gistfile1.txt

# Doro 6880 (DFC-0390) Research Notes

## Device Info

| Property | Value |
|----------|-------|
| Model | Doro 6880 |
| Model Code | DFC-0390 |
| Chipset | Unisoc UMS9117 (Spreadtrum) |
| OS | MOCOR_20A_MP_W21.06.5_Release |
| Firmware Version | DFC-0390_SF296_N_s01A_V18_M241022_MP |
| USB ID | 1782:4d01 (Mass Storage) |

## Current USB Mode

The phone currently shows as **Mass Storage** (USB disk) - only the SD card is accessible, not the firmware.

## Boot Modes (from similar Doro KaiOS phones - may not work on 6880)

| Keys | Mode |
|------|------|
| Power | Normal boot |
| Power + Vol-Up | Recovery |
| Power + Vol-Down | FFBM (has ADB) |
| Power + Vol-Up + Vol-Down | EDL (download mode) |
| Power + * | Fastboot |

## Working Dial Codes (Tested on Doro 6880!)

These codes work on the Doro 6880 running MOCOR OS:

| Code | Function |
|------|----------|
| `#*8378#1#` | Engineering menu |
| `#*8378#9#` | **Firmware update from SD card** |
| `#*8378#4#` | Uptime/charge/IMEI/chipset info |
| `#*8378#5#` | Chip test |
| `#*8378#3#` | Serial number test |
| `####0000#` | Firmware information |
| `*#8375#` | Software/hardware versions |
| `####7777#` | Factory formatting (needs password) |
| `####1040#` | Net monitor |
| `#*786646468#` | RAM usage |

## Firmware Update from SD (#*8378#9#)

The `#*8378#9#` option allows **firmware update from SD card**. This could potentially:
- Flash a custom firmware file from SD to phone
- Accept `.pac` format firmware files

**Note:** This flashes FROM SD TO phone, not dumps FROM phone TO SD.

## Firmware File Format

Spreadtrum/MOCOR devices use `.pac` format firmware files. These can be:
- Extracted using Pac File Unpacker tools
- Flashed via SPD Flash Tool, UMT PRO, or Miracle Box
- Created from device backups using PC tools

## Secret Codes (from Doro 7060/7070 - may not work on 6880)

```
*#34247678#  → Enable DIAG mode for USB
*#06#        → Show IMEI
*#13646633#  → Engineer mode
*#*#76389273#*#* → Firmware version
*#*#0704#*#* → Factory reset
```

## Security Vulnerability (CVE-2023-3630)

**MOCOR OS Clock Fault Injection Attack**

The MOCOR OS running on Spreadtrum/Unisoc devices has a vulnerability that allows bypassing the user lock through clock glitching.

### How it works:
1. Open the phone to access the SoC (UMS9117)
2. Connect a wire to the **CLK pin** of the chipset
3. Ground the wire for **50-100ms** during boot when the lock prompt appears
4. This causes a soft reset that bypasses password checks
5. Full access to the device!

### Affected chips:
- SC6531E (confirmed)
- Possibly UMS9117 (similar architecture)

### Source: [ONEKEY Research](https://onekey.com/blog/security-advisory-unisoc-mocor-fault-injection-security-bypass/)

## Tools for MOCOR/Spreadtrum Devices

| Tool | Platform | Notes |
|------|----------|-------|
| [spreadtrum_flash](https://github.com/ilyakurdyukov/spreadtrum_flash) | Linux | Open source firmware dumper, supports SC6530/6531/6531e |
| SPD Flash Tool | Windows | Most common flashing tool |
| UMT PRO | Windows | Commercial tool, has Doro support |
| ChimeraTool | Windows | Commercial, requires license |

## Current Limitations

- No documented test points for Doro 6880
- No public service manual available
- Boot mode combos don't seem to work on this device
- USB only shows as Mass Storage (no ADB/Diag)
- Doro doesn't release firmware/tools publicly

## Current Status

**Breakthrough!** The MOCOR OS dial codes work on the Doro 6880! This gives access to:
- Engineering menu
- Firmware update from SD card
- System information
- Chip diagnostics

## How to Dump Firmware

### Option 1: Via SD Card (#*8378#9#)
- Only flashes FROM SD TO phone (not a dump)
- Would need a firmware file to flash
- Risk: could brick the phone

### Option 2: Via PC Tools (Requires Download Mode)
- Need to get phone into download/flash mode
- Use SPD Flash Tool, UMT PRO, or spreadtrum_flash (Linux)
- Requires different USB mode (not Mass Storage)

### Option 3: Clock Fault Injection (CVE-2023-3630)
- Requires physical access to SoC pins
- Ground CLK pin for 50-100ms during boot
- Bypasses security, enables full access

## Possible Next Steps

1. Try clock fault injection attack (requires opening phone + soldering)
2. Contact Doro support for firmware/service tools
3. Look for test points inside the phone (requires disassembly)
4. Try different USB cables/modes

## Storage Access (Currently Working)

The phone mounts as USB storage with these folders:
- `Alarm/` - Alarm sounds
- `Audio/` - Audio files
- `DRM_LRO/` - DRM data
- `Filearray/` - File array
- `@fota_adups/` - OTA updates (empty)
- `Others/` - Misc files
- `Photos/` - Photos
- `System/` - System settings (MMS, ringtones)
- `vCard/` - Contacts
- `Video/` - Videos

## References

- [Legacy Portable Computing Wiki - Mocor OS](https://lpcwiki.miraheze.org/wiki/Mocor_OS)
- [BananaHackers Doro 7060/7070 Thread](https://groups.google.com/g/bananahackers/c/ABLbPYa8Nho/m/DmI2jloKCgAJ)
- [ONEKEY Security Advisory](https://onekey.com/blog/security-advisory-unisoc-mocor-fault-injection-security-bypass/)
- [spreadtrum_flash GitHub](https://github.com/ilyakurdyukov/spreadtrum_flash)
- [SPD Flash Tool](https://spdflashtool.com/)