Power Saver mode is a special mode available on beluga where the Wear 3100 is shutdown and the Apollo3 MCU will take control of the display. In this mode the watch functions as a basic wristband where you can choose different watchfaces, track steps, and monitor the heartrate. It also has support for Bluetooth Low Energy, but for this to work you'll likely need to install "HeyTap"
Essentially the "Dual SoC" mode means that you can extend the battery greatly by turning the watch into a smart wristband.
On WearOS you can activate this mode by long pressing the accessory button.
Current research
I've tried to decompile all services on a beluga dump looking for traces to this "Power Saver" mode. This chapter will describe some of those findings.
MCU firmware
The MCU firmware is usually used for sensors and some minor other features. On beluga this firmware also can take over control of the LCD (and touch) allowing you to use the watch while it's essentially turned off (meaning the WearOS system is no longer turned on).
There are three separate firmware versions depending on the model: x19w6, x19w8 and x19w12. All of them follow a similar structure:
It's currently not known how to reverse engineer the firmware, though, it does not appear to be encrypted in any form, since there are some readable strings available after extracting the first entry using binwalk.
ui_xx.bin
This contains all the bitmaps used to display something on the display, binwalk reveals:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
8704 0x2200 PC bitmap, Windows 3.x format,, 24 x 30 x 8
9400 0x24B8 PC bitmap, Windows 3.x format,, 24 x 30 x 8
9912 0x26B8 PC bitmap, Windows 3.x format,, 36 x 30 x 8
10404 0x28A4 PC bitmap, Windows 3.x format,, 36 x 30 x 8
10972 0x2ADC PC bitmap, Windows 3.x format,, 36 x 30 x 8
11592 0x2D48 PC bitmap, Windows 3.x format,, 36 x 30 x 8
12292 0x3004 PC bitmap, Windows 3.x format,, 36 x 30 x 8
13068 0x330C PC bitmap, Windows 3.x format,, 12 x 12 x 8
13292 0x33EC PC bitmap, Windows 3.x format,, 12 x 12 x 8
13544 0x34E8 PC bitmap, Windows 3.x format,, 12 x 12 x 8
13768 0x35C8 PC bitmap, Windows 3.x format,, 192 x 160 x 8
15980 0x3E6C PC bitmap, Windows 3.x format,, 192 x 160 x 8
18104 0x46B8 PC bitmap, Windows 3.x format,, 192 x 160 x 8
20572 0x505C PC bitmap, Windows 3.x format,, 192 x 160 x 8
22884 0x5964 PC bitmap, Windows 3.x format,, 192 x 160 x 8
25124 0x6224 PC bitmap, Windows 3.x format,, 192 x 160 x 8
27436 0x6B2C PC bitmap, Windows 3.x format,, 192 x 160 x 8
29748 0x7434 PC bitmap, Windows 3.x format,, 192 x 160 x 8
32060 0x7D3C PC bitmap, Windows 3.x format,, 192 x 160 x 8
34372 0x8644 PC bitmap, Windows 3.x format,, 192 x 160 x 8
36684 0x8F4C PC bitmap, Windows 3.x format,, 328 x 96 x 8
