2.1 KiB
UniFlash: an opensource Unisoc/Spreadtrum phone flash reader/writer
About
Cross-platform MediaTek feature phone dumping had been achieved long ago with MTreader. Now it's time to do the same for Unisoc (ex-Spreadtrum) phones. And not only that, but also to be able to flash them!
Unfortunately, the architecture of Unisoc chipset boot ROM doesn't allow us to get away without any loader blobs. So, some FDL binaries are also shipped in this repo.
UniFlash started out as UniDump (see this blog post) but had been quickly upgraded to do both tasks.
The uniflash.py file is the main script to use. The unicmd.py file is the library created for easier command interface encapsulation.
For further dumped firmware unpacking/repacking, I recommend bzpwork by ilyazx.
Dependencies
Python 3.8+ and PyUSB.
Usage
Run python uniflash.py -h to see all parameters. But there are several typical scenarios that UniFlash officially supports.
Note: you need to hold a bootkey pressed when connecting the device for it to be detected correctly. This key can vary across devices. Typically it's Call, Soft Left, Soft Right, Center, 9 or #, but it can be anything else.
SC6531E/F/M
This is the default target for UniFlash, FDLs for it are shipped in the repo and you don't need to configure anything else.
For SC6531E, firmware is usually 4MB long, so you just need to run python uniflash.py dump your-output-file.bin to dump the firmware image and python uniflash.py flash your-input-file.bin to flash it.
For SC6531F or SC6531M where firmware can be larger, you need to pass in the length. As with any integer parameter here, you can pass it in hexadecimal format as well.
E.g. for CAT B26 (bootkey is #) the dumping command is: python uniflash.py -l 0x6b7000 dump b26.bin
SC6531D and lower
For now, SC6531DA and other single-FDL variants of SC6531 chipset are not supported.
Credits
Created by Luxferre in 2021. All files except the FDL blobs are public domain.