{"vulnerability": "CVE-2022-3869", "sightings": [{"uuid": "da9f2989-1972-4c94-91a3-9fc95ec3595b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "MISP/71f05cce-2beb-4b80-8496-bbbabc032544", "content": "", "creation_timestamp": "2025-08-25T18:31:44.000000Z"}, {"uuid": "acbbf6da-a241-42e6-b59a-47b24af083e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38692", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrapxvbes2n", "content": "", "creation_timestamp": "2025-09-01T09:05:23.006611Z"}, {"uuid": "9e6de535-af44-42c5-acf5-28b48b533e28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38696", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxraw6r4m727", "content": "", "creation_timestamp": "2025-09-01T09:08:51.241779Z"}, {"uuid": "675dde4e-7159-49a5-888b-59d4f85cad5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38691", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrbay2bbr2j", "content": "", "creation_timestamp": "2025-09-01T09:14:53.418242Z"}, {"uuid": "accfa90f-9c8d-42f6-afeb-2dba2bf199ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38695", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrbjlrz6b2p", "content": "", "creation_timestamp": "2025-09-01T09:19:42.534760Z"}, {"uuid": "d94fd6d8-71b6-4408-9612-346319601569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrbzt6m2w2p", "content": "", "creation_timestamp": "2025-09-01T09:28:47.026447Z"}, {"uuid": "db42b64f-d80f-4fa7-8cde-0ffcc4130cb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38693", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lxrcak32mx2j", "content": "", "creation_timestamp": "2025-09-01T09:32:32.487491Z"}, {"uuid": "a01cb331-cfb4-45bf-b6db-5790c7eb6304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38691", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lxuzbcfd7e2b", "content": "", "creation_timestamp": "2025-09-02T21:02:33.230468Z"}, {"uuid": "70be1ab6-687e-4893-8dfc-bb0bfee8226c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lxuzbchzfb2h", "content": "", "creation_timestamp": "2025-09-02T21:02:33.717745Z"}, {"uuid": "5c336336-53b5-4c65-aa74-9d30dba49995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3869", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/15002", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-3869\n\ud83d\udd25 CVSS Score: 6.5 (cvssV3_0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)\n\ud83d\udd39 Description: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.\n\ud83d\udccf Published: 2022-11-05T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-05T20:27:55.467Z\n\ud83d\udd17 References:\n1. https://huntr.dev/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b\n2. https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8", "creation_timestamp": "2025-05-05T21:20:19.000000Z"}, {"uuid": "dccff8d0-5468-4a02-b0eb-8b9df4fccbe7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/EzuQ9yJQ0BDBizBVHWkFbV5Hyu7-8u0_pTdMQoCrlzwd", "content": "", "creation_timestamp": "2023-12-29T01:57:19.000000Z"}, {"uuid": "f60e8950-c9f4-470c-bc62-fd7aec94fa94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3085", "content": "25 Tools \ud83d\udd27  \ud83d\udd28\ud83d\udd27 - Hackers Factory\n\n\u200b\u200bPython3 C2 Course Code Modules\n\n\u2022 SMTP Module\n\u2022 File Transfer Module\n\u2022 Securing Your Payload Channels\n\nhttps://github.com/dievus/Python3-C2-Course-Code-Modules\n\n#infosec #pentesting #redteam\n\n\u200b\u200bRedTeamScripts\n\nThis repo will contain some random Red Team Scripts that I made that can be useful for others.\n\nhttps://github.com/api0cradle/RedTeamScripts\n\n#infosec #pentesting #redteam\n\n\u200b\u200bHBSQLI\n\nAutomated tool for testing header based blind sql injection.\n\nhttps://github.com/SAPT01/HBSQLI\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bCVE-2022-38694\n\nAn attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges.\n\nhttps://github.com/TomKing062/CVE-2022-38694_unlock_bootloader\n\n#cve #cybersecurity #infosec\n\n\u200b\u200bDopamine\n\nA semi-untethered permasigned jailbreak for iOS 15\n\nhttps://github.com/opa334/Dopamine\n\n#cybersecurity #infosec\n\n\u200b\u200bebpfmon\n\nA tool for monitoring eBPF programs. It is designed to be used with bpftool from the linux kernel. ebpfmon is a TUI (terminal UI) application written in Go that allows you to do real-time monitoring of eBPF programs.\n\nhttps://github.com/redcanaryco/ebpfmon\n\n#cybersecurity #infosec\n\n\u200b\u200bBaseComp\n\nA Comparative Analysis for Integrity Protection in Cellular Baseband Software\n\nhttps://github.com/kaist-hacking/BaseComp\n\n#cybersecurity #infosec\n\n\u200b\u200bZehef\n\nA osint tool who studies the emails \ud83d\udce9\n\nhttps://github.com/N0rz3/Zehef\n\n#OSINT #cybersecurity #infosec\n\n\u200b\u200bgzip-js-injector\n\nGZIP Page Zero Overhead Injection.\n\nhttps://github.com/EtherDream/gzip-js-injector\n\n#infosec #pentesting #redteam\n\n\u200b\u200btelegram-tracker\n\nThe package connects to Telegram's API to generate JSON files containing data for channels, including information and posts. It allows you to search for specific channels or a set of channels provided in a text file, with one channel per line.\n\nhttps://github.com/estebanpdl/telegram-tracker\n\n#OSINT #cybersecurity #infosec\n\n\u200b\u200bOne-Liner-Collections\n\nThis Repositories contains list of One Liners with Descriptions and Installation requirements.\nhttps://github.com/thecybertix/One-Liner-Collections\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bPayloads All The PDFs\n\nA list of crafted malicious PDF files to test the security of PDF readers and tools.\n\nhttps://github.com/luigigubello/PayloadsAllThePDFs\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200busb-sniffer\n\nLow-cost LS/FS/HS USB sniffer with Wireshark interface. This sniffer can be used standalone from a command line or as a plugin for Wireshark with direct control from the UI. Either way, the capture is saved in a standard PcapNG format.\n\nhttps://github.com/ataradov/usb-sniffer\n\n#cybersecurity #infosec #pentesting\n\n\u200b\u200bNucleiFuzzer \n\nA powerful automation tool for detecting xss,sqli,ssrf,open-redirect..etc vulnerabilities in web applications.