Be advised, some of the instructions below are now outdated due to significant changes to the Android Wear firmware and app since the Lollipop update. Most of these activities, like taking screenshots manually, enabling debugging, and even unlocking the bootloader will work with only minor modifications to the steps. However, the rooting steps below can not be expected to work any longer.

You saw Android Wear a couple of months ago when Google unveiled the SDK and both LG and Motorola presented the first promotional pictures. Then you watched the Google I/O keynote that officially launched the LG G Watch and Samsung's surprise addition of the Gear Live. And now you've got a shiny, brand new Android Wear watch before you... but all you can think about is ripping into the digital guts of that thing and doing all of the awful things that Google never intended. Admit it, you're one of us.

Android Police is here with a guide to fill all of your hacking and modding needs. Since Android Wear is so new, some of these methods may not be of much use at first, but the community will surely rise to the challenge before you know it. Let's get started!

These instructions assume that you are moderately familiar with using adb and fastboot. If you're using Windows, you will also need to have the USB drivers from the Android SDK installed and working properly. While it seems the KitKat SDK is sufficient for these steps, it's still best to get the most up-to-date versions of all of these tools before starting. Using outdated tools may result in unpredictable behavior.

Turn on (ADB) Debugging over USB and Bluetooth

Most of the things you'll want to do with Android Wear are going to require enabling debug mode. Since this is a necessity for most developers, the necessary steps have already been documented on the Android developer portal. The instructions in this guide are mostly identical to those provided, but with a few additional details and screenshots.

  1. Open Settings.
    1. Tap on Wear's watch face. This will take you to the voice prompt. Be sure to hit the watch face instead of a notification card.
    2. Wear will wait up to 3 seconds for you to say something, then it'll change to a scrollable list of native actions. You can speed this up by swiping up or tapping on the voice prompt.
    3. Scroll down and select Settings.
  2. Open About.
  3. Find Build number and tap on it 7 times. You're done when a toast popup appears with the message, "You are now a developer!"
  4. Swipe right (to go back) to the Settings menu.
  5. Open Developer options.
  6. Find and set ADB debugging to Enabled.
  7. You'll be asked if you're sure you want to enable. Tap the checkmark button to confirm.
  8. [Optional] If you want to also turn on debugging over Bluetooth, Find and set Debug over Bluetooth to Enabled.

Note: As long as debugging is enabled, attaching Android Wear to any computer with ADB installed will open a prompt like this on the phone your Wear device is paired with. If the computer belongs to you, it's probably safe to check the box and tap Ok so you won't have to authorize it each time. If you ever see this dialog when you aren't expecting it, you should probably play it safe and press Cancel.

Debugging Over Bluetooth

For most of the objectives in this guide, you will have to use adb and fastboot over a wired USB connection. However, if you're taking screenshots or developing an app, it might be more convenient to use adb over a wireless Bluetooth connection. This can be done by forwarding a socket through adb. That sounds more complicated than it really is.

  1. On your Android Wear device:
    1. Enable Debug over Bluetooth (described in the previous section).
  2. On the phone your Android Wear device is paired with:
    1. Attach the phone to your computer with a USB cable.
    2. Open the Android Wear companion app.
    3. Open the Settings screen (it may be an icon represented by a pair of gears, or it may be in the overflow menu).
    4. Enable on Debugging over Bluetooth.Note: Don't worry if the companion app indicates the target device is not connected, the status doesn't always refresh correctly.
  3. On your computer:
    1. Open a terminal window and enter this command:

adb forward tcp:4444 localabstract:/adb-hub; adb connect localhost:4444

The first part of that line will map a socket through the phone that is paired to your Wear device, while the second part makes a connection. At this point, we've got two devices attached to your computer. You can see a list of attached devices with:

adb devices

Screen Shot 2014-07-05 at 8.06.15 AM

The identifiers are listed on the left side, and their connection status on the right side. Since there are two devices visible to adb, it cannot automatically pick a default device. All of your commands will have to be sent using the -s flag along with a device identifier. We already declared the Android Wear watch would be on port 4444, so it's identifier appears as localhost:4444. For example, if we want to open a shell, the command will look something like this:

adb -s localhost:4444 shell

Taking Screenshots

Sometimes you want to snap a shot of what your device is showing you at a given moment. Unfortunately, the current run of Android Wear devices lack a convenient method for taking a screenshot. Until a better solution can be worked out, <cough>already on it<cough>, we have to rely on adb to fill the gap. Taking screenshots with adb requires debugging to be turned on and a connection to a computer through Bluetooth or USB.

