Lucky7

Description

Lucky7 (Samsung Galaxy Watch FE) is a feature-rich, round smartwatch measuring 40mm developed by Samsung. It released with Android 13, and uses the Exynos W920 (S5E5515) Cortex-A55 based AArch64 SoC. Its hardware is very similar to that of the Samsung Galaxy Watch 4 (codenamed Fresh). See the GSMArena page for more hardware details.

There are two different variants of this watch:

Codename	Model Number	Model Name	Display Size
lucky7bs	SM-R861	Samsung Galaxy Watch FE (WiFi)	40mm
lucky7us	SM-R866	Samsung Galaxy Watch FE (LTE)	40mm

Bootloader Unlocking

WARNING: Unlocking the bootloader will trip Knox efuses! Connections inside the SoC will be irreversibly severed, you will permanently lose the ability to use features such as Samsung Pay, and you will get a warning on each startup stating that the device's software "may be corrupt" (this can be ignored).

NOTE: While Samsung disabled bootloader unlocking on their phones with the OneUI 8 (Android 16) update, they did not do so for their watches (as of 26/02/2026). All firmware versions of this watch can be unlocked.

The bootloader of the Galaxy Watch FE can be unlocked using the following steps, with the buttons facing to the right:

• Open settings.
• Go to "About watch" -> "Software information"
• Tap the software version several times until you are informed that developer mode has been enabled.
• Locate the "OEM unlocking" option in the developer options menu, and switch it on.
• Hold both buttons on the side of the watch until the Samsung logo appears with the "rebooting..." text below it.
• Quickly press the upper button several times to open the bootloader menu.
• Use the upper button on the side of the watch to navigate to the "Bootloader unlock" option and select it. A short click moves to the next option and a long hold selects an option.
• Press the upper button to unlock the bootloader.
• After rebooting, if you end up in the recovery, follow the steps presented to wipe the device's data.
• Your bootloader is now unlocked.

Repair

This watch is relatively easy to disassemble to repair. There are four Y00 screws on the back, then everything else just pulls apart.

It uses a rubber gasket for water resistance, so as long as it isn't damaged during disassembly it should be able to be reused, and water resistance not compromised.

See the Samsung Galaxy Watch 4 iFixit repair guides for detailed steps for various repairs.

USB

There are no USB connections exposed anywhere on the exterior of this watch. There are however internal USB pads near the top edge of the watch, which can have a USB cable soldered onto them.

The pinout, with the top edge facing towards you, is as follows from left to right:

• Vcc
• ID
• D+
• D-
• GND

To connect to the watch over USB, you must connect the ID pin to GND through approximately 150kOhms of resistance (it doesn't have to be exact).

UART

The internal USB pads can also be used for receiving 3V UART signals.

The pinout, with the top edge facing towards you, is as follows from left to right:

• Not connected
• ID
• TX
• RX
• GND

To connect to the watch over UART, you must connect the ID pin to GND through 619kOhms of resistance. You should also either add a connector which can be unplugged between the watch and your UART adapter, or a switch on the ID line. This is required as in order for the watch to transmit serial data the ID pin must be disconnected then reconnected during the boot process.

The bootloader does not transmit any data over UART.

To get the kernel to transmit its logs over UART, add 'console=ttySAC0,115200n8 loglevel=7' to CONFIG_CMDLINE in the defconfig and recompile.

Booting

Boot Image Format

The boot image format used by the S-Boot bootloader on the Galaxy Watch FE is Android boot version 4, with INIT_BOOT and DTBO. The partitions involved in booting Linux are therefore BOOT, INIT_BOOT, VENDOR_BOOT, and DTBO, along with VBMETA for signature enforcement.

Device Tree Format

The device tree, used to specify to Linux which hardware the system has and where, in the absence of ACPI, is split into two. The main blob (mostly SoC-specific) part of the device tree is part of the VENDOR_BOOT partition, whereas the overlay blob (mostly board-specific) lives in its own partition, DTBO. The overlay is combined with the main blob by the bootloader to create one unified device tree for Linux to use.

Both of these conform to the standard device tree blob format produced by DTC and the Linux build system, with an extra Android-specific header created by libufdt prepended to the beginning of the file.

The main device tree blob in VENDOR_BOOT is a standard Android device tree blob as specified as above, except that the 'CUSTOM1' field is set to 0xFF (255). It can be generated using mkdtboimg.py from libufdt with the following command:

python3 mkdtboimg.py create --custom1=255 <output> <input>

The overlay device tree blob in DTBO is also a standard Android device tree blob, except that the 'CUSTOM1' field is set to 0x20 (32). It can be generated using mkdtboimg.py with the following command:

python3 mkdtboimg.py create --custom1=32 <output> <input>

The meaning of the values in the 'CUSTOM1' fields is not currently known. They are possibly just magic numbers to identify the different blobs.