{"uuid": "5db3ecdd-f82a-4c3a-bd8a-52725563da11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://gist.github.com/yetanotherf0rked/5de83f4178f0aa20daf03012b9baf0a9", "content": "# Redmi A5 / POCO C71 (Unisoc T7250, `serenity`): bootloader unlock + degoogled GSI\n\nField notes from a full run on one device. Not an official guide. It worked for me; that does not mean it will for you.\nRedacted by Claude - Sonnet 5.\n\n*Edits:*\n- Created 2026-09-23 23:28\n\n| | |\n|---|---|\n| Device | Xiaomi Redmi A5 / POCO C71, model `25028RN03Y`, codename `serenity` |\n| SoC | Unisoc T7250 (`ums9230e`), eMMC |\n| Stock ROM | EEA `A15.0.13.0.VGWEUXM` (Android 15, HyperOS) |\n| Result | Unlocked bootloader + TrebleDroid Android 15 GSI (no Google apps), all hardware I tested works |\n\n> **Warning.** This wipes user data, voids the warranty and can brick the phone. Take the full backup (step 2) before touching anything. You do this at your own risk.\n\n## What this is, and what it is not\n\n- The unlock uses **CVE-2022-38694**, a BootROM/U-Boot signature-check flaw in Unisoc chips, through TomKing062's [CVE-2022-38694_unlock_bootloader](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader). No Xiaomi unlock account or waiting period is involved.\n- The device pack in that project is for a Tecno phone (`ums9230e_Tecno_KL4.zip`). It targets the SoC, not the OEM, and it worked here, but the Redmi A5 is not in the project's official support list.\n- The ROM is a **GSI** (generic system image), not a port. The stock kernel and vendor partitions stay, so proprietary Xiaomi/Unisoc blobs, services and modem remain (see step 6). A community LineageOS device tree for `serenity` exists, but it depends on a kernel source that, as far as I could tell in September 2026, Xiaomi has not published, so I did not use it. A real port would need that kernel source.\n\n## 0. Requirements\n\n- A Linux PC (examples are Arch + fish; adapt package names), a USB data cable, about 10 GB free for the backup.\n- Tools: `gcc`, `make`, `libusb`, `git`, `android-tools` (adb, fastboot), `xz`.\n- On the phone: USB debugging on, OEM unlocking on (kept for later steps). Back up your data, everything on the phone gets erased.\n\n```sh\nsudo pacman -S --needed base-devel libusb git android-tools\n\ngit clone --recursive https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader.git\ncd CVE-2022-38694_unlock_bootloader\ngcc chsize.c -o chsize\ngcc gen_spl-unlock.c -o gen_spl-unlock\ncd spreadtrum_flash\nmake          # produces ./spd_dump\n```\n\nBuild the tools yourself instead of using the `.exe` files in the zip below: the `gen_spl-unlock.exe` shipped there is from July 2024, the source has later fixes.\n\nThen download the device pack from the project's [Releases](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases) (release 1.72 in my case), and put everything in one working folder:\n\n```sh\nmkdir -p ~/a5/kl4 && cd ~/a5/kl4\ncurl -LO https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases/download/1.72/ums9230e_Tecno_KL4.zip\nsha256sum ums9230e_Tecno_KL4.zip      # no published hash for this asset, note yours\nunzip ums9230e_Tecno_KL4.zip\n# copy in your own builds of: spd_dump  chsize  gen_spl-unlock\n```\n\nYou need these files from the zip: `fdl1-dl.bin`, `fdl2-dl.bin`, `fdl2-cboot.bin`, `custom_exec_no_verify_65015f08.bin`, `misc-wipe.bin`. Ignore the Windows binaries. Read `unlock_autopatch_9230.bat` (`tr -d '\\r' < unlock_autopatch_9230.bat`): it is the reference for the sequence below, which is that script adapted to A/B partition names (`uboot_a`, `boot_a`).\n\n## 1. Enter BROM mode\n\nAll `spd_dump` commands below use these addresses for the `ums9230e` (taken from the `.bat`):\n\n```\nexec_addr 0x65015f08\nfdl fdl1-dl.bin 0x65000800\nfdl fdl2-dl.bin 0x9efffe00\n```\n\n1. Power the phone off completely (hold Power 10 to 15 s if needed).\n2. Start `spd_dump` first so that it waits for the device (it looks for USB ID `1782:4d00`).\n3. Hold **Power + Volume Down**, plug in the USB cable, keep holding until it connects.