Soft Bricked Full Android Smartwatch After Firmware Backup

[Please help] Soft Bricked Full Android Smartwatch After Firmware Backup

aldermath
Enthusiastic Member

8

26-02-2025, 09:16 PM

#1

Device: Vwar DW100 (full android smartwatch)
CPU: 8541E
Android 8.1
More info: https://vwar.fit/products/vwar-dw100-sma...7250678035

ResearchDownload version: R23.0.0001

I attempted to backup the firmware of this device using ReseachDownload tool (https://www.hovatek.com/forum/thread-31800.html) but had some issues:
First thing to note: I used the pac file for a DW99 model which is the exact same device with the same CPU, only the SIM slot is in a different place. The FDL should be compatible.
I was able to successfully backup the firmware, but the status in ReseachDownload Tool got stuck at "Checking baudrate" once the backup finished (see image

CopyQ.FQlKWu.png
Size: 24.74 KB / Downloads: 5

). The progress field never changed to "passed".
When the device rebooted, it now just hangs on the boot logo forever, which is the main issue.

Things I've tried:
Since I can still get the device back into download mode, I can retry the process and attempt to reflash things.
For a sanity check, I applied a custom boot logo, which worked, so I know device flashing is still working.
On the recommendation of an XDA forum user, I disabled the 3 File Backup options on the backup tab (see image

CopyQ.aSEHcp.png
Size: 14.11 KB / Downloads: 1

).
I attempted to reflash the stock boot, recovery, and vbmeta partitions, but it times out on vbmeta (see image

CopyQ.aeIwvr.png
Size: 11.79 KB / Downloads: 2

).

All of this still results in the device hanging on the boot logo. This should be recoverable, but I don't know what the next step should be.

aldermath
Enthusiastic Member

8

26-02-2025, 09:38 PM

#2

I get the same issues with version R27.24.2301 of ResearchDownload as well.

maxpayne
Intern

4,288

27-02-2025, 02:23 PM

#3

(26-02-2025, 09:16 PM)aldermath ..
All of this still results in the device hanging on the boot logo. This should be recoverable, but I don't know what the next step should be.

Share a screenshot of the contents of the backup you made

(26-02-2025, 09:16 PM)aldermath I attempted to reflash the stock boot, recovery, and vbmeta partitions

Did boot and recovery flash?

This post was last modified: 27-02-2025, 02:26 PM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

aldermath
Enthusiastic Member

8

27-02-2025, 06:46 PM

#4

(27-02-2025, 02:23 PM)maxpayne
(26-02-2025, 09:16 PM)aldermath ..
All of this still results in the device hanging on the boot logo. This should be recoverable, but I don't know what the next step should be.

Share a screenshot of the contents of the backup you made

(26-02-2025, 09:16 PM)aldermath I attempted to reflash the stock boot, recovery, and vbmeta partitions

Did boot and recovery flash?

VBMeta flashes first so I had to test again. Flashing just Boot or Recovery also times out.

The backup contains every file available under "Read Active Flash" minus splloader and userdata. The sizes seem reasonable (see image) and the files look correct when I glance at them in a hex editor. Even if it turns out the fdl isn't 100% compatible, it seems to have dumped the firmware correctly.

Attached Files

CopyQ.JDiryT.png
Size: 100.01 KB / Downloads: 3

justshez
Senior Member

2,505

01-03-2025, 09:49 AM

#5

(27-02-2025, 06:46 PM)aldermath
(27-02-2025, 02:23 PM)maxpayne
(26-02-2025, 09:16 PM)aldermath ..
All of this still results in the device hanging on the boot logo. This should be recoverable, but I don't know what the next step should be.

Share a screenshot of the contents of the backup you made

(26-02-2025, 09:16 PM)aldermath I attempted to reflash the stock boot, recovery, and vbmeta partitions

Did boot and recovery flash?

VBMeta flashes first so I had to test again. Flashing just Boot or Recovery also times out.

The backup contains every file available under "Read Active Flash" minus splloader and userdata. The sizes seem reasonable (see image) and the files look correct when I glance at them in a hex editor. Even if it turns out the fdl isn't 100% compatible, it seems to have dumped the firmware correctly.

Try using miracle box to flash full firmware, see @ https://www.hovatek.com/forum/thread-17228.html

aldermath
Enthusiastic Member

8

01-03-2025, 10:32 PM

#6

(01-03-2025, 09:49 AM)justshez
(27-02-2025, 06:46 PM)aldermath
(27-02-2025, 02:23 PM)maxpayne
(26-02-2025, 09:16 PM)aldermath ..
All of this still results in the device hanging on the boot logo. This should be recoverable, but I don't know what the next step should be.

