Hacking the Samsung Galaxy Watch: Standalone Root, Custom OS, and Debloating Tizen

If you own an older Samsung smartwatch like the Galaxy Watch 42mm (SM-R810), you have likely felt the pain of vendor abandonment.

Powered by the dual-core Exynos 9110 (ARMv7-A 32-bit Thumb-2) with 768 MB RAM and 4 GB eMMC, the hardware remains capable and well-built. Yet Samsung officially retired it on Tizen OS 5.5.0.2 / One UI Watch 2.0 (R810XXU1GWE2, May 2023).

Following its End-of-Life, software decay quickly took hold:

I set out to solve this: turn the Galaxy Watch into a 100% standalone, fully rootable, debloated, privacy-first wearable Linux device—with working Wi-Fi, fast assisted GPS, expanded storage, and zero smartphone tethering requirements.

Here is the complete engineering journey, the security discoveries, the binary patches, and the technical breakdown of how we achieved it.

1. Device Specifications & Architecture

ParameterSpecification
Device ModelSamsung Galaxy Watch 42mm Bluetooth/Wi-Fi (SM-R810)
ProcessorSamsung Exynos 9110 (Dual-Core ARM Cortex-A53, ARMv7-A 32-bit Thumb-2)
Base Retail FirmwareRetail One UI 2.0 / Tizen 5.5.0.2 (R810XXU1GWE2, May 2023)
Engineering BaseCombination Factory Firmware FT40 (R810XXU1ASA1, Revision U1)
Kernel VersionLinux 4.9.59 (#1-Tizen SMP PREEMPT)
RAM / Flash Storage768 MB LPDDR4 / 4 GB eMMC 5.1
flowchart TD
    subgraph Bootloader["Bootloader Layer"]
        BL["Combination Bootloader (sboot.bin - ASA1 U1)\n- Bypasses Knox RSA signature checks\n- Retains U1 rollback fuse compatibility"]
    end

    subgraph KernelStack["Kernel and Ramdisk Layer"]
        KERNEL["Stock Retail Kernel (dzImage + param.bin - GWE2)\n- Linux 4.9.59 kernel & display parameters\n- Prevents ECT PARA0021 kernel panic"]
        RAMDISK["Custom Ramdisk (ramdisk.img)\n- Standalone static ARM pivot_switch binary\n- Bypasses dm-verity hash tree verification"]
    end

    subgraph RootFS["Custom Rootfs (rootfs.img - One UI 2.0 / Tizen 5.5.0.2)"]
        SDB["Native SDB Root (sdbd)\nOffset 0x10dd8 -> 0xe047 (User=root)"]
        SU["SUID Root Binary\n/bin/su (04755, root:root)"]
        WIFI["Patched net-config\nBypasses TrustZone CKM keystore"]
        GNSS["Patched libsnlp-module.so\nRemoves 10-minute CKM boot deadlock"]
        RESIZE["Storage Auto-Expansion\nresize2fs /dev/mmcblk0p17 (1.83 GB)"]
        UI["Patched w-home and setup-wizard\nBypasses tutorial & ODE black screen"]
    end

    BL --> KERNEL
    KERNEL --> RAMDISK
    RAMDISK -->|"Direct ext4 mount (/dev/mmcblk0p18)"| RootFS

2. Breaking the Boot Chain: The Hybrid Bootloader & dm-verity Bypass

Samsung enforces five distinct cryptographic and hardware checkpoints:

  1. Knox RSA Boot Verification: The retail bootloader (sboot.bin) enforces RSA signature checks on partition images. Flashing a modified rootfs.img results in SECURE CHECK FAIL : (rootfs).
  2. Hardware Rollback Counter: An eFuse counter prevents flashing older bootloader revisions.
  3. RPMB Security Lock: Crypto Manager (cm.bin) binds cryptographically to the eMMC hardware Replay Protected Memory Block (RPMB) key. Flashing a mismatched cm.bin triggers SECURE CHECK FAIL : CM.
  4. Kernel Parameter Mismatch (ECT PARA0021): Flashing an older 2019 Combination kernel with the 2023 Tizen 5.5 ramdisk and display hardware causes a kernel panic into Upload Mode.
  5. dm-verity Enforcement: Stock ramdisk.img validates rootfs block hashes via /usr/lib/initrd/initrd. Any modified byte in rootfs.img causes a reboot loop at NAD passed RPMB provisioned.

