Cross-platform MediaTek feature phone dumping had been achieved long ago with MTreader. Now it's time to do the same for Unisoc (ex-Spreadtrum) phones. And not only that, but also to be able to flash them!

Unfortunately, the architecture of Unisoc chipset boot ROM doesn't allow us to get away without any loader blobs. So, some FDL binaries are also shipped in this repo.

UniFlash started out as UniDump (see this blog post) but had been quickly upgraded to do both tasks.

The uniflash.py file is the main script to use. The unicmd.py file is the library created for easier command interface encapsulation.

For further dumped firmware unpacking/repacking, I recommend bzpwork by ilyazx.

Note: the flasher part is still under testing/study, use at your own risk!

Dependencies

Python 3.8+ and PyUSB.

Usage

Run python uniflash.py -h to see all parameters. But there are several typical scenarios that UniFlash officially supports.

Note: you need to hold a bootkey pressed when connecting the device for it to be detected correctly. This key can vary across devices. Typically it's Call, Soft Left, Soft Right, Center, 9 or #, but it can be anything else.

SC6531E

This is the default target for UniFlash, FDLs for it are shipped in the repo and you don't need to configure anything else unless your model requires signed FDLs.

For SC6531E, firmware is usually 4MB long, so you just need to run python uniflash.py dump your-output-file.bin to dump the firmware image and python uniflash.py flash your-input-file.bin to flash it.

SC6531F/M

For SC6531F or SC6531M, specifying the wrong dump length and attempts to write flash from the same dump can make the device unbootable!

Here, firmware can be larger, so you need to pass in the length. As with any integer parameter here, you can pass it in hexadecimal format as well.

E.g. for CAT B26 (bootkey is #) the dumping command is: python uniflash.py -l 0x800000 dump b26.bin

SC6531D and lower

For now, SC6531DA and other single-FDL variants of SC6531 chipset are not supported.

Credits

Created by Luxferre in 2021. All files except the FDL blobs are public domain.