Hisense a5 pro CC root failed about cve-2022-38694_unlock_bootloader HOT 20 CLOSED

spd_dump fixed 012305c
fdl1 execute still not work
got splloader executed without verify (i thought it couldn't be done last month), so a5pro(cc) will use spl method instead of fdl1 method, this need some tests

from cve-2022-38694_unlock_bootloader.

Nice keep up the good work. Any way to support you, donation?

from cve-2022-38694_unlock_bootloader.

DONE

from cve-2022-38694_unlock_bootloader.

1. tested a t610, fdl1 execute will fail because i set wrong register value in custom_exec.bin
2. spd_dump can't use exec_addr now, rename method like spd_dump_3f48 works

will fix later

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

I'm using Android 10 with software version L1732.6.17.01.00 in Hisense A5PRO cc This root method apply with this software version? And where to use spreadtrum_flash-main_exec? I can't find where it is

git clone the repo, and build within the folder

from cve-2022-38694_unlock_bootloader.

q5 added

from cve-2022-38694_unlock_bootloader.

With --verbose 1

./spd_dump --wait 5000 --verbose 1 exec_addr 0x5500 fdl uboot-mod.bin 0x9efffe00 exec read_part teecfg 0
 1M teecfg.bin read_part trustos 0 6M tos.bin read_part sml 0 1M sml.bin erase_part splloader reset
Waiting for connection (5000s)
libusb_control_transfer ok
send: unknown message
recv: type = 0x81, size = 6
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
send: type = 0x00, size = 0
recv: type = 0x80, size = 0
CMD_CONNECT bootrom
input >

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

I'm using Android 10 with software version L1732.6.17.01.00 in Hisense A5PRO cc This root method apply with this software version? And where to use spreadtrum_flash-main_exec? I can't find where it is

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

I'm using Android 10 with software version L1732.6.17.01.00 in Hisense A5PRO cc This root method apply with this software version? And where to use spreadtrum_flash-main_exec? I can't find where it is

git clone the repo, and build within the folder

Is it necessary to prepare the phone in any way before applying root? I have OEM unlocking and USB debugging allowed in Developer options already

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

now I have this issue

libusb_control_transfer ok
send: unknown message
recv: type = 0x81, size = 6
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
send: type = 0x00, size = 0
recv: type = 0x80, size = 0
CMD_CONNECT bootrom
current exec_addr is 0x5500
loadfile("uboot-mod.bin") failed

from cve-2022-38694_unlock_bootloader.

use spreadtrum_flash-main_exec instead of interactive

now I have this issue

libusb_control_transfer ok
send: unknown message
recv: type = 0x81, size = 6
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
send: type = 0x00, size = 0
recv: type = 0x80, size = 0
CMD_CONNECT bootrom
current exec_addr is 0x5500
loadfile("uboot-mod.bin") failed

After reaching this step, does the phone still start?

from cve-2022-38694_unlock_bootloader.

感谢大佬的工作和分享！关注这个洞很久了，终于等到有可用的exp，顺便提一下，这个手机的root有几个人在论坛悬赏几百美金，如果成功root，大佬绝对是第一功臣～
https://forum.xda-developers.com/t/hisense-a5-pro-cc-how-to-root-unlock-bootloader.4109021/page-8

https://forum.xda-developers.com/t/award-for-anyone-who-roots-hisense-a5-pro-cc.4112773/

from cve-2022-38694_unlock_bootloader.

fdl1 execute fixed 0482afc
download tool from releases

from cve-2022-38694_unlock_bootloader.

now fdl1 can be executed without verify
though i am still not sure if fdl1 from SmileX(t610) can be used to unlock a5p/a5pcc (ddr init is slightly different)

from cve-2022-38694_unlock_bootloader.

about spl method, not written yet
device will not unlock if ddr init in fdl1 failed , if this happen , modify spl and ddr init will use exactly value from manufacturer, i will see if fdl1 can work first

from cve-2022-38694_unlock_bootloader.

smilex fdl1 not work, a5p/a5pcc still need compile fdl1 manually
this takes at least 1 day

from cve-2022-38694_unlock_bootloader.

smilex fdl1 not work, a5p/a5pcc still need compile fdl1 manually this takes at least 1 day

Good work, could you document how to compile fdl1 for other t610 devices? (I have a hisense q5) :)

from cve-2022-38694_unlock_bootloader.

thanks :)
Unfortunately I can't install the root... the executable only says: Waiting for device....

However adb does recognize my phone, spd_dump.exe doesn't... any solution advice?

from cve-2022-38694_unlock_bootloader.

AMAZING

from cve-2022-38694_unlock_bootloader.