The Exploit Solution:

flowchart LR
    A["Kernel (dzImage)"] --> B["initrd (/bin/pivot_switch)"]
    B --> C["Detect /dev/mmcblk0p18"]
    C --> D["Mount ext4 to /sysroot\n(dm-verity bypassed)"]
    D --> E["Mount /opt, /opt/usr, /opt/system/csc"]
    E --> F["Call pivot_root(/sysroot)"]
    F --> G["Execute /lib/systemd/systemd\n(PID 1)"]

The pivot_switch binary executes these steps during boot:

  1. Waits for partition /dev/mmcblk0p18 to appear.
  2. Mounts /dev/mmcblk0p18 to /sysroot as read-only ext4.
  3. Mounts /dev/mmcblk0p16 to /sysroot/opt.
  4. Mounts /dev/mmcblk0p17 to /sysroot/opt/usr.
  5. Mounts /dev/mmcblk0p15 to /sysroot/opt/system/csc.
  6. Moves /dev, /proc, and /sys mounts into /sysroot.
  7. Calls syscall(SYS_pivot_root, "/sysroot", "/sysroot/mnt/initrd").
  8. Detaches the initial ramdisk (umount2("/mnt/initrd", MNT_DETACH)).
  9. Executes /lib/systemd/systemd as Process ID 1.

3. Tizen Security & Package Architecture Discoveries

Disassembling core system utilities uncovered how Tizen restricts user management:

Hardcoded Root Checks in pkgcmd

When attempting to uninstall or disable packages through standard SDB:

Partition Separation: System Apps vs. Preloaded User Apps

Tizen organizes applications across two storage locations:

Knox License Viewer Dependency

During standalone activation (“without phone”), entering the PIN triggers Tizen’s Device Policy Manager (org.tizen.dpm-syspopup). The manager launches com.samsung.knox.license-viewer to display the EULA. If Knox packages are stripped offline, the wizard hangs on a black screen. Keeping com.samsung.knox.license-viewer, com.samsung.knoxcustom-exitui, and com.samsung.knoxenrollmentservice-efl is essential.

4. Achieving Native SDB Root Privilege Escalation (UID 0)

In production Tizen builds, sdb root on rejects escalation with Permission denied because sdbd_rootperm is hardcoded off in /usr/sbin/sdbd-user.

Binary Patch in /usr/sbin/sdbd

At offset 0x10dd8:

Systemd Service Adjustment

In /usr/lib/systemd/system/sdbd.service:

User=root
Group=root

Installing SUID Root Binary /bin/su

We extracted the authentic /bin/su binary from the Combination firmware:

chmod 4755 /bin/su
chown root:root /bin/su
setfattr -n security.SMACK64 -v "_" /bin/su

Running sdb root on now elevates SDB sessions directly to # (uid=0, gid=0) over USB and Wi-Fi.

5. Unpaired Standalone Setup: Bypassing the Hardware ODE & Tutorial Traps

When configuring the watch without a phone, two major software obstacles surfaced:

A. On-Device Encryption (ODE) Bypass in w-lockscreen-setting

Entering a 4-digit PIN invokes hardware encryption (device_encryption_ode_encrypt_device). Because Knox hardware keystore applets are absent under the engineering bootloader, ODE calls deadlocked, leaving b2-setup-wizard stuck on show,black,cover.

Binary Patches in /usr/apps/com.samsung.w-lockscreen-setting/bin/w-lockscreen-setting:

User credentials store safely via standard SHA-256 without deadlocking the crypto engine.

