Home Forum Blog Private Support Courses Archive
Our courses are now on YouTube! Start Watching
Hovatek Forum OPERATING SYSTEMS Android [Tutorial] ODBPEAK Q90E Complete Root & 2.4GHz Hotspot Fix Guide

[Tutorial] ODBPEAK Q90E Complete Root & 2.4GHz Hotspot Fix Guide

[Tutorial] ODBPEAK Q90E Complete Root & 2.4GHz Hotspot Fix Guide

 View a Printable Version
 
hovatek
hovatek
hovatek
Administrator
Website Find
51,038
08-07-2026, 08:01 AM
#1



This is a Unisoc UIS7861 / UMS9230 / T606 — Android 14 powered device. Credits to @bkafi for the doc.

Device Details:
  • Brand/Model: ODBPEAK Q90E (sold on AliExpress)
  • Chipset: UNISOC UIS7861 (uis7861_6h10) / Board Platform: UMS9230
  • Product Name: uis7861_6h10_Natv
  • RAM/Storage: 4GB RAM / 64GB ROM eMMC (SDIO interface)
  • Build Number: MZL_Q90E_030_MB_1126_CarCharger_user_2026020509
  • Build Fingerprint: UNISOC/uis7861_6h10_Natv/uis7861_6h10:14/SP1A.210812.016/05409:user/release-keys
  • Kernel: 5.4.147-android12-9-dirty #107 Thu Feb 5 09:31:26 CST 2026
  • Android: Reports 12 (SDK 31) but fingerprint confirms Android 14 underneath
  • Screen: 1920x440 automotive mirror display
  • Partitions: A/B slots, dynamic, erofs (read-only system partition)

WARNING: This process will wipe all user data on the device. Back up anything important first. Proceed at your own risk.

Overview


This guide covers how to unlock the bootloader, install Magisk root, and permanently fix the WiFi hotspot to broadcast on 2.4GHz on the ODBPEAK Q90E automotive rearview mirror dashcam. The same process likely works on any device with the Unisoc UIS7861 / UMS9230 chipset.

Why we need this: The Q90E hotspot defaults to 5GHz on every boot, which is incompatible with 2.4GHz-only devices such as the Simarine Pico marine battery monitor.

Prerequisites — What You Need


Software to Download

  1. Android Platform Tools (ADB + Fastboot): https://developer.android.com/tools/rele...form-tools
  2. CVE-2022-38694 Unlock Tool: https://github.com/TomKing062/CVE-2022-3...r/releases — download ums9230_universal_unlock_EMMC.zip
  3. SPRD USB Driver: https://androiddatahost.com/dsa6h — extract and install the Win10/Drivers folder
  4. Google USB Driver (for fastboot): https://developer.android.com/studio/run/win-usb
  5. Magisk APK (latest stable): https://github.com/topjohnwu/Magisk/releases


Setup
  • Extract platform-tools to C:\platform-tools and add it to your Windows PATH, or navigate to it in every command prompt session.
  • Extract ums9230_universal_unlock_EMMC.zip to C:\Users\YourName\Downloads\ums9230_universal_unlock_EMMC\


Step 1 — Enable Developer Options & ADB


  1. On the mirror go to Settings → About Device → Build Number
  2. Tap Build Number 7 times rapidly until it says 'You are now a developer'
  3. Go to Settings → Developer Options
  4. Enable USB Debugging
  5. Enable ADB Root Access — PIN is 2846
  6. Enable OEM Unlocking — if the toggle reverts, run:

    Code:

    adb shell settings put global oem_unlock_enabled 1

  7. Connect USB cable from mirror to PC. Accept the USB debugging authorisation popup on the mirror.
  8. Verify ADB connection

    Code:

    adb devices

    You should see your device serial number listed (referenced later as YOUR_SERIAL).

Step 2 — Dump the Boot and SPL Partitions


We need to back up two key partitions before proceeding. Replace YOUR_SERIAL with your device serial number.