From a terminal, enter the command:

adb shell screencap -p /sdcard/DCIM/screenshots/screenshot1.png

Reminder: change the file name for each screenshot.

The path can be set to any location you prefer, but the filename should be changed for each screenshot. If a filename already exists, it will be overwritten without warning. Also, if more than one device is attached, you'll have to use the -s flag to tell adb which device should be taking the screenshot.

Once you're done collecting screens, use adb pull to copy them over to your computer.

adb pull /sdcard/DCIM/screenshots/screenshot1.png

-or, to copy all of them at once-

adb pull /sdcard/DCIM/screenshots/

Modding 101

Welp, it's time to talk about voiding your warranty. If that's not your cup of tea, this is probably a good place to stop. It's possible to do some real damage with most of the things you would do from this point forward. You've been warned.

[disclaimer1]

Bootloader / Fastboot

If modding your Android Wear wristwatch is more your speed, it's time to start poking around the device internals. The first step is to get into the bootloader, also known as fastboot mode. The lack of physical buttons necessitates a few different methods for accessing the bootloader than we're familiar with on most handsets and tablets, but it's not that much different.

Method 1 - Swipe

This is probably the fastest and easiest way to reach fastboot mode. All you have to do is start (or restart) the watch and look for the OEM logo during boot up. While the logo is showing, and before the screen dims, swipe your finger from the top-left corner across to the bottom-right corner. If you're using a Samsung Gear Live, you'll also have to hold down the power button on the side. If executed correctly, you should be looking at your bootloader.

(Working on the video now)

Method 2 - Command Line

In some instances, it might be more convenient to use the command line if you happen to be at your computer and already have a terminal window open and ready to go. As long as debug mode is enabled and the watch is connected, just enter:

adb reboot bootloader

Both devices provide touch-enabled bootloaders. The LG G Watch places three on-screen buttons across the bottom. There are left and right arrows on either side to cycle through different actions (shown in red near the top of the screen). The commands are: Start, Power Off, Recovery Mode, and Restart Bootloader. Tap the arrows until the correct command is shown, then tap the circle in the center to perform the action. The Samsung Gear Live offers the same options, but you have to swipe downward to change your selection, and swipe to the right to activate it.

Left: Samsung Gear Live bootloader, Center: LG G Watch bootloader, Right: prompt to unlock

Recovery

For your primary flashing needs, recovery mode is usually the way to go. There aren't any direct button or gesture combinations to enter recovery mode, but getting there is still quick enough.

Method 1 - Fastboot Menu

This one is pretty obvious. Simply get into the bootloader through whatever means suit you, then use the menu to access Recovery Mode.

Method 2 - Command Line

You already know the bootloader is easy to reach with a simple command, and there's also one for Recovery Mode.

adb reboot recovery

Download Mode

If you find yourself in a bind, there's a chance that you'll be able to fix things in Download Mode. This is more of an interactive flashing tool that relies on a live connection to a computer. At this point in time, there aren't any good reasons to enter this mode, but it is worth mentioning. The steps to enter and leave download mode are a bit different depending on the device.

G Watch

The watch must be fully powered off, and then connected to the computer through the charging cradle. When the LG logo appears during boot up, swipe your finger from the bottom-left corner across to the top-right corner.

If you haven't done anything in download mode, or if the flashing tool doesn't automatically restart the device, it's possible to exit by simply breaking the connection with the computer. WARNING: Disconnecting the watch while flashing firmware will almost certainly brick it. Don't do this if there's any risk of writing data.

Gear Live

Restart the watch (it doesn't need to be powered off) and wait for the Samsung logo during boot up. With the logo on the screen, hold down the power button and swipe your finger from the top-right corner across to the bottom-left corner. Once in this screen, navigate downward by pressing the power button, and activate an option by long-pressing.

If you need to leave download mode, and the flashing software didn't automatically restart, navigate the menu to either "Start" or "Power Off."

Unlocking The Bootloader

Unlocking the bootloader will wipe user data from the device. Your installed apps should be restored after your phone is re-paired, but the data for some apps may not be. This includes collected data from your step counter, device pairings, and debug authorizations.

While it's possible to use adb over Bluetooth to reboot into the bootloader, you'll lose the connection once you're in there. The only way forward is with a wired USB connection to your Android Wear device.

The LG G Watch and Samsung Gear Live are shipping with locked bootloaders, but they are easily unlocked using a standard fastboot command, just like a Nexus device. In fact, if you've ever unlocked a Nexus phone or tablet, the process is basically the same.

