r/OneplusWatch

Hi everyone,

Yesterday I dumped the full OTA for the OnePlus Watch 3 (OPWWE251). Since then I've been digging deeper, and I want to share what I found. I also just launched a Discord server for anyone who wants to help:

Discord: https://discord.gg/F4YK2YhFMc

🔓 EDL / FIREHOSE – FULL ACCESS CONFIRMED

• EDL works via software only: `fastboot oem edl` → device shows up as `05c6:9008` (Qualcomm GDL mode).

• Auto-timeout after ~10s → auto-reboots to system. Zero risk to enter.

• Fastboot works too: `adb reboot bootloader` → `22d9:2024`.

• Recovery exists (stored in vendor_boot) but is minimal – "No command", no menu, no ADB, auto-timeout failsafe.

• Force reboot: hold crown + bottom button ~12s.

More importantly – we now have a full OFP service package (A.94) containing:

• prog_firehose_ddr.elf (+ MCU and FW variants)

• ChainedTableOfDigests_24965_*.bin and _24966_*.bin

• DigestsToSign_24965_*.bin.mbn and _24966_*.bin.mbn

• Full rawprogram/patch XMLs

• Complete bootloader, MCU firmware, and system images

This means EDL restore is now possible if you brick your watch.

🆔 PROJECT ID CONFIRMED

• OnePlus Watch 3 = Project 24965 (OPWWE251, hardware XK929)

• OPPO Watch X2 = Project 24966 (OWWE251, hardware XK927)

Proof from build_24965.prop:

ro.separate.soft=24965

ro.oppo.market.name=OnePlus Watch

ro.product.display_name=OnePlus Watch 3

ro.product.device=OPWWE251

🔓 BOOTLOADER UNLOCK – SUPPORTED!

Key finding in build.prop: `ro.oem_unlock_supported=1`

That means `fastboot flashing unlock` should actually work.

Warning: it wipes all data, voids warranty, and kills Google Wallet. Relock is possible but requires a full stock restore via EDL first.

🛠️ ENGINEER MODE – 78 SECRET CODES

We dumped the full OnePlus service menu:

• 78 secret codes mapped from engineer_order_list.xml

• Full engineer HAL API (30+ methods), including:

– setPartionWriteProtectState(bool) – disables write protect

– writeData() / readData() – raw partition access

– setProperties() – system property modification

• Notable codes:

– *#8020# → enable ADB over WiFi

– *#9434# → secrecy panel

– *#3644999# → RebootManager (write protect)

– *#649010# → Qualcomm Diag mode

⚠️ Big limitation: the receiver is `android:exported="false"`, so these can't be triggered from shell without root or an exploit.

🧠 RTOS BES2610 – HEALTH STACK

• BES2610 = WiFi 6 + BT 5.x + RTOS sensor hub (NOT just sensor hub, and NOT BES2800 – correction to earlier info)

• RTOS handles heart rate, AFib detection, skin temp, steps, GPS

• 64 MCU commands documented, full IPC protocol mapped

• PPG sensor is on RTOS, not Linux

🏗️ ARCHITECTURE

4-processor design:

1. Snapdragon W5+ Gen 1 – Wear OS
2. BES2610 – WiFi 6 + BT + RTOS
3. SSHUB – Sensor Hub
4. Slate – Display / AOD

📦 WHAT WE STILL NEED

• Testers with bricked or sacrificial (willing to risk brick) devices

• Anyone with experience in Ghidra / IDA on ARM bootloaders

• Help with EDL restore testing

• Anyone with a newer OFP (A.125, A.127, A.131)

Everything is documented on GitHub:

github.com/zekog/oneplus-watch-3-firmware-dump

Join the Discord if you want to help or follow progress:

https://discord.gg/F4YK2YhFMc

Thanks to everyone who's been following this. More coming soon.

After an OTA update this error appeared. Everywhere says to hold both buttons down to enter the boot menu but all that happens is this message appears again. Is the only way to factory reset this by sending it in? Anyone else encountered this?

The screen will get scratches in long run? How's the durability of the screen as it's just a normal glass, not sapphire one. Kindly clear my doubt as planning to get one as Watch 3 and 4 not available in India