\n\nhttps://github.com/0xKayala/NucleiFuzzer\n\n#infosec #pentesting #bugbounty\n\n\u200b\u200bAirGuard\n\nProtect yourself from being tracked \ud83c\udf0d by #AirTags \ud83c\udff7 and Find My accessories \ud83d\udccd\n\nhttps://github.com/seemoo-lab/AirGuard\n\n\u200b\u200bVulnerability_PoC\n\nThe PoC/Exploit of some interesting vulnerabilities.\n\nhttps://github.com/numencyber/Vulnerability_PoC\n\n#cybersecurity #infosec\n\n\u200b\u200bSecurity Research\n\nThis project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.\n\nhttps://github.com/google/security-research\n\n#cve #cybersecurity #infosec\n\n\u200b\u200bPHP Cookie Stealer\n\nThis project is a simple PHP script used to demonstrate how an attacker can steal cookies. It captures the victim's cookie, IP address, user agent, and geographical details, and then logs this information.\n\nhttps://github.com/noxvix/Xss-Exploitation\n\n#infosec #pentesting #redteam\n\n\u200b\u200bCVE-2023-23333\n\nSolarView Compact through 6.00 downloader.php commands injection (RCE) nuclei-templates.\n\nhttps://github.com/Mr-xn/CVE-2023-23333\n\n#cve #cybersecurity #infosec\n\n1/2", "creation_timestamp": "2023-06-18T13:18:19.000000Z"}, {"uuid": "21a59186-1329-453d-af04-fb7d6e2bb1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3869", "type": "seen", "source": "https://t.me/cibsecurity/52576", "content": "\u203c CVE-2022-3869 \u203c\n\nCode Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-06T06:07:15.000000Z"}, {"uuid": "78368ec5-cf54-4a7b-b457-1424bbdd3a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38690", "type": "seen", "source": "https://t.me/cibsecurity/51488", "content": "\u203c CVE-2022-38690 \u203c\n\nIn camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-14T22:29:08.000000Z"}, {"uuid": "91a1f3e6-a869-4bad-b4be-2362650fa48f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38698", "type": "seen", "source": "https://t.me/cibsecurity/51482", "content": "\u203c CVE-2022-38698 \u203c\n\nIn messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-14T22:28:59.000000Z"}, {"uuid": "d2528c1e-b2e2-49aa-84cd-583cecd56dbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/14701", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-38694_unlock_bootloader*\nGithub: https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader", "creation_timestamp": "2026-07-31T00:00:28.989431Z"}, {"uuid": "913643ff-67bd-42b8-af5b-5e0db6e08c35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/8497", "content": "#exploit\n1. CVE-2023-32571:\nDynamic Linq Injection RCE Vulnerability\nhttps://research.nccgroup.com/2023/06/13/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571\n\n2. CVE-2022-38694:\nUnisoc T7510 - Unlock bootloader\nhttps://github.com/TomKing062/CVE-2022-38694_unlock_bootloader", "creation_timestamp": "2023-06-16T11:01:01.000000Z"}, {"uuid": "0dafdb4c-3c09-4af5-822d-2634f6070e44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "Telegram/59qmJbxlXRw1hpXLsNomAnJqLLMJaCeoeuKXV4P1Fhmqb-w", "content": "", "creation_timestamp": "2026-08-29T23:00:05.870872Z"}, {"uuid": "7dce79e3-51b6-4739-8f85-3ac3b3751e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/4tIKexrP1B7eYtOW91-QaKQ8EIqNMri3pu2C_JIQ1mA899I", "content": "", "creation_timestamp": "2026-05-15T03:00:06.000000Z"}, {"uuid": "baf9644c-b95f-40e9-bf2f-1ee5b680b34d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/M2s3PphtTCD9brru-X6QMyPesFMqQlhfbVnnLWpusEfiV5g", "content": "", "creation_timestamp": "2026-05-16T21:00:04.000000Z"}, {"uuid": "fd0f14b0-a4e6-4639-8118-6af48604181e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/2btQq9dbgP-EBv9XDOu_5aTwBC9BvHEou5cl2RBPGXXgLCY", "content": "", "creation_timestamp": "2026-05-16T19:00:08.000000Z"}, {"uuid": "d2affc69-2d6a-4f57-bc37-4ce80ea8b177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "Telegram/UOEqxw8X8FBF5SdoLVIwOK-ODKVahezuJQZvJqlgU47R468", "content": "", "creation_timestamp": "2026-05-31T21:00:04.000000Z"}, {"uuid": "23fb989b-e8b6-4bde-b522-2959861372b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY", "content": "", "creation_timestamp": "2026-06-12T21:00:04.000000Z"}, {"uuid": "baac96f0-6252-4a7a-865b-c492286e4ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/7uD_3sOy1EJ9yln05cLAyZKCCBh0NqteygAAuPkhMVWVzSg", "content": "", "creation_timestamp": "2026-06-12T19:00:12.000000Z"}, {"uuid": "a01e9b49-c902-4eab-8c5a-a14c56ab6ead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/yH0XhfWqkuNLj6YQvCrDlaRCWGJc-BvLoJvLCEGvyWoy79M", "content": "", "creation_timestamp": "2026-08-18T10:00:03.738328Z"}, {"uuid": "0f60f121-381c-4a65-b843-6e4aaf10c14c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88504", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ROOT-ZTE-X1001\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sloden1977-lang\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-12 15:00:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMagisk root guide for ZTE Blade X1001 (Android 15, Unisoc UMS9230) using CVE-2022-38694 exploit. Contributions and screenshots welcome.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T06:00:04.609772Z"}, {"uuid": "cf41b0f6-91d0-46bd-937f-ba2364ea229f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "published-proof-of-concept", "source": "Telegram/59qmJbxlXRw1hpXLsNomAnJqLLMJaCeoeuKXV4P1Fhmqb-w", "content": "", "creation_timestamp": "2026-08-31T00:00:50.741734Z"}, {"uuid": "fd47c93f-4140-4a10-8a34-3d04530120a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://t.me/CVEhub/14701", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-38694_unlock_bootloader*\nGithub: https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader", "creation_timestamp": "2026-07-29T12:00:25.243457Z"}, {"uuid": "ad52ce1e-3758-47a2-af81-d49c14321e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://t.me/hacking_Attack/189093", "content": "Analysis of Spreadtrum Longcheer chipsets\nhttps://www.reddit.com/r/Pentesting/comments/1uwxt60/analysis_of_spreadtrum_longcheer_chipsets/\n\nThis report details a systemic security failure affecting millions of budget Android devices deployed across Latin America. The vulnerability is not a single software bug but a deliberate supply chain deception orchestrated by ODM Longcheer and SoC vendor Unisoc, facilitated by OEM Motorola. The core issue involves a hardcoded fscrypt provisioning bypass triggered by LCD ID lcd_td4168 and key 56ef134d... that allows the distribution of fraudulent security updates. These updates spoof the security patch level claiming \"April 2026\" while running vulnerable binaries from \"March 2026\", masking critical flaws like CVE-2021-39658 ismsEx, CVE-2022-38694 BootROM, and exported backdoors in com.spreadtrum.sgps. This architecture creates a permanent attack surface that facilitates active financial fraud PIX hijacking, surveillance, and enterprise network compromise in the Latin American region, where these devices dominate the market.  