 513 : Digest in descriptor not of expected size.
     Overflow while adding up sizes.
     119 77 Release string does not end with a NUL byte.
     Invalid or unknown algorithm.
     external/avb/libavb/avb_rsa.c Padding length does not match hash and signature lengths.
     Could not make block device %s writable (%s).
     131 ERROR_PUBLIC_KEY_REJECTED 615 655 : VERIFICATION_DISABLED bit is set.
     988 : Error determining partition size.
     1273 1290 androidboot.vbmeta.digest Block size is not a multiple of 64.
     Signature is not entirely in its block.
     Invalid input.
     Key does not match expected length.
     115 Overlayfs %s failed with error %s
     Error getting AVB ops Failed to allocate memory.
     Overflow while determining total length.
     assert fail: ops->get_unique_guid_for_partition != NULL
     1544 : Partition size too large to load.
     Same OS instance detected - staying in 'eio' mode.
     69 external/avb/libavb/avb_footer.c 185 Verity already enabled on %s
     %s overlayfs for %s
     99 root=PARTUUID=$(ANDROID_SYSTEM_PARTUUID) 1620 (unknown) Partition name and suffix does not fit.
     659 882 344 : No digest, using persistent digest.
     439 273 1258 _ROOT_DIGEST) 435 74 Invalid tag for hashtree descriptor.
     65 SIGNATURE_MISMATCH '
     Now reboot your device for settings to take effect Magic is incorrect.
     : FATAL:  Persistent values required for AVB_HASHTREE_ERROR_MODE_MANAGED_RESTART_AND_EIO but are not implemented in given AvbOps.
     Error clearing avb.managed_verity_mode.
     56 58 105 54 Signature length does not match key length.
     Padding check failed.
     misc assert fail: slot_data->cmdline == NULL
     ERROR_INVALID_ARGUMENT : Image rollback index is less than the stored rollback index.
     86 1362 1256 Footer magic is incorrect.
     79 0 using external/avb/libavb_user/avb_ops_user.cpp 316 assert fail: ops->get_size_of_partition != NULL
     1518 : No footer detected.
     : Invalid vbmeta size in footer.
     : Chain partition descriptor is invalid.
     1218 assert fail: !*out_image_preloaded
     assert fail: digest_size <= AVB_SHA512_DIGEST_SIZE
     60 external/avb/libavb/avb_kernel_cmdline_descriptor.c 147 197 assert fail: slot_data != NULL
     : chained vbmeta image has non-zero flags
     : Loading entire partition.
     Error writing to avb.managed_verity_mode.
     337 image_data is NULL
    . 62 304 279 Device is locked. Please unlock the device first Error writing data.
     CRC32 does not match.
     125 1414 1463 ERROR_INVALID_METADATA 663 assert fail: vbmeta_num_read <= vbmeta_size
     : Error verifying vbmeta image:  tzsw 103 : Persistent digest is not of expected size.
     Error reading from avb.managed_verity_mode.
     enforcing 434 external/avb/libavb/avb_vbmeta_image.c Public key metadata is not entirely in its block.
     external/avb/libavb_user/avb_user_verity.c Error seeking to offset.
     Error opening " assert fail: ops->read_is_device_unlocked != NULL
     assert fail: ops->read_rollback_index != NULL
     assert fail: footer_num_read == AVB_FOOTER_SIZE
     : Error verifying vbmeta image: unsupported AVB version
     1055 Cannot use A/B with a persistent digest.
     207 androidboot.vbmeta.invalidate_on_error external/avb/libavb/avb_hashtree_descriptor.c 118 144 usage: %s [1|0]
     %s overlayfs
     enabled 276 assert fail: value != NULL
     1706 Unknown digest type : Error getting rollback index for location.
     System partition name and suffix does not fit.
     No dm-verity corruption - using in 'restart' mode.
     Unexpected number of bytes read from avb.managed_verity_mode.
     external/avb/libavb/avb_cmdline.c Error getting device state.
     Invalid tag for chain partition descriptor.
     assert fail: (((uintptr_t)dh) & (AVB_ALIGNMENT_SIZE - 1)) == 0
     external/avb/libavb/avb_hash_descriptor.c Hash is not entirely in its block.
     Hash does not match!
     ' does not look like a vbmeta footer.
     Verity %s on %s
     Error allocating memory for AvbOps.
     391 0123456789abcdef OK ERROR_UNSUPPORTED_VERSION : Error loading vbmeta data.
     733 : Public key used to sign data does not match key in chain partition descriptor.
