I'm trying to get the Ticwatch Pro 4g Verizon (WF11026V) working on a non-Verizon carrier. From other threads, it seems that by faking the SIM of the phone to the officially supported carrier, it's possible to scan an eSIM QR code and it typically works - or at least for the EU versions. I've had no such luck on the Verizon one. Does anyone know more? And does anyone have a EU modem firmware image they can share, in case that is the main difference? (and maybe also modemst1 - though note that this probably includes your IMEI config)
Random technical notes below, which might be useful for people trying similar things:
Janjan's EU ROM (at least the December version) flashes fine on the US version. Without an active Verizon subscription I can't test if the wireless works. Interestingly, Janjan's US ROM just bootloops on the US watch. I did not flash aboot (which contains the fastboot bootloader) out of an abundance of caution, but it seems everything still works with stock aboot.
On the EU versions, there's TicEsimFix, which uses Xposed to change the CarrierId to 28 (Vodafone UK). For those wondering how it works - although sadly it's not open-source (or at least the source isn't easy to find) - it seems to use Xposed's findAndHookMethod to replace the result of TelephonyManager.getSimCarrierId with 28.
This has no effect on the Verizon watch, either in the Mobvoi app or the WearOS app, and either using id=28 or with a Verizon MVNO SIM that reports id=1839 (Verizon). In fact, the WearOS debug logs suggest that the watch is not eSIM capable - 'no eSIM devices found'.
It also appears EU versions have an eSIM assistant app on the watch that doesn't appear on the US version - but even though it's running an EU ROM that isn't showing up. So what if we made it think it was an EU watch? The main differentiator seemed to be in the model number, and it turns out if you change the model to the EU one (WF11018) in the /oem partition, that app shows up after a factory reset. (note - you'll have to remount oem as rw, by default it's mounted as ro - IF YOU TRY THIS MAKE SURE TO BACK UP YOUR PARTITIONS - you can directly adb pull partition images from /dev/block/by-name if in TWRP, it's more complicated from WearOS since adb does not have root permissions)
For the curious, changing props ro.boot.hardware.sku and ro.oem.tw.cmodel (through MagiskHidePropsConf) do not seem to be effective
But launching the app causes it immediately crash. ADB logcat shows this:
The Mobvoi app also allows "Scan QR code", but the watch just says "Download Fail". ADB logcat shows this:
This would suggest that it is able to communicate with the eSIM, but it's getting an invalid response. So the possibilities I can think of are:
1) There's some firmware issue between the app and the eSIM that is causing issues. Perhaps the modem firmware is blocking something - so I'm interested in acquiring an EU modem firmware and trying to flash it. This would be weird in that it's not blocking communication with the SIM completely, but blocking certain functionality.
2) The Verizon watch has a different eSIM chip (or different hardware in general), and it's not possible to use it with a different carrier without hardware mods like soldering in a new eSIM. Could the eSIM just mean a non-rewritable SIM that's just embedded onto the board?
3) The eSIM is somehow locked (is this even a thing? - can it be unlocked and reset? - especially if we have root we can probably send arbitrary commands to the eSIM). The logs above suggest every APDU command - even benign ones like get profiles and EID - is returning 6985, which apparently is an error code.
Any ideas?
Random technical notes below, which might be useful for people trying similar things:
Janjan's EU ROM (at least the December version) flashes fine on the US version. Without an active Verizon subscription I can't test if the wireless works. Interestingly, Janjan's US ROM just bootloops on the US watch. I did not flash aboot (which contains the fastboot bootloader) out of an abundance of caution, but it seems everything still works with stock aboot.
On the EU versions, there's TicEsimFix, which uses Xposed to change the CarrierId to 28 (Vodafone UK). For those wondering how it works - although sadly it's not open-source (or at least the source isn't easy to find) - it seems to use Xposed's findAndHookMethod to replace the result of TelephonyManager.getSimCarrierId with 28.
This has no effect on the Verizon watch, either in the Mobvoi app or the WearOS app, and either using id=28 or with a Verizon MVNO SIM that reports id=1839 (Verizon). In fact, the WearOS debug logs suggest that the watch is not eSIM capable - 'no eSIM devices found'.
