162 字
1 分钟
CVE-2022-38694 紫光展锐解锁BL
几个月前二手淘了一个二手外版酷比魔方iPlay 50。Unisoc T618，4GB RAM，自带系统太卡了，打算解个BL先。
我没有Windows环境，使用Ubuntu：
sudo apt-get install build-essential libusb-1.0-0-dev gitgit clone --recursive https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader.gitcd CVE-2022-38694_unlock_bootloadergcc chsize.c -o chsizegcc gen_spl-unlock.c -o gen_spl-unlockgcc gen_spl-unlock-legacy.c -o gen_spl-unlock-legacycd spreadtrum_flashmake会得到chsize、gen_spl-unlock、spd_dump。
在Release下载对应的设备的固件，我使用这个，下载，解压
将前面编译获得的chsize、gen_spl-unlock、spd_dump复制到刚刚解压的文件夹根目录。
创建以下脚本：
#!/bin/bash
# 检查是否存在已签名的 SPLif [ ! -f "u-boot-spl-16k-sign.bin" ]; then # 第一次运行：读取原始数据并准备解锁文件 ./spd_dump --wait 300 exec_addr 0x3ee8 fdl fdl1-dl.bin 0x5500 fdl fdl2-dl.bin 0x9efffe00 exec r splloader r uboot e splloader e splloader_bak reset
echo "(这是提示而非错误) 如果看到 'find port failed'，请直接关闭并重新运行此脚本。" read -p "按回车键继续..."
./gen_spl-unlock splloader.bin
# 检查上一个命令是否成功 (相当于 !errorlevel! equ 0) if [ $? -eq 0 ]; then mv "splloader.bin" "u-boot-spl-16k-sign.bin" ./chsize uboot.bin mv uboot.bin uboot_bak.bin fi read -p "按回车键继续..."else # 如果已经有签名文件，直接执行擦除 ./spd_dump --wait 300 exec_addr 0x3ee8 fdl fdl1-dl.bin 0x5500 fdl fdl2-dl.bin 0x9efffe00 exec e splloader e splloader_bak reset echo "(这是提示而非错误) 如果看到 'find port failed'，请直接关闭并重新运行此脚本。" read -p "按回车键继续..."fi
# 写入 cboot./spd_dump --wait 300 exec_addr 0x3ee8 fdl fdl1-dl.bin 0x5500 fdl fdl2-dl.bin 0x9efffe00 exec w uboot fdl2-cboot.bin reset
echo "等待 10 秒供设备响应..."sleep 10
# 执行解锁操作 (可能需要运行两次)./spd_dump exec_addr 0x3ee8 fdl spl-unlock.bin 0x5500
# 检查解锁状态 (如果获取到 64 个 0 则仍锁定；如果是 32 位字符串 + 哈希则已解锁)./spd_dump exec_addr 0x3ee8 fdl fdl1-dl.bin 0x5500 fdl fdl2-dl.bin 0x9efffe00 exec verbose 2 read_part miscdata 8192 64 m.bin resetread -p "检查 m.bin 后按回车键继续..."
