[Downloads] SPRD UNISOC Chinese Android Head Unit PAC firmware and little advice
[Downloads] SPRD UNISOC Chinese Android Head Unit PAC firmware and little advice
23-10-2025, 02:44 PM
Hi all,
After trying and trying I finally managed to unlock bootloader and root my device.
It's being sold under the name W60N, seller "Imagebon" on aliexpress.
Unlocking bootloader was turned off by manufacturer/seller.
My mistake was - because the device (it's portable Android car screen, UMS9230, T606, 4GB RAM, 64GB ROM) has no other physical keys, only power button on the side and reset button on the back (pinhole), I had to find pad on pcb, which would allow entering into download mode. I thought I found the correct pad, the device was being recognised as SPRD U2C DIAG on COMx when plugged in, but it was disconnecting after about 5 seconds and rebooting into Android EVERY time.
I have realised later, that it wasn't correct pad to trigger DOWNLOAD MODE or BootROM.
There was in fact button that I initially misidentified, right behind jack socket, where you would plug in reversing camera (see photo).
After finding out, I confirmed it was the correct button to trigger download mode, using Cheetah Tool Pro I successfully unlocked Bootloader on first try.
From there I was able to backup all partitions using Cheetah Tool Pro.
In the meantime, the seller sent me pac firmware, after I've been asking him for a month.
I took boot_a.img and boot_b.img and patched them with Magisk.
Then I thought I'm going to need signed custom vbmeta, extract public keys, sign boot imgs and so on. Did all that, but every time I flashed these files to device it resulted in boot loop.
Then I stumbled upon this conversation:
github.com/TomKing062/CVE-2022-38694
And I thought I'll try flashing only patched boot_a and boot_b. Flashed only boot_a_patched.img first into slot a using fastboot. Then reboot and boOom! All works.
No need to fiddle with vbmeta, signing etc!
Finished rooting with Magisk app on the device. After that, for peace of mind flashed boot_b_patched.img into slot b, rebooted, confirmed that all works.
Below is pac firmware I uploaded to my google drive, as single .pac file and there's folder with .pac extracted with Research Download Tool (copied from temp location RDT creates).
QC_Q30_1130EFPSL_WF2_Q30_MB_1130_CarCharger_user_2025090214_202509021547
Just in case someone would be interested, I also uploaded simple boot animation for this device (resolution 540 x 1440), I made to match my car
Keywords:
Code:
QC , Q30 , 1130 , W60N , Imageboon , UIS7861_6h10 , UMS9230 , T606 , Unisoc , SPRD , .pac This post was last modified: 23-10-2025, 02:58 PM by mpm86.
24-10-2025, 01:43 PM
(23-10-2025, 02:44 PM)mpm86 Hi all,
After trying and trying I finally managed to unlock bootloader and root my device.
It's being sold under the name W60N, seller "Imagebon" on aliexpress.
Unlocking bootloader was turned off by manufacturer/seller.
...
Just in case someone would be interested, I also uploaded simple boot animation for this device (resolution 540 x 1440), I made to match my car
Thanks for sharing
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
29-04-2026, 05:33 PM
I have a second unit from the same Imagebon seller on AliExpress, but this one runs Android 14 instead of Android 12. The device is a 4G DVR dashcam unit with the following specs:
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- Android: 14 (MocorDroid14)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Bluetooth name visible in firmware: Q30_1025EFPSL / Q30_1025E4GFPSL
- Kernel: Linux 5.15.123rc, compiled January 28, 2026
- Partitions: A/B slot (logo_a/b, fbootlogo_a/b, boot_a/b, etc.)
The device is currently bricked (no display). It still connects via BROM/SPD mode (SPRD U2S Diag) and responds to spd_dump with FDL2 prompt, so recovery is possible.
I have the PAC from this thread (QC_Q30_1130EFPSL - Android 12) but the splloader from that firmware is not compatible with this Android 14 unit — the device does not boot after flashing it.
Does anyone have the correct .pac firmware for the Android 14 version of this device? Even just the splloader and uboot partitions from the Android 14 PAC would be enough to recover it.
Any help is greatly appreciated!
05-05-2026, 08:14 AM
(29-04-2026, 05:33 PM)vmastella ...
The device is currently bricked (no display). It still connects via BROM/SPD mode (SPRD U2S Diag) and responds to spd_dump with FDL2 prompt, so recovery is possible.
..
How did it get bricked? You might not need to flash the PAC file depending on how it got bricked.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
05-05-2026, 09:37 PM
(29-04-2026, 05:33 PM)vmastella Hi everyone,
I have a second unit from the same Imagebon seller on AliExpress, but this one runs Android 14 instead of Android 12. The device is a 4G DVR dashcam unit with the following specs:
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- Android: 14 (MocorDroid14)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Bluetooth name visible in firmware: Q30_1025EFPSL / Q30_1025E4GFPSL
- Kernel: Linux 5.15.123rc, compiled January 28, 2026
- Partitions: A/B slot (logo_a/b, fbootlogo_a/b, boot_a/b, etc.)
The device is currently bricked (no display). It still connects via BROM/SPD mode (SPRD U2S Diag) and responds to spd_dump with FDL2 prompt, so recovery is possible.
I have the PAC from this thread (QC_Q30_1130EFPSL - Android 12) but the splloader from that firmware is not compatible with this Android 14 unit — the device does not boot after flashing it.
Does anyone have the correct .pac firmware for the Android 14 version of this device? Even just the splloader and uboot partitions from the Android 14 PAC would be enough to recover it.
