A while ago I was fed up with Android Wear smartwatches and bought a Garmin Fenix 5 Plus. After using it for a while I started to explore the possibilities beyond the manufacturer specifications. This lead to a firmware patcher based upon work from Alex Whiter (who sadly passed in 2019). That patcher modified the firmware update file and disabled the license check for Garmin Maps. After installing a patched firmware, you were able to use any downloaded Garmin map on the watch without having to buy a license. Alex himself also offered a patcher to enable the use of custom made JNX “BirdsEye” files. (These JNX files can be easily created with SAS.Planet / SAS.Планета, a Windows tool to download map tiles and export them to different formats.)
These patchers sparked my interest in the firmware format as I’ve noticed they not only patched the few Bytes in the code but also modified other areas in the file.
I’ve soon stumbled upon these great documentations from Herbert Oppmann: Garmin GCD Format, the older RGN format and the contained binary blobs.
Studying these ended up in me writing gcd-parser to analyse and output the various metadata fields.
This was also when I learned about Garmin’s HWIDs. This is an identifier that Garmin assigns to everything. E.g. my Fenix 5 Plus had the HWID 006-B3100-00 which is also its SKU. Inside the firmware, the HWID is stored as a 2-Byte word containing only the digits after the B. For some reason, the firmware files showed the HWID 2900 but a short search revealed that this was the SKU of the smaller version watch, the Fenix 5S Plus. This meant that all 3 sizes used the same firmware – which made sense. Why develop different hardwares and maintain different firmwares when you can use a one-fits-all approach.
When searching with a hex editor through the firmware file, I’ve also noticed various other HWIDs in the format 006-Bxxxx-yy (and without dashes in some cases). In case of my Fenix 5 Plus, I saw these:
006B219602006B315300006B295700006B282201006B219602(again)006-B3181-02006-B1752-02006-B2079-02006-B2161-02006-B2162-02006-B1743-02006-B2327-02006-B2593-03006-B2787-03006B162100006-B2196-02(followed by2196and3153shortly after)006-B2900-00(The Fenix 5S Plus’s SKU!)
If we only take the 4 digits in the middle, we end up with these: 1621, 1743, 1752, 2079, 2161, 2162, 2196, 2327, 2593, 2787, 2822, 2900, 2957, 3153, 3181.
Now where did I see some of those before? Right! The beta firmware!
Garmin offers beta versions of their firmware which allows you to be one of the first to update to a newer version firmware. These come in a zip file and often also contain new versions for various “components” of the watch, e.g. the GPS or Bluetooth module, to be installed separately. An update file for the Bluetooth/ANT+ module is named GUP3153.GCD. The update for the GPS module is GUP2957.GCD. The WiFi module’s firmware comes in a GUP2196.GCD. Now would you look at that!
Using my tool, I could verify that these GCD files list those HWIDs in their file header. There’s also a so-called “SensorHub” firmware which didn’t pop up in the firmware code in full, but only in its short form 3014.
Now I downloaded and analysed firmwares from other Garmin watches and created this table. This clearly shows that many models use the same components, e.g. the Fenix 5 Plus range and the D2 Delta range. And even while the ANT/BLE/BT firmwares show different HWIDs for those, if you compare both with a hex editor, they turn out to be identical.
So my next goal was to turn my Fenix 5 Plus into the much more expensive D2 Delta.
After a few initial attempts at modifying the HWID in the firmware header file failed, I’ve found out about the so-called “PREBOOT” mode in many Garmin devices. This is a recovery mode where the device accepts basically any firmware using Garmin’s WebUpdater tool. I read that it works better with the firmware being in RGN format as there are fewer security measures, so I converted a D2 Delta GCD file into RGN beforehand using RGN_Tool.
The way this went was like this: You have to power off the watch with no cable attached. Then start WebUpdater and go to the screen where it searches for a device. Now with the USB end already plugged into your computer, hold the START/STOP button on the watch and keep holding it while connecting the cable to the watch (still holding down the button!). (I held the button until the update completed – just to be sure.) Now WebUpdater should find the watch and ask for a firmware file. I selected the converted RGN file … and a few seconds later the watch booted up as a D2 Delta. Success! Albeit in a much more complicated way than needed as we’ll find out later.
But when trying to do it the other way around, there was big surprise: The D2 Delta firmware didn’t seem to have a Preboot mode. At least no key combination worked like it did when flashing the D2 firmware.
