Stock R12 · reversible runtime writes
Paint the digits.
Change the segment shapes on the real ring, then restore the original table. Health counters, the clock and firmware stay untouched.
This page writes RAM. Only the ten digit-glyph bytes at 0x2085e5 are writable. Use only the exact supported R12. Keep this tab visible, the phone awake and the ring connected until restoration verified. Auto-restore cannot be guaranteed if Bluetooth drops, the tab closes or Android suspends it.
Not a five-cell framebuffer. Stock firmware selects glyphs by decimal digit. Repeated digits must share a shape; leading blank cells stay blank. The preview rejects impossible text rather than faking step counts. Shapes affect all numeric screens temporarily.
Web Bluetooth requires Chrome on Android over HTTPS (or a supported desktop browser). Open directly, not inside an app. Nothing runs on load.
Snapshot → paint → restore
Choose the R12 first. No command has been sent.
- Device
- Not selected
- Firmware / hardware
- Not read
- Step screen's real value
- Not read
- Sensor ID · no register changes
- Not read
Supported: digits, space, dash, underscore, A B C D E F H I J L N O P R S T U. B/D/N/R/T use lowercase-style segment approximations. Uniform mode takes one character.
Inspect to compute an honest step-screen preview.
Before each write: exact DIS identity, a fresh stock LUT read and fresh real steps. Two small BF packets at most; full LUT readback. No generic addresses, register writes, sensor setup, pointers, RAM code, time changes, reboot or OTA permission.
Digits may still be changed. Recovery data is stored only in this browser tab's sessionStorage, including its private device ID to require the same ring. Keep this tab. Reconnect explicitly and restore; a different ring or an unrecognised LUT is refused. Nothing is uploaded and no reconnect runs automatically.
RAM readback is not visible-display acceptance. Wake the ring and select its step-count screen yourself; these buttons record your observation separately.
Packets and recovery.
Local JSON includes the saved/attempted LUT states, restoration result, physical observation and sample measurements. It omits the private browser device ID. Save before beginning another attempt.
A five-second acceleration measurement
Stock A1/03 polls the existing raw producer without starting/changing its timer or setting sensor registers. This may increase packet delivery; it may still return cached samples. Move the ring gently and compare two separate captures.
No physical sampling result. Requests, A103 arrivals, distinct XYZ values, identical runs and arrival gaps will be reported—not advertised as fresh sensor Hz.
What this can and cannot do.
- Release the R12's competing app/desktop connection; leave other devices alone. Choose your physical R12 in Chrome's native chooser.
- Inspect the exact
RT11CR_1.00.08_250514/RT11CR_V1.0baseline and stock table. An unknown table is not silently reset. - Select the step-count screen. Start with uniform H: it replaces every visible decimal digit with an H, leaving leading blanks intact. For text, the real digits must permit the selected glyph pattern.
- Tap Write once, watch the ring, and keep the tab visible until the saved table is restored and verified. Stop requests restoration rather than abandoning an in-flight write.
- Record what you saw and save the report. If restoration failed, keep the same tab and reconnect to the same ring for its explicit recovery path. Do not switch to arbitrary pokes or flash firmware.
Independent five-cell text needs a separately proved renderer/framebuffer path; the stock UART frame lives on the stack. This tool deliberately does not forge a step counter, inject code, redirect a pointer or write UART registers to pretend that problem is solved. A physical C0 read passed on 30 October 2026; BF and visible output still need real-device reports.
Evidence and unresolved questions → · Runtime writer contract and recovery ↗