# 还原 SPL 和 Uboot./spd_dump exec_addr 0x3ee8 fdl fdl1-dl.bin 0x5500 fdl fdl2-dl.bin 0x9efffe00 exec r boot w splloader u-boot-spl-16k-sign.bin w uboot uboot_bak.bin w misc misc-wipe.bin reset
read -p "脚本执行完毕。按回车键退出..."需要使用Root权限执行：
sudo ./unlock.sh按组合键(iPlay 50 是 电源+音量加 7秒)
chao@pearfish:~/ums512_alldocube_iplay_50_EN_20230801$ sudo ./unlock.shbranch:HEAD, sha1:f2fc779210d9e4b5ca1904c79a49cc5e114b58f3Waiting for dl_diag connection (300s)libusb_control_transfer okCHECK_BAUD bootromBSL_REP_VER: "SPRD3\0"CMD_CONNECT bootromcurrent exec_addr is 0x3ee8SEND fdl1-dl.bin to 0x5500SEND custom_exec_no_verify_3ee8.bin to 0x3ee8EXEC FDL1usb_recv failed : LIBUSB_ERROR_TIMEOUTCHECK_BAUD FAILCHECK_BAUD FDL1BSL_REP_VER: "Spreadtrum Boot Block version 1.1\0"CMD_CONNECT FDL1KEEP_CHARGE FDL1SEND fdl2-dl.bin to 0x9efffe00FDL2: incompatible partitionEXEC FDL2usb_recv failed : LIBUSB_ERROR_TIMEOUTDISABLE_TRANSCODEReading Partition List[===== ] 12.5%[========== ] 25.0%[=============== ] 37.5%[==================== ] 50.0%[========================= ] 62.5%[============================== ] 75.0%[=================================== ] 87.5%[========================================] 100.0%Read Part Done: user_partition+0x0, target: 0x8000, read: 0x8000 0 splloader 256KB 1 prodnv 10MB 2 miscdata 1MB 3 misc 1MB 4 trustos_a 6MB 5 trustos_b 6MB 6 sml_a 1MB 7 sml_b 1MB 8 uboot_a 3MB 9 uboot_b 3MB 10 uboot_log 4MB 11 logo 8MB 12 fbootlogo 8MB 13 l_fixnv1_a 2MB 14 l_fixnv2_a 2MB 15 l_fixnv1_b 2MB 16 l_fixnv2_b 2MB 17 l_runtimenv1 2MB 18 l_runtimenv2 2MB 19 gnssmodem_a 1MB 20 gnssmodem_b 1MB 21 wcnmodem_a 10MB 22 wcnmodem_b 10MB 23 persist 2MB 24 l_modem_a 25MB 25 l_modem_b 25MB 26 l_deltanv_a 1MB 27 l_deltanv_b 1MB 28 l_gdsp_a 10MB 29 l_gdsp_b 10MB 30 l_ldsp_a 20MB 31 l_ldsp_b 20MB 32 l_agdsp_a 6MB 33 l_agdsp_b 6MB 34 l_cdsp_a 1MB 35 l_cdsp_b 1MB 36 pm_sys_a 1MB 37 pm_sys_b 1MB 38 teecfg_a 1MB 39 teecfg_b 1MB 40 hypervsior_a 10MB 41 hypervsior_b 10MB 42 boot_a 64MB 43 boot_b 64MB 44 vendor_boot_a 100MB 45 vendor_boot_b 100MB 46 init_boot_a 8MB 47 init_boot_b 8MB 48 dtb_a 8MB 49 dtb_b 8MB 50 dtbo_a 8MB 51 dtbo_b 8MB 52 super 5600MB 53 cache 100MB 54 vbmeta_a 1MB 55 vbmeta_b 1MB 56 metadata 16MB 57 sysdumpdb 10MB 58 vbmeta_system_a 1MB 59 vbmeta_system_b 1MB 60 vbmeta_vendor_a 1MB 61 vbmeta_vendor_b 1MB 62 vbmeta_system_ext_a 1MB 63 vbmeta_system_ext_b 1MB 64 vbmeta_product_a 1MB 65 vbmeta_product_b 1MB 66 vbmeta_odm_a 1MB 67 vbmeta_odm_b 1MB 68 avbmeta_rs_a 1MB 69 avbmeta_rs_b 1MB 70 common_rs1_a 8MB 71 common_rs1_b 8MB 72 common_rs2_a 16MB 73 common_rs2_b 16MB 74 userdata 53243MBstandard gpt table saved to pgpt.binskip saving sprd partition list packetpartition list saved to partition_1772917064.xmlTotal number of partitions: 74Storage is emmcENABLE_WRITE_RAW_DATADevice is using slot b[========= ] 24.2%[=================== ] 48.4%[============================= ] 72.7%[====================================== ] 96.9%[========================================] 100.0%Read Part Done: splloader+0x0, target: 0x40000, read: 0x40000[= ] 4.0%[== ] 6.1%[=== ] 8.1%[==== ] 10.1%[===== ] 14.1%[====== ] 16.1%[======= ] 18.2%[======== ] 20.2%[========= ] 24.2%[========== ] 