So now it was time to experiment with modifying the firmware files to flash them using the watch’s own firmware update feature. After asking around in various forums, I was referred to Alex Whiter as THE man to ask about Garmin firmwares. And so I did.
He replied with some vital hints about the header of the actual binary data and how the checksum is calculated.
And after a lot of trial and error I finally succeeded. My watch accepted my Frankenstein’d firmware and turned back into a Fenix 5 Plus again. Turns out the watch does not only check the HWID of the firmware file but there are also 2 fields with some kind of flags that are compared agains the watch’s configuration.
- Fenix 5 Plus: HWID:
3196, Flag1:200, Flag2:1 - D2Delta: HWID:
2900, Flag1:200, Flag2:59
And with the HWID and flags matching, a version number higher than already installed (and a correct checksum), the watch accepted my file.
I incorporated this new information into my gcd-parser tool which enabled me to unpack and re-pack firmwares while auto-correcting the checksum. I was now able to freely convert my Fenix 5 Plus into a D2 Delta and back – just by using different firmware files.
To enable all the D2 features in your Garmin account, you have to completely remove your Fenix 5 Plus via Garmin’s website first and then re-register it using Garmin Connect. While it will show up with the picture of a Fenix on the website, all other apps should show the D2. After that, you can register on flyGarmin to install the navigation database which then enables all aviation features.
One minor issue, though: The aviation navigation database doesn’t update automatically via Garmin Express or Garmin Connect. So you’ll have to visit flyGarmin once a month to update it from there.
Nevertheless, have fun with Nexrad weather, the airport database and all the other aviation features. All other features from the Fenix range are still there, too.
For ease of use, I’ve uploaded all needed files to The Internet Archive. There are also files to convert a Fenix 5X to a D2 Charlie in the same manner and a few more experimental files that I never got around to test properly (Fenix 3/D2 Bravo, Fenix 3 HR/D2 Bravo Titanium).
So to convert your Fenix 5 Plus, you’ll first have to make sure you have one of the compatible firmwares. If your firmware is newer than 15.40, download the file fenix5Plus_1540_Backdate.gcd. Then rename it to GUPDATE.GCD and put it into the GARMIN folder on your watch. Then disconnect the cable. The watch should prompt about a new firmware update – install it.
Now it will boot up with firmware 15.40. You can then download the file f5P1540_to_D2Delta710.gcd. Again, rename it to GUPDATE.GCD and put it into the GARMIN folder. Unplug, flash and you should be greeted by a “D2 Delta”. To make sure everything works fine, now is a good time to do a factory reset on the watch.
Going back works the same. First make sure you’re on a compatible firmware version by using the proper backdate file. Then use the correct conversion firmware.
Enjoy!
Pingback: Syncing Garmin Pulse Ox data to Apple Health – blog.mbirth.uk
great work! now if you could only trace what they changed and made our watches drain battery likecrazy xD its a pitty
I’ve switched to an Apple Watch and sold all Garmin gear some time ago. Also, Garmin started to encrypt their firmwares and until that encryption is broken, there’s no way to change anything. Sorry.
I’ve been looking at this post recently as I’ve a newer Garmin device. Is there any forum or discord that helped when you got stuck? I’m trying to take my lifestyle series watch and place running dynamics ANT+ profiles, along with seeing if I could get APAC specific features working (need to analyze more and see if I can discern hardware differences from firmware bundles). Please do email me if you get the chance.
Hey there first of all thanks allot for the How to it worked perfectly but i cannot go back anymore to OG fenix firmware now as awesome as the D2 stuff is i’d like ot revert but it installs and nothing happens what ma i doing wrong?
Have you checked the MEGA folder linked above? It contains the necessary Backdate files (for the Fenix 5 Plus/D2 Delta) to downgrade and once downgraded, you can use the matching conversion upgrade to turn it back into a Fenix.
If you have the Fenix 5X/D2 Charlie, locate the Backdate file to D2 Charlie 5.50 then convert to Fenix 5X using the firmware file from the MEGA folder.
Hi nope it installs and then nothing has changed well anyway it’s fine no drawbacks from it being a D2 now i guess hey question is there any way to ”hack” the backlight setting into decreasing by 1% instead of 5% i want it to be ultra dim mb there is a way? or u can guide me into how to get there with your experience?
That’s weird. Is that a 5X or the 5 Plus? Everything was tested on a 5 Plus but I believe for the 5X you’ll also have to revert the display firmware (component no. 006-B2605-00) to get the original watch faces back.