B. Navigation Stack and Display Lifecycle in b2-setup-wizard

During development, two major failure modes occurred:

  1. Early Exit Failure: Patching _start (0xd230) or main in b2-setup-wizard to exit(0) caused an unresponsive black screen. In Tizen, b2-setup-wizard is the primary display client started by starter.service. Exiting early terminates execution before Enlightenment and Wayland initialize the display surface.
  2. Stack Frame Imbalance Crash: Tapping “Next” on the PIN screen caused a CPU crash. _bottomButtonClickedCb allocated a 40-byte stack frame (sub sp, #16; push {r4-r8, lr}). Jumping to 0x28ed8 used _lockScreenAppControlReplyCb’s 56-byte stack teardown (add sp, #28; pop {r4-r9, pc}), corrupting the stack pointer by 16 bytes.

Resolution: Re-engineered _bottomButtonClickedCb at offset 0x29010 with inline assembly:

C. Eliminating the Rotary Bezel Tutorial Lockup in w-home

On first boot, w-home shows an overlay window to teach rotary bezel navigation. In standalone mode, this window does not register input listeners. It captures all touches and stops user input.

Resolution:

  1. In /usr/apps/com.samsung.w-home/bin/w-home at offset 0x814b0:
    • Replace 10 b5 04 46 with 8c e7 00 bf (b.n 0x813cc; nop), bypassing the tutorial window constructor.
  2. Initialize persistent vconf keys in /usr/bin/oobe-finish.sh: 
    vconftool set -t int "db/private/com.samsung.w-home/tutorial_oobe_enabled" 0 -g 5000 -f -s com.samsung.w-home
vconftool set -t int "db/private/com.samsung.w-home/oobe_state" 0 -g 5000 -f -s com.samsung.w-home
vconftool set -t int "db/setup_wizard/first_boot" 0 -f
vconftool set -t int "db/setting/setup_wizard_finish" 1 -f

D. Offline Debloat vs. Registry Fragility

Deleting application packages directly from rootfs.img before first boot caused setup failures. Tizen uses inter-dependent vconf keys and SQLite databases in /opt. Missing package registrations during enrollment cause startup deadlocks. Keeping a clean system image and performing live debloating with root privileges after first boot proved significantly more stable.

6. Reverse Engineering the Wi-Fi Subsystem

Wi-Fi configuration posed the most intricate debugging challenge: connecting to an access point crashed the UI and dropped back to the watchface.

The Central Key Manager (CKM) Trap

On retail firmware, entering a Wi-Fi passphrase causes net-config to invoke Samsung’s Central Key Manager (CKM):

ckmc_create_key_aes(...);
ckmc_encrypt_data(...);
ckmc_decrypt_data(...);

These calls rely on TrustZone hardware applets absent on the engineering bootloader. When the user tapped “Connect”, net-config aborted with a TrustZone fault, dropping the UI back to the watchface.

Debugging Pitfalls & Resolutions:

  1. Thumb/ARM State Transition Trap (SIGILL): Branching from Thumb-2 code with b.w 0xa918 jumped into an ARM PLT stub without changing the processor instruction state (T-bit). This generated an Illegal Instruction fault (SIGILL) and killed net-config.
    • The fix uses valid interworking: push {lr}; blx 0xa918; pop {pc} (00 b5 de f7 2e ec 00 bd).
  2. Bypass CKM Functions in /usr/bin/net-config: Bypass AES encryption routines and return string duplicates with g_strdup:
    • Offset 0x2c0ca: Change df f8 c0 b2 to 04 46 ab e0 (mov r4, r0; b 0x2c226).
    • Offset 0x2bd3a: Change 05 a9 05 46 to 06 46 d1 e0 (mov r6, r0; b 0x2bee2).
  3. Restore Linux File Capabilities: Modifying the binary automatically strips POSIX extended capabilities. You must apply them again manually: 
    setcap cap_dac_override,cap_net_admin,cap_net_raw=ei /usr/bin/net-config
setfattr -n security.SMACK64 -v "_" /usr/bin/net-config
chown 551:551 /usr/bin/net-config
chmod 0500 /usr/bin/net-config
  4. Broadcom Hardware Radio Power Management: In stock wifi_bin at offset 0x24e0e, if the radio was off, the UI showed popup_scanning_show without creating the scan list layout, causing a bounce-back to the main menu. Forcing wifi_is_activated to return 1 caused a SIGSEGV crash because register r1 was uninitialized.
    • The working fix keeps the original wifi_bin binary to power on the Broadcom radio cleanly, sets [WiFi] Enable=true in /var/lib/connman/settings, and applies patches only to net-config.