The Attack Chain: \"Silent Rescue\"  The risk is compounded by a chain of vulnerabilities that work in concert: Hardware Root Unpatchable: CVE-2022-38694 in the Unisoc BootROM allows permanent bypass of Secure Boot via physical USB access. Public tools spd_dump exist. Remote Entry Network: CVE-2025-31718 Modem RCE allows remote code execution via rogue cell towers IMSI catchers, common in urban LATAM centers. Privilege Escalation Zero-Permission: CVE-2021-39658 ismsEx service allows any app to send SMS or modify system properties without permissions, bypassing Android 2FA. System Backdoors Exported Components: com.spreadtrum.sgps exposes location tracking and system controls via dialer codes _#_#2266#_#_. Payload Delivery Silent Installers: Pre-installed system apps com.dti.amx Digital Turbine and com.inmobi.installer hold INSTALL_PACKAGES, allowing silent installation of banking trojans e.g., PixRevolution without user consent. The Cover-Up FOTA Spoofing: The fscrypt bypass injects a fake ro.build.version.security_patch string, tricking users, banks, and MDM systems into believing the device is secure.  Critical Risk to Latin America LATAM  The impact on Latin America is disproportionate and severe due to market dynamics and reliance on mobile finance. A. Market Dominance of Vulnerable Devices Ubiquity: Unisoc T606/T616 chipsets power the best-selling budget devices in the region Motorola Moto G04s, G24, Infinix, Tecno. Search results confirm Unisoc's aggressive expansion in LATAM, with over 100 5G devices deployed in the region by 2025. Demographic Impact: These devices are the primary computing tool for unbanked and underbanked populations who rely exclusively on smartphones for government aid, commerce, and banking. B. Direct Threat to Financial Infrastructure PIX & Billetera M\u00f3vil Active Exploitation: The PixRevolution trojan identified March 2026 actively hijacks PIX instant payments in Brazil by overlaying fake screens and diverting funds in real-time. The Enabler: The vulnerabilities in this report ismsEx SMS bypass, INSTALL_PACKAGES silent installer, exported SGPS location tracking provide the perfect infrastructure for such malware to operate undetected. 2FA Bypass: CVE-2021-39658 allows malware to read or intercept SMS verification codes without permission, rendering traditional 2FA useless for banking apps. C. Enterprise & Supply Chain Risk MDM Evasion: Corporate Mobile Device Management MDM systems rely on the security_patch string to enforce compliance. The FOTA spoofing mechanism ensures that compromised devices report \"Compliant\" status while running vulnerable firmware, allowing them to bypass corporate security gates. Data Exfiltration: The com.motorola.bach.modemstats service with READ_LOGS and MANAGE_NETWORK_POLICY can be weaponized to exfiltrate corporate data over hidden backchannels that ignore data usage limits. D. The \"Fake Patch\"", "creation_timestamp": "2026-09-01T20:00:06.648853Z"}, {"uuid": "5bde056f-3f24-4312-a166-9561215e30aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "exploited", "source": "https://t.me/hacking_Attack/189093", "content": "Analysis of Spreadtrum Longcheer chipsets\nhttps://www.reddit.com/r/Pentesting/comments/1uwxt60/analysis_of_spreadtrum_longcheer_chipsets/\n\nThis report details a systemic security failure affecting millions of budget Android devices deployed across Latin America. The vulnerability is not a single software bug but a deliberate supply chain deception orchestrated by ODM Longcheer and SoC vendor Unisoc, facilitated by OEM Motorola. The core issue involves a hardcoded fscrypt provisioning bypass triggered by LCD ID lcd_td4168 and key 56ef134d... that allows the distribution of fraudulent security updates. These updates spoof the security patch level claiming \"April 2026\" while running vulnerable binaries from \"March 2026\", masking critical flaws like CVE-2021-39658 ismsEx, CVE-2022-38694 BootROM, and exported backdoors in com.spreadtrum.sgps. This architecture creates a permanent attack surface that facilitates active financial fraud PIX hijacking, surveillance, and enterprise network compromise in the Latin American region, where these devices dominate the market.  The Attack Chain: \"Silent Rescue\"  The risk is compounded by a chain of vulnerabilities that work in concert: Hardware Root Unpatchable: CVE-2022-38694 in the Unisoc BootROM allows permanent bypass of Secure Boot via physical USB access. Public tools spd_dump exist. Remote Entry Network: CVE-2025-31718 Modem RCE allows remote code execution via rogue cell towers IMSI catchers, common in urban LATAM centers. Privilege Escalation Zero-Permission: CVE-2021-39658 ismsEx service allows any app to send SMS or modify system properties without permissions, bypassing Android 2FA. System Backdoors Exported Components: com.spreadtrum.sgps exposes location tracking and system controls via dialer codes _#_#2266#_#_. Payload Delivery Silent Installers: Pre-installed system apps com.dti.amx Digital Turbine and com.inmobi.installer hold INSTALL_PACKAGES, allowing silent installation of banking trojans e.g., PixRevolution without user consent. The Cover-Up FOTA Spoofing: The fscrypt bypass injects a fake ro.build.version.security_patch string, tricking users, banks, and MDM systems into believing the device is secure.  