26.2%[=========== ] 28.3%[============ ] 30.3%[============= ] 34.3%[============== ] 36.3%[=============== ] 38.3%[================ ] 40.4%[================= ] 44.4%[================== ] 46.4%[=================== ] 48.4%[==================== ] 50.5%[===================== ] 54.5%[====================== ] 56.5%[======================= ] 58.5%[======================== ] 60.5%[========================= ] 62.6%[========================== ] 66.6%[=========================== ] 68.6%[============================ ] 70.6%[============================= ] 72.7%[============================== ] 76.7%[=============================== ] 78.7%[================================ ] 80.7%[================================= ] 82.7%[================================== ] 86.8%[=================================== ] 88.8%[==================================== ] 90.8%[===================================== ] 92.8%[====================================== ] 96.9%[======================================= ] 98.9%[========================================] 100.0%Read Part Done: uboot_b+0x0, target: 0x300000, read: 0x300000Erase Part Done: splloaderErase Part Done: splloader_bak(这是提示而非错误) 如果看到 'find port failed'，请直接关闭并重新运行此脚本。按回车键继续...0xf9f40xdb1f4按回车键继续...branch:HEAD, sha1:f2fc779210d9e4b5ca1904c79a49cc5e114b58f3Waiting for dl_diag connection (300s)libusb_control_transfer okCHECK_BAUD bootromBSL_REP_VER: "SPRD3\0"CMD_CONNECT bootromcurrent exec_addr is 0x3ee8SEND fdl1-dl.bin to 0x5500SEND custom_exec_no_verify_3ee8.bin to 0x3ee8EXEC FDL1usb_recv failed : LIBUSB_ERROR_TIMEOUTCHECK_BAUD FAILCHECK_BAUD FDL1BSL_REP_VER: "Spreadtrum Boot Block version 1.1\0"CMD_CONNECT FDL1KEEP_CHARGE FDL1SEND fdl2-dl.bin to 0x9efffe00FDL2: incompatible partitionEXEC FDL2usb_recv failed : LIBUSB_ERROR_TIMEOUTDISABLE_TRANSCODEReading Partition List[===== ] 12.5%[========== ] 25.0%[=============== ] 37.5%[==================== ] 50.0%[========================= ] 62.5%[============================== ] 75.0%[=================================== ] 87.5%[========================================] 100.0%Read Part Done: user_partition+0x0, target: 0x8000, read: 0x8000 0 splloader 256KB 1 prodnv 10MB 2 miscdata 1MB 3 misc 1MB 4 trustos_a 6MB 5 trustos_b 6MB 6 sml_a 1MB 7 sml_b 1MB 8 uboot_a 3MB 9 uboot_b 3MB 10 uboot_log 4MB 11 logo 8MB 12 fbootlogo 8MB 13 l_fixnv1_a 2MB 14 l_fixnv2_a 2MB 15 l_fixnv1_b 2MB 16 l_fixnv2_b 2MB 17 l_runtimenv1 2MB 18 l_runtimenv2 2MB 19 gnssmodem_a 1MB 20 gnssmodem_b 1MB 21 wcnmodem_a 10MB 22 wcnmodem_b 10MB 23 persist 2MB 24 l_modem_a 25MB 25 l_modem_b 25MB 26 l_deltanv_a 1MB 27 l_deltanv_b 1MB 28 l_gdsp_a 10MB 29 l_gdsp_b 10MB 30 l_ldsp_a 20MB 31 l_ldsp_b 20MB 32 l_agdsp_a 6MB 33 l_agdsp_b 6MB 34 l_cdsp_a 1MB 35 l_cdsp_b 1MB 36 pm_sys_a 1MB 37 pm_sys_b 1MB 38 teecfg_a 1MB 39 teecfg_b 1MB 40 hypervsior_a 10MB 41 hypervsior_b 10MB 42 boot_a 64MB 43 boot_b 64MB 44 vendor_boot_a 100MB 45 vendor_boot_b 100MB 46 init_boot_a 8MB 47 init_boot_b 8MB 48 dtb_a 8MB 49 dtb_b 8MB 50 dtbo_a 8MB 51 dtbo_b 8MB 52 super 5600MB 53 cache 100MB 54 vbmeta_a 1MB 55 vbmeta_b 1MB 56 metadata 16MB 57 sysdumpdb 10MB 58 vbmeta_system_a 1MB 59 vbmeta_system_b 1MB 60 vbmeta_vendor_a 