APPLLP MAX S999 + other HEBS types - UNSUPPORTED - posts left here

,

I don’t use a “tethered” app with my S999+ with Android 11. I install things either through the Play Store in the device or an .apk transferred to the device. I treat it like a fully stand-alone device.

Maybe if you reach out to Rainbuvvy they can provide their S999 image to flash to your device, or whatever image they are using on the S999’s they are selling.

Generally speaking, it’s extremely difficult to get an iOS app to work with Android.

If it has been withdrawn from the Apple store, it indicates that it doesn’t meet security standards. Watch Droid (Android) is appropriate, but of course, on Android devices only.

2 Likes

I found that it is working with application “BT Watch” but the application is too small(function only to resend notifications) . Also I saw that someone has origin rom “4g_h19_s999_en_v0.9_p_user_20230712” and I think that this rom is working more better with IOS (cause I have much older version). So please share it.

Maybe check out here? Seems to be quite useful for this device….

https://xdaforums.com/t/s999-smart-watch-mtk-6761-stock-firmware-unlock-booloader-root-gsi-roms.4526023/page-4

Hoya there. So I was interested in the S998 or MKT6761 or MKT6763 or Lokmat Max 2 or another of the 50 names it has. The square one with 2,64” screen made by several brands ( factory, sainbuuvy, Lokmat). And I wonder if some of you already have it and can help me. My main concerns are three:

The watchfaces will be limited and without the plus sign at the end of the list to download a hundred if necessary.

There won’t be an app to connect to the phone. I’m not looking for a small smartphone but a big smartwatch.

The cameras quality will be inferior to those advertised. It happened to me a few weeks ago with the Lokmat Max New S999 (the one with 6gb RAM). They advertise 13 and 5 megapixels and the reality is 2 and 0.3 max. I returned it. And I thought Lokmat was supposed to be the brand to go in this kind of watches.

Well if anyone can throw some light on the subject I’d really appreciate it. I’ve been looking for information and reviews and stuff but there isn’t much on the internet. I hope this is the right chat to ask.

I found solution in development new app for sharing notifications from iPhone if you use custom rom(for example I use Corvus_vS4.0-Leviathan-treble_arm64_ab-Unofficial-1513.img(Android 12). But I can’t add links there…

1 Like

Just remove the https and replace dot with , to bypass detection

2 Likes

Okay, this is link. I am waiting for reviews: drive.google.com/file/d/1sXhUcqnrqZbCCseNztNbGZGpzkqdWuI7/view?usp=sharing

1 Like

is similar to rtosify, no adjusments options, you can give a try.

Where have you find a S999 with 6gb of ram ? Have you a link ?

Hello,

On aliexpress, here for example :

I only see 4gb ram on this links, not 6gb..

  1. Installing an iPhone app only via Xcode on a Mac—no .ipa, no TestFlight, no App Store. This is Swift Package source code. You need a Mac + Apple ID (free = 7-day certificate); for a permanent one, it’s $99/year Apple Developer.
    2. iOS doesn’t allow apps to read other apps’ notifications—only ANCS (which we’re already using). Their iOS app can only intercept their own app-generated notifications or their own shortcuts. They won’t receive iMessage/Telegram/Mail, as we receive them via ANCS.
    3. The watch must be a BLE peripheral—we tested it, and on this MTK chip, the peripheral mode silently fails (0 BLE apps registered in dumpsys), so we can’t emulate their watch app at all.

Conclusion: rtosify-lite-ios isn’t suitable for us. We already have something working that they can’t do (receiving system iOS notifications via ANCS without an iPhone app at all).

1 Like

does iphone not use random mac?otherwise without ios app how does it know which to connect to, android ble it always changes
rtosify also uses ancs so should be able to read the system notification
i have .ipa file if needed

There is no S999 with 6gb of ram…

In this context regarding iPhone applications, the size of the ram is not important.

@AILIFE I’m fairly sure that ios does allow for random mac for Wi-Fi, but I doubt it will be acceptable for BT. I’m happy to find out otherwise, but given their security focus - I have doubts.

Why not just use the real BT mac and if not present, just write it using the the correct tool for the watch SOC.

in android you can NOT set a static mac when advertising BLE for privacy
on iOS can you do that? it wouldnt make sense
because without ios app, and mac is random, how do watch know where to connect?
if real mac is present, your app can not read it, and your app can not force a mac either

it is just a question i have no ios experience and it is the case for android
difficulty of installing app is just what you get for using a iphone you should have know that

and without iOS app, what is there to set the MAC? does the ios system just automatically always advertise a static mac?that would kinda be a security flaw i dont believe they do that, so without ios app, how does this all work?

Thanks for the offer, but I want to clarify the ANCS model — the MAC question keeps coming up and it actually flips the architecture.

▎ iOS ANCS is the inverse of rtosify. On iOS, the iPhone is the GATT server — it hosts the Apple Notification Center Service (UUID
▎ 7905F431-B5CE-4E99-A40F-4B1E122D00D0). The watch is the GATT client (BLE central). So the watch initiates the connection to iPhone, not the other way ▎ around. No iOS app is needed — ANCS is exposed by iOS itself to any bonded peer.
▎ ▎ About the random MAC: Yes, iOS uses LE Privacy with Resolvable Random Private Addresses that rotate (~15 min). But after BT pairing, iOS shares its
▎ Identity Resolving Key (IRK) with the bonded peer. After that, the watch’s Bluedroid stack resolves any future rotated address back to the same iPhone
▎ using the IRK — automatically, no app code needed. Works on stock MT6761.

▎ So in the central-side model: the watch doesn’t need a stable public MAC and the iPhone’s rotating MAC isn’t a problem.

▎ About MTK peripheral mode on S999: confirmed by dumpsys bluetooth_manager: startAdvertising() fires the onStartSuccess callback but 0 BLE apps registered
▎ / mAdvertisingServiceUuids empty. The chip silently doesn’t actually transmit advertisements. So the rtosify model (watch advertises as peripheral, iPhone
▎ connects in) is closed on this hardware regardless of iOS-side code.

▎ What works on S999 + Corvus GSI: watch as central + ANCS. I built NotifyBridge that does exactly this — user does standard Classic BT pair from iPhone
▎ Settings → Bluetooth, then the watch app opens GATT-client to the bonded iPhone, subscribes to Notification Source + Data Source, parses
▎ Get-Notification-Attributes responses, and reposts as local Android notifications. Working on Corvus vS4.0 Leviathan on S999. Happy to share the APK if
▎ anyone wants it.

@pablo11 — same logic: writing the BT MAC via the SoC tool isn’t required here. Random + IRK handles everything once initial Classic pair is done.

3 Likes