How to Unlock Bootloader using CVE-2022-38694 Exploit
In this guide, we will show you the steps to unlock the bootloader on your Android device using the CVE-2022-38694 Exploit. Unlocking the bootloader is usually a fairly easy task- just boot your device to Fastboot Mode, type in fastboot flashing unlock, and finally confirm the choice on your device via the Power and Volume keys. Unfortunately, that isn’t the case with all OEMs.
Devices with a Unisoc or Spreadtrum chipset are perhaps the most complicated ones out there when it comes to the unlocking process [and now HyperOS is going that direction as well ]. The aforementioned command will not work on any device with an underlying Unisoc or Spreadtrum chipset. Well, some of these devices don’t even have a Fastboot Mode to begin with. So, what can be done in such cases?
Well, you can use the Identifier Token to get this job done , but its use case is limited to only a few devices out there. This is where the CVE-2022-38694 Exploit comes into play. In technical terms:
Any attacker [which would be we in this case] with physical access to the device can overwrite a function pointer in the BootROM data section and execute their own code with BootROM privileges.
The exploitation of this vulnerability could easily lead to unauthorized access to the device’s bootloader. And guess what? This is exactly what we would need [it’s just that while the access will still be unauthorized, we would be very much aware of the user who is getting this access!]. So, making full use of this CVE-2022-38694 Exploit, let’s proceed ahead and unlock the bootloader on your Unisoc/Spreadtrum devices.
- How to Unlock Bootloader using CVE-2022-38694 Exploit Supported Device List Download Bootloader Unlock CVE-2022-38694 Exploit Tool Bootloader Unlocking Instructions
How to Unlock Bootloader using CVE-2022-38694 Exploit
Before starting, please take a complete device backup. Moreover, the process might void the device’s warranty as well. So proceed ahead with caution and at your own risk. Droidwin and its members wouldn’t be held responsible in case of a thermonuclear war, your alarm doesn’t wake you up, or if anything happens to your device, and data by performing the below steps.
Supported Device List
Apart from the ones listed below, there are a few other devices given in the Downloads section, which are not part of this list but are supported as well.
| Chipset | Device Name | Boot to Download Mode | OS Version | Additional Information |
|---|---|---|---|---|
| sc9863a | Itel Vision 2s/3 | vab | ||
| sc9863a | Realme C11 2021 RMX3231/Narzo 50i RMX3235 | vab | ||
| sc9863a | Redbeat C1 | vab | use sc9863a_Itel_Vision_3 | |
| sc9863a | Vortex NS65 | use sc9863a_Itel_Vision_3 | ||
| sc9863a | ZTE Blade A31 | vab | arm32 | |
| sc9863a | ZTE Blade A51 | vab | arm32 | |
| sc9863a | ZTE Blade A52 | vab | arm32, can use as 9863a_32 vab ZTE universal | |
| sc9863a | ZTE Blade A5 2019 | 9 | ||
| sc9863a | ZTE Blade A7 2019 | 9 | ||
| sc9863a | ZTE Blade V2020 Smart | 10 | ||
| sc9863a | ZTE Voyage 40se | vab | fdl-dl from A52, can use as 9863a_64 vab ZTE universal | |
| ud710 | Coolpad X10 | 9 | ||
| ud710 | Hisense A7 | POWER + VOL_UP + VOL_DOWN | 10 | fdl1-boot |
| ud710 | Hisense A7cc | POWER + VOL_UP + VOL_DOWN | 10 | fdl1-boot |
| ud710 | Hisense HNR551T | POWER + VOL_UP + VOL_DOWN | 9 | |
| ud710 | K-Touch Bee A7 | 9 | ||
| ud710 | Tyyh 2020/Hisense HNR552T | POWER + VOL_UP + VOL_DOWN | 9 | fdl1-boot |
| ud710 | Tyyh 2021/360 q10pro | POWER + VOL_DOWN | 10 | fdl1-boot, 2021 and q10pro have different device-tree |
| ud710 | xiaolajiao 20 | |||