37980 0x945C PC bitmap, Windows 3.x format,, 328 x 96 x 8
39032 0x9878 PC bitmap, Windows 3.x format,, 44 x 66 x 8
40396 0x9DCC PC bitmap, Windows 3.x format,, 32 x 66 x 8
41152 0xA0C0 PC bitmap, Windows 3.x format,, 44 x 66 x 8
42216 0xA4E8 PC bitmap, Windows 3.x format,, 44 x 66 x 8
43336 0xA948 PC bitmap, Windows 3.x format,, 44 x 66 x 8
44264 0xACE8 PC bitmap, Windows 3.x format,, 44 x 66 x 8
45392 0xB150 PC bitmap, Windows 3.x format,, 44 x 66 x 8
46684 0xB65C PC bitmap, Windows 3.x format,, 44 x 66 x 8
47568 0xB9D0 PC bitmap, Windows 3.x format,, 44 x 66 x 8
49056 0xBFA0 PC bitmap, Windows 3.x format,, 44 x 66 x 8
50352 0xC4B0 PC bitmap, Windows 3.x format,, 52 x 52 x 8
51228 0xC81C PC bitmap, Windows 3.x format,, 120 x 120 x 8
53032 0xCF28 PC bitmap, Windows 3.x format,, 120 x 120 x 8
54648 0xD578 PC bitmap, Windows 3.x format,, 52 x 52 x 8
55480 0xD8B8 PC bitmap, Windows 3.x format,, 52 x 52 x 8
56612 0xDD24 PC bitmap, Windows 3.x format,, 52 x 52 x 8
57432 0xE058 PC bitmap, Windows 3.x format,, 52 x 52 x 8
58436 0xE444 PC bitmap, Windows 3.x format,, 180 x 207 x 8
61988 0xF224 PC bitmap, Windows 3.x format,, 254 x 300 x 8
66416 0x10370 PC bitmap, Windows 3.x format,, 254 x 300 x 8
70660 0x11404 PC bitmap, Windows 3.x format,, 144 x 188 x 8
73304 0x11E58 PC bitmap, Windows 3.x format,, 144 x 188 x 8
76020 0x128F4 PC bitmap, Windows 3.x format,, 144 x 188 x 8
78776 0x133B8 PC bitmap, Windows 3.x format,, 144 x 188 x 8
81616 0x13ED0 PC bitmap, Windows 3.x format,, 144 x 188 x 8
84564 0x14A54 PC bitmap, Windows 3.x format,, 144 x 188 x 8
87528 0x155E8 PC bitmap, Windows 3.x format,, 144 x 188 x 8
90440 0x16148 PC bitmap, Windows 3.x format,, 144 x 188 x 8
93372 0x16CBC PC bitmap, Windows 3.x format,, 144 x 188 x 8
96280 0x17818 PC bitmap, Windows 3.x format,, 144 x 188 x 8
98840 0x18218 PC bitmap, Windows 3.x format,, 144 x 188 x 8
101484 0x18C6C PC bitmap, Windows 3.x format,, 144 x 188 x 8
104188 0x196FC PC bitmap, Windows 3.x format,, 144 x 188 x 8
106944 0x1A1C0 PC bitmap, Windows 3.x format,, 144 x 188 x 8
109784 0x1ACD8 PC bitmap, Windows 3.x format,, 144 x 188 x 8
112732 0x1B85C PC bitmap, Windows 3.x format,, 144 x 188 x 8
115696 0x1C3F0 PC bitmap, Windows 3.x format,, 144 x 188 x 8
118608 0x1CF50 PC bitmap, Windows 3.x format,, 144 x 188 x 8
121540 0x1DAC4 PC bitmap, Windows 3.x format,, 144 x 188 x 8
124448 0x1E620 PC bitmap, Windows 3.x format,, 144 x 188 x 8
127008 0x1F020 PC bitmap, Windows 3.x format,, 220 x 180 x 8
129064 0x1F828 PC bitmap, Windows 3.x format,, 220 x 180 x 8
131304 0x200E8 PC bitmap, Windows 3.x format,, 220 x 180 x 8
133508 0x20984 PC bitmap, Windows 3.x format,, 220 x 180 x 8
135424 0x21100 PC bitmap, Windows 3.x format,, 220 x 180 x 8