Critical Risk to Latin America LATAM  The impact on Latin America is disproportionate and severe due to market dynamics and reliance on mobile finance. A. Market Dominance of Vulnerable Devices Ubiquity: Unisoc T606/T616 chipsets power the best-selling budget devices in the region Motorola Moto G04s, G24, Infinix, Tecno. Search results confirm Unisoc's aggressive expansion in LATAM, with over 100 5G devices deployed in the region by 2025. Demographic Impact: These devices are the primary computing tool for unbanked and underbanked populations who rely exclusively on smartphones for government aid, commerce, and banking. B. Direct Threat to Financial Infrastructure PIX & Billetera M\u00f3vil Active Exploitation: The PixRevolution trojan identified March 2026 actively hijacks PIX instant payments in Brazil by overlaying fake screens and diverting funds in real-time. The Enabler: The vulnerabilities in this report ismsEx SMS bypass, INSTALL_PACKAGES silent installer, exported SGPS location tracking provide the perfect infrastructure for such malware to operate undetected. 2FA Bypass: CVE-2021-39658 allows malware to read or intercept SMS verification codes without permission, rendering traditional 2FA useless for banking apps. C. Enterprise & Supply Chain Risk MDM Evasion: Corporate Mobile Device Management MDM systems rely on the security_patch string to enforce compliance. The FOTA spoofing mechanism ensures that compromised devices report \"Compliant\" status while running vulnerable firmware, allowing them to bypass corporate security gates. Data Exfiltration: The com.motorola.bach.modemstats service with READ_LOGS and MANAGE_NETWORK_POLICY can be weaponized to exfiltrate corporate data over hidden backchannels that ignore data usage limits. D. The \"Fake Patch\"", "creation_timestamp": "2026-09-02T01:00:24.333148Z"}, {"uuid": "208f70e0-4e93-4ce0-a7b7-8281c5f5ceeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "content": "", "creation_timestamp": "2026-09-18T04:00:09.741112Z"}, {"uuid": "b91abab8-0946-4665-96b5-05dc3a46e452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "exploited", "source": "Telegram/29Fa6kOu2Kkjlzr-wySBlSXFcHEZP-1nUpNSNRyD8H-deyE", "content": "", "creation_timestamp": "2026-09-19T00:00:23.786313Z"}, {"uuid": "5db3ecdd-f82a-4c3a-bd8a-52725563da11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://gist.github.com/yetanotherf0rked/5de83f4178f0aa20daf03012b9baf0a9", "content": "# Redmi A5 / POCO C71 (Unisoc T7250, `serenity`): bootloader unlock + degoogled GSI\n\nField notes from a full run on one device. Not an official guide. It worked for me; that does not mean it will for you.\nRedacted by Claude - Sonnet 5.\n\n*Edits:*\n- Created 2026-09-23 23:28\n\n| | |\n|---|---|\n| Device | Xiaomi Redmi A5 / POCO C71, model `25028RN03Y`, codename `serenity` |\n| SoC | Unisoc T7250 (`ums9230e`), eMMC |\n| Stock ROM | EEA `A15.0.13.0.VGWEUXM` (Android 15, HyperOS) |\n| Result | Unlocked bootloader + TrebleDroid Android 15 GSI (no Google apps), all hardware I tested works |\n\n> **Warning.** This wipes user data, voids the warranty and can brick the phone. Take the full backup (step 2) before touching anything. You do this at your own risk.\n\n## What this is, and what it is not\n\n- The unlock uses **CVE-2022-38694**, a BootROM/U-Boot signature-check flaw in Unisoc chips, through TomKing062's [CVE-2022-38694_unlock_bootloader](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader). No Xiaomi unlock account or waiting period is involved.\n- The device pack in that project is for a Tecno phone (`ums9230e_Tecno_KL4.zip`). It targets the SoC, not the OEM, and it worked here, but the Redmi A5 is not in the project's official support list.\n- The ROM is a **GSI** (generic system image), not a port. The stock kernel and vendor partitions stay, so proprietary Xiaomi/Unisoc blobs, services and modem remain (see step 6). A community LineageOS device tree for `serenity` exists, but it depends on a kernel source that, as far as I could tell in September 2026, Xiaomi has not published, so I did not use it. A real port would need that kernel source.\n\n## 0. Requirements\n\n- A Linux PC (examples are Arch + fish; adapt package names), a USB data cable, about 10 GB free for the backup.\n- Tools: `gcc`, `make`, `libusb`, `git`, `android-tools` (adb, fastboot), `xz`.\n- On the phone: USB debugging on, OEM unlocking on (kept for later steps). Back up your data, everything on the phone gets erased.\n\n```sh\nsudo pacman -S --needed base-devel libusb git android-tools\n\ngit clone --recursive https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader.git\ncd CVE-2022-38694_unlock_bootloader\ngcc chsize.c -o chsize\ngcc gen_spl-unlock.c -o gen_spl-unlock\ncd spreadtrum_flash\nmake          # produces ./spd_dump\n```\n\nBuild the tools yourself instead of using the `.exe` files in the zip below: the `gen_spl-unlock.exe` shipped there is from July 2024, the source has later fixes.\n\nThen download the device pack from the project's [Releases](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases) (release 1.72 in my case), and put everything in one working folder:\n\n```sh\nmkdir -p ~/a5/kl4 && cd ~/a5/kl4\ncurl -LO https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases/download/1.72/ums9230e_Tecno_KL4.zip\nsha256sum ums9230e_Tecno_KL4.zip      # no published hash for this asset, note yours\nunzip ums9230e_Tecno_KL4.zip\n# copy in your own builds of: spd_dump  chsize  gen_spl-unlock\n```\n\nYou need these files from the zip: `fdl1-dl.bin`, `fdl2-dl.bin`, `fdl2-cboot.bin`, `custom_exec_no_verify_65015f08.bin`, `misc-wipe.bin`. Ignore the Windows binaries. Read `unlock_autopatch_9230.bat` (`tr -d '\\r' < unlock_autopatch_9230.bat`): it is the reference for the sequence below, which is that script adapted to A/B partition names (`uboot_a`, `boot_a`).\n\n## 1. Enter BROM mode\n\nAll `spd_dump` commands below use these addresses for the `ums9230e` (taken from the `.bat`):\n\n```\nexec_addr 0x65015f08\nfdl fdl1-dl.bin 0x65000800\nfdl fdl2-dl.bin 0x9efffe00\n```\n\n1. Power the phone off completely (hold Power 10 to 15 s if needed).