Unlocking SPD UNISOC T606 UMIDIGI A15C Bootloader Help

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 08:11 AM

#1

hello ive been following your guides. and man gotta first say. VERY IMPRESSED with your work !! and anyone else working alongside !! plan to take some courses soon as im a dev myself !! love working on android systems !!

anywho, got all the way to the end until i reach this error. i just need some guidance on how to take the received output and resign with the correct code

./fastboot flashing unlock_bootloader signature.bin
downloading 'unlock_message'...
OKAY [ 0.000s]
unlocking bootloader...
FAILED (remote: Unlock bootloader fail.)
finished. total time: 0.054s

this is my vbmeta-sign.img output

Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 576 bytes
Auxiliary Block: 16320 bytes
Public key (sha1): 9333a436e32f42c3c67d4e4952712370f73cc23b
Algorithm: SHA256_RSA4096
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.2.0'
Descriptors:
Chain Partition descriptor:
Partition Name: boot
Rollback Index Location: 1
Public key (sha1): 67f308a7fe7a61ca6559f8d95447fc76eb4f46a8
Chain Partition descriptor:
Partition Name: vendor_boot
Rollback Index Location: 18
Public key (sha1): 1335b241420d5bbb4342b981f70bab0cc35db37b
Chain Partition descriptor:
Partition Name: dtbo
Rollback Index Location: 6
Public key (sha1): 67f308a7fe7a61ca6559f8d95447fc76eb4f46a8
Chain Partition descriptor:
Partition Name: vbmeta_system
Rollback Index Location: 2
Public key (sha1): db013faa2fa26fff5cb7935fc66c75cc88dd2d79
Chain Partition descriptor:
Partition Name: vbmeta_vendor
Rollback Index Location: 4
Public key (sha1): ab91fe6de62f9fcff2f70123cbcc3f67f4a735bd
Chain Partition descriptor:
Partition Name: vbmeta_odm
Rollback Index Location: 7
Public key (sha1): 43082ddac6f71ba36846a9a6a593b3978864cb6e
Chain Partition descriptor:
Partition Name: vbmeta_system_ext
Rollback Index Location: 3
Public key (sha1): 42990ce7a717305ae205d394ce8e4c3459bb66c5
Chain Partition descriptor:
Partition Name: vbmeta_product
Rollback Index Location: 5
Public key (sha1): 4494c2ee1a8827838202a6bb24732f90b8fb0f3e
Chain Partition descriptor:
Partition Name: l_modem
Rollback Index Location: 11
Public key (sha1): feafae23dadefc2a8b391ea36865059eb1f34b94
Chain Partition descriptor:
Partition Name: l_ldsp
Rollback Index Location: 12
Public key (sha1): feafae23dadefc2a8b391ea36865059eb1f34b94
Chain Partition descriptor:
Partition Name: l_gdsp
Rollback Index Location: 13
Public key (sha1): feafae23dadefc2a8b391ea36865059eb1f34b94
Chain Partition descriptor:
Partition Name: pm_sys
Rollback Index Location: 14
Public key (sha1): feafae23dadefc2a8b391ea36865059eb1f34b94
Chain Partition descriptor:
Partition Name: l_agdsp
Rollback Index Location: 15
Public key (sha1): feafae23dadefc2a8b391ea36865059eb1f34b94
Prop: com.android.build.boot.os_version -> '13'
Prop: com.android.build.boot.security_patch -> '2023-06-05'
Prop: com.android.build.system.os_version -> '13'
Prop: com.android.build.system.security_patch -> '2023-06-05'
Prop: com.android.build.vendor.os_version -> '13'
Prop: com.android.build.vendor.security_patch -> '2023-06-05'

Attached Files

Bootloader sign error.png
Size: 97.2 KB / Downloads: 0

Gargoyle
Contributor

538

11-01-2025, 08:21 AM

#2

https://github.com/TomKing062/CVE-2022-3...bootloader

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 09:58 AM

#3

(11-01-2025, 08:21 AM)Gargoyle https://github.com/TomKing062/CVE-2022-3...bootloader

thx !! Have checked it out, made the files requested in the git. . one being chsize, spd-dump and another gen_spl-unlock now a tidibit confused, as theres no direct informative directions as per unlock, do i use the gen_spl-unlock on the my devices vbmeta-sign.img ?

then to continue with hovateks method ?