137296 0x21850 PC bitmap, Windows 3.x format,, 220 x 180 x 8
139132 0x21F7C PC bitmap, Windows 3.x format,, 220 x 180 x 8
140744 0x225C8 PC bitmap, Windows 3.x format,, 220 x 180 x 8
142356 0x22C14 PC bitmap, Windows 3.x format,, 220 x 180 x 8
144192 0x23340 PC bitmap, Windows 3.x format,, 220 x 180 x 8
146124 0x23ACC PC bitmap, Windows 3.x format,, 120 x 146 x 8
148484 0x24404 PC bitmap, Windows 3.x format,, 120 x 146 x 8
150204 0x24ABC PC bitmap, Windows 3.x format,, 120 x 146 x 8
152100 0x25224 PC bitmap, Windows 3.x format,, 120 x 146 x 8
154016 0x259A0 PC bitmap, Windows 3.x format,, 120 x 146 x 8
155872 0x260E0 PC bitmap, Windows 3.x format,, 120 x 146 x 8
157804 0x2686C PC bitmap, Windows 3.x format,, 120 x 146 x 8
159848 0x27068 PC bitmap, Windows 3.x format,, 120 x 146 x 8
161456 0x276B0 PC bitmap, Windows 3.x format,, 120 x 146 x 8
163708 0x27F7C PC bitmap, Windows 3.x format,, 120 x 146 x 8
165784 0x28798 PC bitmap, Windows 3.x format,, 120 x 146 x 8
168520 0x29248 PC bitmap, Windows 3.x format,, 120 x 146 x 8
170456 0x299D8 PC bitmap, Windows 3.x format,, 120 x 146 x 8
172732 0x2A2BC PC bitmap, Windows 3.x format,, 120 x 146 x 8
175008 0x2ABA0 PC bitmap, Windows 3.x format,, 120 x 146 x 8
177136 0x2B3F0 PC bitmap, Windows 3.x format,, 120 x 146 x 8
179416 0x2BCD8 PC bitmap, Windows 3.x format,, 120 x 146 x 8
181808 0x2C630 PC bitmap, Windows 3.x format,, 120 x 146 x 8
183636 0x2CD54 PC bitmap, Windows 3.x format,, 120 x 146 x 8
186312 0x2D7C8 PC bitmap, Windows 3.x format,, 120 x 146 x 8
188692 0x2E114 PC bitmap, Windows 3.x format,, 220 x 268 x 8
196320 0x2FEE0 PC bitmap, Windows 3.x format,, 48 x 48 x 8
196904 0x30128 PC bitmap, Windows 3.x format,, 48 x 48 x 8
197680 0x30430 PC bitmap, Windows 3.x format,, 220 x 268 x 8
212808 0x33F48 PC bitmap, Windows 3.x format,, 126 x 172 x 8
217084 0x34FFC PC bitmap, Windows 3.x format,, 126 x 172 x 8
221140 0x35FD4 PC bitmap, Windows 3.x format,, 126 x 172 x 8
223244 0x3680C PC bitmap, Windows 3.x format,, 126 x 172 x 8
226496 0x374C0 PC bitmap, Windows 3.x format,, 126 x 172 x 8
231504 0x38850 PC bitmap, Windows 3.x format,, 126 x 172 x 8
236596 0x39C34 PC bitmap, Windows 3.x format,, 126 x 172 x 8
241900 0x3B0EC PC bitmap, Windows 3.x format,, 126 x 172 x 8
245460 0x3BED4 PC bitmap, Windows 3.x format,, 126 x 172 x 8
250176 0x3D140 PC bitmap, Windows 3.x format,, 126 x 172 x 8
254796 0x3E34C PC bitmap, Windows 3.x format,, 126 x 172 x 8
263732 0x40634 PC bitmap, Windows 3.x format,, 126 x 172 x 8
266344 0x41068 PC bitmap, Windows 3.x format,, 126 x 172 x 8
269676 0x41D6C PC bitmap, Windows 3.x format,, 126 x 172 x 8
275912 0x435C8 PC bitmap, Windows 3.x format,, 126 x 172 x 8
280776 0x448C8 PC bitmap, Windows 3.x format,, 126 x 172 x 8
