Bug: ECG feature can be enabled on iOS 13.4 beta 2 + watchOS 6.2 beta 2

Update: Still works for iOS 14.3 + watchOS 7.2

I can provide clean account to activate your Apple Watch's ECG feature, please contact @hiraku_dev on Twitter.

Few months ago, I posted a tutorial about how to enable ECG feature of Apple Watch (oversea model). The restriction is: you must have an Apple Watch which is bought from ECG feature enabled region. However, Apple made a mistake on iOS 13.4 beta 2 and watchOS 6.2 beta 2, ANY Apple Watch S4 or S5 can enable ECG feature now!

However, the method I provided (iTunes backup modification) can't work for this case, you MUST find someone who activated ECG in traditional way (not iMazing method or jailbreak method), and use his/her iCloud account to sync the health app data to your device. You can find some people provide this kind of service on eBay or other place, but I don't recommend you to use stranger's account because your device might be locked and the seller can ask you for more money.

Please don't ask me whether xxx version can use this trick to enable ECG feature or not! Because this is a BUG, Apple may fix this in the future. But, if you don't upgrade iOS / watchOS, you can enable ECG feature as long as you want! Also, you can't downgrade watchOS, and watchOS 6.2 requires iOS 11.4 or above, so you can't downgrade iOS back to 13.3.1 or below either. Please think twice if you want to use this method to activate ECG!

In the following part of this post, I would show how this bug happened:

Since iOS 13.4 and watchOS 6.2, to test the ECG region restriction feature, Apple added a "switch" inside iOS, if the switch is on, then the system would bypass region checking.

The code is in HealthKit, there's two classes: HKMPNDeviceRegionFeatureSupportedStateProvider and HKNonMPNDeviceRegionFeatureSupportedStateProvider.

If the system calls functions in HKMPNDeviceRegionFeatureSupportedStateProvider class, then it would check device region as usual. However, if it calls functions in HKNonMPNDeviceRegionFeatureSupportedStateProvider, it would ignore region checking!

The question is, how the iOS / watchOS decide which class / function it should call? I dissembled the functions:

/* @class HKHeartRhythmAvailability */
+(id)deviceRegionFeatureSupportedStateProviderForCompanionDevice:(id)device {
    BOOL checkIgnored = [self isCompanionRegionCheckEnabledForDevice:device];
    Class class = [HKMPNDeviceRegionFeatureSupportedStateProvider class];
    if (checkIgnored != NO) {
        class = [HKNonMPNDeviceRegionFeatureSupportedStateProvider class];
    }
    return [class isCompanionRegionCheckEnabledForDevice:device];
}

+(bool)isCompanionRegionCheckEnabledForDevice:(void *)device {
    BOOL ignoresMPN = _os_feature_enabled_impl("HeartRhythm", "ecg_app_install_ignores_mpn");
    NSUUID *uuid = [[NSUUID alloc] initWithUUIDString:@"03C7A646-DB1E-404B-B393-033E5496A383"];
    BOOL supportUUID = [device supportsCapability:uuid];
    // Some code which is not important
    return ignoresMPN && supportUUID
}

/* @class HKHeartRhythmAvailability */

+(id)deviceRegionFeatureSupportedStateProviderForCompanionDevice:(id)device {

BOOL checkIgnored = [self isCompanionRegionCheckEnabledForDevice:device];

Class class = [HKMPNDeviceRegionFeatureSupportedStateProvider class];

if (checkIgnored != NO) {

class = [HKNonMPNDeviceRegionFeatureSupportedStateProvider class];

}

return [class isCompanionRegionCheckEnabledForDevice:device];

}

+(bool)isCompanionRegionCheckEnabledForDevice:(void *)device {

BOOL ignoresMPN = _os_feature_enabled_impl("HeartRhythm", "ecg_app_install_ignores_mpn");

NSUUID *uuid = [[NSUUID alloc] initWithUUIDString:@"03C7A646-DB1E-404B-B393-033E5496A383"];

BOOL supportUUID = [device supportsCapability:uuid];

// Some code which is not important

return ignoresMPN && supportUUID

}

As you can see, if ecg_app_install_ignores_mpn is enabled, then it would call HKNonMPNDeviceRegionFeatureSupportedStateProvider and ignore region checking.

