controlling a boAt smartwatch from my laptop over bluetooth

I have a cheap boAt Prism smartwatch, and the only thing allowed to talk to it is the boAt Crest app. But the watch speaks Bluetooth, and so does my laptop, so i wanted to know why the app gets to be the only boss. It doesn't have to be. I ended up pushing my own watch faces to it from a python script, with no app involved.

the short version

The watch is built by KaHa (not boAt) on a Realtek chip, and talks a plain serial protocol over Bluetooth LE.
The command channel has no pairing, password or auth. Anything nearby can boss it around.
I learned the protocol from the decompiled app and wrote a python tool for battery, clock, vibrate, notifications and watch faces.
Custom firmware isn't happening, and the hunt for it turned up something funny.

the open door

I scanned with my laptop and the watch showed up instantly. Its device info says KaHa Pte Ltd and Realtek. boAt just puts its name on it, which is why so many cheap watches feel identical.

Inside is a Nordic UART service, basically a two-way serial pipe over Bluetooth, and it's wide open. I connected from a laptop the watch had never seen, and it happily took orders.

learning the language

To know which bytes mean what, i pulled the Crest app apart with jadx. KaHa's code spells out every command (set time, send notification, find my watch), and each one is the same little envelope: category, command, length, payload. There's no checksum and no encryption.

I wrote a python script with bleak, and battery worked first, then the clock, then vibrate. "Find my watch" on this model is literally just buzzing it five times (so that's what mine does too). Notifications only worked once i found a hidden command that switches alerts on, which the app sends quietly on connect.

my own watch face

Uploading a picture as a wallpaper didn't work, because this early-2021 firmware doesn't do wallpapers. A custom face here is a whole face file: the app ships a template and paints your photo into it. My script does the same and streams it over, and two minutes later my face was on the watch.

One catch: the template is 368×448 but the screen is 410×502, and the watch silently deletes anything that doesn't match the template. The fix is boring. Paint the art on pure black and the empty strip vanishes into the bezel.

the firmware dead end

Custom firmware needs the original firmware, and nobody publishes it. The chip's SDK is under NDA, and the one person who tried on a similar watch said you'd have to open it up and wire in a hardware programmer.

So i poked the app's update server instead. It doesn't need a login, and it said "up to date" to everything, even when i claimed an ancient version and even when i asked about all ~130 boAt models the app knows. I didn't get a single firmware file.

It probably only serves real registered watches. Still, in my opinion the update button is mostly there to look reassuring. You buy a sub-₹2000 watch as-is, and as-is is what you keep, which makes that open Bluetooth pipe the best feature it has.

where it landed

Full control from my laptop: battery, clock, vibrate, notifications, faces. No app.
Custom faces from any picture in one command.
Custom firmware stays on the shelf.

Code and protocol notes are at udaysinh-git/boat-watch. It worked on my watch and firmware, and if you brick yours, that's on you.

It's a cheap watch, but it's a lot more fun once you stop asking the app for permission.