285324 0x45A8C PC bitmap, Windows 3.x format,, 126 x 172 x 8
291308 0x471EC PC bitmap, Windows 3.x format,, 126 x 172 x 8
296168 0x484E8 PC bitmap, Windows 3.x format,, 126 x 172 x 8
306344 0x4ACA8 PC bitmap, Windows 3.x format,, 126 x 172 x 8
313384 0x4C828 PC bitmap, Windows 3.x format,, 28 x 28 x 8
313956 0x4CA64 PC bitmap, Windows 3.x format,, 360 x 360 x 8
319228 0x4DEFC PC bitmap, Windows 3.x format,, 220 x 268 x 8
324836 0x4F4E4 PC bitmap, Windows 3.x format,, 128 x 128 x 8
326592 0x4FBC0 PC bitmap, Windows 3.x format,, 128 x 128 x 8
329332 0x50674 PC bitmap, Windows 3.x format,, 128 x 128 x 8
331892 0x51074 PC bitmap, Windows 3.x format,, 128 x 128 x 8
334476 0x51A8C PC bitmap, Windows 3.x format,, 128 x 128 x 8
336976 0x52450 PC bitmap, Windows 3.x format,, 128 x 128 x 8
339360 0x52DA0 PC bitmap, Windows 3.x format,, 128 x 128 x 8
341712 0x536D0 PC bitmap, Windows 3.x format,, 128 x 128 x 8
344008 0x53FC8 PC bitmap, Windows 3.x format,, 128 x 128 x 8
346220 0x5486C PC bitmap, Windows 3.x format,, 128 x 128 x 8
348344 0x550B8 PC bitmap, Windows 3.x format,, 128 x 128 x 8
350336 0x55880 PC bitmap, Windows 3.x format,, 128 x 128 x 8
352248 0x55FF8 PC bitmap, Windows 3.x format,, 128 x 128 x 8
354064 0x56710 PC bitmap, Windows 3.x format,, 128 x 128 x 8
355652 0x56D44 PC bitmap, Windows 3.x format,, 128 x 128 x 8
357056 0x572C0 PC bitmap, Windows 3.x format,, 148 x 148 x 8
359092 0x57AB4 PC bitmap, Windows 3.x format,, 148 x 148 x 8
362316 0x5874C PC bitmap, Windows 3.x format,, 148 x 148 x 8
365320 0x59308 PC bitmap, Windows 3.x format,, 148 x 148 x 8
368232 0x59E68 PC bitmap, Windows 3.x format,, 148 x 148 x 8
371180 0x5A9EC PC bitmap, Windows 3.x format,, 148 x 148 x 8
374004 0x5B4F4 PC bitmap, Windows 3.x format,, 148 x 148 x 8
376788 0x5BFD4 PC bitmap, Windows 3.x format,, 148 x 148 x 8
379480 0x5CA58 PC bitmap, Windows 3.x format,, 148 x 148 x 8
382064 0x5D470 PC bitmap, Windows 3.x format,, 148 x 148 x 8
384564 0x5DE34 PC bitmap, Windows 3.x format,, 148 x 148 x 8
386920 0x5E768 PC bitmap, Windows 3.x format,, 148 x 148 x 8
389148 0x5F01C PC bitmap, Windows 3.x format,, 148 x 148 x 8
391268 0x5F864 PC bitmap, Windows 3.x format,, 148 x 148 x 8
393088 0x5FF80 PC bitmap, Windows 3.x format,, 148 x 148 x 8
394684 0x605BC PC bitmap, Windows 3.x format,, 194 x 194 x 8
397040 0x60EF0 PC bitmap, Windows 3.x format,, 194 x 194 x 8
400112 0x61AF0 PC bitmap, Windows 3.x format,, 194 x 194 x 8
403176 0x626E8 PC bitmap, Windows 3.x format,, 194 x 194 x 8
406124 0x6326C PC bitmap, Windows 3.x format,, 194 x 194 x 8
408860 0x63D1C PC bitmap, Windows 3.x format,, 194 x 194 x 8
411468 0x6474C PC bitmap, Windows 3.x format,, 194 x 194 x 8
414000 0x65130 PC bitmap, Windows 3.x format,, 194 x 194 x 8