7. GNSS Location Subsystem & Neutralizing the 10-Minute Boot Freeze

GPS initially failed with a 10-minute timeout after boot (LOCATIONS_ERROR_SERVICE_NOT_AVAILABLE / 0xfd400003).

Tracing the 10-Minute Boot Freeze

Attaching GDB to lbs-server revealed that Thread 1 blocked on syscall 168 (SYS_poll) with a 600,000 ms (10-minute) timeout immediately after boot.

flowchart LR
    LBS["lbs-server"] --> SNLP["S-NLP (libsnlp-module.so)"]
    SNLP --> KEY["snlp_get_encryption_key()"]
    
    subgraph Stock["Stock Execution (10-minute timeout)"]
        KEY -->|"Calls ckmc_get_data()"| CKM["Central Key Manager"]
        CKM -->|"Blocked in SYS_poll (600s)"| TZ["TrustZone IPC (Missing Applet)"]
    end
    
    subgraph Patched["Patched Execution (0.57s ready)"]
        KEY -.->|"0xdaec: movs r0, #0; bx lr"| FAST["Immediate NULL Return"]
        FAST -.->|"Registers on D-Bus"| DBUS["org.tizen.lbs.Providers.LbsServer"]
    end

The Samsung Network Location Provider (libsnlp-module.so.0.2.53) queried CKM for encryption keys. Because CKM did not respond, lbs-server stalled for 10 minutes before finally registering org.tizen.lbs.Providers.LbsServer on D-Bus.

Binary Patch: In /usr/lib/libsnlp-module.so.0.2.53 at offset 0xdaec (snlp_get_encryption_key):

Returns NULL immediately. Startup time dropped from 600 seconds down to 0.57 seconds!

Google SUPL Assisted GPS (A-GPS)

We replaced the dead Nokia/HERE location server with Google SUPL:

vconftool set -t string "db/location/supl/Server" "supl.google.com" -f
vconftool set -t int "db/location/supl/Port" 7275 -f
vconftool set -t int "db/location/supl/SslEnabled" 1 -f

Time-To-First-Fix (TTFF) dropped to 1–3 seconds.

Watchdog & Permissions Fix

8. Storage Auto-Expansion (112 MB to 1.83 GB)

The stock user.img partition image is only 112 MB, leaving ~29 MB free out of the box. Stock Tizen relies on stock initrd to resize it. Because our pivot_switch bypassed stock initrd, user storage remained clamped at 112 MB.

Fix: Integrated automated ext4 filesystem expansion into /usr/bin/oobe-finish.sh:

/sbin/resize2fs /dev/mmcblk0p17
/sbin/resize2fs /dev/mmcblk0p16

This expands /opt/usr to the full boundary of 1.83 GB (1.72 GB available) dynamically on first boot.

9. Comprehensive 3-Layer OS Debloating

With native root established, we executed a 3-layer debloating strategy:

flowchart TD
    ROOT["SDB Root (UID 0)"]

    subgraph Layer1["Layer 1: User and System TPK Packages"]
        L1_CMD["Command: pkgcmd -u -n <pkgid>"]
        L1_DESC["- Uninstalls application packages\n- Frees storage in /opt/usr\n- Unregisters D-Bus services"]
        L1_CMD --- L1_DESC
    end

    subgraph Layer2["Layer 2: System Framework RPM Packages"]
        L2_CMD["Command: pkgcmd -D -t rpm -n <pkgid> --global"]
        L2_DESC["- Hides applications from App Launcher\n- Disables background autostart\n- Reversible through pkgcmd -A"]
        L2_CMD --- L2_DESC
    end

    subgraph Layer3["Layer 3: Systemd Services"]
        L3_CMD["Command: systemctl disable --now <service>"]
        L3_DESC["- Stops background daemons immediately\n- Frees active RAM\n- Prevents socket autostart"]
        L3_CMD --- L3_DESC
    end