| ums312 | MEIZU MeiBlue 10/10s | 9 | ||
| ums312 | Qin F21pro+ | vab | can use as ums312 vab universal ? | |
| ums512 | Alldocube iplay 50 | POWER + VOL_DOWN | vab | can use as ums512 vab universal |
| ums512 | GIONEE GT9 | vab | fdl1-boot | |
| ums512 | Hisense A5pro | POWER + VOL_UP + VOL_DOWN | 10 | fdl1-boot |
| ums512 | Hisense A5procc | POWER + VOL_UP + VOL_DOWN | 10 | fdl1-boot |
| ums512 | Hisense E22 HITV102C | use Hisense A5procc | ||
| ums512 | Hisense hi reader | POWER + VOL_UP + VOL_DOWN | 10 | |
| ums512 | Hisense Q5 | POWER + VOL_UP + VOL_DOWN | 10 | fdl1-boot |
| ums512 | Infinix hot 12 play nfc | vab | NOP handshake | |
| ums512 | Motorola Moto G20 | vab | ||
| ums512 | OYSIN m60p v5000 | vab | ||
| ums512 | Realme C21y RMX3261/RMX3263 | vab | ||
| ums512 | Realme C25y RMX3269 | vab | ||
| ums512 | Umidigi A13 Pro | use Umidigi G1 Max | ||
| ums512 | Umidigi G1 Max | vab | ||
| ums512 | ZTE Axon20 4G A2121E P618A01 | 10 | fdl1-boot | |
| ums9230 | Alldocube iplay 50 mini | POWER + VOL_DOWN | vab | EMMC ONLY !!! |
| ums9230 | Baidu Qinghe V20 | vab | read #57 | |
| ums9230 | Blackview A85 | vab | ||
| ums9230 | Coolpad shangfeng50 | vab | use ums9230 universal | |
| ums9230 | Doogee T10 | POWER + VOL_DOWN | vab | |
| ums9230 | Doogee T10s | vab | ||
| ums9230 | Doogee T20 Mini | vab | use ums9230 universal | |
| ums9230 | DOOV u23 | vab | use ums9230 universal | |
| ums9230 | DOOV x15pro | vab | use ums9230 universal | |
| ums9230 | i15pro | vab | ||
| ums9230 | IIIF150 B2 | vab | ||
| ums9230 | Infinix Hot 12pro | vab | ||
| ums9230 | Infinix Hot 30i | vab | patch dl_cmd_handler | |
| ums9230 | Itel P40+ | vab | patch dl_cmd_handler | |
| ums9230 | Itel S23 | vab | patch dl_cmd_handler | |
| ums9230 | Itel vision 3 plus | vab | ||
| ums9230 | Itel vision 5 plus | vab | NOP handshake | |
| ums9230 | lebest l23pro | vab | use ums9230 universal | |
| ums9230 | moto e13 | vab | EMMC ONLY, THIS WILL ERASE YOUR UFS | |
| ums9230 | moto e20 | vab | use moto e13 | |
| ums9230 | Nokia G21 | vab | ||
| ums9230 | Philips X7206 | vab | use Alldocube iplay 50 mini | |
| ums9230 | Realme C31 RMX3501 | vab | ||
| ums9230 | Realme C33 RMX3424 | vab | ||
| ums9230 | Realme C35 RMX3511 | vab | ||
| ums9230 | Realme C51 RMX3830 | vab | ||
| ums9230 | Realme C53 RMX3760/RMX3762 | vab | ||
| ums9230 | Realme narzo 50i prime RMX3506 | vab | ||
| ums9230 | Realme Note 50 RMX3834 | vab | ||
| ums9230 | RYHT X90 | vab | ||
| ums9230 | Tecno spark 8c | vab | ||
| ums9230 | Umidigi A15 | vab | ||
| ums9230 | Umidigi Active T1 | vab | ||
| ums9230 | universal | vab | EMMC ONLY !!! | |
| ums9230 | zte blade 40/50 design | vab | use ums9230 universal | |
| ums9620 | anbernic RG 556 | vab | fdl1-boot | |
| ums9620 | anbernic RG Cube | vab | fdl1-boot | |
| ums9620 | Bihee a89 | POWER + Num_1 | vab | |
| ums9620 | Coolpad GoldCentury y60 | POWER + VOL_UP | vab | patch dl_cmd_handler use ums9620_universal_unlock test dramtype yourself |
| ums9620 | DOOV x9 | vab | use universal dram1/dram2 | |
| ums9620 | Hisense H60 | vab | ||
| ums9620 | OSCAL Tiger 13 | vab | use ZTE Universal or universal dram1/dram2 | |
| ums9620 | TCL t508n | POWER + center + up + down + right + left | vab | |
| ums9620 | universal dram1/dram2 | vab | Coolpad devices,Tyyh 2022 | |
| ums9620 | ZTE Universal | POWER + VOL_DOWN | vab | 30s, 41, 50 |
| ums9621 | MeiZu Note 16 | vab | custom_exec payload is private |
Download Bootloader Unlock CVE-2022-38694 Exploit Tool
You may now get hold of the tool corresponding to your device from below [ Credits for these files: TomKing062 on GitHub] .