It also appears EU versions have an eSIM assistant app on the watch that doesn't appear on the US version - but even though it's running an EU ROM that isn't showing up. So what if we made it think it was an EU watch? The main differentiator seemed to be in the model number, and it turns out if you change the model to the EU one (WF11018) in the /oem partition, that app shows up after a factory reset. (note - you'll have to remount oem as rw, by default it's mounted as ro - IF YOU TRY THIS MAKE SURE TO BACK UP YOUR PARTITIONS - you can directly adb pull partition images from /dev/block/by-name if in TWRP, it's more complicated from WearOS since adb does not have root permissions)
For the curious, changing props ro.boot.hardware.sku and ro.oem.tw.cmodel (through MagiskHidePropsConf) do not seem to be effective
But launching the app causes it immediately crash. ADB logcat shows this:
Code:
10-04 03:42:01.266 4978 4978 D LpaApplication: onCreate
10-04 03:42:01.454 4978 4978 D TicPhoneStateListener: service state = {mVoiceRegState=1(OUT_OF_SERVICE), mDataRegState=1(OUT_OF_SERVICE), mChannelNumber=-1, duplexMode()=0, mCellBandwidths=[], mVoiceRoamingType=home, mDataRoamingType=home, mVoiceOperatorAlphaLong=, mVoiceOperatorAlphaShort=, mDataOperatorAlphaLong=, mDataOperatorAlphaShort=, isManualNetworkSelection=false(automatic), mRilVoiceRadioTechnology=0(Unknown), mRilDataRadioTechnology=0(Unknown), mCssIndicator=unsupported, mNetworkId=-1, mSystemId=-1, mCdmaRoamingIndicator=-1, mCdmaDefaultRoamingIndicator=-1, mIsEmergencyOnly=false, mIsDataRoamingFromRegistration=false, mIsUsingCarrierAggregation=false, mLteEarfcnRsrpBoost=0, mNetworkRegistrationStates=[NetworkRegistrationState{transportType=1 domain=CS regState=NOT_REG_SEARCHING accessNetworkTechnology=UNKNOWN reasonForDenial=0 emergencyEnabled=false supportedServices=null cellIdentity=null voiceSpecificStates=VoiceSpecificRegistrationStates { mCssSupported=false mRoamingIndicator=-1 mSystemIsInPrl=-1 mDefaultRoamingIndicator=-1} dataSpecificStates=null}, NetworkRegistrationState{transportType=1 domain=PS regState=NOT_REG_NOT_SEARCHING accessNetworkTechnology=UNKNOWN reasonForDenial=0 emergencyEnabled=false supportedServices=null cellIdentity=null voiceSpecificStates=null dataSpecificStates=DataSpecificRegistrationStates { mMaxDataCalls=20}}]}
10-04 03:42:01.458 4978 4978 I LpaApplication: Proxy service connect state changed: 2
10-04 03:42:01.459 4978 4978 I ServiceConnector: [mps] service connected, cn: ComponentInfo{com.mobvoi.companion.aw/com.mobvoi.wear.msgproxy.server.AwWearMessageProxyService}, mConnectLost: false
10-04 03:42:02.136 4978 4978 D TelMgr : TelMgrReader hasIcc true
10-04 03:42:02.137 4978 4978 D TelMgr : sendTerminalCapaCmdToICCcard
10-04 03:42:02.148 1461 1490 I ActivityManager: Displayed com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity: +1s101ms
10-04 03:42:02.170 4978 4978 D TelMgr : iccTransmitApduBasicChannel response is 9000
10-04 03:42:02.171 4978 4978 D TelMgr : TelMgrReader: sendTerminalCapaCmdToICCcard 9000
10-04 03:42:02.221 4978 4978 D TelMgr : TelMgrReader:iccOpenLogicalChannel Channel: 2 Status: 1
10-04 03:42:02.223 4978 4978 D RealCardService: getGsmaV4Card, cardValid: falsecard Connected: true