Dump boot_a (for Magisk patching later)

Code:

adb -s YOUR_SERIAL shell "dd if=/dev/block/by-name/boot_a of=/sdcard/boot_a.img bs=4096" adb -s YOUR_SERIAL pull /sdcard/boot_a.img C:\temp\boot_a.img

Dump spl_a (critical — needed for unlock)

Code:

adb -s YOUR_SERIAL shell "dd if=/dev/block/by-name/spl_a of=/sdcard/spl_a.bin bs=4096" adb -s YOUR_SERIAL pull /sdcard/spl_a.bin C:\temp\spl_a.bin

IMPORTANT: Keep copies of both files in a safe location before continuing.


Step 3 — Patch the Boot Image with Magisk


  1. Install the Magisk APK on the mirror:

    Code:

    adb -s YOUR_SERIAL install magisk.apk

  2. Push the boot image to the mirror:

    Code:

    adb -s YOUR_SERIAL push C:\temp\boot_a.img /sdcard/Download/boot_a.img


  3. On the mirror open Magisk → tap Install → Select and Patch a File → choose boot_a.img
  4. Wait for Magisk to finish. It will create a file called magisk_patched-XXXXX.img
  5. Pull the patched image back:

    Code:

    adb -s YOUR_SERIAL pull /sdcard/Download/magisk_patched-*.img C:\temp\

Step 4 — Generate the SPL Unlock Payload


Open a command prompt and navigate to the unlock tool folder:

Code:

cd C:\Users\YourName\Downloads\ums9230_universal_unlock_EMMC

Copy the spl_a.bin we dumped earlier into the unlock folder and run gen_spl-unlock:

Code:

copy C:\temp\spl_a.bin splloader.bin gen_spl-unlock.exe splloader.bin

This should output a hex size (e.g. 0x10448) with no error. A file called spl-unlock.bin will be created.
Copy it to create the signed bin the unlock script needs:

Code:

copy spl-unlock.bin u-boot-spl-16k-sign.bin

Step 5 — Trigger BROM Mode


This is the key discovery for the Q90E — BROM mode is triggered via ADB, no physical PCB access needed!

Code:

adb -s YOUR_SERIAL shell reboot autodloader

The mirror screen will go black. In Windows Device Manager you should see SPRD U2S Diag (COMx) appear under Ports. If the SPRD driver is not installed, right-click the unknown device and install the driver from the Win10/Drivers folder you downloaded earlier.

Note: The device will automatically stay in BROM mode if the splloader partition is erased (as happens during the unlock process), so you can reconnect without running this command again.

Step 6 — Run the Bootloader Unlock Script


Immediately after the mirror enters BROM mode (screen goes black, SPRD U2S Diag appears in Device Manager), run the unlock script:

Code:

unlock_autopatch_9230.bat

What the script does (phases)

  1. Phase 1: Connects to BROM, reads splloader and uboot partitions, erases splloader and splloader_bak, then resets. Press any key when prompted.
  2. Phase 2: Connects again, writes the modified fdl2-cboot.bin to uboot_a, then resets. The device re-enters BROM automatically.
  3. Phase 3: Sends spl-unlock.bin (the unlock payload) to the device. The device executes it and reboots.
  4. Final phase: Waits for dl_diag connection to write the unlocked splloader back. If this fails (find port failed), proceed to Step 7 manually.

If the final phase fails — restore manually

If the script ends with 'find port failed' on the final step, the device will be stuck in BROM. Write back the original splloader and uboot manually:

Code:

spd_dump --wait 60 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w uboot_a C:\temp\uboot_a.bin w splloader u-boot-spl-16k-sign.bin reset

Note: u-boot-spl-16k-sign.bin IS the unlock payload (spl-unlock.bin). Writing it to splloader allows the device to boot with an unlocked bootloader.

When the device boots you should see the message: 'local flag is unlock skip verify' in the top right corner. This confirms the bootloader is now unlocked!