The backlight stepping can’t be modified, I’m afraid. There might be a way in modifying the actual firmware code, but that’s something I’d rather not try as it can turn the watch into a paperweight very easily. (I believe the tactix Charlie can do that, but this is using the same firmware as the fenix 5X and I haven’t figured out how to change whether it comes up as a fenix or a tactix.)
Hi it was a 5x
Charlie firmware swap on plus would be awesome did u get that to work
Yes, I did all my experiments with a 5 Plus and ultimately turned it into a D2 Delta (and back into the 5 Plus).
Not sure if my message came trough i never commented on wordpress
And how about Fenix 5x plus to tactix?
*
And how about Fenix 5x plus to tactix?
The tactix uses the exact same firmware as the 5X. There’s a hidden flag that decides whether the watch comes up as a fenix or a tactix. But I’ve never investigated where this is stored and how to change it.
Any way into getting MK1 firmware onto fenix 5x? basically same watch
That works, but the depth gauge is not working correctly as the 5X’s pressure sensor seems different. So, doesn’t make much sense doing this conversion.
Im planning on transferring 5x parts to a descent mk1 case to build my own dive watch only thing is the software so i will use the pressure sensor of the mk1 no problemo so how do i flash it safely with mk1?
You’d have to find the matching Mk1 firmware to the one your Fenix is running. (Check the changelogs and look for similarities!) Then decompose the Mk1 firmware file using my tool, modify the identifiers to match those of the Fenix, increase the version number so it gets seen as an update, and recompose a GCD file. You should then be able to install this to the watch. After installation, it’s important to also update all the other firmwares, most importantly SensorHub and Display. (Which might also need some trickery with their version numbers.) No guarantees, though. You might end up with an expensive paperweight.
Its just interesting the only sole upgrade on the MK1 is that it has a different barometer charging port case and other firmware and screen while the buttons are the same mechanical buttons as the fenix 5x plus a watch people have taken 40 meters down so since i have spare 5x plus’s i wanna just build my own this prepping own firmware is quite spooky thought i might look into it thanks for sharing
i will only swap the case so the only new additions would be the barometer if i dont exchange it i suppose i can just use a 3rd party diving app or something i just want the big charging port so the small one doesnt get eaten away
Hi also the links are ded i feel also like i would brick it because i just have no clue how to get this done haha
You’d basically need to dig out the 5X and Descent Mk1 firmwares from the Perry archive here: https://archive.org/details/garmin_perry_archive . Then dissect them using my tool, change identifiers (HWID and the flags) and version numbers of the Descent firmware to look like it’s a Fenix firmware (with a slightly higher version), and then make a proper GCD file out of it again. This should then install to the watch. No guarantees, though.
How would i compile and run your tool?
It’s Python. You only need a Python3 runtime and the Python libraries listed in the requirements.txt file. (There are various different tools to install these automatically, e.g. pip or uv.)
im a bit stuck could you help me im not very familiar
Hi there. Do you think going from a d2 x10 to a d2 Mach 1 is possible? Those 2 were introduced back in 2022 as far as I can tell. Were the firmware already encrypted by that time?
Thank you
Hi Olivier, they started after the D2 Delta / Fenix 5 Plus series. IIRC the MARQ firmwares (2019!) were already encrypted. Until someone cracks the encryption, changing the firmwares of later models is not possible, I’m afraid.
Hi Markus,
I followed your procedure and turn my fenix 5 plus into d2 delta. After, delta d2 software upgraded to latest version 8.30. Now i’m trying to revert back to fenix 5 plus as following your procedure, but nothing happens. It does not downgrade to D2 delta firmware 7.00, 6.00 or any other version. I copy the backdate file to GARMIN folder and rename it accordingly GUPDATE.GCD, then when i unplug the watch, it installs the firmware but nothing changes at the end. when i check the about section of the watch it still says version 8.30.
Hi again Markus,
I think my problem is solved. Even though my watch showed the D2 firmware version as 8.30, I tried to update with the file “D2Delta700_to_f5P1530_Alternative.gcd” directly without backdating first to 7.00 version. And finally watch accepted the file. I also changed the auto update feature “off” at the same time. So it was not a controlled experiment, 2 changes at the same time. Anyways may be someone may use this info in the future.
I’m glad it worked out for you. It might be that Garmin implemented some kind of downgrade-protection in later firmwares. I’m glad it worked with the “Alternative” file. I don’t have any Garmin watches to test anymore, so thank you for sharing your experience! 🙂