CMF Watch Pro 2
The CMF Watch Pro 2 is the first device covered by this project. It runs the Actions
ATS3089C platform on board JX402, ships as firmware 1.0.0.73 and exposes a BLE command
service, a watch-face upload channel and an AOTA firmware update path.
Profile
Section titled “Profile”| Property | Value |
|---|---|
| Model | CMF Watch Pro 2 |
| Board | jx402_01_3089c |
| SoC | Actions ATS3089C (Cortex-M based, Thumb-2) |
| Firmware | 1.0.0.73 (AOTA version string 1.00_2509131556) |
| Application | app.bin, base address 0x10000000, ACTH header |
| Display | 240×240 |
| Storage | /NAND:E resource partition, fixed 58,777,088 bytes |
| BLE | MTU 23 observed; payload frames are AES-CBC encrypted with a CRC32-LE tail |
Verified capabilities
Section titled “Verified capabilities”| Area | Result |
|---|---|
| Shell/AT channel | Status, identity, sensor and factory commands answered |
| BLE authentication | Pairing, nonce exchange and session key derivation working |
| AOTA parse and rebuild | Byte-identical rebuild of the stock image |
| SDFS, RES, STY, WFDL, AJS | Parse, edit and rebuild with byte-identical round-trips |
| Watch-face upload | Install and delete over BLE, verified on hardware |
| AJS animation replacement | Custom animation played on the watch UI |
| Full AOTA firmware OTA | Image transferred, committed and booted on the watch |
The detailed result table, with the evidence behind each entry, is on the status page.
Page map
Section titled “Page map”Protocol
- BLE protocol — frames, keys, characteristic layout, notification streams
- AOTA OTA flow — the verified update sequence
- Shell / AT channel — command family and pairing secret retrieval
Formats
Internals
Guides
Boundaries
Section titled “Boundaries”The constants, offsets and BLE behaviour documented here belong to this firmware build. Other models and other builds are covered by separate sections; see the roadmap.
Risks specific to this device — flashing, storage ceilings, unresolved formats — are on the limitations page.