[GUIDE] Restore Null SN and locked Bootloader|Wrong ROM flash|Amazfit Pace & Stratos - Amazfit

[GUIDE] Restore Null SN and locked Bootloader|Wrong ROM flash|Amazfit Pace & Stratos
DON'T INSTALL ANY STOCK ROM​What is this?
It is guide/tutorial for restoring the serial number and unlocking the bootloader on your Amazfit Pace or Stratos watch.
If you have installed a Pace ROM on your Stratos watch, or a Stratos ROM on your Pace, you lost your serial number and locked the bootloader. If this is your case. you will probably note:
- Null serial number​
- Locked bootloader​
- Touchscreen not working​
- Button/keys not working​
- Bootloop​
​
Supported devices
- Amazfit Pace watch: A1602 and A1612 models
- Amazfit 2 Stratos watch: A1609 and A16019 models
Can it be fixed?
Yes, it can. At least if your watch can gain root access over adb.
Requirements
1. Property installed adb drivers
How to check this: Open a CMD.exe or any command window on your PC and type:
Code:
adb devices
Output (or similar)
Code:
List of devices attached
9dee1d33 device
2. Property installed fastboot drivers
How to check this: Open a CMD.exe or any command window on your PC and type:
Code:
adb shell reboot bootloader
fastboot devices
Output (or similar)
Code:
0123456789 fastboot
Reboot with:
Code:
fastboot reboot
3. Root access over adb
How to check this: Open a CMD.exe or any command window on your PC and type:
Code:
adb root
Output (or similar)
Code:
adbd is already running as root
Another way to check root:
Code:
adb root
adb shell
Output (or similar)
Code:
[email protected]:/ #
In both cases, you gained root access over adb, you are good to go.
But if you get something like this:
Code:
adb cannot run as root in production builds
Or
Code:
[email protected]:/ $
You don't have root access over adb which means you can't restore your watch check this post: https://forum.xda-developers.com/t/...fit-pace-stratos.3775998/page-3#post-84352471 by matrixios01
How to restore the watch
In few words:
- Meet the requirements​
- Get some data from your watch​
- Edit a file which i will provide (misc.img) with previous data​
- Restore the edited file (misc.img) to your watch​
- Use your original unlock code for unlocking again the bootloader (this step may vary)​
- Check that you managed to restore the SN and unlocked the bootloader (this step may vary)​
- Install a custom ROM for your device (Pace ROM for Pace watch or Stratos ROM for Stratos watch)​
- Check that your watch works fine again​
I will post whole method in the next post with all needed steps and commands.
Credits
To this people:
@S3V3N for original backup & restore script
@Neuer_User for all his stuff for Amazfit Pace and Stratos
@Cracklydisc (Nicola Sagliano) for all his stuff for Amazfit Pace and Stratos
@1immortal for all his stuff and support for Amazfit Pace and Stratos
Those two guys that tested first this method with different result
If you like my work, buy me a beer.