10-04 03:42:02.237 4978 4978 I ES10c :
10-04 03:42:02.237 4978 4978 I ES10c :
10-04 03:42:02.237 4978 4978 I ES10c : Get profiles info request:
10-04 03:42:02.237 4978 4978 I ES10c : Full:
10-04 03:42:02.237 4978 4978 I ES10c : BF2D035C015A
10-04 03:42:02.239 4978 4978 D TelMgr : >> 80E2910006BF2D035C015A
10-04 03:42:02.240 4978 4978 D TelMgr : Channel 2, class 128, p1 145, p2 0, p3 6 data BF2D035C015A
10-04 03:42:02.277 4978 4978 D TelMgr : sendCommand response 6985
10-04 03:42:02.279 4978 4978 D TelMgr : << 6985
10-04 03:42:02.287 4978 4978 D TelMgr : close: Channel: 2 Status: 1
10-04 03:42:02.316 4978 4978 I GSMAv4Card: Closed connection to card
10-04 03:42:02.320 4978 4978 E RealCardService: Refresh profiles failed,
10-04 03:42:02.320 4978 4978 E RealCardService: java.lang.RuntimeException: b.c.c.a.a.a.j: Get profiles info problem
10-04 03:42:02.320 4978 4978 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.x.i(RealCardService.java:11)
10-04 03:42:02.320 4978 4978 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.x.a(RealCardService.java:15)
10-04 03:42:02.320 4978 4978 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.CardService.onCreate(CardService.java:6)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.app.ActivityThread.handleCreateService(ActivityThread.java:3533)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.app.ActivityThread.access$1300(ActivityThread.java:200)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1667)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.os.Handler.dispatchMessage(Handler.java:106)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.os.Looper.loop(Looper.java:193)
10-04 03:42:02.320 4978 4978 E RealCardService: at android.app.ActivityThread.main(ActivityThread.java:6680)
10-04 03:42:02.320 4978 4978 E RealCardService: at java.lang.reflect.Method.invoke(Native Method)
10-04 03:42:02.320 4978 4978 E RealCardService: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
10-04 03:42:02.320 4978 4978 E RealCardService: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)
10-04 03:42:02.320 4978 4978 E RealCardService: Caused by: b.c.c.a.a.a.j: Get profiles info problem
10-04 03:42:02.320 4978 4978 E RealCardService: at b.c.c.a.a.a.m.a(Es10cImpl.java:38)
10-04 03:42:02.320 4978 4978 E RealCardService: at b.c.c.a.a.a.q.a(LocalProfileManagment.java:3)
10-04 03:42:02.320 4978 4978 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.x.i(RealCardService.java:6)
10-04 03:42:02.320 4978 4978 E RealCardService: ... 11 more
10-04 03:42:02.320 4978 4978 E RealCardService: Caused by: b.c.c.a.a.a.j: Invalid APDU response: 6985
10-04 03:42:02.320 4978 4978 E RealCardService: at b.c.c.a.a.a.n.a(GsmaV4Card.java:13)
10-04 03:42:02.320 4978 4978 E RealCardService: at b.c.c.a.a.a.h.a(CardAwareEndpoint.java:3)
10-04 03:42:02.320 4978 4978 E RealCardService: at b.c.c.a.a.a.m.a(Es10cImpl.java:8)
10-04 03:42:02.320 4978 4978 E RealCardService: ... 13 more
10-04 03:42:02.335 4978 4978 D Management: onService Connected
10-04 03:42:02.338 4978 4978 D TelMgrReader: isCardPresent? true
10-04 03:42:02.414 4978 5000 D TelMgr : TelMgrReader:iccOpenLogicalChannel Channel: 2 Status: 1
10-04 03:42:02.415 4978 5000 I RealCardService: TelMgrReader connected!