416428 0x65AAC PC bitmap, Windows 3.x format,, 194 x 194 x 8
418768 0x663D0 PC bitmap, Windows 3.x format,, 194 x 194 x 8
420992 0x66C80 PC bitmap, Windows 3.x format,, 194 x 194 x 8
423096 0x674B8 PC bitmap, Windows 3.x format,, 194 x 194 x 8
425064 0x67C68 PC bitmap, Windows 3.x format,, 194 x 194 x 8
426900 0x68394 PC bitmap, Windows 3.x format,, 194 x 194 x 8
428604 0x68A3C PC bitmap, Windows 3.x format,, 194 x 194 x 8
429976 0x68F98 PC bitmap, Windows 3.x format,, 44 x 14 x 8
430204 0x6907C PC bitmap, Windows 3.x format,, 178 x 96 x 8
431336 0x694E8 PC bitmap, Windows 3.x format,, 220 x 268 x 8
438904 0x6B278 PC bitmap, Windows 3.x format,, 8 x 34 x 8
439316 0x6B414 PC bitmap, Windows 3.x format,, 10 x 34 x 8
439656 0x6B568 PC bitmap, Windows 3.x format,, 18 x 34 x 8
440208 0x6B790 PC bitmap, Windows 3.x format,, 17 x 34 x 8
440816 0x6B9F0 PC bitmap, Windows 3.x format,, 22 x 34 x 8
441424 0x6BC50 PC bitmap, Windows 3.x format,, 19 x 34 x 8
442008 0x6BE98 PC bitmap, Windows 3.x format,, 5 x 34 x 8
442316 0x6BFCC PC bitmap, Windows 3.x format,, 11 x 34 x 8
442836 0x6C1D4 PC bitmap, Windows 3.x format,, 11 x 34 x 8
443360 0x6C3E0 PC bitmap, Windows 3.x format,, 13 x 34 x 8
443776 0x6C580 PC bitmap, Windows 3.x format,, 17 x 34 x 8
444168 0x6C708 PC bitmap, Windows 3.x format,, 7 x 34 x 8
444500 0x6C854 PC bitmap, Windows 3.x format,, 10 x 34 x 8
444780 0x6C96C PC bitmap, Windows 3.x format,, 9 x 34 x 8
445080 0x6CA98 PC bitmap, Windows 3.x format,, 12 x 34 x 8
445516 0x6CC4C PC bitmap, Windows 3.x format,, 16 x 34 x 8
446096 0x6CE90 PC bitmap, Windows 3.x format,, 16 x 34 x 8
446548 0x6D054 PC bitmap, Windows 3.x format,, 16 x 34 x 8
447032 0x6D238 PC bitmap, Windows 3.x format,, 16 x 34 x 8
447560 0x6D448 PC bitmap, Windows 3.x format,, 16 x 34 x 8
448068 0x6D644 PC bitmap, Windows 3.x format,, 16 x 34 x 8
448596 0x6D854 PC bitmap, Windows 3.x format,, 16 x 34 x 8
449132 0x6DA6C PC bitmap, Windows 3.x format,, 16 x 34 x 8
449564 0x6DC1C PC bitmap, Windows 3.x format,, 16 x 34 x 8
450156 0x6DE6C PC bitmap, Windows 3.x format,, 16 x 34 x 8
450692 0x6E084 PC bitmap, Windows 3.x format,, 8 x 34 x 8
451016 0x6E1C8 PC bitmap, Windows 3.x format,, 7 x 34 x 8
451380 0x6E334 PC bitmap, Windows 3.x format,, 15 x 34 x 8
451780 0x6E4C4 PC bitmap, Windows 3.x format,, 17 x 34 x 8
452104 0x6E608 PC bitmap, Windows 3.x format,, 16 x 34 x 8
452508 0x6E79C PC bitmap, Windows 3.x format,, 15 x 34 x 8
452976 0x6E970 PC bitmap, Windows 3.x format,, 26 x 34 x 8
453812 0x6ECB4 PC bitmap, Windows 3.x format,, 20 x 34 x 8
454376 0x6EEE8 PC bitmap, Windows 3.x format,, 19 x 34 x 8
454976 0x6F140 PC bitmap, Windows 3.x format,, 19 x 34 x 8
455524 0x6F364 PC bitmap, Windows 3.x format,, 19 x 34 x 8