To unlock your device, reboot it into bootloader mode and run this command from a terminal:

fastboot oem unlock

Warning: Samsung does not prompt for confirmation!!! It immediately unlocks the device and wipes your data. Come on, Samsung, get it together...

The LG G Watch will present you with the standard prompt advising you that this action may void your warranty and that your data will be wiped. The only thing of significance you're likely to lose is your pedometer info. Just about everything else should be stored by the apps on your phone. Once your watch is paired with your phone again, almost everything will be restored automatically.

To move ahead with the unlock, tap either arrow to change the option to "Yes - Unlock (may void warranty)," then tap the circle. It will only take a moment to wipe user data, and then the unlock is finished. Before making any other modifications, you should reboot the device, even if you're just rebooting back into the bootloader. Some devices may begin bootlooping without a restart after unlocking.

Left: LG bootloader unlocked, Right: LG boot screen with unlock icon

Oh, and before we assume Samsung is the only one that did a rush job with its bootloader, take a closer look at LG's unlock screen. Not only does it falsely claim that it will delete personal information on your phone, but it wants to inform the user that unlocking will allow for the installation of a "custome operting system" and that may void your "warrenty". Way to go, LG.

Rooting

Since the release of Android 5.0 Lollipop on Android Wear, rooting hasn't been closely examined. For watches with custom recoveries and unlockable bootloaders, it should be possible to flash SuperSU, but this process hasn't been examined yet.

Alright, you've unlocked your bootloader and you're ready to tear it up with custom roms and other assorted mods. But wait, this is probably a good time to stop. No, I'm not messing with you. Justin Case and I only just acquired root on the G Watch on July 4th, and there's very little that can be done with it at this point. Additionally, there are no superuser managers (eg. Chainfire's SuperSU or Koush's Superuser) available to prevent an app from abusing root for malicious purposes. This situation will surely change over a matter of days, or even hours, but that's where we're at for the moment. I'm not suggesting that people avoid rooting, only that they wait until it can be done a little more safely.

If you're one of the people that wants to get started on building some root apps, or you just need to be on the bleeding edge, you're in the right place. So far, we only have the process worked out for the LG G Watch, but the Samsung Gear Live should be ready fairly soon.

LG G Watch

The process is very straight forward, but it requires that you already have your bootloader unlocked. If you haven't already done so, go back and complete that step first.

First, download our modified boot image (thanks to Justin Case):

File name: LGGW-rootboot.img

MD5: fe2e8e3bb008096100da3e2014c597f1

  1. AndroidFileHost
  2. MediaFire
  3. ZippyShare
  4. Mega

Now, reboot into the bootloader:

adb reboot-bootloader

And boot the G Watch using the modified boot image. Warning: Do not flash the boot image, just boot from it!

fastboot boot LGGW-rootboot.img

The watch will play the boot animation for about 2 seconds, then automatically reboot. The modified boot image is only meant to run once so that it can install the necessary superuser binaries. After the watch automatically reboots, it will be running on the stock boot image. There will be no outwardly obvious signs the G Watch has been rooted, but you can check it by opening a shell through adb and running su.

adb shell

su

If your prompt turns from shell@dory to root@dory, then you've got root on your G Watch. Congratulations!

Samsung Gear Live

Still waiting on a stock root method.

Custom Recovery

Rooting your smartwatch is certainly a good way to get a handle on its operation, but there are times when the stock software just isn't good enough. At this point, you'll want to switch over to running a custom ROM. For that, you really want to use a custom recovery to do all of your flashing.

The process for installing a custom recovery on the G Watch is exactly like it would be for any other unlocked device. If you haven't already unlocked your bootloader, go back and complete that step. There's no need to root your device to install a custom recovery.

First, download the recovery image appropriate for your device:

Then, while your device is connected to a computer, get to your bootloader screen through whatever means you would like to use and enter this command to flash the recovery image.

fastboot flash recovery <filename.img>

The bootloader will briefly display the words "Downloading..." and then "Writing..." Once it is finished, tap the arrows until you see the option to reboot into Recovery Mode, and tap the circle button. That's all it takes!

Wrap-up

Since a lot will be changing with Android Wear over the next few days and weeks, I'll try to keep this post updated as new information comes in.

Changelog

  • 2014-07-05: Initial Version
  • 2014-07-25: Added details for TWRP custom recovery on G Watch. Also broken out a separate section to describe accessing fastboot, recovery, and download mode.
  • 2014-12-16: Struck out the Rooting section until it can be rewritten with respect to the changes made for Android 5.0.