\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec\n```\n\nThings that look wrong but are normal:\n\n- The **screen stays black** in BROM mode.\n- `LIBUSB_ERROR_TIMEOUT` / `CHECK_BAUD FAIL` right after `EXEC FDL1` are cosmetic. `find port failed` just means retry.\n- `LIBUSB_ERROR_BUSY` means another `spd_dump` still holds the USB device (a FDL2 session is open).\n\nYou end up at an interactive `FDL2 >` prompt.\n\n## 2. Full backup (do not skip)\n\nAt the `FDL2 >` prompt:\n\n```\npartition_list partitions.txt\npath ./backup\nr all\n```\n\n`r all` dumps every partition except blackbox, cache and userdata: about 8 GB, `super` alone is 5 GiB. When done:\n\n```sh\ncd backup && sha256sum * > SHA256SUMS\n```\n\nCopy the folder to a second disk. This is what saves you if anything below goes wrong. Keep the unmodified `splloader.bin`, `uboot_a.bin`, `misc*.bin`, `vbmeta_*.bin`, `boot_a.bin`, `super.bin`.\n\nDo the next steps in a **separate folder** (`~/a5/kl4`) so nothing overwrites the backup.\n\n## 3. Unlock the bootloader\n\nStay in the same `FDL2 >` session if you can (re-entering BROM is fiddly), and use a second terminal in the working folder for the local commands.\n\n**FDL2 prompt:**\n\n```\nread_part splloader 0 0x40000 splloader_backup.bin\nread_part miscdata 0 0x100000 miscdata_backup.bin\n```\n\n**Second terminal:**\n\n```sh\ncp splloader_backup.bin splloader.bin\n```\n\n**FDL2 prompt:**\n\n```\nr uboot_a\ne splloader\n```\n\n**Second terminal** (generate the unlock payload and the patched SPL):\n\n```sh\n./gen_spl-unlock splloader.bin      # creates spl-unlock.bin and patches splloader.bin\nmv splloader.bin u-boot-spl-16k-sign.bin\n./chsize uboot_a.bin                # prints a size, e.g. 0x12e678 for me\nmv uboot_a.bin uboot_a_bak.bin\n```\n\n**FDL2 prompt:**\n\n```\nw uboot_a fdl2-cboot.bin\nreset\n```\n\nThe phone now has no SPL, so it can only start in BROM mode: black screen and no reaction to the buttons is expected. If `spd_dump` does not see it, unplug the cable, hold Power 10 to 15 s, then hold Power + Volume Down while plugging it in. Run the exploit payload. It may take two or three tries, and the timeouts are expected:\n\n```sh\nsudo ./spd_dump exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800\n```\n\nCheck the result (BROM again if needed):\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec verbose 2 read_part miscdata 8192 64 m.bin reset\nhexdump -C m.bin\n```\n\n- 64 zero bytes: still **locked**, redo the payload.\n- 32 bytes of text + a 16-byte hash + the same 16-byte hash: **unlocked**.\n\nRestore the loaders and wipe userdata (this is the `.bat`'s restore line with A/B names):\n\n```sh\nsudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r boot_a w splloader u-boot-spl-16k-sign.bin w uboot_a uboot_a_bak.bin w misc misc-wipe.bin reset\n```\n\nThe phone shows an **ERASING** screen, then boots the stock system. Verify:\n\n```sh\nadb reboot bootloader\nfastboot getvar unlocked      # unlocked: yes\n```\n\n## 4. Flash the GSI (from fastbootd, not the bootloader)\n\n- Image: TrebleDroid `ci-20250415` (android-15.0.0_r26), `system-td-arm64-ab-vanilla.img.xz`, from the [releases page](https://github.com/TrebleDroid/treble_experimentations/releases/tag/ci-20250415). This is a build without GMS.\n- No checksum is published upstream. The `.xz` I used had SHA-256 `11ad0520611e5844fb035072e369b660ecf7bee6888e430abb10d19989668fdb`; record yours.\n\n```sh\nxz -dk system-td-arm64-ab-vanilla.img.xz        # about 2 GB\n\nadb reboot fastboot                             # userspace fastboot, \"fastbootd\"\nfastboot getvar is-userspace                    # must say yes\nfastboot flash system system-td-arm64-ab-vanilla.img\nfastboot flash misc ~/a5/kl4/misc-wipe.bin      # forces a userdata/metadata format on next boot\nfastboot reboot\n```\n\n- `Invalid sparse file format at header magic` during the flash is harmless (fastboot tries sparse, then falls back to raw).\n- Boot is slow the first time (ERASING screen, then the Android animation).\n- **Do not flash a modified `vbmeta`** (see pitfalls). The working combination is stock `vbmeta_a` + GSI `system_a` + `misc-wipe`, with the bootloader reporting `orange`/unlocked.