\n2. Start `spd_dump` first so that it waits for the device (it looks for USB ID `1782:4d00`).\n3. Hold **Power + Volume Down**, plug in the USB cable, keep holding until it connects.\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec\n```\n\nThings that look wrong but are normal:\n\n- The **screen stays black** in BROM mode.\n- `LIBUSB_ERROR_TIMEOUT` / `CHECK_BAUD FAIL` right after `EXEC FDL1` are cosmetic. `find port failed` just means retry.\n- `LIBUSB_ERROR_BUSY` means another `spd_dump` still holds the USB device (a FDL2 session is open).\n\nYou end up at an interactive `FDL2 >` prompt.\n\n## 2. Full backup (do not skip)\n\nAt the `FDL2 >` prompt:\n\n```\npartition_list partitions.txt\npath ./backup\nr all\n```\n\n`r all` dumps every partition except blackbox, cache and userdata: about 8 GB, `super` alone is 5 GiB. When done:\n\n```sh\ncd backup && sha256sum * > SHA256SUMS\n```\n\nCopy the folder to a second disk. This is what saves you if anything below goes wrong. Keep the unmodified `splloader.bin`, `uboot_a.bin`, `misc*.bin`, `vbmeta_*.bin`, `boot_a.bin`, `super.bin`.\n\nDo the next steps in a **separate folder** (`~/a5/kl4`) so nothing overwrites the backup.\n\n## 3. Unlock the bootloader\n\nStay in the same `FDL2 >` session if you can (re-entering BROM is fiddly), and use a second terminal in the working folder for the local commands.\n\n**FDL2 prompt:**\n\n```\nread_part splloader 0 0x40000 splloader_backup.bin\nread_part miscdata 0 0x100000 miscdata_backup.bin\n```\n\n**Second terminal:**\n\n```sh\ncp splloader_backup.bin splloader.bin\n```\n\n**FDL2 prompt:**\n\n```\nr uboot_a\ne splloader\n```\n\n**Second terminal** (generate the unlock payload and the patched SPL):\n\n```sh\n./gen_spl-unlock splloader.bin      # creates spl-unlock.bin and patches splloader.bin\nmv splloader.bin u-boot-spl-16k-sign.bin\n./chsize uboot_a.bin                # prints a size, e.g. 0x12e678 for me\nmv uboot_a.bin uboot_a_bak.bin\n```\n\n**FDL2 prompt:**\n\n```\nw uboot_a fdl2-cboot.bin\nreset\n```\n\nThe phone now has no SPL, so it can only start in BROM mode: black screen and no reaction to the buttons is expected. If `spd_dump` does not see it, unplug the cable, hold Power 10 to 15 s, then hold Power + Volume Down while plugging it in. Run the exploit payload. It may take two or three tries, and the timeouts are expected:\n\n```sh\nsudo ./spd_dump exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800\n```\n\nCheck the result (BROM again if needed):\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec verbose 2 read_part miscdata 8192 64 m.bin reset\nhexdump -C m.bin\n```\n\n- 64 zero bytes: still **locked**, redo the payload.\n- 32 bytes of text + a 16-byte hash + the same 16-byte hash: **unlocked**.\n\nRestore the loaders and wipe userdata (this is the `.bat`'s restore line with A/B names):\n\n```sh\nsudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r boot_a w splloader u-boot-spl-16k-sign.bin w uboot_a uboot_a_bak.bin w misc misc-wipe.bin reset\n```\n\nThe phone shows an **ERASING** screen, then boots the stock system. Verify:\n\n```sh\nadb reboot bootloader\nfastboot getvar unlocked      # unlocked: yes\n```\n\n## 4. Flash the GSI (from fastbootd, not the bootloader)\n\n- Image: TrebleDroid `ci-20250415` (android-15.0.0_r26), `system-td-arm64-ab-vanilla.img.xz`, from the [releases page](https://github.com/TrebleDroid/treble_experimentations/releases/tag/ci-20250415). This is a build without GMS.\n- No checksum is published upstream. The `.xz` I used had SHA-256 `11ad0520611e5844fb035072e369b660ecf7bee6888e430abb10d19989668fdb`; record yours.\n\n```sh\nxz -dk system-td-arm64-ab-vanilla.img.xz        # about 2 GB\n\nadb reboot fastboot                             # userspace fastboot, \"fastbootd\"\nfastboot getvar is-userspace                    # must say yes\nfastboot flash system system-td-arm64-ab-vanilla.img\nfastboot flash misc ~/a5/kl4/misc-wipe.bin      # forces a userdata/metadata format on next boot\nfastboot reboot\n```\n\n- `Invalid sparse file format at header magic` during the flash is harmless (fastboot tries sparse, then falls back to raw).\n- Boot is slow the first time (ERASING screen, then the Android animation).\n- **Do not flash a modified `vbmeta`** (see pitfalls). The working combination is stock `vbmeta_a` + GSI `system_a` + `misc-wipe`, with the bootloader reporting `orange`/unlocked.\n\nI ran a 13-point hardware checklist afterwards and everything passed, including the two I feared most, Wi-Fi and the cameras. The resulting build fingerprint is `Redmi/serenity_eea/serenity:15/BP1A.250405.007/250414:userdebug/test-keys`.\n\n## 5. Pitfalls I hit\n\n- **`read_part` is the command**, not `read_partition`. Syntax: `read_part    `.\n- **The Unisoc U-Boot fastboot (bootloader mode) failed to write for me.** Flash attempts ended with `Status read failed (No such device)`. Use fastbootd (`adb reboot fastboot`) instead. `getvar is-userspace: yes` while in bootloader mode does not mean fastbootd is available, check after `fastboot reboot fastboot`.\n- **A `vbmeta_a` rebuilt with `--disable-verity --disable-verification` bootloops** (3 s logo, reboot, forever) on this bootloader. The stock `vbmeta_a` is accepted even when unlocked. Separate `vbmeta_system/vendor/product/odm/system_ext` partitions exist, leave them alone.\n- The bootloop is not fixed by rewriting `super`. It is fixed by restoring `vbmeta_a` and wiping (next section).\n- `xxd` may be missing (use `hexdump -C`), and `<( )` is bash only (fish uses `psub`).\n- Log lines like `tuning fail`, `read error!` on a size probe, or `panic type boot count 69` are counters and probes, not signs of a dying eMMC.\n- Do not paste your serial number, IMEI or chip UID (printed by `spd_dump`) in public issues.\n\n## 6. Recovery\n\nIf the phone bootloops after a flash, get back to BROM (step 1) and restore the stock vbmeta and wipe:\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w vbmeta_a /path/to/backup/vbmeta_a.bin w misc misc-wipe.bin reset\n```\n\nTo go all the way back to the stock system, write `super` from your backup as well (`w super /path/to/backup/super.bin`, about 5 GiB, slow). The unlock itself survives this.