Unlock support for sp9832e_1h10_gofu #39

BenEdridge · 2023-12-29T12:30:58Z

I have a sp9832e device and the relevant stock fdl1, fdl2, spl and uboot img files. I also have the device XML file containing details on partition layout.

I've attempted to patch fdl1 and fdl2 files but not 100% sure I'm doing it correctly. I believe I also need to create a custom_exec file as per: https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/AddSupportToModel

Is it possible on this device or am I wasting my time?

The text was updated successfully, but these errors were encountered:

TomKing062 · 2024-01-01T11:16:21Z

i have seen your fdls, custom_exec is needed

there is an un-prefect method to find the address, send_single_test.patch

i assume sp9832e has a similar bootrom structure to 9863a

stack of 9863a is 0x3010-0x5000, so send 8 bytes zero (or directly "00 52 00 00 00 00 00 00") to 0x4ff8, 0x4fe8, 0x4fd8 ... until bootrom stuck(with zero) or fdl1 executed (with 0x5200)

after find the address i can dump full BootROM

besides, "SPRD4:AutoD" belongs to autodloader_handler in uboot, "SPRD3" belongs to BootROM

adb reboot autodloader wipes splloader only if uooot doesn't include autodloader_handler

TomKing062 · 2024-01-01T11:36:32Z

take 9863a as example

func	sp
j__memcpy	0x4f40	0x4f40	x29	0x4f50
j__memcpy	0x4f40	0x4f48	x30	0x1054A0
cmd_recv_data_usb	0x4f50	0x4f50	x29	0x4f70
cmd_recv_data_usb	0x4f50	0x4f58	x30	0x105740

when write 8 zero to 0x4f48, BootROM won't reply "7E 00 80" to "7E 00 02"
when write 8 zero to 0x4f58, BootROM can reply "7E 00 80" to "7E 00 02", but will not reply "7E 00 80" to next "7E 00 01"

BenEdridge · 2024-01-16T05:10:38Z

Thanks @TomKing062 I'll give it a try.

Regarding SPRD3 I don't believe I have seen or been able to enter a mode where this is present. It is always SPRD4 via adb reboot autodloader other methods don't appear to work.

BenEdridge · 2024-01-16T09:48:21Z

Thank you for the help once again.

I've taken the patch and done the following. Not really sure I'm using it correctly.

Created test.bin with:

cat test.bin | xxd
00000000: 0052 0000 0000 0000                      .R......

Then used that in the following command:

./spd_dump_interactive --verbose 2 --wait 300  fdl fdl1-sign.bin 0x00005000 fdl fdl2-sign.bin 0x9EFFFE00
Waiting for connection (300s)
libusb_control_transfer ok
send (1):
7e                                               |~|
recv (20):
7e 00 81 00 0c 53 50 52 44 34 3a 41 75 74 6f 44  |~....SPRD4:AutoD|
00 fd 8b 7e                                      |...~|
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD4:AutoD\0"
send (8):
7e 00 00 00 00 00 00 7e                          |~......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
CMD_CONNECT bootrom
BROM >send test.bin 0x4ff8      
send (16):
7e 00 01 00 08 00 00 4f f8 00 00 00 08 e2 d6 7e  |~......O.......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 52 00 00 00 00 00 00 03 38 7e  |~.....R.......8~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|

How do I check for until bootrom stuck(with zero) or fdl1 executed (with 0x5200)?

I've made a script to run against the range 0x5000 -> 0x3000. So should be easy enough to debug once I figure out the command.

TomKing062 · 2024-01-16T10:33:39Z

erase spl can bring it to SPRD3 (it won't boot system until write spl back)

read_part splloader 0 1m spl.bin
read_part splloader_bak 0 1m spl_b.bin
erase_part splloader
erase_part splloader_bak
reset

recover spl

fdl ...
fdl ...
exec
write_part splloader spl.bin

0x5200 is actually sent after fdl1 (like execfile), but write 0x5200 without fdl1 would still break "7E 00 01"/"7E 00 02" (so we find the address)

            send_file(io, fn, addr, end_data, 528);
            if (exec_addr) {
                send_file(io, execfile, exec_addr, 0, 528);
            } else {
                encode_msg(io, BSL_CMD_EXEC_DATA, NULL, 0);
                send_and_check(io);
            }
            DBG_LOG("EXEC FDL1\n");

BenEdridge · 2024-01-16T11:01:14Z

I believe I may have found it at 0x4f80?