456128 0x6F5C0 PC bitmap, Windows 3.x format,, 17 x 34 x 8
456596 0x6F794 PC bitmap, Windows 3.x format,, 16 x 34 x 8
457036 0x6F94C PC bitmap, Windows 3.x format,, 20 x 34 x 8
457628 0x6FB9C PC bitmap, Windows 3.x format,, 21 x 34 x 8
458264 0x6FE18 PC bitmap, Windows 3.x format,, 9 x 34 x 8
458744 0x6FFF8 PC bitmap, Windows 3.x format,, 17 x 34 x 8
459264 0x70200 PC bitmap, Windows 3.x format,, 19 x 34 x 8
459880 0x70468 PC bitmap, Windows 3.x format,, 16 x 34 x 8
460316 0x7061C PC bitmap, Windows 3.x format,, 26 x 34 x 8
461104 0x70930 PC bitmap, Windows 3.x format,, 21 x 34 x 8
461804 0x70BEC PC bitmap, Windows 3.x format,, 21 x 34 x 8
462428 0x70E5C PC bitmap, Windows 3.x format,, 19 x 34 x 8
462964 0x71074 PC bitmap, Windows 3.x format,, 21 x 34 x 8
463624 0x71308 PC bitmap, Windows 3.x format,, 19 x 34 x 8
464248 0x71578 PC bitmap, Windows 3.x format,, 18 x 34 x 8
464808 0x717A8 PC bitmap, Windows 3.x format,, 18 x 34 x 8
465236 0x71954 PC bitmap, Windows 3.x format,, 19 x 34 x 8
465844 0x71BB4 PC bitmap, Windows 3.x format,, 19 x 34 x 8
466428 0x71DFC PC bitmap, Windows 3.x format,, 26 x 34 x 8
467200 0x72100 PC bitmap, Windows 3.x format,, 19 x 34 x 8
467788 0x7234C PC bitmap, Windows 3.x format,, 18 x 34 x 8
468316 0x7255C PC bitmap, Windows 3.x format,, 18 x 34 x 8
468788 0x72734 PC bitmap, Windows 3.x format,, 8 x 34 x 8
469268 0x72914 PC bitmap, Windows 3.x format,, 13 x 34 x 8
469732 0x72AE4 PC bitmap, Windows 3.x format,, 8 x 34 x 8
470204 0x72CBC PC bitmap, Windows 3.x format,, 13 x 34 x 8
470604 0x72E4C PC bitmap, Windows 3.x format,, 14 x 34 x 8
470868 0x72F54 PC bitmap, Windows 3.x format,, 10 x 34 x 8
471168 0x73080 PC bitmap, Windows 3.x format,, 16 x 34 x 8
471664 0x73270 PC bitmap, Windows 3.x format,, 17 x 34 x 8
472240 0x734B0 PC bitmap, Windows 3.x format,, 16 x 34 x 8
472712 0x73688 PC bitmap, Windows 3.x format,, 16 x 34 x 8
473276 0x738BC PC bitmap, Windows 3.x format,, 16 x 34 x 8
473752 0x73A98 PC bitmap, Windows 3.x format,, 11 x 34 x 8
474256 0x73C90 PC bitmap, Windows 3.x format,, 17 x 34 x 8
474856 0x73EE8 PC bitmap, Windows 3.x format,, 17 x 34 x 8
475436 0x7412C PC bitmap, Windows 3.x format,, 8 x 34 x 8
475856 0x742D0 PC bitmap, Windows 3.x format,, 10 x 34 x 8
476368 0x744D0 PC bitmap, Windows 3.x format,, 16 x 34 x 8
476904 0x746E8 PC bitmap, Windows 3.x format,, 8 x 34 x 8
477348 0x748A4 PC bitmap, Windows 3.x format,, 26 x 34 x 8
478024 0x74B48 PC bitmap, Windows 3.x format,, 17 x 34 x 8
478548 0x74D54 PC bitmap, Windows 3.x format,, 17 x 34 x 8
479056 0x74F50 PC bitmap, Windows 3.x format,, 17 x 34 x 8
479624 0x75188 PC bitmap, Windows 3.x format,, 17 x 34 x 8
480200 0x753C8 PC bitmap, Windows 3.x format,, 11 x 34 x 8
480600 0x75558 PC bitmap, Windows 3.x format,, 15 x 34 x 8