\n\n## 7. Post-install audit (what \"degoogled\" does and does not mean here)\n\nRead on the running GSI with `adb shell`:\n\n| Check | Result |\n|---|---|\n| `ro.crypto.state` | `encrypted` |\n| `ro.debuggable` | `1` (userdebug build) |\n| `ro.build.version.security_patch` | `2025-03-05` (system, from the April 2025 GSI) |\n| `ro.vendor.build.security_patch` | `2026-02-01` (stock vendor) |\n| Verified boot | `orange`, device state `unlocked` |\n| Google packages | none from GMS; only AOSP-origin `com.google.android.iwlan` and a networkstack overlay |\n\n`pm list packages | grep -iE \"google|gms|xiaomi|miui|sprd|unisoc\"` still shows `com.sprd.logmanager`, `com.sprd.engineermode`, `com.sprd.uasetting` and a set of Unisoc overlays. `ps -A` shows proprietary vendor services running: `vendor.sprd.hardware.{cplog_svc,tool-service,network-service,gnss-service,enhance-service,trusty-service,connmgr,combined}`, `vendor.xiaomi.hardware.{micharge,misys@1..4}`, `sprdstorageproxyd`, plus the Unisoc keymint, bluetooth and USB HALs.\n\nSo: no Google apps or services, but this is **not a hardened system**. The system patch level is behind the vendor's, the build is `userdebug`/`test-keys`, ADB is available, and the vendor blobs, modem and TEE remain closed and unaudited. I have not measured the phone's network traffic (default AOSP connectivity checks and NTP still go to Google unless changed).\n\nIdeas not done yet: capture traffic from a controlled hotspot, use a newer GSI with current patches, disable ADB and the `com.sprd.*` diagnostic apps, change the captive-portal and NTP servers.\n\n## Credits and sources\n\n- TomKing062, [CVE-2022-38694_unlock_bootloader](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) and its wiki (the `spd_dump`, `chsize`, `gen_spl-unlock` tools and device packs)\n- joaostack, [Exploiting Unisoc Redmi A5](https://github.com/joaostack/Android-Hacking/blob/main/Exploiting_Unisoc_RedmiA5%20%5BEN%5D.md) (memory addresses and restore idea)\n- XDA thread, [Bootloader unlock Redmi A5](https://xdaforums.com/t/bootloader-unlock-redmi-a5.4763326/)\n- [TrebleDroid](https://github.com/TrebleDroid/treble_experimentations) (GSI builds)", "creation_timestamp": "2026-09-23T21:30:29.284534Z"}, {"uuid": "e0ca794d-57d7-42d2-835e-664e1c059729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://gist.github.com/foxy1402/831dd73bb1d2514f952126b5fb5d7da5", "content": "# JamboPhone JP1 \u2014 Unlock, Root & LineageOS GSI (no bootloops)\n\n> **Tested end-to-end on 2026-10-01** on a JamboPhone JP1 (Unisoc UMS9230 / T606, 4 GB RAM, 64 GB **UFS**, Android 13, VAB A/B slots) \u2014 unlocked via CVE-2022-38694, backed up, rooted with Magisk 30.7, and running **LineageOS 22.2 GSI (Android 15)**.\n>\n> This guide documents the exact sequence that worked **and the bootloop trap that the generic GSI advice triggers on this device** (spoiler: it's the vbmeta flash everyone tells you to do).\n\n---\n\n## \u26a0\ufe0f Read this first\n\n- **This is for the JamboPhone JP1 (UMS9230) only.** Other Unisoc phones need their own package from the same repo \u2014 check your chip with an app like **Treble Info / Treble Check** first.\n- **Your phone's storage is UFS, not eMMC.** The GitHub release ships `ums9230_universal_unlock_EMMC.zip` **and** `ums9230_universal_unlock_UFS.dangerous.zip`. **You must use the UFS package.** Flashing the eMMC FDL2 onto a UFS phone is a documented brick. (Sanity check: when FDL2 starts, spd_dump prints `Storage is ufs` \u2014 if it says eMMC you have the wrong package.)\n- Unlocking **wipes your data**. Backup everything you care about first (photos \u2192 Google Photos / PC).\n- The unlock **cannot be reversed** (there is no stock firmware download for this phone \u2014 which is also why the backup in step 3 is sacred).\n- A failed flash can hard-brick. The **BootROM mode is not affected by software bricks** (it lives in mask ROM), so as long as you follow the recovery section you can always get back in. If you can enter BootROM, you're not bricked.\n- Do this on a **laptop or a PC with a UPS**, on a **good USB cable straight into the PC** (no hubs), with **>50% phone battery**.\n\n---\n\n## 1. What you need (downloads)\n\n| File | Link | Notes |\n|---|---|---|\n| Unlock package (**UFS!**) | https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases | grab `ums9230_universal_unlock_UFS.dangerous.zip` \u2014 contains `spd_dump.exe`, `fdl1-dl.bin`, `fdl2-dl.bin`, `fdl2-cboot.bin`, `gen_spl-unlock.exe`, `chsize.exe`, `misc-wipe.bin`, `custom_exec_no_verify_65015f08.bin` |\n| platform-tools (adb + fastboot) | https://dl.google.com/android/repository/platform-tools-latest-windows.zip | unzip anywhere |\n| Google USB driver | https://developer.android.com/studio/run/win-usb | for fastboot mode (VID_18D1/PID_4EE0) |\n| SPRD drivers | included in the unlock package (`SPD_Driver_*` folder) or https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki | for BootROM mode (VID_1782/PID_4D00, shows as `SPRD U2S Diag (COMx)`) |\n| Magisk APK | https://github.com/topjohnwu/Magisk/releases | v30.7 tested \u2014 targets the **boot** partition on this phone (not init_boot) |\n| LineageOS GSI | https://github.com/Doze-off/lineage_treble/releases | `LineageOS-22.2_treble_arm64_bgN.img.xz` = Android 15 **with Play Store**; `..._bvN.img.xz` = vanilla, no GApps. arm64 + A/B (\"b\") is correct for JP1. |\n| Treble Check | Play Store | confirms arm64 + A/B partitioning |\n\nAlternatives (if the Doze-off builds disappear): MisterZtr's [LineageOS_gsi](https://github.com/MisterZtr/LineageOS_gsi) and Andy Yan's [andyyan-gsi](https://sourceforge.net/projects/andyyan-gsi/files/) \u2014 but their files live on SourceForge, which (as of 2026-10) blocks CLI downloads and intermittently fails in browsers too. The GitHub-hosted Doze-off builds are the reliable path.\n\nUnzip the unlock package, e.g. to `C:\\ums9230_UFS\\`. All `spd_dump` commands below run **from that folder**.