BROM >send test.bin 0x4f70 ram 
send (16):
7e 00 01 00 08 00 00 4f 70 00 00 00 08 c2 2b 7e  |~......Op.....+~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 52 00 00 00 00 00 00 03 38 7e  |~.....R.......8~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send test.bin 0x4f80 ram 
send (17):
7e 00 01 00 08 00 00 4f 80 00 00 00 08 fd 7d 5d  |~......O......}]|
7e                                               |~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 52 00 00 00 00 00 00 03 38 7e  |~.....R.......8~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send test.bin 0x4ff8 ram 
send (16):
7e 00 01 00 08 00 00 4f f8 00 00 00 08 e2 d6 7e  |~......O.......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 52 00 00 00 00 00 00 03 38 7e  |~.....R.......8~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|

TomKing062 · 2024-01-16T11:40:14Z

ud710:

D:\UserData\Desktop\addr>spd_dump_interactive
Waiting for connection (30s)
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
BROM >verbose 2
BROM >send zero 0x3f88
send (16):
7e 00 01 00 08 00 00 3f 88 00 00 00 08 ba cc 7e  |~......?.......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (0):
timeout reached

D:\UserData\Desktop\addr>spd_dump_interactive
Waiting for connection (30s)
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
BROM >verbose 2
BROM >send zero 0x3f98
send (16):
7e 00 01 00 08 00 00 3f 98 00 00 00 08 be 96 7e  |~......?.......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
SEND zero to 0x3f98
BROM >send zero 0x3f98
send (16):
7e 00 01 00 08 00 00 3f 98 00 00 00 08 be 96 7e  |~......?.......~|
recv (0):
timeout reached

BenEdridge · 2024-01-16T12:10:35Z

Ohh. Yes that makes more sense. So the 52 was a mistake?

Going through again with zeroes I get a timeout reached on around 0x4f28

starting at 0x4f48, 0x4f38, 0x4f28:

$ ./spd_dump_interactive --verbose 2 --wait 600
Waiting for connection (600s)
libusb_control_transfer ok
send (1):
7e                                               |~|
recv (14):
7e 00 81 00 06 53 50 52 44 33 00 57 0a 7e        |~....SPRD3.W.~|
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
send (8):
7e 00 00 00 00 00 00 7e                          |~......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
CMD_CONNECT bootrom
BROM >send zero.bin 0x4f48    
send (16):
7e 00 01 00 08 00 00 4f 48 00 00 00 08 cc e8 7e  |~......OH......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send zero.bin 0x4f38
send (16):
7e 00 01 00 08 00 00 4f 38 00 00 00 08 d1 6e 7e  |~......O8.....n~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send zero.bin 0x4f28
send (16):
7e 00 01 00 08 00 00 4f 28 00 00 00 08 d5 34 7e  |~......O(.....4~|
timeout reached

starting at 0x4f28, 0x4f38, 0x4f48:

Waiting for connection (600s)
libusb_control_transfer ok
send (1):
7e                                               |~|
recv (14):
7e 00 81 00 06 53 50 52 44 33 00 57 0a 7e        |~....SPRD3.W.~|
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
send (8):
7e 00 00 00 00 00 00 7e                          |~......~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
CMD_CONNECT bootrom
BROM >send zero.bin 0x4f28    
send (16):
7e 00 01 00 08 00 00 4f 28 00 00 00 08 d5 34 7e  |~......O(.....4~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send zero.bin 0x4f38
send (16):
7e 00 01 00 08 00 00 4f 38 00 00 00 08 d1 6e 7e  |~......O8.....n~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
send (16):
7e 00 02 00 08 00 00 00 00 00 00 00 00 89 4c 7e  |~.............L~|
recv (8):
7e 00 80 00 00 3b 5a 7e                          |~....;Z~|
BROM >send zero.bin 0x4f48
send (16):
7e 00 01 00 08 00 00 4f 48 00 00 00 08 cc e8 7e  |~......OH......~|
timeout reached

TomKing062 · 2024-01-25T06:20:38Z

main part done, exec_addr is 0x4f18 for normal download and 0x4ee8 for fallback download

BenEdridge · 2024-01-27T01:11:47Z

Thank you @TomKing062 I will be attempting the SPL method. I've read through https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/AddSupportToModel#modify-images does that mean I need to compile from source and do: https://github.com/TomKing062/jing_patch ?