10-04 03:42:02.416 4978 5000 D TelMgr : >> 82E2910003BF2200
10-04 03:42:02.417 4978 5000 D TelMgr : Channel 2, class 130, p1 145, p2 0, p3 3 data BF2200
10-04 03:42:02.449 4978 5000 D TelMgr : sendCommand response 6985
10-04 03:42:02.451 4978 5000 D TelMgr : << 6985
10-04 03:42:02.453 4978 5000 D TelMgr : close: Channel: 2 Status: 1
10-04 03:42:02.480 4978 5000 I GSMAv4Card: Closed connection to card
10-04 03:42:02.490 4978 5000 E ProfileListFragment:
10-04 03:42:02.490 4978 5000 E ProfileListFragment: java.lang.RuntimeException: b.c.c.a.a.a.j: Get eUICC FW problem
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at com.mobvoi.ticwear.lpa.euicc.card.x.d(RealCardService.java:6)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at com.mobvoi.ticwear.lpa.euicc.card.CardService.d(CardService.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at b.c.c.a.e.b.call(Unknown Source:2)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.j$a.onNext(OnSubscribeMap.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.z$a.onNext(OperatorSubscribeOn.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.e.a(NotificationLite.java:9)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e$b.a(SubjectSubscriptionManager.java:13)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e$b.a(SubjectSubscriptionManager.java:3)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e$b.b(SubjectSubscriptionManager.java:6)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.a.a(BehaviorSubject.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.a.call(BehaviorSubject.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e.a(SubjectSubscriptionManager.java:14)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e.a(SubjectSubscriptionManager.java:5)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.e.call(SubjectSubscriptionManager.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.i.a(OnSubscribeLift.java:3)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.i.call(OnSubscribeLift.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.h.b(Observable.java:7)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.d.a.z$a.call(OperatorSubscribeOn.java:4)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at f.a.b.b$b.run(LooperScheduler.java:1)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at android.os.Handler.handleCallback(Handler.java:873)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at android.os.Handler.dispatchMessage(Handler.java:99)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at android.os.Looper.loop(Looper.java:193)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at android.os.HandlerThread.run(HandlerThread.java:65)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: Caused by: b.c.c.a.a.a.j: Get eUICC FW problem
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at b.c.c.a.a.a.m.f(Es10cImpl.java:7)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at b.c.c.a.a.a.q.b(LocalProfileManagment.java:3)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at com.mobvoi.ticwear.lpa.euicc.card.x.d(RealCardService.java:5)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: ... 22 more
10-04 03:42:02.490 4978 5000 E ProfileListFragment: Caused by: b.c.c.a.a.a.j: Invalid APDU response: 6985
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at b.c.c.a.a.a.n.a(GsmaV4Card.java:13)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: at b.c.c.a.a.a.m.f(Es10cImpl.java:2)
10-04 03:42:02.490 4978 5000 E ProfileListFragment: ... 24 more
10-04 03:42:02.500 4978 5000 D Es10c : GetEid
10-04 03:42:02.552 4978 5000 D TelMgr : TelMgrReader:iccOpenLogicalChannel Channel: 2 Status: 1
10-04 03:42:02.553 4978 5000 I RealCardService: TelMgrReader connected!
10-04 03:42:02.554 4978 5000 I ES10c :
10-04 03:42:02.554 4978 5000 I ES10c :
10-04 03:42:02.554 4978 5000 I ES10c : Get EID request:
10-04 03:42:02.554 4978 5000 I ES10c : Full:
10-04 03:42:02.554 4978 5000 I ES10c : BF3E035C015A
10-04 03:42:02.556 4978 5000 D TelMgr : >> 82E2910006BF3E035C015A
10-04 03:42:02.557 4978 5000 D TelMgr : Channel 2, class 130, p1 145, p2 0, p3 6 data BF3E035C015A
10-04 03:42:02.614 4978 5000 D TelMgr : sendCommand response 6985
10-04 03:42:02.616 4978 5000 D TelMgr : << 6985
10-04 03:42:02.617 4978 5000 D TelMgr : close: Channel: 2 Status: 1
10-04 03:42:02.647 4978 5000 I GSMAv4Card: Closed connection to card
10-04 03:42:02.654 4978 5000 E AndroidRuntime: FATAL EXCEPTION: Apdu
10-04 03:42:02.654 4978 5000 E AndroidRuntime: Process: com.mobvoi.wear.lpa.aw, PID: 4978
10-04 03:42:02.654 4978 5000 E AndroidRuntime: java.lang.IllegalStateException: Exception thrown on Scheduler.Worker thread. Add `onError` handling.