\n\n---\n\n## 2. Enter BootROM (download) mode\n\nBootROM is the mask-ROM inside the chip \u2014 unreachable by software bricks, but it has no signature check... except one that CVE-2022-38694 bypasses.\n\n**The gesture (learn this \u2014 you'll use it many times):**\n1. Power the phone **off** (hold POWER ~15 s if needed).\n2. **Cable first:** connect USB to the PC and wait for the charging icon.\n3. Now hold **POWER + VOL_DOWN for 7\u201310 seconds, until the screen goes black.**\n4. Windows plays the USB-connect sound: Device Manager shows **`SPRD U2S Diag (COMx)`**.\n\nThe window is only ~12 s, so **start the waiting `spd_dump` command first**, then do the gesture. If it prints `find port failed`, close it, re-arm, retry the gesture.\n\n\u26a0\ufe0f If you ever see \"black screen with charging icon, no PC sound\" \u2014 that's just off-mode charging, not BootROM. No USB device = not in BootROM.\n\n---\n\n## 3. BACKUP (do not skip \u2014 it's the only \"firmware\" that will ever exist for this phone)\n\nThere is no official firmware image for the JP1. Your own backup is the only recovery source. Backup everything critical:\n\n**Arm the catch + dump the small critical partitions** (BootROM session #1, note: **no `reset` at the end** so the session stays alive):\n\n```bat\nspd_dump --wait 600 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r splloader r uboot r miscdata r misc r prodnv r trustos_a r trustos_b r sml_a r sml_b r uboot_log\n```\n\n**Then, fast, in a second command, reconnect to the same session and bulk-dump the rest** (use the `backup_list.xml` from this gist \u2014 55 partitions, ~700 MB total):\n\n```bat\nspd_dump --stage 2 blk_size 63488 path backup read_parts backup_list.xml reset\n```\n\nNotes:\n- Do **not** use plain `r all` \u2014 it also dumps the 9 GB `super` partition (hours over USB). The trimmed list covers everything *except* super/cache/userdata/blackbox, which you can't restore meaningfully anyway.\n- `--stage 2` attaches to the still-running FDL2 session without redoing the exploit. It's one-shot per session \u2014 run it promptly after command 1.\n- `blk_size 63488` raises transfer speed to several MB/s (default is slow).\n- When done, **copy the `backup\\` folder somewhere safe** (cloud + a second drive). It contains your IMEI/NV (`prodnv`, `l_fixnv*`), modem, trustzone, and every boot chain piece.\n\n---\n\n## 4. Unlock the bootloader (CVE-2022-38694)\n\nHow it works, briefly: dump SPL + uboot \u2192 erase SPL \u2192 write a cboot-flavored FDL2 into the uboot slot \u2192 boot a signature-check-NOPed SPL, which boots that cboot, which flips the `miscdata` unlock flag \u2192 restore originals.\n\nRun each block from the unlock package folder. After each `reset` the phone reboots \u2014 re-enter BootROM (section 2) for the next block.\n\n**4.1 \u2014 dump SPL + uboot, then erase SPL** (this dump doubles as the backup from step 3):\n\n```bat\nspd_dump --wait 600 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r splloader r uboot e splloader e splloader_bak reset\n```\n\n**4.2 \u2014 prepare the patched SPL and a size-fixed uboot backup:**\n\n```bat\ngen_spl-unlock splloader.bin\nren splloader.bin u-boot-spl-16k-sign.bin\nchsize uboot.bin\nren uboot.bin uboot_bak.bin\n```\n\n(`gen_spl-unlock` truncates the SPL to its real size and NOPs 4 signature checks \u2192 `u-boot-spl-16k-sign.bin` is now unsigned-boot-capable; `chsize` pads the uboot dump so it can be written back later.)\n\n**4.3 \u2014 park cboot in the uboot slot:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w uboot fdl2-cboot.bin reset\n```\n\n**4.4 \u2014 boot the NOPed SPL** (it chains cboot from flash, which rewrites `miscdata` = unlock; the phone reboots by itself when done \u2014 this may need to be run **twice**):\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800\n```\n\n**4.5 \u2014 verify the unlock flag:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec read_part miscdata 8192 64 miscdata_check.bin reset\n```\n\nOpen `miscdata_check.bin` in a hex editor: **64 zero bytes = still locked**; **non-zero data with two 16-byte blocks = unlocked** \u2705\n\n**4.6 \u2014 restore SPL + uboot and wipe the boot command block:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r boot w splloader u-boot-spl-16k-sign.bin w uboot uboot_bak.bin w misc misc-wipe.bin reset\n```\n\n(The `r boot` grabs your stock boot image too \u2014 keep `boot.bin`! You'll use it for Magisk.)\n\n**4.7 \u2014 boot Android.** It will factory-reset and show a bootloader-unlock warning at power-on. Verify from adb:\n\n```\nadb shell getprop ro.boot.flash.locked     \u2192 0\nadb shell getprop ro.boot.verifiedbootstate \u2192 orange\n```\n\nRe-enable Developer options + USB debugging after the reset.\n\n---\n\n## 5. Root with Magisk\n\n1. `adb install Magisk-v30.7.apk`\n2. `adb push backup-from-step-4\\boot.bin /sdcard/Download/boot_a.bin`  *(the stock boot you dumped in 4.6 \u2014 it must be the image for the **currently active slot**, check with `adb shell getprop ro.boot.slot_suffix`)*\n3. Magisk app \u2192 **Install** \u2192 **Select and Patch a File** \u2192 pick `Download/boot_a.bin` \u2192 **LET'S GO** \u2192 wait for *All done!*\n4. Pull it:\n   ```bat\n   adb pull /sdcard/Download/magisk_patched-XXXXX.img magisk_patched.img\n   ```\n5. Flash it \u2014 **in bootloader fastboot, and note the explicit `_a` name**:\n   ```bat\n   adb reboot bootloader\n   fastboot flash boot_a magisk_patched.img\n   fastboot reboot\n   ```\n\n\u26a0\ufe0f Quirks on this device:\n- `fastboot flash boot ...` (bare name) fails with `Write img fail!` \u2014 always use `boot_a`/`boot_b`.\n- **`fastboot flash vbmeta_a` (any vbmeta!) in bootloader mode hangs the phone mid-write** and needs a physical restart. Never flash vbmeta in bootloader mode here. (In fact \u2014 see section 7 \u2014 never flash vbmeta at all.)