481084 0x7573C PC bitmap, Windows 3.x format,, 10 x 34 x 8
481536 0x75900 PC bitmap, Windows 3.x format,, 17 x 34 x 8
482072 0x75B18 PC bitmap, Windows 3.x format,, 15 x 34 x 8
482540 0x75CEC PC bitmap, Windows 3.x format,, 22 x 34 x 8
483152 0x75F50 PC bitmap, Windows 3.x format,, 15 x 34 x 8
483644 0x7613C PC bitmap, Windows 3.x format,, 15 x 34 x 8
484168 0x76348 PC bitmap, Windows 3.x format,, 15 x 34 x 8
484580 0x764E4 PC bitmap, Windows 3.x format,, 10 x 34 x 8
485096 0x766E8 PC bitmap, Windows 3.x format,, 8 x 34 x 8
485556 0x768B4 PC bitmap, Windows 3.x format,, 10 x 34 x 8
486072 0x76AB8 PC bitmap, Windows 3.x format,, 20 x 34 x 8
486452 0x76C34 PC bitmap, Windows 3.x format,, 23 x 34 x 8
487012 0x76E64 PC bitmap, Windows 3.x format,, 180 x 207 x 8
490500 0x77C04 PC bitmap, Windows 3.x format,, 48 x 48 x 8
491124 0x77E74 PC bitmap, Windows 3.x format,, 48 x 48 x 8
491596 0x7804C PC bitmap, Windows 3.x format,, 48 x 48 x 8
492220 0x782BC PC bitmap, Windows 3.x format,, 48 x 48 x 8
Here's a preview of some of the contents:
WearOS
Triggering this mode from WearOS doesn't appear to be trivial as it's tightly embedded in the system.
There are four references to "Power Saver":
After extracting the apks it was shown HeySystemUIPartner is responsible for the UI shown when you long press the accessory button. The others didn't initially show anything of interest at this point as the goal is to find out how to trigger the "Power Saver" mode.
After further research it became obvious that an Intent named com.android.internal.intent.action.REQUEST_WRISTMODE is responsible for triggering the mode. However finding this was harder than it may seem at a first glance. But a comment to WristbandConfirmActivity revealed more information. This appears to be the Intent we need.
Log.d(ShutdownUINormal.TAG, "start WristbandConfirmActivity with user confirm");
Intent intent = new Intent("com.android.internal.intent.action.REQUEST_WRISTMODE");
This activity contains the logic to show a dialog and when confirmed it will initiate a shutdown using the Android PowerManager. But It passes a special reason flag with it ENTER_WRIST_BAND_MODE. So it ends up calling this:
This call is located in (my) decompiled code: HeySystemUIPartner/sources/com/heytap/wearable/systemuipartner/wristband/WristBandConfirmActivity.java.
services.vdex contains the reference to ENTER_WRIST_BAND_MODE in the sources/com/android/server/power/ShutdownMcuThread.java file. Specifically this check:
Which ends up setting a targetMode. To turn off the entire system it's set to 2 to enable WristBandMode/"Power Saver" mode it's set to 1.
Then it calls setMcuWorkMode the implementation for this function is located in boot-framework.vdex.
