[Please help] Motorola Moto G35 XT2433-5 (Unisoc T760) hard bricked after Chimera FRP - BROM only,
[Please help] Motorola Moto G35 XT2433-5 (Unisoc T760) hard bricked after Chimera FRP - BROM only,
18-06-2026, 09:57 AM
Hello everyone,
I have a Motorola Moto G35 5G XT2433-5 (EU / RETEU) with Unisoc T760 (ums9620_2h10).
Unfortunately, the phone became hard bricked after a Chimera FRP removal via Test Point.
Current state
Black screen
No vibration
No Fastboot
No Recovery
Only detected as SPRD U2S Diag (COMxx) after Test Point.
Chimera reports that the partition table is invalid and now only accepts a .PAC file.
What happened
Chimera successfully detected the phone and flashed several partitions:
blackbox
boot_a
cache
ch_sys_a
dtbo_a
elabel
init_boot_a
l_agdsp_a
logo
nr_deltanv_a
nr_fixnv1_a
nr_modem_a
nr_phy_a
persist
prodnv
pm_sys_a
sml_a
teecfg_a
trustos_a
uboot_a
vbmeta*
vendor_boot_a
After reboot the device never booted again.
I have the COMPLETE original Motorola firmware
The firmware contains:
flash.cfg
ums9620_2h10.xml
fdl1-sign.bin
lk-fdl2-sign.bin
Gpt_entry_ufs-sign.bin
u-boot-spl-16k-ufs-sign.bin
lk-sign.bin
sml-sign.bin
tos-sign.bin
teecfg-sign.bin
super.img
boot-gki.img
vendor_boot.img
init_boot.img
all modem/NV images
all vbmeta images
all partition images
So I have everything except an official PAC file.
I also have a second identical phone
I bought another Moto G35 XT2433-5 with exactly the same hardware.
Using Motorola's special fastboot.exe I successfully extracted:
GPT
factory
prodnv
persist
miscdata
nr_fixnv1_a
uboot_a
from the working phone.
What I already tried
Motorola Rescue Assistant (requires Fastboot)
ResearchDownload
UpgradeDownload
Chimera
Fastboot OEM commands
Trying to create a PAC file
Motorola fastboot supports:
oem backupnv
oem pull
but not
oem push
oem restore
oem help
My questions
Is it possible to recover this device without ISP/eMMC/UFS programming?
Can ResearchDownload or another Spreadtrum tool flash directly using:
flash.cfg
ums9620_2h10.xml
FDL1
FDL2
without creating a PAC?
Is there any known method to generate a valid PAC for this firmware?
Is there any way to restore GPT on this device in BROM mode?
Any advice would be greatly appreciated.
Thank you very much!
26-06-2026, 02:03 PM
(18-06-2026, 09:57 AM)phonestorewien Is it possible to recover this device without ISP/eMMC/UFS programming?
Yes, in its current state, if you have a PAC and assuming no authentication prevents a tool like Research Download tool from flashing
(18-06-2026, 09:57 AM)phonestorewien Can ResearchDownload or another Spreadtrum tool flash directly using:
flash.cfg
ums9620_2h10.xml
FDL1
FDL2
without creating a PAC?
Research Download tool requires a PAC file. Maybe using something like spd_dump @ https://github.com/TomKing062/action_spd_dump_it
(18-06-2026, 09:57 AM)phonestorewien Is there any known method to generate a valid PAC for this firmware?
If I were in your shoes and considering this approach, then I would modify an XT2433-4 PAC file
Zip and send a link to the following files
Code:
flash.cfg
ums9620_2h10.xml
fdl1-sign.bin
lk-fdl2-sign.bin
Gpt_entry_ufs-sign.bin
u-boot-spl-16k-ufs-sign.bin
GPT
factory
prodnv
persist
miscdata
nr_fixnv1_a
uboot_aLearn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)