\n\nI ran a 13-point hardware checklist afterwards and everything passed, including the two I feared most, Wi-Fi and the cameras. The resulting build fingerprint is `Redmi/serenity_eea/serenity:15/BP1A.250405.007/250414:userdebug/test-keys`.\n\n## 5. Pitfalls I hit\n\n- **`read_part` is the command**, not `read_partition`. Syntax: `read_part    `.\n- **The Unisoc U-Boot fastboot (bootloader mode) failed to write for me.** Flash attempts ended with `Status read failed (No such device)`. Use fastbootd (`adb reboot fastboot`) instead. `getvar is-userspace: yes` while in bootloader mode does not mean fastbootd is available, check after `fastboot reboot fastboot`.\n- **A `vbmeta_a` rebuilt with `--disable-verity --disable-verification` bootloops** (3 s logo, reboot, forever) on this bootloader. The stock `vbmeta_a` is accepted even when unlocked. Separate `vbmeta_system/vendor/product/odm/system_ext` partitions exist, leave them alone.\n- The bootloop is not fixed by rewriting `super`. It is fixed by restoring `vbmeta_a` and wiping (next section).\n- `xxd` may be missing (use `hexdump -C`), and `<( )` is bash only (fish uses `psub`).\n- Log lines like `tuning fail`, `read error!` on a size probe, or `panic type boot count 69` are counters and probes, not signs of a dying eMMC.\n- Do not paste your serial number, IMEI or chip UID (printed by `spd_dump`) in public issues.\n\n## 6. Recovery\n\nIf the phone bootloops after a flash, get back to BROM (step 1) and restore the stock vbmeta and wipe:\n\n```sh\nsudo ./spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w vbmeta_a /path/to/backup/vbmeta_a.bin w misc misc-wipe.bin reset\n```\n\nTo go all the way back to the stock system, write `super` from your backup as well (`w super /path/to/backup/super.bin`, about 5 GiB, slow). The unlock itself survives this.\n\n## 7. Post-install audit (what \"degoogled\" does and does not mean here)\n\nRead on the running GSI with `adb shell`:\n\n| Check | Result |\n|---|---|\n| `ro.crypto.state` | `encrypted` |\n| `ro.debuggable` | `1` (userdebug build) |\n| `ro.build.version.security_patch` | `2025-03-05` (system, from the April 2025 GSI) |\n| `ro.vendor.build.security_patch` | `2026-02-01` (stock vendor) |\n| Verified boot | `orange`, device state `unlocked` |\n| Google packages | none from GMS; only AOSP-origin `com.google.android.iwlan` and a networkstack overlay |\n\n`pm list packages | grep -iE \"google|gms|xiaomi|miui|sprd|unisoc\"` still shows `com.sprd.logmanager`, `com.sprd.engineermode`, `com.sprd.uasetting` and a set of Unisoc overlays. `ps -A` shows proprietary vendor services running: `vendor.sprd.hardware.{cplog_svc,tool-service,network-service,gnss-service,enhance-service,trusty-service,connmgr,combined}`, `vendor.xiaomi.hardware.{micharge,misys@1..4}`, `sprdstorageproxyd`, plus the Unisoc keymint, bluetooth and USB HALs.\n\nSo: no Google apps or services, but this is **not a hardened system**. The system patch level is behind the vendor's, the build is `userdebug`/`test-keys`, ADB is available, and the vendor blobs, modem and TEE remain closed and unaudited. I have not measured the phone's network traffic (default AOSP connectivity checks and NTP still go to Google unless changed).\n\nIdeas not done yet: capture traffic from a controlled hotspot, use a newer GSI with current patches, disable ADB and the `com.sprd.*` diagnostic apps, change the captive-portal and NTP servers.\n\n## Credits and sources\n\n- TomKing062, [CVE-2022-38694_unlock_bootloader](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) and its wiki (the `spd_dump`, `chsize`, `gen_spl-unlock` tools and device packs)\n- joaostack, [Exploiting Unisoc Redmi A5](https://github.com/joaostack/Android-Hacking/blob/main/Exploiting_Unisoc_RedmiA5%20%5BEN%5D.md) (memory addresses and restore idea)\n- XDA thread, [Bootloader unlock Redmi A5](https://xdaforums.com/t/bootloader-unlock-redmi-a5.4763326/)\n- [TrebleDroid](https://github.com/TrebleDroid/treble_experimentations) (GSI builds)", "creation_timestamp": "2026-09-23T21:30:29.284534Z"}