How to root Android 5.0.1 on your Sony SmartWatch 3 (SWR50)

Michael Roland's picture
Submitted by Michael Roland on Thu, 2015-01-29 17:38

In my previous post I started to dissect the NFC functionality of our Sony SmartWatch 3 (SWR50). Unfortunately, without having root access it is pretty much impossible to explore the whole file system of the watch. More specifically, the interesting parts of the file system (device files under /dev and certain application binaries under /system/bin) are concealed from the adb shell user by SELinux. Therefore, we aimed for getting root access on our SWR50.

Luckily, there was already a guide for rooting the SWR50 available on XDA Developers: [GUIDE][ROOT] Smartwatch 3 KNX01V. This guide worked like a charm on our watch that was still running Android 4.4W (KNX01V). Unfortunately, we then upgraded to Android 5.0.1 (LWX48P) and, eventhough the su binaries survived the upgrade, the su command no longer managed to gain root permissions. As a first shot we tried to re-run the rooting boot image from the guide. This wasn't a good idea though. BE WARNED! Booting the watch with that boot image soft-bricked our device. The device still booted into Android but never started the Android UI due to haning in an endless loop. After I recovered from that shock and after some time (hours?!) of debugging, I — luckily — managed to recover from that soft-brick by (simply) wiping the data partition.

So why did this happen?

In order to find out what happened, I downloaded the Android Image Kitchen toolchain and extracted the root file system from the rooting boot image. After analyzing the startup scripts of the rooting boot image, the answer to this question was rather simple: This happened because the init scripts of the boot image perform a whole bunch of modifications on the data partition of the watch. While these modifications were just the same that are performed during a regular boot of KNX01V, these modifications were incompatible with the new layout of the data partition in Android 5. Hence, Android 5.0.1 (LWX48P) got stuck in a boot loop.

Creating a less intrusive rooting boot image

I, then, decided to create a less intrusive version of the rooting boot image by removing all unneccessary parts of the init scripts. The new image only mounts the system partition, starts a minimal set of system components and (as the original rooting boot image) executes a script (/sbin/superuser.sh in the root file system of the image) containing the commands to install the su binaries. Particularly, the new version no longer touches the data partition. You can download this image here. However, this does not solve the problem of getting root privileges on Android 5.0.1. The method of rooting included into that image is simply incapable of obtaining root privileges on Android 5.

Getting root on the SWR50 with Android 5.0.1 (LWX48P)

Consequently, I decided to digg a bit deeper into the prerequisites of rooting Android 5. Luckily, Chainfire already did a great job on creating SuperSU for Android and making it available as an update.zip ready to be installed through recovery mode. So all I had to do was to extract the installation script and the installable files from the UPDATE-SuperSU-v2.40.zip file. I used version 2.40, which was the most current version at that time. I then ported the installation script to the /sbin/superuser.sh shell script of the rooting boot image. Moreover, I reduced the SuperSU installation to only the core components necessary to gain root access through adb shell. Specifically, I included the su binaries for the SWR50 hardware platform only and skipped the installation of the SuperSU UI app. You can download this new image here (and this repository contains the source files for image creation using Android Image Kitchen). A quick test (boot that rooting boot image and wait until the watch reboots into Android) revealed that SuperSU 2.40 is capable of obtaining root privileges on LWX48P.

I want root too! — A step-by-step tutorial

So I already got root and, when you read so far, certainly want to know how to get root on your SWR50 too. Therefore, I created this step-by-step tutorial (heavily based on XorZone's original guide on XDA Developers):

Prerequisites

Step 1

Enable the Developer options for your watch (go to Settings -> About and quickly tap the Build number 7 times in a row).

Step 2

Enable ADB debugging (under Settings -> Developer options). The watch will request confirmation to allow ADB debugging through the companion app on your phone the first time you use the adb tool from your computer.

Step 3

You may need to install the Android ADB Composite Interface device driver for your watch.

Step 4

Use the adb reboot command to boot into fastboot boot loader mode:

adb reboot bootloader

Step 5 (conditional)

If the bootloader of your watch is not already unlocked, you will need to unlock it. On our watch the bootloader was already unlocked by default, so we could simply skip this step.

BE WARNED: This step will wipe all your data from the watch.

fastboot oem unlock
fastboot oem unlock
fastboot format cache
fastboot format userdata
fastboot reboot

After the device rebooted, you have to boot it into fastboot boot loader mode again:

adb reboot bootloader

Step 6

Boot the rooting boot image:

adb boot SWR50-rootboot-for-LWX48P-byMR.img

The image will boot into a screen "SmartWatch 3" and will stay there for several seconds. When the rooting boot image completed its tasks it will automatically reboot into the regular Android system.

Step 7

You can now test if rooting succedded by starting adb shell and executing the su binary:

adb shell
shell@tetra:/ $ su
root@tetra:/ #

You can then check if you really got root privileges (and are not locked out by SELinux) by typing ls -l /data which should result in a directory listing like the following:

root@tetra:/ # ls -l /data
ls -l /data
adb
app
app-asec
app-lib
app-private
bugreports
dalvik-cache
data
dontpanic
drm
gps
local
lost+found
media
mediadrm
misc
property
resource-cache
security
system
tombstones
user
root@tetra:/ #

 

There is an alternative approach too!

We are not the only ones playing around with the Sony SmartWatch3 SWR50. Hence, while preparing this post there appeared an alternative approach for rooting the watch. Perpe did a great job in porting the TWRP recovery to the SWR50. Therefore, an alternative approach for rooting is to flash (or just to boot) that recovery image and then install the SuperSU update.zip package.