    ROOT --> Layer1
    ROOT --> Layer2
    ROOT --> Layer3

Execution Commands:

1. Deactivate Companion Synchronization Services:

pkgcmd -D -t rpm -n com.samsung.app-list-backup-service --global
pkgcmd -D -t tpk -n com.samsung.contacts-backup-service --global
pkgcmd -D -t rpm -n com.samsung.ime-backup-service --global
pkgcmd -D -t tpk -n com.samsung.message-backup-service --global
pkgcmd -D -t rpm -n com.samsung.wis-backup-service --global
pkgcmd -D -t rpm -n com.samsung.w-samsung-cloud --global
pkgcmd -D -t tpk -n com.samsung.cmc --global
pkgcmd -D -t tpk -n com.samsung.mdec-consumer --global
pkgcmd -D -t tpk -n com.samsung.fmg --global
pkgcmd -D -t tpk -n com.samsung.fmm --global
pkgcmd -D -t rpm -n net.wc-popup --global
pkgcmd -D -t rpm -n net.wc-syspopup --global

2. Deactivate Telemetry and Diagnostic Daemons:

pkgcmd -D -t tpk -n com.samsung.runestone-core --global
pkgcmd -D -t tpk -n com.samsung.runestone-gear --global
pkgcmd -D -t tpk -n com.samsung.runestone-setting --global
pkgcmd -D -t tpk -n com.samsung.tizen.samsung-analytics --global
pkgcmd -D -t tpk -n com.samsung.logdump-uploader --global
pkgcmd -D -t rpm -n gps-log-service --global

systemctl disable --now sanalyticsd.service sanalyticsd.socket
systemctl disable --now gpsslogd.service
systemctl disable --now bluetooth-hci-logger.service
systemctl disable --now diagd.service
systemctl disable --now dumpsys-service.service

3. Deactivate Voice Assistant Packages:

pkgcmd -D -t tpk -n com.samsung.tizen.bixby --global
pkgcmd -D -t tpk -n com.samsung.tizen.bixby-voice --global
pkgcmd -D -t tpk -n com.samsung.tizen.bixby-provisioning --global
pkgcmd -D -t rpm -n com.samsung.tizen.bixby-wakeup-service --global
pkgcmd -D -t tpk -n com.samsung.tizen.iva-service --global

4. Deactivate Telephony Daemons (Device has no cellular modem):

systemctl disable --now telephony-daemon.service
systemctl disable --now ims-daemon.service
pkgcmd -D -t rpm -n com.samsung.imssettings --global

5. Prune Foreign TTS Voice Packs:

Pruned non-English voice data from /usr/share/voice/tts/smt_vdata/:

mount -o remount,rw /
find /usr/share/voice/tts/smt_vdata/ -type f ! -name 'smt_en_US*' -delete
mount -o remount,ro /

Reclaimed 150+ MB of read-only rootfs space.

System Impact Benchmarks:

MetricStock FirmwareCustom Rooted FirmwareImprovement
Available Free RAM272 MB364 MB+92 MB RAM reclaimed
Active RAM Used395 MB302 MB-93 MB system load
Active Swap Usage61 MB47 MB-14 MB swap reduction
Background Daemons69 units61 units8 wake-lock services killed
App Drawer3 cluttered pages1 page essentialsFast, zero bloatware stubs
GPS Fix LatencyFailed / 600s timeout1 to 3 secondsInstant Google SUPL fix
Available User Disk29 MB1,720 MB (1.72 GB)59x more user storage

10. Packaging & Wireless Flashing via NetOdin

The partition images are assembled into a standard POSIX ustar archive with root ownership (0:0), terminated with an Odin-compatible MD5 checksum string.