---

Restore method
Restore method
1. Get some data form your watch
Turn on your watch, connect the watch to PC, and open a CMD.exe or any command window.
Code:
adb shell getprop
Output (or similar)
Code:
[dalvik.vm.dex2oat-Xms]: [64m]
[dalvik.vm.dex2oat-Xmx]: [512m]
[dalvik.vm.heapgrowthlimit]: [64m]
.
.
.
[wifi.supplicant_scan_interval]: [360]
[windowsmgr.max_events_per_sec]: [500]
[wlan.driver.status]: [unloaded]
You will get a list with a lot of properties, you may find these properties marked in blue, or use individual command for each parameter:
adb shell getprop ro.bt.bdaddr
Output=A1:B2:C3:00:E5:F6 = This is Bluetooth MAC address. 6 pairs of digits.
adb shell getprop ro.sn.serial_numbers
Output=123456789ABCDE = This is the Serial Number (SN) of your watch, and may be corrupted, but you can find it in the back of your watch as SN xxx.... 14 digits.
adb shell getprop ro.sn.serial_numbers_factory
Output=123456789AB = This is the factory serial number, and may be corrupted also, there is no way to get original one AFAIK and I don't know if it is relevant. 11 digits.
adb shell getprop ro.wifi.wifiaddr
Output=A1:B2:C3:00:E5:FF = This is WiFi MAC address. 6 pairs of digits, and different from Bluetooth address.
Click to expand...
Click to collapse
All the data marked in red, is the data we will use to edit misc.img file in next step.
2. Edit misc.img file
To do this, you will need to install an hexadecimal text editor that works on your PC. As I use a Windows PC, I will use HxD to edit misc.img file. You can download HxD text editor for Windows and the dummy misc.img file from here. A dummy misc.img file is a file which has random data on it.
2.1 Unzip the file, install HxD text editor and run it.
2.2 Chose Open, go to the path where misc.img is, select it and open the file:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2.3 Ensure that you are using hexadecimal (hex) address visualization:
3. Edit misc.img file with your data
3.1 Serial Number (SN)
Go to memory address 600, and enter your SN on Decoded Text section:
3.2 Bluetooth MAC
Go to memory address 800, and enter your Bluetooth MAC address on Decoded Text section:
3.3 WiFi MAC
Go to memory address A00, and enter your WiFi MAC address on Decoded Text section:
3.4 Factory serial nuember
Go to memory address C00, and enter your factory serial number on Decoded Text section. If you don't have this data, just leave it as it is.
3.5 Save edited misc.img file
Click on Save icon:
4. Now in the unzipped folder you will have the edited misc.img file and a new file named as misc.img.bak which is a backup of misc.img. If you want, you can open misc.img again and check if all your data is correct.
5. Copy misc.img to watch and restore it
Open a CMD.exe or any command window, and go to the path where misc.img is, and copy it to your watch:
Code:
adb push misc.img /sdcard/
Output (or similar)
Code:
1950 KB/s (16777216 bytes in 8.398s)
Restore misc.img on your watch (this is where root is needed):
Code:
adb root
adb shell dd if=/sdcard/misc.img of=/dev/block/platform/jzmmc_v1.2.0/by-name/misc
Output (or similar)
Code:
8193+0 records in
8192+0 records out
4194304 bytes transferred in 0.870 secs (4821039 bytes/sec)
Reboot your watch:
Code:
adb reboot
6. Check the SN
Reboot into fastboot mode:
Code:
adb shell reboot bootloader
Get all data from bootloader:
Code:
fastboot getvar all
Output (or similar)
Code:
.
.
.
(bootloader) serialno: 123456789ABCEF
.
.
(bootloader) unlocked: no
.
.
.
If you get your SN back ((bootloader) serialno: 123456789ABCEF), restoration was successful. But you may get unlocked bootloader result ((bootloader) unlocked: no), and here is where you will use your original unlock code, or request it again using the unlock service you already know.
Code:
fastboot oem unlock your_unlock_code
Output (or similar)
Code:
...
OKAY [ 0.047s]
finished. total time: 0.048s
And check again your bootloader status:
Code:
fastboot getvar all
Output (or similar)
Code:
.
.
.
(bootloader) serialno: 123456789ABCEF
.
.
(bootloader) unlocked: yes
.
.
.
If you get (bootloader) unlocked: yes your bootloader is unlocked again. If you get (bootloader) unlocked: no result, don't worry, it may be unlocked after installing any ROM for your device (this happened to me).
Exit from fastboot mode:
Code:
fastboot reboot
8. Install a ROM for your device
- If you own an Amazfit Pace watch, I suggest you to install any PACEfied ROM (1.2.50h for example) but 1.2.51 version (remember that this version is causing some issues for some users).
- If you own an Amazfit Stratos watch, I suggest you to install any STRATOSfied ROM.
9. Factory Reset
When the ROM is installed, probably it will not boot and will stay in a bootloop in the bootanimation, so you MUST do a Factory Reser in order to make it boot.
Reboot to fastboot mode:
Code:
adb shell reboot bootloader
Erase cache (It will take around 8s):
Code:
fastboot erase cache
Erase data (It will take around 210s):
Code:
fastboot erase data
10. When the Factory Reset finish, check again the status of your bootloader
Code:
fastboot getvar all
Now you should get unlocked bootloader result. If not, use again the unlock code and command.
Exit from fastboot mode:
Code:
fastboot reboot
11. Your watch may be operative now
If everything went right, you managed to recover your bricked/****ed watch. Be ready to pair the watch with Amazfit app and enjoy your watch again!
Thanks for reading.

---

MIO2
MIO2

---

MIO3
MIO3

---

MIO4
MIO4

---

Hi, Saratoga79
I get the message in point 3:
adb cannot run as root in production builds
and
[email protected]:/ $
No way to recover it
:crying::crying::crying:

---

Thanks a bunch for doing that mate!

---

aromanos_76 said:
Hi, Saratoga79
I get the message in point 3:
adb cannot run as root in production builds
and
[email protected]:/ $
No way to recover it
:crying::crying::crying:
Click to expand...
Click to collapse
And how is your bootloader? If you have locked bootloader, there is nothing to do, AFAIK.
What was your problem?

---

Saratoga79 said:
And how is your bootloader? If you have locked bootloader, there is nothing to do, AFAIK.
What was your problem?
Click to expand...
Click to collapse
I can access to the device (adb devices) and start the fastboot mode.
The strange thing is.... that even the serial no is null, the watch is locked and I've no root permissions...
The watch still working!!! :laugh:
Sorry, I still can't attache images: hxxxs://ibb.co/iDg4zx

---

Great job Saratoga, I hope this means you got your PACE back up and running!

---

Great, I just used the info to save my misc.img partition in case something goes wrong.

---

nhedgehog said:
Great, I just used the info to save my misc.img partition in case something goes wrong.
Click to expand...
Click to collapse
You could also get your own misc.img from watch.

---

Guess I wasn't specific enought. Thats what I did, saving my own misc.img from watch.