Any help is greatly appreciated!
I probably have the same Android 14 Head Unit.
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Device: UNISOC Q30_1026EWT2SL (uis7861_6h10_Natv)
I received the firmware (ota) file from the seller, so I'm sharing it.
https://drive.google.com/drive/folders/1...sp=sharing | mirror
Note: I don't think it's compatible with Android 12 units.
Since the img can be extracted from payload.bin, recovery might be possible if you can fastboot. (I don't know how to do that...)
Also, I was able to create an image backup using Android 12 FDL, so I can provide the pac if needed.
(However, since I have limited knowledge, I would need you to tell me the required Base list.)
This post was last modified: 07-05-2026, 09:37 AM by hovatek.
25-06-2026, 11:37 PM
Do we know if this firmware would would my my android smart mirror?
Brand/Model: ODBPEAK Q90E (sold on AliExpress)
Chipset: UNISOC UIS7861 (uis7861_6h10) / Board Platform: UMS9230
Product Name: uis7861_6h10_Natv
RAM/Storage: 4GB RAM / 64GB ROM
Build Number: MZL_Q90E_030_MB_1126_CarCharger_user_2026020509
Build Fingerprint: UNISOC/uis7861_6h10_Natv/uis7861_6h10:14/SP1A.210812.016/05409:user/release-keys
Kernel: 5.4.147-android12-9-dirty #107 Thu Feb 5 09:31:26 CST 2026
Android: Reports 12 (SDK 31) but fingerprint confirms Android 14 underneath
Screen: 1920x440 automotive mirror display
Partitions: A/B slots, dynamic, erofs (read-only system partition)
26-06-2026, 05:50 AM
(29-04-2026, 05:33 PM)vmastella Hi everyone,
I have a second unit from the same Imagebon seller on AliExpress, but this one runs Android 14 instead of Android 12. The device is a 4G DVR dashcam unit with the following specs:
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- Android: 14 (MocorDroid14)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Bluetooth name visible in firmware: Q30_1025EFPSL / Q30_1025E4GFPSL
- Kernel: Linux 5.15.123rc, compiled January 28, 2026
- Partitions: A/B slot (logo_a/b, fbootlogo_a/b, boot_a/b, etc.)
The device is currently bricked (no display). It still connects via BROM/SPD mode (SPRD U2S Diag) and responds to spd_dump with FDL2 prompt, so recovery is possible.
I have the PAC from this thread (QC_Q30_1130EFPSL - Android 12) but the splloader from that firmware is not compatible with this Android 14 unit — the device does not boot after flashing it.
Does anyone have the correct .pac firmware for the Android 14 version of this device? Even just the splloader and uboot partitions from the Android 14 PAC would be enough to recover it.
Any help is greatly appreciated!
Hey vmastella
How did you get your device into BROM mode?
Cheers, Damien
26-06-2026, 10:42 PM
This is the key discovery for the Q90E — BROM mode is triggered via ADB, no physical PCB access needed!
adb -s YOUR_SERIAL shell reboot autodloader
The mirror screen will go black. In Windows Device Manager you should see SPRD U2S Diag (COMx) appear under Ports. If the SPRD driver is not installed, right-click the unknown device and install the driver from the Win10/Drivers folder you downloaded earlier.
Note: The device will automatically stay in BROM mode if the splloader partition is erased (as happens during the unlock process), so you can reconnect without running this command again.
05-07-2026, 06:03 AM
(05-05-2026, 09:37 PM)nec093Hi, I broke my Moto CarPlay device. I flashed a broken boot logo into it using the included script. Now it won't boot at all. I really need the FDL files to remove the partition map and clean out the broken file. It works exactly on this 7861 configuration. If you could send me the entire PAС file, that would be great.(29-04-2026, 05:33 PM)vmastella Hi everyone,
I have a second unit from the same Imagebon seller on AliExpress, but this one runs Android 14 instead of Android 12. The device is a 4G DVR dashcam unit with the following specs:
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- Android: 14 (MocorDroid14)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Bluetooth name visible in firmware: Q30_1025EFPSL / Q30_1025E4GFPSL
- Kernel: Linux 5.15.123rc, compiled January 28, 2026
- Partitions: A/B slot (logo_a/b, fbootlogo_a/b, boot_a/b, etc.)
The device is currently bricked (no display). It still connects via BROM/SPD mode (SPRD U2S Diag) and responds to spd_dump with FDL2 prompt, so recovery is possible.
I have the PAC from this thread (QC_Q30_1130EFPSL - Android 12) but the splloader from that firmware is not compatible with this Android 14 unit — the device does not boot after flashing it.
Does anyone have the correct .pac firmware for the Android 14 version of this device? Even just the splloader and uboot partitions from the Android 14 PAC would be enough to recover it.
Any help is greatly appreciated!
I probably have the same Android 14 Head Unit.
- Chipset: UNISOC UIS7861 (uis7861_6h10)
- RAM: 4GB / ROM: 64GB
- Screen: 10.25 inch, 1920x720
- Device: UNISOC Q30_1026EWT2SL (uis7861_6h10_Natv)
I received the firmware (ota) file from the seller, so I'm sharing it.
https://drive.google.com/drive/folders/1...sp=sharing | mirror
Note: I don't think it's compatible with Android 12 units.
Since the img can be extracted from payload.bin, recovery might be possible if you can fastboot. (I don't know how to do that...)
Also, I was able to create an image backup using Android 12 FDL, so I can provide the pac if needed.
(However, since I have limited knowledge, I would need you to tell me the required Base list.)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)