     : Error while checking public key used to sign data.
     1128 419 461 1315 Error getting size of " Too many strings passed.
     Loading vbmeta struct in footer from partition ' 849 Partition name does not fit.
     : Read incorrect number of bytes.
     240 No system partition.
     assert fail: out_hashtree_error_mode != NULL
     assert fail: ops->read_persistent_value != NULL
     assert fail: ops->write_persistent_value != NULL
     1328 39 59 Error parsing key.
     /dev/block/by-name/ 284 No support for given major version.
     874 Rebooting because of dm-verity corruption - recording OS instance and using 'eio' mode.
     $(ANDROID_VBMETA_PARTUUID) 274 Invalid tag for hash descriptor.
     INVALID_VBMETA_HEADER 260 disable-verity 1 156 179 Error writing A/B metadata.
     : Public key used to sign data rejected.
     : Kernel cmdline descriptor is invalid.
     503 380 system No support for footer version.
     57 verity cannot be disabled/enabled - USER build Error validating A/B metadata from disk. Resetting and writing new A/B metadata to disk.
     742
     : Too many vbmeta images.
     132 447 : Error reading persistent digest.
     1265 1301 Unknown algorithm.
     1386 1388 627 assert fail: pk_data != NULL && pk_len > 0
     764 : Hashtree descriptor is invalid.
     1158 527 : Error loading data from partition.
     Boot image location and length mismatch.
     200 OK_NOT_SIGNED UNSUPPORTED_VERSION Unknown AvbVBMetaVerifyResult value.
     285 disabling 224 386 1389 1427 Requested partitions cannot be empty when using AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION 668 691 788 956 109 333 : Reading back initialized persistent digest failed!
     1352 androidboot.veritymode Descriptor size is not divisible by 8.
     250 disabled Loading vbmeta struct from partition ' assert fail: !is_main_vbmeta
     1006 : Chain partition has invalid rollback_index_location field.
     1146 314 1257 assert_not_reached()
     restart_on_corruption external/avb/libavb/avb_chain_partition_descriptor.c 63 91 205 teardown Couldn't find verity metadata! Overflow when adding values.
     assert fail: ops->read_from_partition != NULL
     593 : Error loading footer.
     : No such partition. Trying 'boot' instead.
     assert fail: slot_data->num_vbmeta_images == 0
     : Kernel cmdline is not valid UTF-8.
     170 84 androidboot.vbmeta.avb_version ignore_zero_blocks $(AVB_ Invalid rollback index location value.
     external/avb/libavb/avb_descriptor.c 96 66 Hash check failed.
     system/core/set-verity-state/set-verity-state.cpp enable-verity Insufficient buffer space.
     409 AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION was passed but the validate_public_key_for_partition() operation isn't implemented.
      Partition name is not valid UTF-8.
     834 avb.managed_verity_mode logging $(ANDROID_VERITY_MODE) assert fail: part_name_len < AVB_PART_NAME_MAX_SIZE
     Successfully %s verity
     Failed to read fstab 41 boot assert fail: is_main_vbmeta
     412 : Digest does not exist, device unlocked so not initializing digest.
     35 AVB0 100 assert fail: data.descriptor_number == num_descriptors
     266 Data from ' locked verity not enabled - ENG build 142 106 1387 Unknown AvbSlotVerifyResult value.
     891 assert fail: slot_data->num_vbmeta_images > 0
     898 1321 Invalid descriptor length.
     HASH_MISMATCH Verity already disabled on %s
     : 217 30 1385 ERROR_ROLLBACK_INDEX 804 1182 avb.persistent_digest. 248 : Digest does not exist, initializing persistent digest.
     261 Error getting unique GUID for system partition.
     $(ANDROID_BOOT_PARTUUID) androidboot.vbmeta.device Maybe run adb root? 322 Error closing file descriptor.
     ERROR_VERIFICATION : DEBUG:  923 ldfw : Unsupported hash algorithm.
     517 355 1359 PARTUUID=$(ANDROID_VBMETA_PARTUUID) 378 Descriptor payload size overflow.
     49 Block sizes add up to more than given length.
     124 Embedded hash has wrong size.
     Error allocating memory.
     Unexpected key length.
     ' does not look like a vbmeta header.
          /fstab.device   ro.boot.vbmeta.digest   ro.boot.slot_suffix     ro.secure       ro.boot.vbmeta.device_state  AB0