- sc9863a_Itel_Vision_3.zip
- [email protected]
- sc9863a_Realme_C11_2021_RMX3231_Narzo_50i_RMX3235.zip
- sc9863a_ZTE_Blade_A31.zip
- sc9863a_ZTE_Blade_A51.zip
- sc9863a_ZTE_Blade_A52.zip
- sc9863a_ZTE_Blade_A5_2019.zip
- sc9863a_ZTE_Blade_A7_2019.zip
- sc9863a_ZTE_Blade_v2020_smart.zip
- sc9863a_ZTE_Voyage_40se_v4.zip
- ud710_coolpad_x10.zip
- ud710_hisense_a7.zip
- ud710_hisense_a7cc.zip
- ud710_hisense_HNR551T.zip
- ud710_K-TouchBeeA7.zip
- ud710_tyyh2020.zip
- ud710_tyyh2021.zip
- ud710_xiaolajiao20.zip
- ums312_for_android9_10_MeiBlue_10_10s_repack.zip
- ums312_MeiBlue_10_10s.zip
- ums312_Qin_F21pro+.zip
- ums512_alldocube_iplay_50_EN_20230801.zip
- ums512_for_android10_alldocube_iplay_50_repack.zip
- ums512_GIONEE_GT9.zip
- ums512_hisense_a5pro.zip
- ums512_hisense_a5procc.zip
- ums512_hisense_hi_reader.zip
- ums512_hisense_q5.zip
- ums512_infinix_hot_12_play_nfc.zip
- ums512_Motorola_Moto_G20.zip
- ums512_OYSIN_m60p_v5000.zip
- ums512_Realme_C21y_RMX3261_RMX3263.zip
- [email protected]
- ums512_Umidigi_G1_Max.zip
- ums512_ZTE_Axon20_4G_A2121E_P618A01.zip
- ums9230e_Tecno_KL4.zip
- ums9230_alldocube_iplay_50_mini_EN_20230527.zip
- ums9230_Baidu_Qinghe_V20.zip
- ums9230_Blackview_A85.zip
- ums9230_Doogee_T10.zip
- ums9230_Doogee_T10s.zip
- [email protected]
- ums9230_i15pro.zip
- ums9230_IIIF150_B2.zip
- ums9230_Infinix_hot_12_pro.zip
- ums9230_Infinix_Hot_30i_base230522.zip
- ums9230_itel_P40+_base230619_v2.zip
- ums9230_itel_S23_base230605.zip
- ums9230_itel_vision_3_plus.zip
- ums9230_itel_vision_5_plus.zip
- ums9230_moto_e13_v2.zip
- ums9230_moto_g04.zip
- ums9230_moto_g14.zip
- ums9230_Nokia_G21.zip
- ums9230_Realme_C31_RMX3501.zip
- ums9230_Realme_C33_RMX3624.zip
- ums9230_Realme_C35_RMX3511.zip
- ums9230_Realme_C51_RMX3830.zip
- ums9230_Realme_C53_RMX3760_RMX3762.zip
- ums9230_Realme_narzo_50i_prime_RMX3506.zip
- ums9230_Realme_Note_50_RMX3834.zip
- ums9230_RYHT_X90.zip
- ums9230_tecno_spark_8c.zip
- ums9230_Umidigi_A15.zip
- ums9230_Umidigi_Active_T1.zip
- ums9230_universal_unlock.zip
- ums9620_bihee_a89_v3.zip
- ums9620_hisense_h60.zip
- ums9620_RG_556.zip
- ums9620_RG_CUBE.zip
- ums9620_tcl_t508n_v6.zip
- ums9620_universal_unlock_dramtype1.zip
- ums9620_universal_unlock_dramtype2.zip
- ums9620_ZTE_universal.zip
Bootloader Unlocking Instructions
- First off, download and extract the SPD Drivers on your PC.
- Then launch the DriverSetup.exe file and install the drivers.
- Now, download the Unlock Bootloader Tool from the above link.
- Then boot your device to the Download Mode as shown below:
- Power off your device. Then, press and hold the Volume Down key and connect it to your PC via a USB cable.
- Power off your device. Then, press and hold the Volume Up and Down keys and connect it to your PC via a USB cable.
- Now open Device Manager [via Windows+X shortcut keys] and search for your device.
- It should be named like: Unisoc Phone, SPRD COM, UNKNOWN DEVICE, or something similar.
- So right-click on it and select Update Drivers > Browse my computer for driver > Choose from a list of drivers > select the SPRD AT Version xxx > hit Install.
- Now disconnect the phone. Open the “Unlock_autopatch_512.bat” file and connect your device to the PC in Download Mode [as explained above].
- Now, proceed with the on-screen instructions to complete the rest of the process. Once done, your device will boot to the OS having an unlocked bootloader.
- How to Unlock Bootloader on Tecno Devices [MediaTek & Unisoc]
- How to Unlock Bootloader on any Unisoc/Spreadtrum Device
- Download and Install Unisoc / Spreadtrum USB Drivers
- How to Backup Unisoc/Spreadtrum Firmware using Research Download Tool
(Cancel Reply)
Δ