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.a.b.b$b.run(LooperScheduler.java:3)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:873)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:99)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at android.os.Looper.loop(Looper.java:193)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at android.os.HandlerThread.run(HandlerThread.java:65)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: Caused by: f.b.f: b.c.c.a.a.a.j: Get profiles info problem
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.d.c$a.a(InternalObservableUtils.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.d.c$a.call(InternalObservableUtils.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.d.b.onError(ActionSubscriber.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.e.a.a(SafeSubscriber.java:2)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.e.a.onError(SafeSubscriber.java:4)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.j$a.onError(OnSubscribeMap.java:4)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.j$a.onNext(OnSubscribeMap.java:5)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.z$a.onNext(OperatorSubscribeOn.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.e.a(NotificationLite.java:9)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e$b.a(SubjectSubscriptionManager.java:13)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e$b.a(SubjectSubscriptionManager.java:3)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e$b.b(SubjectSubscriptionManager.java:6)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.a.a(BehaviorSubject.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.a.call(BehaviorSubject.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e.a(SubjectSubscriptionManager.java:14)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e.a(SubjectSubscriptionManager.java:5)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.e.call(SubjectSubscriptionManager.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.i.a(OnSubscribeLift.java:3)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.i.call(OnSubscribeLift.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.h.b(Observable.java:7)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.z$a.call(OperatorSubscribeOn.java:4)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.a.b.b$b.run(LooperScheduler.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: ... 4 more
10-04 03:42:02.654 4978 5000 E AndroidRuntime: Caused by: java.lang.RuntimeException: b.c.c.a.a.a.j: Get profiles info problem
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at com.mobvoi.ticwear.lpa.euicc.card.x.a(RealCardService.java:52)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at com.mobvoi.ticwear.lpa.euicc.card.CardService.a(CardService.java:4)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.e.m.call(Unknown Source:2)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at f.d.a.j$a.onNext(OnSubscribeMap.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: ... 19 more
10-04 03:42:02.654 4978 5000 E AndroidRuntime: Caused by: b.c.c.a.a.a.j: Get profiles info problem
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.a.a.m.e(Es10cImpl.java:8)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.a.a.q.a(LocalProfileManagment.java:1)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at com.mobvoi.ticwear.lpa.euicc.card.x.a(RealCardService.java:51)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: ... 22 more
10-04 03:42:02.654 4978 5000 E AndroidRuntime: Caused by: b.c.c.a.a.a.j: Invalid APDU response: 6985
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.a.a.n.a(GsmaV4Card.java:13)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.a.a.h.a(CardAwareEndpoint.java:3)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: at b.c.c.a.a.a.m.e(Es10cImpl.java:4)
10-04 03:42:02.654 4978 5000 E AndroidRuntime: ... 24 more
10-04 03:42:02.666 1461 2061 W ActivityManager: Force finishing activity com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity
10-04 03:42:02.731 4978 5000 I Process : Sending signal. PID: 4978 SIG: 9
10-04 03:42:02.784 1461 1475 I WindowManager: WIN DEATH: Window{c241991 u0 com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity}
10-04 03:42:02.762 365 524 I chatty : uid=1000(system) HwBinder:365_1 identical 1 line
10-04 03:42:02.784 1461 1566 W InputDispatcher: channel 'c241991 com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity (server)' ~ Consumer closed input channel or an error occurred. events=0x9
10-04 03:42:02.784 1461 1566 E InputDispatcher: channel 'c241991 com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity (server)' ~ Channel is unrecoverably broken and will be disposed!
10-04 03:42:02.784 1461 1475 W InputDispatcher: Attempted to unregister already unregistered input channel 'c241991 com.mobvoi.wear.lpa.aw/com.mobvoi.ticwear.lui.LpaAwMainActivity (server)'
10-04 03:42:02.787 1461 1886 I ActivityManager: Process com.mobvoi.wear.lpa.aw (pid 4978) has died: cch CRE
10-04 03:42:02.792 351 351 I Zygote : Process 4978 exited due to signal (9)
10-04 03:42:02.792 1461 1485 W libprocessgroup: kill(-4978, 9) failed: No such process
10-04 03:42:02.792 1461 1485 I libprocessgroup: Successfully killed process cgroup uid 10024 pid 4978 in 4msThe Mobvoi app also allows "Scan QR code", but the watch just says "Download Fail". ADB logcat shows this:
Code:
10-05 03:02:58.850 18870 18890 D TelMgr : TelMgrReader:iccOpenLogicalChannel Channel: 2 Status: 1
10-05 03:02:58.850 18870 18890 I RealCardService: TelMgrReader connected!
