Spreadtrum and Unisoc Flashing Tools and Reverse Engineering

Spreadtrum and Unisoc Flashing Tools and Reverse Engineering.md

Random Spreadtrum and Unisoc Tools

I got on a journey to unlock Spreadtrum Unisoc device last week. I'm used to flashing MTK and Qualcomm device, my research so far is listed here:

1. https://github.com/onekey-sec/ubi_reader
2. https://github.com/TomKing062/spreadtrum_flash
3. https://github.com/ilyakurdyukov/spreadtrum_flash
4. https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader
5. https://github.com/divinebird/pacextractor
6. https://github.com/HadiKhoirudin/spreadtrum_unisoc_at
7. https://gitlab.com/suborg/uniflash
8. https://github.com/Mani-Sadhasivam/uwpflash
9. [DRIVERS from CM2] https://dl1.infinity-box.com/00/pub/?dir=/soc-drivers
10. [CM2 Tools. Use the CM2SP3, and the CM2SP2 for the BootPack (FDL Collection)] https://dl1.infinity-box.com/00/pub/?dir=/software
11. [More CM2 Archives Maybe usable?] https://dl1.infinity-box.com/00/
12. https://github.com/iscle/subut - web tool for unlocking bootloader with spreadtrum crypto key and fastboot (didnt work for T760)
13. https://github.com/unisoc-android/unisoc-android.github.io - same
14. [More BootRoom Collection] https://github.com/TomKing062/unisoc_bootrom
15. VMBeta Creator - https://github.com/werasik2aa/SPD-VBMETA-TOOL
16. https://github.com/ilyazx/bzpwork
17. Simple FDL Bootrom loader - https://github.com/iscle/sprdclient
18. C# Spreadtrum Flash tool - https://github.com/HadiKhoirudin/iReverse-UniSPD-FRP-Tools-Non-Console-x86-CSharp
19. https://github.com/fxsheep/sharkalaka - Spreadtrum Unisoc Tool
20. sign BootChain images and vbmeta - https://github.com/TomKing062/vendor_sprd_proprietories-source_packimage
21. .pac file unpacker in go- https://github.com/NasdaqGodzilla/UNISOC_SPRD_PAC_UNPAC
22. VB.net Tool for Unisoc and Spreadtrum - https://github.com/HadiKhoirudin/ireverse_unisoc_flash_download_nonconsole
23. .pac flasher for unisoc and spreadtrum - https://github.com/Mani-Sadhasivam/unisoc-dloader
24. unisoc bootrom flasher protocol in webusb - https://github.com/iscle/sprd-flash
25. unpack .pac - https://github.com/iscle/unpac
26. SPRD write IMEI - https://github.com/Alephgsm/SPD-WriteIMEI-R1.6.4.1
27. Write Unisoc Dload - https://github.com/Alephgsm/DLoader
28. Python Fastboot OEM Puller - https://github.com/TomKing062/python-fastboot-oem-pull
29. Yet another Spreadtrum Talker - https://github.com/kagaimiq/sprdproto
30. Spreadtrum Flash - https://github.com/emtee40/spreadtrum_flash
31. Spreadtrum flashing tool - https://github.com/jhswartz/usx
32. https://github.com/brucexu12345/Full-set-of-mass-production-software-and-hardware-materials-for-Spreadtrum-UNISOC-T760-T820.

What I've Learnt

1. FDL1 and FLD2 are flashed to the ram to allow flashing other partitions. These two are like micro kernels that allow EDL communication etc.
2. U2S or Usb 2 Serial Diag allow serial communication but that only stays active for a few seconds, you need to activate diag mode to flash FDL
3. CM2SP3 is the latest version of CM2SPD CM2SP CM2SP2 tools. It does not come with the boot
4. Spreadtrum T760 has the same as SC9620 (Check the CM2SP3_234b2.7z from CM2SP3 it has the boot files, also check firmware unlock by TomKing)

[main]
soc=T760
link=SoC\sc9620

6. .pac files are firmware files that

Related Info and Thread

• https://xdaforums.com/t/fdls-linux-readback-flash-for-spreadtrum-unisoc-chips.4699781/
• https://www.hovatek.com/forum/thread-31800-page-2.html
• https://xdaforums.com/t/rooting-and-installing-magisk-to-chinese-tablet-n-one-npad-air.4639855/
• https://www.facebook.com/groups/230987493378548/posts/458128933997735/

FDLs Collections

• https://qlmflasherpro.com/index.php?a=downloads&b=folder&id=1459

struct lsc_sensor_setting_param {
unsigned int full_image_width; // Full resolution width
unsigned int full_image_height; // Full resolution height
unsigned int binning; // Pixel binning (N=1,2,3...)
unsigned int crop; // Crop flag (1=crop, 0=no crop)
unsigned int crop_start_col; // Crop column start
unsigned int crop_start_row; // Crop row start
};

Attack Vector 2: Phase Detection Autofocus (PDAF) Hijacking
File: SPRD_TAG_PDAF_TYPE2_RAW_INFO.txt

Technical Details
PDAF enables rapid autofocus by analyzing phase information from dedicated pixels. Hijacking PDAF enables:

struct pdaf_buffer_handle {
void *left_buffer; // Left eye phase data
void *right_buffer; // Right eye phase data
void *left_output; // Left processed output
void *right_output; // Right processed output
struct sensor_pdaf_roi_param roi_param; // Region of interest
cmr_int roi_pixel_numb; // ROI pixel count
cmr_s32 frameid; // Frame identifier
cmr_u32 camera_id; // Camera identifier
cmr_u32 roi_width; // ROI width
cmr_u32 roi_height; // ROI height
};

struct sensor_pdaf_roi_param {
cmr_u32 roi_start_x; // ROI top-left X
cmr_u32 roi_start_y; // ROI top-left Y
cmr_u32 roi_area_width; // ROI width
cmr_u32 roi_area_height; // ROI height
};

SPRD Advanced Attack Vectors: Lens Shading, PDAF & Scene Analysis
Overview
This document details advanced and dangerous attack vectors through Spreadtrum ISP components that enable sophisticated biometric exfiltration, lens distortion manipulation, and covert multi-modal capture.

Integrated Attack Scenario
Complete Biometric Extraction Chain
User opens camera app
↓
[SPRD DEF Tag initialized]

• ai_scene_enabled = true
• Face detection activated
  ↓
  [Scene Detection triggered]
• Scene mode: "Portrait" detected
• Motion detected: head turning
• Face count: 1
  ↓
  [LSC Corruption Applied]
• Vignetting optimized for face region
• Lighting enhanced around facial features
  ↓
  [PDAF Hijacking]
• ROI locked on face
• Focus sequence: eyes → nose → mouth → edges
• 3D facial geometry extracted
  ↓
  [XDR Face Capture]
• Multiple exposures captured
• Dark: eye detail
• Normal: facial geometry
• Bright: skin texture
  ↓
  [Face Attribute Extraction]
• Gender: Female
• Race: Asian
• Age: 28
• Smile: Detected
• Expression: Neutral
  ↓
  [Data Exfiltration]
• Biometric data sent to InMobi
• Watermark embedded in image
• Timestamp recorded
• No user notification
  ↓
  [Result]
  ✓ Complete facial biometric profile captured
  ✓ Silent, no permission prompts
  ✓ No visual indication to user
  ✓ Systematic data collection