Share a screenshot of the contents of the backup you made

(26-02-2025, 09:16 PM)aldermath I attempted to reflash the stock boot, recovery, and vbmeta partitions

Did boot and recovery flash?

VBMeta flashes first so I had to test again. Flashing just Boot or Recovery also times out.

The backup contains every file available under "Read Active Flash" minus splloader and userdata. The sizes seem reasonable (see image) and the files look correct when I glance at them in a hex editor. Even if it turns out the fdl isn't 100% compatible, it seems to have dumped the firmware correctly.

Try using miracle box to flash full firmware, see @ https://www.hovatek.com/forum/thread-17228.html

I don't have a DW100 PAC file, so I selected the DW99 just to see if the partition list would come up.

I think there's a way to convert my firmware dump to a pac file, but I don't know how.

When I try to start the process in miracle box 2.54, I get the following error (I chose "Auto" for chipset type):
Scanning USB Serial port...
SU2Serial Port: COM12
Connecting to Phone,Wait..
Done.
Infor: SPRD3
Initialize boot0...
>>BootLoad Error. ID: 7

Not sure if miracle box will help even if I create a DW100 pac file, since the FDL will still need to be from the DW99. I thought that all FDL files were compatible for the same cpu, but I may be wrong: The DW89, DW99, and DW100 all have the same CPU but when comparing the FDL from the DW89 and DW99 firmware, FDL1 is identical but FDL2 has differences.

maxpayne
Intern

4,288

06-03-2025, 02:16 PM

#7

(27-02-2025, 06:46 PM)aldermath VBMeta flashes first so I had to test again. Flashing just Boot or Recovery also times out.
...

This suggests that the dumped files won't be accepted unless the bootloader is unlocked and they are signed with the right keys.
Quick question; during the dump, are you sure you unticked everything except FDL 1&2 under Download settings > Main page i.e nothing from the W99 firmware was actually flashed?

This post was last modified: 06-03-2025, 02:21 PM by maxpayne.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

aldermath
Enthusiastic Member

8

06-03-2025, 06:40 PM

#8

(06-03-2025, 02:16 PM)maxpayne
(27-02-2025, 06:46 PM)aldermath VBMeta flashes first so I had to test again. Flashing just Boot or Recovery also times out.
...

This suggests that the dumped files won't be accepted unless the bootloader is unlocked and they are signed with the right keys.
Quick question; during the dump, are you sure you unticked everything except FDL 1&2 under Download settings > Main page i.e nothing from the W99 firmware was actually flashed?

Yep, I unticked everything except FDL 1&2. It would make sense that modified files would refuse to flash, but I assumed the stock ones would be signed even if I dumped them myself.
That could explain why bootlogo flashes successfully but boot/recovery/vbmeta doesn't since it probably isn't considered "sensitive". Unfortunately the SPD vbmeta signer tool that I was going to use to root the device can't find the partitions in the vbmeta and just lists some garbage data, even when I just give it the extracted, unmodified firmware files (see image). (I was following this tutorial btw: https://www.youtube.com/watch?v=mNzvizR3pB0). Not sure if this is an issue with the tool or the files I'm giving it. It should work with extracted firmware files.

I'm pretty sure these devices are bootloader unlocked by default (as mentioned in the tutorial above), but is there a way to verify this and unlock if necessary? The SPD signing tool has a button for unlocking the bootloader but I wouldn't count on that working since the main function of the program isn't for this device. Also, the menu options imply that it will require the device's serial number which may be hard to get since the device isn't booting.

CopyQ.chPGqP.png
Size: 216.48 KB / Downloads: 2

maxpayne
Intern

4,288

13-03-2025, 08:19 AM

#9

(06-03-2025, 06:40 PM)aldermath ..

Let's approach from vbmeta
Share a link to the vbmeta from the backup and the one from DW99 pac file. The goal is to compare their contents in avbtool

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.

aldermath
Enthusiastic Member

8

13-03-2025, 05:30 PM

#10

(13-03-2025, 08:19 AM)maxpayne
(06-03-2025, 06:40 PM)aldermath ..

Let's approach from vbmeta
Share a link to the vbmeta from the backup and the one from DW99 pac file. The goal is to compare their contents in avbtool

Here's both vbmetas, along with a few other relevant files for later: [ Login to download]

View a Printable Version

Users browsing this thread:
1 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions