New to the FAW game.
i got my cd20max today. I changed the language to English.
Should I test with a ‘burner’ sim card? OR, is there any concern with using my ‘main’ sim to test calls and messages?
I’m fairly savvy, so appreciate any good starting point. I got the 4 pin cable on the way.
You will be fine with any sim to test. Have you global or CN model
judging by second line it is CN
Cn baseband is allot stronger then EU
so it should work with any sim
call is unlikely to work but data almost certainly yes
Thanks! But since I use Google fi I think there is an issue for out of the box. Provisioning requires the Google fi app on Android. I’d love to know if there’s a way around that.
So probably I will need to grab a different SIM card.
My question was kind of on the “apps/background network usage” of the standard rom. Is there any apps that are phoning home or similar that I should turn off.
It is chinese model. I ordered from the same seller that this user did: https://discourse.fullandroidwatch.org/t/where-to-order-cd20max-cd12max-from/74462/97?u=jimmy_james
There are some, more on mimu compared to noemie, but it’s 2026 you don’t have unlimited data?
It’s not gonna be crazy because ofcourse that’s gonna drain the battery and they don’t want that
I don’t think the background data used by the system app is enough to worry about, first the system updater check update, then the launcher will keep persistent connection, then the child mode manager, I don’t think it’ll use more then a few mb if that, not enough to worry about using all your data capacity
Received my CD20max CN version a few days a go.
USB debugging succeeded with code *#*#385882#*#* and ADB is working with data cable.
Fastboot flashing seems to be locked / disabled in this batch.
spd_dump works and the first thing was take full backup with “r all”!
Tried TWRP from GitHub - hxzbaka/twrp_device_tree_sprd_uws6152_1h10_go-cd20max: BiDeZhi_WATCH CD20MAX-W527 Android9.0 · GitHub and it was writable with spd_dump and booted but touch was not working. Replaced kernel from stock boot.img and compiled whole thing from sources => touch worked with new image.
Because there is sprd recovery key available from those sources it is possible to sign modified recovery images with avbtool.
Installed Magisk in recovery mode: 1. adb install Magisk, 2. modified stock recovery.img with Magisk, 3. signed modified recovery image with avbtool, 4. write signed image with spd_dump, 5. rebooted to recovery => system booted with Magisk installed.
With these modifications there is now some text in the lower left corner of the display. Does anyone know what it means (“The device has no written number”) and how to get rid of it? 
ps. Thanks to all for the links and tips provided!
Edit: The reason for the above problem was that the IMEI was not visible to the system when Magisk was active when booted from the recovery partition.
Found sprd vbmeta private key from Hovatek and managed to make new signed vbmeta image with new boot image key. Then I could install Magisk to boot image and now I have working root and IMEI at the same time.
# On Linux
spd_dump --wait 300 fdl fdl1-sign.bin 0x5500 fdl fdl2-sign.bin 0x9efffe00 exec
r all
poweroff
VBMetaKeysExtractor vbmeta.bin
avbtool make_vbmeta_image --key rsa4096_vbmeta.pem --algorithm SHA256_RSA4096 --flag 2 --chain_partition boot:1:recovery_key.bin --chain_partition system:3:system_key.bin --chain_partition vendor:4:vendor_key.bin --chain_partition product:10:product_key.bin --chain_partition dtbo:9:dtbo_key.bin --chain_partition recovery:2:recovery_key.bin --chain_partition l_modem:5:l_modem_key.bin --chain_partition l_ldsp:6:l_ldsp_key.bin --chain_partition l_gdsp:7:l_gdsp_key.bin --chain_partition pm_sys:8:pm_sys_key.bin --chain_partition dtb:11:dtb_key.bin --chain_partition l_agdsp:12:l_agdsp_key.bin --chain_partition l_cdsp:13:l_cdsp_key.bin --padding_size 20480 --output vbmeta_custom.img
python vbmeta_pad.py
avbtool add_hash_footer --image modified_boot.img --partition_name boot --partition_size 36700160 --key sprd_rsa4096_recovery.pem --algorithm SHA256_RSA4096
spd_dump --wait 300 fdl fdl1-sign.bin 0x5500 fdl fdl2-sign.bin 0x9efffe00 exec
w vbmeta vbmeta_custom.img
w boot modified_boot.img
poweroff
And TWRP is also now back in use.
Yes, it usually means that the bootloader (pre-loader) has been unlocked or modified. @AILIFE may know exactly what this means, can you help with this translation? Mind you, I am surprised that you didn’t translate it with the photo @Mr47…?
Anyway, it’s likely to be similar to the unlocked bootloader message that you see on phones that have been unlocked / rooted etc…
I just wanted to say a big thank you from all here, for all your images and info… rmation about your progress. This is the sort of detail that end users want to see and try to understand. This is a great post, thanks 
机器未写号=machine haven’t been written IMEI number
With w527 avb is not functional, you can just flash system right away without do anything else and it’ll boot, but you need to disable encryption either in system or vendor or it’ll boot to recovery and say data is corrupted and in custom ROM it won’t check IMEI
If you want my next generation system will in development, contact me @AILIFE4798
Ah ok, same as ASR… I mean same warming.
Thanks
for qc people to throw those away and not ship it acidentally
Update on Sims for Usage in USA
GoogleFi - NO.. requires app installed to provision
Tello - NO. T-Mobile MVNO, aggressively rejects non VoLTE capable phones - Stock ROM can’t provision.
Up next, SpeedTalk sim. Will report back.
stock rom and my rom is both capable of volte, but freedom country have no standard so it is not garunteed to work
Thanks for the information and your work!
I can still boot Magisk enabled with “adb reboot recovery” and back to “stock” (and IMEI showing) with “adb reboot”. I can live with that.
Developer helper can write IMEI, just generate any one online is ok, noemie system does collect and send back the IMEI but their server does not validate the IMEI is from their factory, only mimu does that, if you write IMEI that failed their algorithm check it will say device not found error
Btw you can elevate from adb into root on any unisoc or asr device (if selinux disabled can elevate from untrusted app into root)
Thanks. So, can I spoof the real IMEI with developer helper “on the fly” when Magisk (and root) is enabled?
no ned root, sprd is easy to write imei, you can also do with PC using some program, but on stock using the developer helper is easiest
but as i said the system do not care what imei do you have so just having something is enough, only mimu ui device you will be better having real imei otherwise you lose all connection feature like watchface and ota
it is not used for to ruin your day just make QC’s life easier thats it
i mean why do you even buy w527 to use stock rom anyways
