TicWatch Pro 3 Ultra GPS (rubyfish) on Wear OS 3.5

TWRP and Magisk root — neither requiring a downgrade to Wear OS 2, which every documented route for this watch says you must do first.

Two results

1. TWRP boots on the Wear OS 3.5 bootloader

The community position is that "flashing TWRP without downgrading won't work" — TWRP "wasn't made for Wear OS 3". That is true of the published image, and our own attempts confirm it. It is not true of its ramdisk.

A hybrid — stock Wear OS 3.5 recovery as the base, TWRP's ramdisk swapped in — boots. Isolated one variable at a time:

variant	kernel	ramdisk	container	result
published TWRP as-is	Wear OS 2 era	TWRP	v0/older	refused
container fixed only	foreign	foreign	v1 + stock recovery_dtbo	still refused
stock base, foreign ramdisk	stock 3.5	TWRP	stock	accepted, boots

Header v1 plus the stock recovery_dtbo is necessary but not sufficient — the bootloader gates on the kernel. → docs/01-twrp-on-wearos35.md

This matters on its own: TWRP is how you take a full backup before touching boot, and it gives the root shell needed to verify a flash by hashing on the device.

2. Magisk root on a normal boot of stock Wear OS 3.5

$ adb shell su -c id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
$ getenforce
Enforcing

Build RMRB.240228.002. Verified on battery over Wi-Fi with USB unplugged, surviving reboots unattended. → docs/02-root-how-it-works.md

Two independent problems had to be solved, and together they produced a very misleading signature:

a. magiskinit picked the wrong init mode and the kernel panicked. This bootloader does not put skip_initramfs on the cmdline, so magiskinit decided it was not on a legacy system-as-root device, chose RootFS Init, tried to exec an original /init that never existed (the stock boot has no ramdisk), exited 1, and panicked at t≈2.9 s. Fix: put skip_initramfs on the boot image's own cmdline.

b. boot_patch.sh does not install Magisk. It produces a correct boot image and nothing else; the runtime payload in /data/adb/magisk/ is installed by the Magisk app. Without it you get a watch that boots perfectly and has no Magisk — indistinguishable from a bad patch:

I : Magisk 30.7(30700) daemon started
I : ** post-fs-data mode running
I : * Initializing Magisk environment
E : * Magisk environment incomplete, abort      <- the whole mystery

⚠️ Read this before you get excited

• One device, one firmware build, one person. RMRB.240228.002, bootloader rubyfish-06.02.06.04.08. No reproduction by anyone else yet.
• Your bootloader must already be unlocked. Unlocking wipes the watch and is not covered here.
• You need a data-capable USB connection. The stock cradle is power-only. This is the single biggest practical obstacle and it is pure hardware, not software.
• Not verified on the LTE variant (rover), the non-Ultra Pro 3, or any other build.
• Neither result is novel research. The root failure mode is a known class of bug; the /data/adb/magisk requirement is documented Magisk behaviour; TWRP and its ramdisk are other people's work. What is new, as far as we can tell, is the working combination on 3.5 and the write-up.

Why the gap probably exists — a rare configuration, not a hard problem

The documented way to get Wear OS 3.5 onto this watch requires relocking the bootloader (the main XDA guide's premise is that an unlocked watch cannot receive the 3.5 OTA, and its methods end with fastboot oem lock). So the set of watches that are both unlocked and on 3.5 is very small — and a relocked watch cannot be rooted at all.

We are not claiming to have beaten anyone to anything. We happened to be in an unusual position, hit some obstacles, and wrote down how we got past them. The search behind the "we could not find any published account" claim is documented in docs/06-prior-art.md, along with what is ours and what is not. If you have a counter-example, please open an issue — we will link it and amend this page.

Documents

01-twrp-on-wearos35.md	TWRP without downgrading — the hybrid recipe, and why the bootloader gates on the kernel
02-root-how-it-works.md	Root mechanism — why magiskinit picks the wrong mode, and the two-part fix
03-root-procedure.md	Step by step, with the verification discipline
04-device-findings.md	Device facts worth knowing before you start
05-dead-ends.md	What did not work, and four claims we had to retract
06-prior-art.md	What we searched; what is ours and what is not
evidence/	Raw logs backing the claims above

Suggested order: 01 → 04 → 03. The TWRP recipe, then the device facts, then the procedure. Read 05 before you flash anything.

Scripts

repack-bootimg.py	Inspect/repack boot images; hybrid builds the TWRP image. Stdlib only, no mkbootimg.
patch-cmdline.py	Edit a boot image's own kernel cmdline — the skip_initramfs fix, and enlarging the ramoops console
verify-flash.sh	Verify a flash by hashing on the device, over the image's byte range

No firmware images here — deliberately

This repo ships scripts, not binaries. The patched boot and the TWRP hybrid are both derivatives of Mobvoi's proprietary images. Rather than redistribute them, the scripts rebuild them from your own device's dump. That is also more useful, since nothing is pinned to one firmware build.

Mobvoi publish kernel source at mobvoi/mobvoi-ticwatch-kernel.

Credit

• Magisk — topjohnwu/Magisk.
• TWRP for rubyfish — the ramdisk used in the hybrid is community work, taken byte-identical from the published rubyfish_recovery.img; credit to its builders and to the twrpdtgen device tree authors.
• Closest prior art — a Wear OS 3.5 TWRP build exists for the LTE variant (rover), with reportedly broken ADB/sideload. Untested by us and a different artefact, but it got to the general idea first. Linked in docs/01-twrp-on-wearos35.md.

This repo is a write-up of applying existing tools, not new tooling.

Licence

Scripts and documentation: MIT (see LICENSE). No third-party binaries are redistributed here.