My Terminal output :

$ ./gen_spl-unlock
Usage: ./gen_spl-unlock <filename>

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 10:29 AM

#4

(11-01-2025, 09:58 AM)xXHenneBXx
(11-01-2025, 08:21 AM)Gargoyle https://github.com/TomKing062/CVE-2022-3...bootloader
Edited:

thx !! Have checked it out, made the files requested in the git. . one being chsize, spd-dump and another gen_spl-unlock now a tidibit confused, as theres no direct informative directions as per unlock, do i use the gen_spl-unlock on firmware then re-install .pac using spd flash tool ?

My Terminal output :

$ ./gen_spl-unlock
Usage: ./gen_spl-unlock <filename>

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 11:45 AM

#5

UPDATE !! was able to use gen_spl-unlock on the lk-sign.bin which is the bootloader, now im going to repack firmware and test. Will post an update

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 01:51 PM

#6

Come to the conclusion i was mistaken reading or even thinking what this was stating, so anyways, i used the gen_spl-unlock on my lk-sign.bin, which then output the patched file GREAT ! then i realised im supposed to boot into BootROM using the method stating in guide, i got to bootrom, but now i dont know what command it is to send to the bootrom using my newly patched lk-sign.bin..

i get the basic command to dump the firmware from device is "spd_dump --wait 300 fdl /path/to/fdl1 fdl1_addr fdl /path/to/fdl2 fdl2_addr exec path savepath r all reset"..

reading the help shows this command
"exec_addr [addr]
(brom stage only)
Sends custom_exec_no_verify_addr.bin to the specified memory address to bypass the signature verification by brom for splloader/fdl1.
Used for CVE-2022-38694.
"

would my new command be

spd_dump --wait 300 fdl /path/to/fdl1 fdl1_addr fdl /path/to/fdl2 fdl2_addr exec_addr custom_exec_no_verify_addr.bin [addr] reset ?

would this be correct ? of course adjusting my file paths and addresses. can i then flash vbmeta after to disable dm-verity or do i have to use script based within my line to add the option verity {0,1} is 0 off 1 0n also stated in the help as a command ?

(11-01-2025, 08:21 AM)Gargoyle https://github.com/TomKing062/CVE-2022-3...bootloader

Attached Files

Screenshot from 2025-01-11 07-48-21.png
Size: 68.36 KB / Downloads: 2

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 05:20 PM

#7

Completed unlocking the UMIDIGI A15C UNISOC T606 BASED.. used another guide i found on xda much simpler, using the same method as described in github !! Thanks @Gargoyle @Hovatek for making it all happen, plan on making my own guide for simpler and much more user friendly directions.. this XDA guide also states it works for ALL T606 chips, so on that for Devs, im assuming it is the same keys used across all phones using this chipset ? link : https://xdaforums.com/t/oukitel-wp23-pro...t-89181596

now to get the rest of the extraction for what i need to build a custom twrp fromHovateks auto twrp builder and tes that out !! ..
OMW to making custom ROMS

SEE YOU ALL SOON !!!!

xXHenneBXx
Enthusiastic Member

9

11-01-2025, 05:59 PM

#8

(11-01-2025, 05:20 PM)xXHenneBXx showing some photos of it being unlocked and the phone build for completed confirmation

Attached Files

flashing boot.png
Size: 41.11 KB / Downloads: 4

magisk-installed.png
Size: 44.83 KB / Downloads: 3

PHONE ABOUT.png
Size: 160.28 KB / Downloads: 3

xXHenneBXx
Enthusiastic Member

9

12-01-2025, 06:19 PM

#9

Made a Tutorial for anyone looking to do this on this device or chipset !!

13 easy steps [UNLOCKED][ROOTED][TWRP]

https://xdaforums.com/t/guide-umidigi-a1...s.4713070/

View a Printable Version

Users browsing this thread:
2 Guest(s)

Find us

Call us

Mail us

Useful Links

Actions