    Edit 1.

    Code:
    extracted\system_Original_EVB4\system\etc\security\fsverity\
    extracted\system_Original_EVB4\system\bin\disable-verity
    extracted\system_Original_EVB4\system\bin\enable-verity
    extracted\system_Original_EVB4\system\bin\fsverity
    extracted\system_Original_EVB4\system\bin\fsverity_init
    extracted\system_Original_EVB4\system\bin\set-verity-state
    extracted\system_Original_EVB4\system\etc\security\fsverity\fsverity-release.x509.der

    Edit 2.



    Code:
    D:\Android\ADB>adb shell
    freshbl:/ $ su
    freshbl:/ # disable-verity --help
    disable-verity only works for userdebug builds
    verity cannot be disabled/enabled - USER build
    
    
    ----------------------------------
    
    
    freshbl:/ # fsverity --help
    Usage:
      Enable fs-verity on a file:
        fsverity enable FILE
                   [--hash-alg=HASH_ALG] [--block-size=BLOCK_SIZE] [--salt=SALT]
                   [--signature=SIGFILE]
    
      Display the measurement of the given verity file(s):
        fsverity measure FILE...
    
      Sign a file for fs-verity:
        fsverity sign FILE OUT_SIGFILE --key=KEYFILE
                   [--hash-alg=HASH_ALG] [--block-size=BLOCK_SIZE] [--salt=SALT]
                   [--cert=CERTFILE]
    
      Standard options:
        fsverity --help
        fsverity --version
    
    Available hash algorithms: sha256, sha512
    See `man fsverity` for more details.
    
    
    
    -------------------------------------------
    
    
    freshbl:/ # fsverity_init --help
    
    
    ------------------------------------------
    
    
    freshbl:/ # set-verity-state --help
    usage: set-verity-state [1|0]

    Edit 3.

    Some Google search result...

    3
    The Magisk "creation"/patching part with GW4 device.

    A
    Magisk APK 24.3 successfully tested with my SM-R860 FVD4...

    Code:
    adb install Magisk-v24.3.apk


    B
    Magisk need Filemanager...
    I have installed 4 or 5 from Playstore via GW4... but ONLY this is working as it seems...

    File Explorer FTP Server
    from Nasai



    C

    I will make Video... how Magisk looks on SM-R860 aka GW4...
    Need some time...
    Will add later...


    D

    You can use Download folder... because Magisk stores result in Download...

    In other words:
    Code:
    /sdcard/Download
    3
    The same reason we root any device; to have full access to system resources without a naggy nanny telling us what we can and can't do with our own devices. With root, we can be creative. Without root, we have to follow rules.
    Fair enough
  • 4
    A

    NO
    1 click Solution

    B

    netOdin
    AND
    Odin


    So at the moment USB connection required. Means 4 wires soldered to Watch...

    Feel free to find Solution without USB...
    My brain is too small.

    C

    Success only with old EVA8 and my SM-R870...

    If I have enough tested... then maybe 1 day in future will check newer Firmware(S)...


    D

    Magisk
    Version 24.3 patched successfully 2 files from Stock Firmware EVA8

    Code:
    boot.img
    vbmeta.img

    D.1

    My mistake was to use other device to Patch... SM-A202F Android 11...
    But this is wrong

    Better same or similar device...

    In my case I performed the Magisk step with SM-R860 FVD4

    D.2

    BUT
    additional step required to make it GW4 Security "compatible"...

    With Hex Editor of your choice... search for text string:
    Code:
    seandroid

    Remove last 11 MB... included the search text string...

    Look at attached boot.img

    E

    After Bootloader Unlock blabla stepS...

    netOdin for vbmeta TAR

    This force you to do Factory Reset in Recovery...

    WARNING!
    This is exact the step which kills Knox... so byebye warranty and some Apps...

    F

    NEXT/SECOND
    step is with ODIN and USB cable

    boot.img TAR

    G

    In next post(s) I will try to give more infos...
    Maybe Video Upload for Magisk step... because additional File Manager needed...


    Best Regards
    3
    I've unlocked bootloader, got boot.img(hashes match in update.zip and my boot.img + it boots fine), patched it and vbmeta in tar by magisk 24.3, but when i flash new boot.img, it throws me "SECURE FAILED: BOOT" error on watch and system doesn't boot, flashing unpatched boot.img gets watch to work again. Why does it happen and is there any fix? SM-R860
    Files:
    3
    IMHO in 1 hour I can test...

    My Checklist...

    Code:
    A
    
    Reset SM-R870 Standalone
    No WiFi
    
    
    B
    
    *#9900#
    
    Upload enabled
    +
    Debug HIGH
    
    C
    
    Full charging
    
    
    D
    
    Bootloader unlock
    
    
    
    E
    
    netOdin Action

    I need 45 minutes for C... Charging...

    Then Bootloader Unlock... then I can try Magisk patched files... Version 25.1...
    3
    Tiny progress...

    Flashed successfully only patched vbmeta...

    This forced me to do Factory Reset from Recovery... necause some Error blabla...

    Bootloader unlock shows Warning Pic... blabla Custom...

    Now I have the second blabla not Samsung Official...

    So IMHO Knox is now dead...

    Code:
    D:\Android\ADB>adb shell getprop ro.boot.warranty_bit
    1

    Bootloader unlock alone not kill Knox... IMHO...
    Code:
    D:\Android\ADB>adb shell getprop ro.boot.warranty_bit
    0
    3
    The Magisk "creation"/patching part with GW4 device.

    A
    Magisk APK 24.3 successfully tested with my SM-R860 FVD4...

    Code:
    adb install Magisk-v24.3.apk


    B
    Magisk need Filemanager...
    I have installed 4 or 5 from Playstore via GW4... but ONLY this is working as it seems...

    File Explorer FTP Server
    from Nasai



    C

    I will make Video... how Magisk looks on SM-R860 aka GW4...
    Need some time...
    Will add later...


    D

    You can use Download folder... because Magisk stores result in Download...

    In other words:
    Code:
    /sdcard/Download