Step 7 — Flash the Magisk Patched Boot Image


Once the device has booted into Android after the unlock, enable Developer Options and USB Debugging again (the factory reset cleared them). ADB Root PIN is 2846.

  1. Reboot to fastboot:

    Code:

    adb -s YOUR_SERIAL reboot bootloader

  2. Install the Google USB driver when the fastboot device appears as 'fastboot Gadget' in Device Manager (right-click → Update driver → Android Bootloader Interface).
  3. Verify fastboot sees the device:

    Code:

    fastboot devices

  4. Flash the Magisk patched boot (replace the filename with your actual patched file):

    Code:

    fastboot flash boot_a magisk_patched-XXXXX.img

  5. Reboot:

    Code:

    fastboot reboot

Step 8 — Complete Magisk Setup


  1. After reboot, install the Magisk APK on the mirror:

    Code:

    adb -s YOUR_SERIAL install magisk.apk


  2. Open Magisk on the mirror. It should show 'Installed: 30.7' (or similar).
  3. Tap Install → Direct Install (recommended) → let it complete → Reboot.
  4. After reboot, enable ADB Root Access in Developer Options (PIN: 2846).
  5. Grant root to ADB shell in Magisk: open Magisk → Superuser tab → tap Shell → set to Grant.
  6. Verify root works:

    Code:

    adb -s YOUR_SERIAL shell su -c id

  7. You should see:

    Code:

    uid=0(root) gid=0(root)

Step 9 — Add the Permanent 2.4GHz Hotspot Boot Script


This Magisk boot script runs automatically on every boot and forces the hotspot to 2.4GHz with your chosen SSID and password.

Create the script file on your PC

Create a text file called hotspot_2ghz.sh with the following contents:

Code:

#!/system/bin/sh sleep 30 cmd wifi stop-softap sleep 3 cmd wifi start-softap YourSSID wpa2 YourPassword -b 2

Replace YourSSID with your desired hotspot name and YourPassword with your password. The -b 2 flag forces 2.4GHz.

Deploy the script to the device

Code:

adb -s YOUR_SERIAL root adb -s YOUR_SERIAL push hotspot_2ghz.sh /sdcard/hotspot_2ghz.sh adb -s YOUR_SERIAL shell su -c "cp /sdcard/hotspot_2ghz.sh /data/adb/service.d/hotspot_2ghz.sh" adb -s YOUR_SERIAL shell chmod 755 /data/adb/service.d/hotspot_2ghz.sh adb -s YOUR_SERIAL shell cat /data/adb/service.d/hotspot_2ghz.sh

The last command should print the script contents confirming it was saved correctly.

Step 10 — Test and Verify


  1. Reboot the mirror:

    Code:

    adb -s YOUR_SERIAL reboot

  2. Wait approximately 40 seconds for the device to fully boot and for the script to run.
  3. On your phone scan for WiFi networks. You should see your SSID broadcasting.
  4. Connect and verify it shows as 2.4GHz in your phone's WiFi settings.
  5. Reboot a second time to confirm it's not a fluke. Should be 2.4GHz every time.

Key Discoveries Specific to This Device

  • BROM trigger: 'adb shell reboot autodloader' — no physical PCB access or volume buttons needed. This command exists in the device's uboot and triggers the SPRD bootrom download mode.
  • ADB Root PIN: 2846 — used to enable root ADB access in Developer Options.
  • The device reports Android 12 but is actually Android 14 underneath (build fingerprint contains :14/).
  • The hotspot band is hardcoded in /data/vendor/wifi/hostapd/hostapd_wlan2.conf — the XML setting is ignored. Only cmd wifi start-softap with -b 2 flag reliably forces 2.4GHz.
  • persist.sys.hotspot.band=2 and persist.sys.hotspot.name/password control the SSID and password displayed in Settings but not the actual radio band without root.



Credits
This post was last modified: 08-07-2026, 08:20 AM by hovatek.
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
Reply
Reply
 View a Printable Version
Users browsing this thread:
 1 Guest(s)
Users browsing this thread:
 1 Guest(s)