TomKing062 · 2024-01-27T01:17:40Z

no need to compile

ghost · 2024-05-21T14:16:05Z

I also have a sp9832e_1h10_go(fu) phone which I'm trying to unlock and flash a modified system. I'm able to use spd_dump successfully.

@BenEdridge: How did you go with the the SPL method? Did it work? Like you, I'm not sure if my attempt at patching fdl1/fdl2 is correct. Don't want to accidentally brick the device.

@TomKing062: A release for the sp9832e_1h10_go may assist certain ZTE models/re-brands (eg. the ZTE Blade A31 Lite mentioned by another user). Thank you for your great work.

p3y0t3 · 2024-05-21T16:41:28Z

Thank them with your wallet! TK deserves your support! In this economy every little bit helps the devs - and TK has been working tirelessly for months on this.

…

On Tue, May 21, 2024, 7:16 AM sj882s ***@***.***> wrote: I also have a sp9832e_1h10_go(fu) phone which I'm trying to unlock and flash a modified system. I'm able to use spd_dump successfully. @BenEdridge <https://github.com/BenEdridge>: How did you go with the the SPL method? Did it work? Like you, not I'm not sure if my attempt at patching fdl1/fdl2 is correct. Don't want to accidentally brick the device. @TomKing062 <https://github.com/TomKing062>: A release for the sp9832e_1h10_go may assist certain ZTE models/re-brands (eg. the ZTE Blade A31 Lite mentioned by another user). Thank you for your great work. — Reply to this email directly, view it on GitHub <#39 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5TIDEDTMUQGXMACSASB5RTZDNJLZAVCNFSM6AAAAABBGSKACGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMRSG42DEMRTGE> . You are receiving this because you are subscribed to this thread.Message ID: <TomKing062/CVE-2022-38694_unlock_bootloader/issues/39/2122742231@ github.com>

BenEdridge mentioned this issue Dec 31, 2023

Guidance on sp9832e_1h10_gofu (Connected but receive 7e ver expected error) ilyakurdyukov/spreadtrum_flash#6

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unlock support for sp9832e_1h10_gofu #39

Unlock support for sp9832e_1h10_gofu #39

BenEdridge commented Dec 29, 2023

TomKing062 commented Jan 1, 2024 •

edited

Loading

TomKing062 commented Jan 1, 2024 •

edited

Loading

BenEdridge commented Jan 16, 2024

BenEdridge commented Jan 16, 2024 •

edited

Loading

TomKing062 commented Jan 16, 2024

BenEdridge commented Jan 16, 2024

TomKing062 commented Jan 16, 2024

BenEdridge commented Jan 16, 2024

TomKing062 commented Jan 25, 2024

BenEdridge commented Jan 27, 2024

TomKing062 commented Jan 27, 2024

ghost commented May 21, 2024 •

edited by ghost

Loading

p3y0t3 commented May 21, 2024 via email

Unlock support for sp9832e_1h10_gofu #39

Unlock support for sp9832e_1h10_gofu #39

Comments

BenEdridge commented Dec 29, 2023

TomKing062 commented Jan 1, 2024 • edited Loading

TomKing062 commented Jan 1, 2024 • edited Loading

BenEdridge commented Jan 16, 2024

BenEdridge commented Jan 16, 2024 • edited Loading

TomKing062 commented Jan 16, 2024

BenEdridge commented Jan 16, 2024

TomKing062 commented Jan 16, 2024

BenEdridge commented Jan 16, 2024

TomKing062 commented Jan 25, 2024

BenEdridge commented Jan 27, 2024

TomKing062 commented Jan 27, 2024

ghost commented May 21, 2024 • edited by ghost Loading

p3y0t3 commented May 21, 2024 via email

TomKing062 commented Jan 1, 2024 •

edited

Loading

TomKing062 commented Jan 1, 2024 •

edited

Loading

BenEdridge commented Jan 16, 2024 •

edited

Loading

ghost commented May 21, 2024 •

edited by ghost

Loading