1MB 61 vbmeta_vendor_b 1MB 62 vbmeta_system_ext_a 1MB 63 vbmeta_system_ext_b 1MB 64 vbmeta_product_a 1MB 65 vbmeta_product_b 1MB 66 vbmeta_odm_a 1MB 67 vbmeta_odm_b 1MB 68 avbmeta_rs_a 1MB 69 avbmeta_rs_b 1MB 70 common_rs1_a 8MB 71 common_rs1_b 8MB 72 common_rs2_a 16MB 73 common_rs2_b 16MB 74 userdata 53243MBstandard gpt table saved to pgpt.binskip saving sprd partition list packetpartition list saved to partition_1772917079.xmlTotal number of partitions: 74Storage is emmcENABLE_WRITE_RAW_DATADevice is using slot bfile size : 0xf0ba4[== ] 6.4%[===== ] 12.9%[======= ] 19.3%[========== ] 25.8%[============ ] 32.2%[=============== ] 38.6%[================== ] 45.1%[==================== ] 51.5%[======================= ] 57.9%[========================= ] 64.4%[============================ ] 70.8%[============================== ] 77.3%[================================= ] 83.7%[==================================== ] 90.1%[====================================== ] 96.6%[========================================] 100.0%Write Part Done: uboot_b, target: 0xf0ba4, written: 0xf0ba4等待 10 秒供设备响应...branch:HEAD, sha1:f2fc779210d9e4b5ca1904c79a49cc5e114b58f3Waiting for dl_diag connection (30s)libusb_control_transfer okCHECK_BAUD bootromBSL_REP_VER: "SPRD3\0"CMD_CONNECT bootromcurrent exec_addr is 0x3ee8SEND spl-unlock.bin to 0x5500SEND custom_exec_no_verify_3ee8.bin to 0x3ee8EXEC FDL1usb_recv failed : LIBUSB_ERROR_IOCHECK_BAUD FAILusb_send failed : LIBUSB_ERROR_IObranch:HEAD, sha1:f2fc779210d9e4b5ca1904c79a49cc5e114b58f3Waiting for dl_diag connection (30s)libusb_control_transfer failed : LIBUSB_ERROR_IO检查 m.bin 后按回车键继续...branch:HEAD, sha1:f2fc779210d9e4b5ca1904c79a49cc5e114b58f3Waiting for dl_diag connection (30s)libusb_control_transfer okCHECK_BAUD bootromBSL_REP_VER: "SPRD3\0"CMD_CONNECT bootromcurrent exec_addr is 0x3ee8SEND fdl1-dl.bin to 0x5500SEND custom_exec_no_verify_3ee8.bin to 0x3ee8EXEC FDL1usb_recv failed : LIBUSB_ERROR_TIMEOUTCHECK_BAUD FAILCHECK_BAUD FDL1BSL_REP_VER: "Spreadtrum Boot Block version 1.1\0"CMD_CONNECT FDL1KEEP_CHARGE FDL1SEND fdl2-dl.bin to 0x9efffe00FDL2: incompatible partitionEXEC FDL2usb_recv failed : LIBUSB_ERROR_TIMEOUTDISABLE_TRANSCODEReading Partition List[===== ] 12.5%[========== ] 25.0%[=============== ] 37.5%[==================== ] 50.0%[========================= ] 62.5%[============================== ] 75.0%[=================================== ] 87.5%[========================================] 100.0%Read Part Done: user_partition+0x0, target: 0x8000, read: 0x8000 0 splloader 256KB 1 prodnv 10MB 2 miscdata 1MB 3 misc 1MB 4 trustos_a 6MB 5 trustos_b 6MB 6 sml_a 1MB 7 sml_b 1MB 8 uboot_a 3MB 9 uboot_b 3MB 10 uboot_log 4MB 11 logo 8MB 12 fbootlogo 8MB 13 l_fixnv1_a 2MB 14 l_fixnv2_a 2MB 15 l_fixnv1_b 2MB 16 l_fixnv2_b 2MB 17 l_runtimenv1 2MB 18 l_runtimenv2 2MB 19 gnssmodem_a 1MB 20 gnssmodem_b 1MB 21 wcnmodem_a 10MB 22 wcnmodem_b 10MB 23 persist 2MB 24 l_modem_a 25MB 25 l_modem_b 25MB 26 l_deltanv_a 1MB 27 l_deltanv_b 1MB 28 l_gdsp_a 10MB 29 l_gdsp_b 10MB 30 l_ldsp_a 20MB 31 l_ldsp_b 20MB 32 l_agdsp_a 6MB 33 l_agdsp_b 6MB 34 l_cdsp_a 1MB 35 l_cdsp_b 1MB 36 pm_sys_a 1MB 37 pm_sys_b 1MB 38 teecfg_a 