Skip to content

Add support for TicWatch Pro / Pro 3 (bcm43436b0 9.88.0.0) WearOS 2 #648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 22 commits into
base: master
Choose a base branch
from
Open

Add support for TicWatch Pro / Pro 3 (bcm43436b0 9.88.0.0) WearOS 2 #648

wants to merge 22 commits into from

Conversation

@yesimxev
Copy link

@yesimxev yesimxev commented Mar 17, 2025 •
edited
Loading

  • Credits to @jlinktu for his unlimited help and patience!
  • For TicWatch Pro, patched firmware needs to be renamed to fw_bcmdhd.bin

yesimxev and others added 22 commits August 15, 2024 00:45
Initial commit for bcm43436b0 9.88.0.0 (TicWatch Pro 3)
c2903d6
Initial commit of injection patch
4031a3a
sendframe: use a later version of sendframe
65d8e42
fix invalid switch case definition introduced with commit 1f1b4e7
0b3553e
replace monitor hook BLPatch with a forced long instruction branch
24484b0
bcm43436b0: add basic frame injection patch for 9.88.0.0
d5f5474
Trying to debug
d8f162f
Revert "Trying to debug"
240e378 
This reverts commit d8f162f.
Try monitormode without flashpatch
6beba82
@jlinktu
added code to debug crash at 0x33738 that occurs for unknown reasons …
04ecb67 
…when injecting
@yesimxev
Merge pull request #7 from jlinktu/new
ea36781 
added code to debug crash at 0x33738 that occurs for unknown reasons …
Patch nullpointer in sendframe.c, this time without genericpatch/flas…
fd5aeb0 
…hpatch
Revert "Patch nullpointer in sendframe.c, this time without genericpa…
0928756 
…tch/flashpatch"

This reverts commit fd5aeb0.
Fixed radiotap headers, and injection crash
13480d2
Fix injection trying harder & re-add debug
673e0f4
@jlinktu
bcm43436b0 9.88.0.0 remove out of structure files
1a44ed6
@jlinktu
bcm43436b0 9.88.0.0 correct monitor hook address, change from branch …
4c47be9 
…to branch link, and correct wrapper address of wl_monitor
@jlinktu
bcm43436b0 9.88.0.0 force scb null check branch link to be wide and a…
b39dff8 
…dapt null pointer check accordingly
@yesimxev
Merge pull request #8 from jlinktu/new
570c781 
Monitor and scb null check fixes
Finalising monitor mode
db3e9a5
Revise dump-rom (cause panic if run from outside)
681de12
Add TicWatches to README
62404b1
@jlinktu
Copy link
Member

jlinktu commented Mar 18, 2025

This needs a clean-up before it can be merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yesimxev @jlinktu