\n- Reboot \u2192 `adb shell su -c id` \u2192 `uid=0(root)` after you approve Magisk's Shell prompt. \u2705\n\n---\n\n## 6. Flash LineageOS GSI (the safe way)\n\n```bat\nadb reboot bootloader\nfastboot reboot fastboot                  :: boots userspace fastbootd (shows \"fastbootd\" on screen)\nfastboot flash system LineageOS-22.2_treble_arm64_bgN.img\nfastboot -w                               :: wipes userdata+cache \u2014 REQUIRED when switching ROMs\nfastboot reboot\n```\n\n- Decompress the GSI first (`LineageOS-22.2_treble_arm64_bgN.img.xz` \u2192 `.img`, ~3 GB): use 7-Zip, or `xz -d` / Windows' built-in `tar.exe`.\n- `system_a` on the JP1 is ~3.8 GiB; this GSI is ~3.05 GiB \u2014 fits. fastbootd auto-resizes the logical partition.\n- First boot takes 5\u201315 min (boot splash \u2192 LineageOS animation \u2192 setup wizard).\n- Expect the \"orange state\" bootloader warning at every power-on \u2014 normal for an unlocked phone.\n\n---\n\n## 7. \ud83d\udd25 THE BOOTLOOP TRAP \u2014 and how to recover\n\n**Every generic GSI guide says:** `fastboot flash vbmeta vbmeta.img --disable-verity --disable-verification`.\n**On this phone that command causes a hard bootloop, even with the bootloader unlocked.**\n\nWhy: that flag rewrite **invalidates the vbmeta's cryptographic signature**. Unisoc's bootloader (cboot/LK) **panics on any signature-invalid vbmeta in the chain \u2014 regardless of unlock state**. It fills a panic counter, then locks you into a boot-cycle (splash logo \u2192 fastboot text \u2192 reboot). The GSI itself is *fine*: with all **stock signed vbmetas** left in place, cboot boots the GSI happily \u2014 the AVB hashtree mismatch on an unlocked device just means no dm-verity (orange state).\n\n**Rules:**\n1. **Never flash any vbmeta on this device. Not with flags, not at all.**\n2. Bootloader-mode vbmeta writes additionally hang the phone mid-write.\n\n**If you already did it and are bootlooping** (this exact recovery worked):\n\n1. Enter BootROM (section 2), keep the phone on USB.\n2. Restore all six stock vbmetas of the active slot from your backup, and reset the panic counters (they live in `sysdumpdb`):\n   ```bat\n   spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w vbmeta_a backup\\vbmeta_a.bin w vbmeta_system_a backup\\vbmeta_system_a.bin w vbmeta_vendor_a backup\\vbmeta_vendor_a.bin w vbmeta_system_ext_a backup\\vbmeta_system_ext_a.bin w vbmeta_product_a backup\\vbmeta_product_a.bin w vbmeta_odm_a backup\\vbmeta_odm_a.bin w sysdumpdb backup\\sysdumpdb.bin reset\n   ```\n3. **True cold boot:** hold POWER ~20 s until really off, then power on. (The stale \"reboot into fastboot\" reason lives in a register that only clears on cold boot.)\n4. If it still loops, diagnose from BootROM \u2014 the bootloader keeps logs you can read:\n   ```bat\n   spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r uboot_log read_part sysdumpdb 0 10485760 sysdumpdb.bin reset\n   ```\n   Extract strings from `uboot_log.bin` (16 MB ring buffer; find the last `welcome to lk` block) and look at `sysdumpdb.bin` (text lines: `reboot reg`, `reset mode`, `reason is ...`). `reason is bootloader panic` = something in the boot chain is wrong (usually vbmeta); kernel panics appear differently.\n5. Still stuck? Restore the whole step-4.6 state (SPL/uboot/misc) from backup and boot \u2014 with slot b never flashed, `fastboot set_active b` from bootloader is your fallback to stock.\n\n---\n\n## 8. Bonus: 24/7 dashboard setup (chart display use-case)\n\nRooted LineageOS settings that make a plugged-in display phone behave:\n\n```bat\nadb shell settings put global stay_on_while_plugged_in 7    :: screen never sleeps on charger\nadb shell settings put system screen_off_timeout 2147480000  :: fallback timeout, maxed\nadb shell settings put system accelerometer_rotation 1       :: auto-rotate for the landscape stand\nadb shell dumpsys deviceidle whitelist +org.mozilla.firefox  :: never let Android kill Firefox\nadb shell cmd appops set org.mozilla.firefox RUN_ANY_IN_BACKGROUND allow\n```\n\n- zRAM is on by default here (2.27 GiB compressed swap) \u2014 no config needed.\n- This phone's charger IC ignores software charge-limit writes, so a 24/7-plugged battery sits at 100%; slow 2.5 W charging keeps it cool. Recommend a weekly drain to ~50\u201360%.\n- Battery temperature watchdog (Magisk service script, alerts above 42 \u00b0C) \u2014 drop this in `/data/adb/service.d/batterywatch.sh`, `chmod 755`:\n  ```sh\n  #!/system/bin/sh\n  while true; do\n      T=$(cat /sys/class/power_supply/battery/temp 2>/dev/null)\n      if [ -n \"$T\" ] && [ \"$T\" -ge 420 ]; then\n          cmd notification post -S bigtext -t \"BatteryWatch\" BatteryWatch \"Battery is $((T/10)).$((T%10))C - hot!\"\n      fi\n      sleep 600\n  done &\n  ```\n\n---\n\n## FAQ\n\n**Q: Is my phone bricked if it only shows the splash / fastboot screen?**\nNo. If BootROM mode works (section 2 gesture + `SPRD U2S Diag` appears), you can read/write every partition and recover. The splash-then-fastboot cycle is usually the bootloader panic of section 7.\n\n**Q: Can I use the eMMC package if I can't find the UFS one?**\nNo. UFS device + eMMC FDL2 = brick risk. The FDL2 log line `Storage is ufs` is your green light.\n\n**Q: Which Magisk partition?**\n`boot` (via `boot_a`/`boot_b`) \u2014 not `init_boot` on this phone (issue #116 in the unlock repo confirms).\n\n**Q: Why Android 15 and not 16?**\n4 GB RAM. LOS 22.2 (A15) runs comfortably; A16 GSIs are heavier. Same reasoning says pick the `-bgN` (GApps included) variant over vanilla + separate GApps flash.\n\n**Q: Does the unlock trip anything permanent?**\nThe orange warning at boot and an unlocked `miscdata` flag \u2014 that's it. There's no re-lock on this device.\n\n---\n\n## Credits\n\n- **TomKing062** \u2014 CVE-2022-38694 research, `spd_dump`, the unlock packages, and the wiki. The JP1 was confirmed working in [issue #116](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/issues/116).\n- **Doze-off** \u2014 TrebleDroid-based LineageOS GSI builds ([releases](https://github.com/Doze-off/lineage_treble/releases)).\n- **MisterZtr, Andy Yan, phhusson / TrebleDroid** \u2014 GSI ecosystem.\n- **topjohnwu** \u2014 Magisk.\n\n*Guide compiled 2026-10-01 from a live end-to-end session on a JamboPhone JP1. Follow at your own risk \u2014 but do the backup and nothing here is unrecoverable.*\n", "creation_timestamp": "2026-10-01T12:57:41.000000Z"}]}