You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is not possible to archive right now. The stock bootloader does not support read.
And to install a new bootloader the flash and bootloader gets erased. So after flashing it there is nothing to dump anymore.
The only thing possible to backup it the stock Bootloader. That one is already known and same for many DaFit devices.
But what about reading the stock boot loader using openocd (or gdb with Black Magic?):
When I try to dump I get Unknown device. Maybe newer P8 watches has read protection bit set ?:
flash read_bank 0 flash-bank0.bin
Unknown device: nRF51xxx (HWID 0x00000000) 0kB Flash, 0kB RAM
wrote 0 bytes to file flash-bank0.bin from flash bank 0 at offset 0x00000000 in 7.190152s (0.000 KiB/s)
Do you happen to have a dump of the stock boot loader ? And will it be possible to recover original firmware using Da Fit software if we re-install the stock boot loader ?
Every Smartwatch from DaFit has the Read Protection bit set so it is needed to recovery the nRF wich also does erase the flash.
I have the stock bootloader and used it to have a way to go simply back and retry while developing, i can not share it.
The Stock Bootloader does not have any BLE functions included so it relies on the Firmware that will download the new Firmware to external flash, that means it is not possible to go back to stock with only the Bootloader flashed.
You are right, ATC1441. Once I flashed your hacked boot loader, the flash was accessible.
I assume the only way to get the boot loader is to craft a special image with a firmware dumper that is loaded by the existing firmware. I was only thinking about this to be able to compare when debugging. But since most of the hardware is already identified, I's not strictly necessary.
The Flash is unlocked after the Hacked bootloader as it clears the UICR registers while flashing.
The idea with the special firmware dumper is possible but not needed anymore as this is already done :) and only the bootloader can be dumped that way.
On Mon, Aug 17, 2020 at 5:00 AM atc1441 wrote:
The Stock Bootloader does not have any BLE functions included so it relies
on the Firmware that will download the new Firmware to external flash, that
means it is not possible to go back to stock with only the Bootloader
flashed.
I'm sorry, I'm lost.
So you write here that stock FW is flashed to the SPI flash. But the recipe
here: https://bloglon.blogspot.com/2020/07/p8-smartwatch-research.html
proposes to flash the stock ROM with nRF connect to the app area which is
0x23000 for the s132v5.0.1 .
I also took a look at the stock FW I acquired with the app (meanwhile
learning Radare2).
~~ (((According to the Vector table it should be put to another area: 0x1FA00 which is bizarre. ))) ~~ EDIT: This appeared to be completely wrong.
Would you clarify a little for me?
Thanks in advance.
So the stock bootloader needs the new firmware on external flash.
When already on the custom bootloader and you want to go back to stock you need to flash it to 0x23000 internaly. That is what the stock bootloader does as well.
Just mentioning when going back to stock on a closed watch you can not flash anything else every again ota. You need to open the watch then
On Tue, Sep 29, 2020 at 4:29 AM atc1441 wrote:
So the stock bootloader needs the new firmware on external flash.
I see. But as we lost that to the moment, that doesn't matter.
When already on the custom bootloader and you want to go back to stock you
need to flash it to 0x23000 internaly. That is what the stock bootloader
does as well.
Great!
~~ ((( But what's kinda suspicious to me is that stock FW has 0x2043xx in its vector table. ))) ~~ EDIT: This appeared to be completely wrong.
It is beyond internal flash and I may guess it is the
external (SPI) flash area. That makes me wonder how it works...
BTW I guess that resetting UICR and erasing internal flash still saved SPI.
Did you manage to backup it?
Just mentioning when going back to stock on a closed watch you can not
flash anything else every again ota. You need to open the watch then
Yep, warned already. We still need a good custom BL to make it more flexible.
If you want, we can go on discussing in Gitter.
Thanks again!
The Stock Bootloader does not have any BLE functions included so it relies on the Firmware that will download the new Firmware to external flash, that means it is not possible to go back to stock with only the Bootloader flashed.
Can't the stock firmware be populated in the external flash before the stock bootloader is flashed, and then the stock bootloader will finish the job? Thereby returning to a factory-like state where firmware updates remain possible...
Activity
goddade commentedon Aug 16, 2020
+1
atc1441 commentedon Aug 16, 2020
This is not possible to archive right now. The stock bootloader does not support read.
And to install a new bootloader the flash and bootloader gets erased. So after flashing it there is nothing to dump anymore.
The only thing possible to backup it the stock Bootloader. That one is already known and same for many DaFit devices.
suphammer commentedon Aug 16, 2020
Hi atc1441,
But what about reading the stock boot loader using openocd (or gdb with Black Magic?):
When I try to dump I get Unknown device. Maybe newer P8 watches has read protection bit set ?:
Do you happen to have a dump of the stock boot loader ? And will it be possible to recover original firmware using Da Fit software if we re-install the stock boot loader ?
atc1441 commentedon Aug 16, 2020
Every Smartwatch from DaFit has the Read Protection bit set so it is needed to recovery the nRF wich also does erase the flash.
I have the stock bootloader and used it to have a way to go simply back and retry while developing, i can not share it.
The Stock Bootloader does not have any BLE functions included so it relies on the Firmware that will download the new Firmware to external flash, that means it is not possible to go back to stock with only the Bootloader flashed.
suphammer commentedon Aug 17, 2020
You are right, ATC1441. Once I flashed your hacked boot loader, the flash was accessible.
I assume the only way to get the boot loader is to craft a special image with a firmware dumper that is loaded by the existing firmware. I was only thinking about this to be able to compare when debugging. But since most of the hardware is already identified, I's not strictly necessary.
atc1441 commentedon Aug 17, 2020
The Flash is unlocked after the Hacked bootloader as it clears the UICR registers while flashing.
The idea with the special firmware dumper is possible but not needed anymore as this is already done :) and only the bootloader can be dumped that way.
ildar commentedon Sep 28, 2020
atc1441 commentedon Sep 28, 2020
Hey.
So the stock bootloader needs the new firmware on external flash.
When already on the custom bootloader and you want to go back to stock you need to flash it to 0x23000 internaly. That is what the stock bootloader does as well.
Just mentioning when going back to stock on a closed watch you can not flash anything else every again ota. You need to open the watch then
ildar commentedon Sep 29, 2020
ildar commentedon Sep 30, 2020
ildar commentedon Dec 28, 2020
luke-jr commentedon Nov 19, 2021
Can't the stock firmware be populated in the external flash before the stock bootloader is flashed, and then the stock bootloader will finish the job? Thereby returning to a factory-like state where firmware updates remain possible...
atc1441 commentedon Nov 19, 2021
Yes this does work.
"Only" needs to be imolemented