Partition File Sequence:

1. sboot.bin              (Combination FT40 ASA1 Bootloader)
2. param.bin              (Stock Retail Parameters)
3. dzImage                (Stock Retail Kernel)
4. ramdisk.img            (Custom dm-verity Bypass Ramdisk)
5. ramdisk-recovery.img   (Stock Retail Recovery Ramdisk)
6. rootfs.img             (Custom Standalone Rootfs - 1.36 GB ext4)
7. system-data.img        (Stock Retail System Data - 93.3 MB ext4)
8. user.img               (Stock Retail User Storage Base - 112 MB ext4)

Important: Packaging must strictly use GNU tar (e.g. inside Linux or Docker). macOS BSD tar writes extended pax headers (uname and gname) that NetOdin’s internal parser rejects with RQT_Read fail.

Packaging Command:

tar -H ustar -c --owner=0 --group=0 -f firmware.tar \
    sboot.bin param.bin dzImage ramdisk.img ramdisk-recovery.img rootfs.img system-data.img user.img

md5sum -t firmware.tar >> firmware.tar
mv firmware.tar firmware.tar.md5

Installation Steps:

  1. Enter Wireless Download Mode:
    • Press and hold the Home/Power (bottom) button until Rebooting... appears.
    • Release the button and press it repeatedly until the Reboot Menu appears.
    • Select Download (Wireless), then press and hold the button.
    • On the WPS screen, press the Home/Power button twice to start AP Mode (Access Point: SM-R810-xxxx).
  2. Flash Firmware with NetOdin3:
    • Connect PC Wi-Fi to the watch’s access point.
    • Start NetOdin3.exe and verify that the connection indicator turns blue/cyan.
    • Select the .tar.md5 package in the AP slot.
    • Click Start to write the partitions and wait for the green PASS! status.
  3. Out-of-Box Standalone Setup:
    • The watch boots directly into the standalone setup wizard.
    • Create a 4-digit PIN and accept the legal terms.
    • Open Settings > Connections > Wi-Fi > Wi-Fi networks, select your network, and type the password.
  4. Root Shell Verification: 
    sdb root on
sdb shell
# whoami
root
# df -h /opt/usr
Filesystem      Size  Used Avail Use% Mounted on
/dev/mmcblk0p17 1.8G  112M  1.7G   6% /opt/usr

11. Emergency Recovery & Unbrick Procedures

If the device ever stops responding or enters a boot loop during experimentation:

Force Reset from Upload Mode or Hangs

If the watch hangs on Rebooting... or enters a kernel panic upload mode (ECT PARA0021):

  1. Press and hold the Home/Power (bottom) button continuously for 12 to 15 seconds.
  2. The hardware will perform an unconditional power reset.
  3. Release the button immediately when the display goes dark.
  4. Tap the button rapidly to enter the Samsung Reboot Menu.

Recovery Wipe (Cache and Stale Database Clear)

If the watch hangs on the Samsung logo because of stale SQLite database entries in /opt:

  1. Enter the Samsung Reboot Menu.
  2. Select Recovery, then press and hold the Home/Power button.
  3. Stock recovery will boot, format cache partitions and user databases, and restart cleanly.

Revert to Factory Retail Firmware

To restore the device to official factory stock:

  1. Load official stock firmware archives into NetOdin3:
    • AP: AP_R810XXU1GWE2_usr.tar.md5
    • BL: BL_R810XXU1GWE2_usr.tar.md5
    • CSC: CSC_OXA_R810OXA1GWE2_usr.tar.md5
  2. Connect to the watch access point in Wireless Download Mode.
  3. Click Start to restore official retail software.

Conclusion

By combining reverse engineering, assembly patching, and Linux kernel fundamentals, an officially abandoned smartwatch has been given a new life. The device boots in seconds, runs noticeably faster, lasts longer on battery, and gives full root ownership without requiring any smartphone tethering.

← Return to all articles