1MB 39 teecfg_b 1MB 40 hypervsior_a 10MB 41 hypervsior_b 10MB 42 boot_a 64MB 43 boot_b 64MB 44 vendor_boot_a 100MB 45 vendor_boot_b 100MB 46 init_boot_a 8MB 47 init_boot_b 8MB 48 dtb_a 8MB 49 dtb_b 8MB 50 dtbo_a 8MB 51 dtbo_b 8MB 52 super 5600MB 53 cache 100MB 54 vbmeta_a 1MB 55 vbmeta_b 1MB 56 metadata 16MB 57 sysdumpdb 10MB 58 vbmeta_system_a 1MB 59 vbmeta_system_b 1MB 60 vbmeta_vendor_a 1MB 61 vbmeta_vendor_b 1MB 62 vbmeta_system_ext_a 1MB 63 vbmeta_system_ext_b 1MB 64 vbmeta_product_a 1MB 65 vbmeta_product_b 1MB 66 vbmeta_odm_a 1MB 67 vbmeta_odm_b 1MB 68 avbmeta_rs_a 1MB 69 avbmeta_rs_b 1MB 70 common_rs1_a 8MB 71 common_rs1_b 8MB 72 common_rs2_a 16MB 73 common_rs2_b 16MB 74 userdata 53243MBstandard gpt table saved to pgpt.binskip saving sprd partition list packetpartition list saved to partition_1772917112.xmlTotal number of partitions: 74Storage is emmcENABLE_WRITE_RAW_DATADevice is using slot b[= ] 2.6%[== ] 5.0%[=== ] 7.6%[==== ] 10.0%[===== ] 12.6%[====== ] 15.0%[======= ] 17.5%[======== ] 20.1%[========= ] 22.5%[========== ] 25.1%[=========== ] 27.5%[============ ] 30.1%[============= ] 32.5%[============== ] 35.0%[=============== ] 37.6%[================ ] 40.0%[================= ] 42.6%[================== ] 45.0%[=================== ] 47.6%[==================== ] 50.0%[===================== ] 52.5%[====================== ] 55.1%[======================= ] 57.5%[======================== ] 60.1%[========================= ] 62.5%[========================== ] 65.1%[=========================== ] 67.5%[============================ ] 70.0%[============================= ] 72.6%[============================== ] 75.0%[=============================== ] 77.6%[================================ ] 80.0%[================================= ] 82.6%[================================== ] 85.0%[=================================== ] 87.5%[==================================== ] 90.1%[===================================== ] 92.5%[====================================== ] 95.1%[======================================= ] 97.5%[========================================] 100.0%Read Part Done: boot_b+0x0, target: 0x4000000, read: 0x4000000file size : 0xf9f4[======================================= ] 99.2%[========================================] 100.0%Write Part Done: splloader, target: 0xf9f4, written: 0xf9f4file size : 0xdb1f4[== ] 7.1%[===== ] 14.1%[======== ] 21.2%[=========== ] 28.3%[============== ] 35.4%[================ ] 42.4%[=================== ] 49.5%[====================== ] 56.6%[========================= ] 63.7%[============================ ] 70.7%[=============================== ] 77.8%[================================= ] 84.9%[==================================== ] 92.0%[======================================= ] 99.0%[========================================] 100.0%Write Part Done: uboot_b, target: 0xdb1f4, written: 0xdb1f4file size : 0x800[========================================] 100.0%Write Part Done: misc, target: 0x800, written: 0x800脚本执行完毕。按回车键退出...
好像有个python工具一键解锁，没有尝试过。
分享
如果这篇文章对你有帮助，欢迎分享给更多人！
CVE-2022-38694 紫光展锐解锁BL
https://blog.chaomixian.top/posts/cve-2022-38694-unisoc-unlock-bootloader/ 部分信息可能已经过时
相关文章 智能推荐