# UniFlash: an opensource Unisoc/Spreadtrum phone flash reader/writer

## About

Cross-platform MediaTek feature phone dumping had been achieved long ago with [MTreader](https://gitlab.com/suborg/mtreader). Now it's time to do the same for Unisoc (ex-Spreadtrum) phones. And not only that, but also to be able to flash them!

Unfortunately, the architecture of Unisoc chipset boot ROM doesn't allow us to get away without any loader blobs. So, some FDL binaries are also shipped in this repo.

UniFlash started out as UniDump (see [this blog post](https://chronovir.us/2021/12/18/Opus-Spreadtrum/)) but had been quickly upgraded to do both tasks.

The `uniflash.py` file is the main script to use. The `unicmd.py` file is the library created for easier command interface encapsulation.

For further dumped firmware unpacking/repacking, I recommend [bzpwork](https://github.com/ilyazx/bzpwork) by ilyazx.

**Note: the flasher part is still under testing/study, use at your own risk!**

## Dependencies

Python 3.8+ and PyUSB.

## Usage

Run `python uniflash.py -h` to see all parameters. But there are several typical scenarios that UniFlash officially supports.

**Note**: you need to hold a bootkey pressed when connecting the device for it to be detected correctly. This key can vary across devices. Typically it's Call, Soft Left, Soft Right, Center, 9 or #, but it can be anything else.

### SC6531E

This is the default target for UniFlash, FDLs for it are shipped in the repo and you don't need to configure anything else.

For SC6531E, firmware is usually 4MB long, so you just need to run `python uniflash.py dump your-output-file.bin` to dump the firmware image and `python uniflash.py flash your-input-file.bin` to flash it.

### SC6531F/M

For SC6531F or SC6531M, **only readback is supported as of now, attempts to write flash can make the device unbootable!**

Here, firmware can be larger, so you need to pass in the length. As with any integer parameter here, you can pass it in hexadecimal format as well.

E.g. for CAT B26 (bootkey is `#`) the dumping command is: `python uniflash.py -l 0x6b7000 dump b26.bin`

### SC6531D and lower

For now, SC6531DA and other single-FDL variants of SC6531 chipset are not supported.

## Credits

Created by Luxferre in 2021. All files except the FDL blobs are public domain.