Smartwatch 2 firmware hacking

[RedDragonTaff]

I reanimated 2 SW2 with the download of the 3 system files from /res/raw in com.sonymobile.smartconnect.smartwatch2.apk
(before black screen from flashing system for SW1)
commands:
dfu-util -c 1 -i 0 -a 0 -s 0x08000000 -D bl.bin
dfu-util -c 1 -i 0 -a 0 -s 0x08040000 -D asw.bin
dfu-util -c 1 -i 0 -a 1 -s 0x01 -D fat.bin

For my SmartWatch 2, the first 2 steps run fine, but step three doesn't progress at all using the bl.bin, asw.bin, fat.bin I extracted from the apk. Here's the verbose console log from my failed step 3:

$ sudo ./dfu-util -c 1 -i 0 -a 0 -s 0x01 -D ../../SW2_unpack/res/raw/fat.bin -v
dfu-util 0.7

Copyright 2005-2008 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2012 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to [email protected]

Opening DFU capable USB device... ID 0fce:f0fa
Run-time device DFU version 011a
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=0, name="@Internal Flash /0x08000000/03*016Kg,01*016Kg,01*064Kg,07*128Kg,03*016Kg,01*016Kg,01*064Kg,07*128Kg"
Claiming USB DFU Interface...
Setting Alternate Setting #0 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 2048
No valid DFU suffix signature
Warning: File has no DFU suffix
DfuSe interface name: "Internal Flash "
Memory segment at 0x08000000 3 x 16384 = 49152 (rew)
Memory segment at 0x0800c000 1 x 16384 = 16384 (rew)
Memory segment at 0x08010000 1 x 65536 = 65536 (rew)
Memory segment at 0x08020000 7 x 131072 = 917504 (rew)
Memory segment at 0x08100000 3 x 16384 = 49152 (rew)
Memory segment at 0x0810c000 1 x 16384 = 16384 (rew)
Memory segment at 0x08110000 1 x 65536 = 65536 (rew)
Memory segment at 0x08120000 7 x 131072 = 917504 (rew)
Downloading to address = 0x00000001, size = 557300
Error: Last page at 0x000880f4 is not writeable


Did anyone successfully perform step 3 yet? If so can I grab you set of these 3 files to flash please?

Thanks

AL

 

[RedDragonTaff]

For my SmartWatch 2, the first 2 steps run fine, but step three doesn't progress at all using the bl.bin, asw.bin, fat.bin I extracted from the apk. Here's the verbose console log from my failed step 3:

$ sudo ./dfu-util -c 1 -i 0 -a 0 -s 0x01 -D ../../SW2_unpack/res/raw/fat.bin -v
dfu-util 0.7

Copyright 2005-2008 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2012 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to [email protected]

Opening DFU capable USB device... ID 0fce:f0fa
Run-time device DFU version 011a
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=0, name="@Internal Flash /0x08000000/03*016Kg,01*016Kg,01*064Kg,07*128Kg,03*016Kg,01*016Kg,01*064Kg,07*128Kg"
Claiming USB DFU Interface...
Setting Alternate Setting #0 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 2048
No valid DFU suffix signature
Warning: File has no DFU suffix
DfuSe interface name: "Internal Flash "
Memory segment at 0x08000000 3 x 16384 = 49152 (rew)
Memory segment at 0x0800c000 1 x 16384 = 16384 (rew)
Memory segment at 0x08010000 1 x 65536 = 65536 (rew)
Memory segment at 0x08020000 7 x 131072 = 917504 (rew)
Memory segment at 0x08100000 3 x 16384 = 49152 (rew)
Memory segment at 0x0810c000 1 x 16384 = 16384 (rew)
Memory segment at 0x08110000 1 x 65536 = 65536 (rew)
Memory segment at 0x08120000 7 x 131072 = 917504 (rew)
Downloading to address = 0x00000001, size = 557300
Error: Last page at 0x000880f4 is not writeable


Did anyone successfully perform step 3 yet? If so can I grab you set of these 3 files to flash please?

Thanks

AL

Sorry typo, should have used:
$ sudo ./dfu-util -c 1 -i 0 -a 1 -s 0x01 -D ../../SW2_unpack/res/raw/fat.bin -v

This flashes the eMMC partition. Now the watch boots without showing the FlashFS, but instead I see a progress bar and as it almost reaches the end the watch reboots and the cycle starts again. Endless progress bar reaching almost 100% and reboot, <repeat>.

Does anyone else see this?

AL

 

[nokodanox]

Hi everyone!
Sorry for re-open this thread but, I have a Flash FS problem with my SmartWatch 2.
I tried everything about using the DFU for Downloading the 3 .bin files. And I'm having troubles with the last one (fat.bin) while trying to write on the "eMMC" with this command:

dfu-util -c 1 -i 0 -a 1 -s 0x01 -D fat.bin -v

I can run successfully this two commands but I'm stuck now with the last step:

dfu-util -c 1 -i 0 -a 0 -s 0x08000000 -D bl.bin
dfu-util -c 1 -i 0 -a 0 -s 0x08040000 -D asw.bin

This is what I get.

"Opening DFU capable USB device... ID 0fce:f0fa
Run-time device DFU version 011a
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=1, name="@eMMC /0x00000000/01*512Mg"
Claiming USB DFU Interface...
Setting Alternate Setting #1 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 2048
No valid DFU suffix signature
Warning: File has no DFU suffix
DfuSe interface name: "eMMC "
Memory segment at 0x00000000 1 x 536870912 = 536870912 (rew)
Downloading to address = 0x00000001, size = 557300
Download from image offset 00000000 to memory 00000001-00000800, size 2048
Poll timeout 0 ms
Error during download get_status
Failed to write whole chunk: -7 of 2048 bytes"

Hope someone could help me unbrick this Smartwatch, If anyone could help me doing it, I would like to send a small gift via PayPal.
Thank you so much, waiting for your answers...

 

[heartofgearz]

hey, im getting the same error as yours.."Failed to write whole chunk: -7 of 2048 bytes" when writing the fat.bin file, did you fix yours?