Finally I have some time to describe how to override bootloader and softdevice. It's not supported by weloop bootloader but nothing stops us from writing a custom firmware that will allow this. To make it as simple as possible and to use existing applications that support nordic DFU I've decided to merge custom installation app with a new bootloader and a softdevice and upload it as a new firmware. After firmware upload installation app is started and bootloader and softdevice are copied to the correct addresses. Unfortunately it's not so easy because it's not possible to override softdevice from the firmware. There's also problem with UICR registers because it's not possible to override them. There's only one way to change UICR - make a full memory erase. But when we do this from a firmware then watch will crash after erase because processor will be executing instructions from empty flash...

So how I did this? I've created two apps:

• ossw-installer - this app makes a copy of new softdevice and bootloader to an external flash, makes a full memory erase, copies new softdevice and bootloader from external flash to processor flash and sets correct values in UICR.
• ossw-jump - this app copies ossw-installer to processor RAM and jumps to its start address.

So haw does it work step by step? On the left there's a weloop processor flash structure before any changes. In the middle there's memory structure of ossw-combined.bin file. On the right there's a weloop processor flash structure after installation of ossw-combined.hex using nRF Master Control Panel.

After firmware installation weloop restarts and bootloader is executed and passes execution to ossw-jump. This app copies ossw-installer to RAM.

Then ossw-jump jumps to ossw-installer start address. This app copies new bootloader and softdevice to external flash.

After copying bootloader and softdevice full memory flash erase is executed so weloop processor flash is empty.

And finally new bootloader and softdevice is copied from external flash to processor flash and new bottloader address (0x3C000) is set in UICR.

And that's it, we have a new bootloader and S120 2.0.0 softdevice and may upload a new firmware with nRF Toolbox.