10-05 03:02:58.851 18870 18890 I LPALight: Started
10-05 03:02:58.851 18870 18890 D TelMgr : >> 82E2910003BF2000
10-05 03:02:58.852 18870 18890 D TelMgr : Channel 2, class 130, p1 145, p2 0, p3 3 data BF2000
10-05 03:02:58.879 18870 18890 D TelMgr : sendCommand response 6985
10-05 03:02:58.879 18870 18890 D TelMgr : << 6985
10-05 03:02:58.881 18870 18890 D TelMgr : close: Channel: 2 Status: 1
10-05 03:02:58.899 18870 18890 I GSMAv4Card: Closed connection to card
10-05 03:03:04.907 18870 18870 D RealCardService: updateUI
10-05 03:03:04.910 18870 18870 D DownloadActivity: Download error: Invalid APDU response: 6985: Invalid APDU response: 6985
10-05 03:03:04.955 18870 18890 D TelMgr : TelMgrReader:iccOpenLogicalChannel Channel: 2 Status: 1
10-05 03:03:04.956 18870 18890 I RealCardService: TelMgrReader connected!
10-05 03:03:04.958 18870 18890 D TelMgr : >> 82E2910003BF2800
10-05 03:03:04.959 18870 18890 D TelMgr : Channel 2, class 130, p1 145, p2 0, p3 3 data BF2800
10-05 03:03:04.995 18870 18890 D TelMgr : sendCommand response 6985
10-05 03:03:04.996 18870 18890 D TelMgr : << 6985
10-05 03:03:04.997 18870 18890 D TelMgr : close: Channel: 2 Status: 1
10-05 03:03:05.016 18870 18890 I GSMAv4Card: Closed connection to card
10-05 03:03:05.018 18870 18890 E RealCardService: Error while processing notifications
10-05 03:03:05.018 18870 18890 E RealCardService: b.c.c.a.a.a.j: Invalid APDU response: 6985
10-05 03:03:05.018 18870 18890 E RealCardService: at b.c.c.a.a.a.n.a(GsmaV4Card.java:13)
10-05 03:03:05.018 18870 18890 E RealCardService: at b.c.c.a.a.a.l.a(Es10bImpl.java:164)
10-05 03:03:05.018 18870 18890 E RealCardService: at b.c.c.a.a.a.r.a(NotificationManagment.java:1)
10-05 03:03:05.018 18870 18890 E RealCardService: at b.c.c.a.a.a.r.a(NotificationManagment.java:7)
10-05 03:03:05.018 18870 18890 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.x.h(RealCardService.java:1)
10-05 03:03:05.018 18870 18890 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.r.a(RealCardService.java:20)
10-05 03:03:05.018 18870 18890 E RealCardService: at com.mobvoi.ticwear.lpa.euicc.card.d.call(Unknown Source:4)
10-05 03:03:05.018 18870 18890 E RealCardService: at f.d.d.b.onNext(ActionSubscriber.java:1)
10-05 03:03:05.018 18870 18890 E RealCardService: at f.e.a.onNext(SafeSubscriber.java:2)
10-05 03:03:05.018 18870 18890 E RealCardService: at f.d.a.w$a.call(OperatorObserveOn.java:8)
10-05 03:03:05.018 18870 18890 E RealCardService: at f.a.b.b$b.run(LooperScheduler.java:1)
10-05 03:03:05.018 18870 18890 E RealCardService: at android.os.Handler.handleCallback(Handler.java:873)
10-05 03:03:05.018 18870 18890 E RealCardService: at android.os.Handler.dispatchMessage(Handler.java:99)
10-05 03:03:05.018 18870 18890 E RealCardService: at android.os.Looper.loop(Looper.java:193)
10-05 03:03:05.018 18870 18890 E RealCardService: at android.os.HandlerThread.run(HandlerThread.java:65)
10-05 03:03:05.020 18870 18890 D RealCardService: execute event: downloadThis would suggest that it is able to communicate with the eSIM, but it's getting an invalid response. So the possibilities I can think of are:
1) There's some firmware issue between the app and the eSIM that is causing issues. Perhaps the modem firmware is blocking something - so I'm interested in acquiring an EU modem firmware and trying to flash it. This would be weird in that it's not blocking communication with the SIM completely, but blocking certain functionality.
2) The Verizon watch has a different eSIM chip (or different hardware in general), and it's not possible to use it with a different carrier without hardware mods like soldering in a new eSIM. Could the eSIM just mean a non-rewritable SIM that's just embedded onto the board?
3) The eSIM is somehow locked (is this even a thing? - can it be unlocked and reset? - especially if we have root we can probably send arbitrary commands to the eSIM). The logs above suggest every APDU command - even benign ones like get profiles and EID - is returning 6985, which apparently is an error code.
Any ideas?