Depending on the workMode (which is the targetMode) it will set a message id:
0 -> 373
1 -> 375
2 -> 374
At this point it will send a message to the SensorHubManager: this.mSensorHubmanager.sendInfoSafely(msgId, new OppoData().setData(data));
Power Saver mode is a special mode available on
beluga
where the Wear 3100 is shutdown and the Apollo3 MCU will take control of the display. In this mode the watch functions as a basic wristband where you can choose different watchfaces, track steps, and monitor the heartrate. It also has support for Bluetooth Low Energy, but for this to work you'll likely need to install "HeyTap"Essentially the "Dual SoC" mode means that you can extend the battery greatly by turning the watch into a smart wristband.
On WearOS you can activate this mode by long pressing the accessory button.
Current research
I've tried to decompile all services on a
beluga
dump looking for traces to this "Power Saver" mode. This chapter will describe some of those findings.MCU firmware
The MCU firmware is usually used for sensors and some minor other features. On
beluga
this firmware also can take over control of the LCD (and touch) allowing you to use the watch while it's essentially turned off (meaning the WearOS system is no longer turned on).There are three separate firmware versions depending on the model:
x19w6
,x19w8
andx19w12
. All of them follow a similar structure:These are located on the
vendor
partition:/firmware/mcufirmware/
The
config.txt
file contains the information on which file to use:mcu_xx.bin
This files contains the actual firmware along with some AES keys (?).
binwalk
reveals the following:It's currently not known how to reverse engineer the firmware, though, it does not appear to be encrypted in any form, since there are some readable strings available after extracting the first entry using
binwalk
.ui_xx.bin
This contains all the bitmaps used to display something on the display,
binwalk
reveals:Here's a preview of some of the contents:
WearOS
Triggering this mode from WearOS doesn't appear to be trivial as it's tightly embedded in the system. There are four references to "Power Saver":
After extracting the apks it was shown
HeySystemUIPartner
is responsible for the UI shown when you long press the accessory button. The others didn't initially show anything of interest at this point as the goal is to find out how to trigger the "Power Saver" mode.After further research it became obvious that an
Intent
namedcom.android.internal.intent.action.REQUEST_WRISTMODE
is responsible for triggering the mode. However finding this was harder than it may seem at a first glance. But a comment toWristbandConfirmActivity
revealed more information. This appears to be the Intent we need.This activity contains the logic to show a dialog and when confirmed it will initiate a
shutdown
using the AndroidPowerManager
. But It passes a specialreason
flag with itENTER_WRIST_BAND_MODE
. So it ends up calling this:This call is located in (my) decompiled code:
HeySystemUIPartner/sources/com/heytap/wearable/systemuipartner/wristband/WristBandConfirmActivity.java
.services.vdex
contains the reference toENTER_WRIST_BAND_MODE
in thesources/com/android/server/power/ShutdownMcuThread.java
file. Specifically this check:Which ends up setting a
targetMode
. To turn off the entire system it's set to2
to enableWristBandMode
/"Power Saver" mode it's set to1
.Then it calls
setMcuWorkMode
the implementation for this function is located inboot-framework.vdex
. Depending on theworkMode
(which is thetargetMode
) it will set a message id:At this point it will send a message to the
SensorHubManager
:this.mSensorHubmanager.sendInfoSafely(msgId, new OppoData().setData(data));
Finally the
SensorHubManager
appears to be the point where data is actually send to the MCU via a binder interface to thedeamonserver
. On AsteroidOS this interface is also available as it is needed for sensors to work: https://github.com/AsteroidOS/meta-smartwatch/blob/59166cef96bc7e55dc6292826644a8d12c272ba0/meta-beluga/recipes-android/android-init/android-init/init.rc#L56Data is sent to the
deamonserver
by using atransaction
which is a call to an A Android API used specifically for the binder interface:bussnessID
is the message id mentioned previously.Next steps
Create a simple application that can talk to the
deamonserver
using the binder interface. We already have some reference material to this by means of:bluebinder
: Bluetooth binder. Creates a simple bridge between the Bluetooth binder service and a virtual HCI device.geoclue-hybris-plugin
: Uses the binder interface for GPS.sensorfw
: Uses the sensor binder interface for sensor support.