---

I had a null serial number in my Stratos, then I followed all steps
Now I have a serial number back, however the bottons and touch screen is not working
What do you think could be the problem ?

---

RENEMX said:
I had a null serial number in my Stratos, then I followed all steps
Now I have a serial number back, however the bottons and touch screen is not working
What do you think could be the problem ?
Click to expand...
Click to collapse
What ROM did you install after restoring your SN?

---

Thanks Saratoga79 for replying
This is the info: My watch is the Stratos A1609
Smartwatch is connected to Amazfit app, running version: 1.2.44
Something I saw trying to update the version is Using ROM Stratos Everest 2.0.15.0 Multilanguage , Installer V.06 by Saratoga is after checking the unlock is YES
I have tried to change the language BUT after clicking for the installation the message is “I have not installed ROM V0.6
So the problem today is that the touch screen
Below additional information, I hope it helps, any question please let me know.
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) version-bootloader: U-Boot 2013.07-00101-g96591b8
(bootloader) version-baseband: N/A
(bootloader) version-hardware: V1.1 20130322
(bootloader) version-cdma: N/A
(bootloader) variant: watch
(bootloader) serialno: 16091814071027
(bootloader) product: watch
(bootloader) secure: no
(bootloader) unlocked: yes
(bootloader) uart-on: NO
(bootloader) partition-size:bootloader: 0x0000
(bootloader) partition-type:bootloader: emmc
(bootloader) partition-size:recovery: 0x1000
(bootloader) partition-type:recovery: emmc
(bootloader) partition-size:boot: 0x2000
(bootloader) partition-type:boot: emmc
(bootloader) partition-size:system: 0x3000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:cache: 0x4000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:userdata: 0x5000
(bootloader) partition-type:userdata: ext4
(bootloader) max-download-size: 0x4000000
all:
finished. total time: 0.313s

---

RENEMX said:
Thanks Saratoga79 for replying
This is the info: My watch is the Stratos A1609
Smartwatch is connected to Amazfit app, running version: 1.2.44
Something I saw trying to update the version is Using ROM Stratos Everest 2.0.15.0 Multilanguage , Installer V.06 by Saratoga is after checking the unlock is YES
I have tried to change the language BUT after clicking for the installation the message is “I have not installed ROM V0.6
So the problem today is that the touch screen
Below additional information, I hope it helps, any question please let me know.
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) version-bootloader: U-Boot 2013.07-00101-g96591b8
(bootloader) version-baseband: N/A
(bootloader) version-hardware: V1.1 20130322
(bootloader) version-cdma: N/A
(bootloader) variant: watch
(bootloader) serialno: 16091814071027
(bootloader) product: watch
(bootloader) secure: no
(bootloader) unlocked: yes
(bootloader) uart-on: NO
(bootloader) partition-size:bootloader: 0x0000
(bootloader) partition-type:bootloader: emmc
(bootloader) partition-size:recovery: 0x1000
(bootloader) partition-type:recovery: emmc
(bootloader) partition-size:boot: 0x2000
(bootloader) partition-type:boot: emmc
(bootloader) partition-size:system: 0x3000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:cache: 0x4000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:userdata: 0x5000
(bootloader) partition-type:userdata: ext4
(bootloader) max-download-size: 0x4000000
all:
finished. total time: 0.313s
Click to expand...
Click to collapse
So you already installed my ROM for your Stratos? Did you get any error? Did you do the Factory reset?
If you still face same issue, maybe you can try installing STRATOSfied.

---

Otherwise this method, I want to go back to stock, lock my bootloader and use it as a new (I bought as used and the ex-owner installed a ROM and unlock the bootloader), how can i do that?
Thanks

---

After i fixed the issue of null serial number using your procedure
Then
I used the tool: ROM Everest 2.0.15.0 to change the language however the program cannot recognize my watch as A1609, please see:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
The message is the following:
Model detected: A1602 - Amazfit Sports Watch
Version Installed ROM: huanghe -1.2.44
China ROM PACEfied found
ONLY FOR AMAZFIT 2 STRATOS WATCH
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
My watch is stratos A1609 but inside it has running Android PACEfied
So, I have tried to install flash Chinese/English ROM using your tool "Huawmi AMAZFIT Tool" and
Firmware_CN_STRATOS_2.0.7.5.zip
After that there are three options:
a) I want to use already stracted files
b) I want to delete already extracted files and re unpack it
c) I want to stop this process
doing option a) and b) againg I still have Android Pacified and touch screen is not working

---

Saratoga79 said:
So you already installed my ROM for your Stratos? Did you get any error? Did you do the Factory reset?
If you still face same issue, maybe you can try installing STRATOSfied.
Click to expand...
Click to collapse
I cannot do factory reset becuase touch screen not working
I tried Startosfied but it did not work, and also I tried installing Stratos ROM but it did not work
I think the problem is the hardware is for Stratos but software is Paciefied, what do you think ?
Please read the latest info I sent (previous to this one)