Now, we only need to find where is ecg_app_install_ignores_mpn, it's in /System/Library/FeatureFlags/Domain/HeartRhythm.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ecg_app_install_ignores_mpn</key>
    <dict>
        <key>Enabled</key>
        <true/>
        <key>DisplayName</key>
        <string>Move Off of MPN</string>
    </dict>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>ecg_app_install_ignores_mpn</key>

<dict>

<key>Enabled</key>

<true/>

<key>DisplayName</key>

</dict>

</plist>

In line 8, the value is true! However, on iOS 13.4 beta 1, it was false! Because Apple accidentally set this value to true on beta 2, we can by pass ECG region checking! Good job, Apple!

So, let me say again: please don't ask me whether xxx version can use this trick to enable ECG feature or not! Because this is a BUG, Apple will fix this in the future. But, if you don't upgrade iOS / watchOS, you can enable ECG feature as long as you want!

Credit：Apple、吉米簡

2020/02/22

iOS 教學, 技術研究

21 則留言

Ricky

2020/02/24

When you say use his/her iCloud account to sync the health app data to your device, do I pair my watch with their apple id?

回覆
1. Hiraku
  
  2020/02/27
  
  No. Just login the specific Apple ID to your iCloud account in iPhone
Ricky

2020/02/27

Thanks for the info. It works perfectly! Now i wont update my OS forever hahaha

回覆
1. Hiraku
  
  2020/02/28
  
  FYI beta 3 still works
Ricky

2020/02/28

Thanks for the info! Updating to 3 now!

回覆
Matt

2020/03/11

is it still working on latest beta softwares?

回覆
1. Hiraku
  
  2020/03/13
  
  beta 5 still works
haha

2020/03/25

working on iOS 13.4?(not beta)

回覆
1. Hiraku
  
  2020/03/27
  
  yes
Kavin

2020/03/26

Hi~ I own an Apple Watch bought from an non-EER region, if I pair my iPhone with another ECG-capable watch (from EER) and activate its ECG (so that the flags will be written in the health database), will I get ECG on my own watch?

回覆
1. Hiraku
  
  2020/03/27
  
  Yes, for watchOS 6.2.
  However you must live in EER region or travel to EER region to enable ECG flag, or you may need to find an activated account.
2. Kavin
  
  2020/03/28
  
  Thanks. Will you be updating the information above when watchOS gets updated? (So that the community would know whether to update or not 🙂
3. Hiraku
  
  2020/03/29
  
  I will update in this post, you can also follow my twitter account @hiraku_dev
Ray2ray

2020/04/07

wish i can DM u on twitter but ur account is not available 4 a DM. Could u plz send me a email thanks.

回覆
1. Hiraku
  
  2020/04/08
  
  Just mention me @hiraku_dev and I will send you DM
OldSoldier1969

2020/04/08

Wonderful !! ECG works even in OS 13.4.1 !!

回覆
? Josef Rey ? (@joeszef)

2020/04/14

Mentioned you on Twitter, hope to hear from you soon. Thanks!

回覆
Tom Zenit

2020/04/30

Hi,
I have appwatch from EER region but the app isn't there anymore after the software update to 6.2.5. I already added the plst file in ios 13.4.5 and it activated the ECG but can't have it work with apple watch because ecg app is gone. please help or advise if a clean account that mentioned will do the trick

回覆
1. Hiraku
  
  2020/04/30
  
  yes. the plist trick doesn't work on iOS 13.4 and above. you need to use account trick.
Refh

2020/05/01

Mine is apple watch 4 with iphone 7. Ios 13.4.1 and watch os 6.2.1. Is it still possible? I am not within region.

回覆
1. Hiraku
  
  2020/05/01
  
  Yes it's possible.

Hiraku Dev

Bug: ECG feature can be enabled on iOS 13.4 beta 2 + watchOS 6.2 beta 2

21 則留言

發佈留言取消回覆