{"uuid": "e0ca794d-57d7-42d2-835e-664e1c059729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-38694", "type": "seen", "source": "https://gist.github.com/foxy1402/831dd73bb1d2514f952126b5fb5d7da5", "content": "# JamboPhone JP1 \u2014 Unlock, Root & LineageOS GSI (no bootloops)\n\n> **Tested end-to-end on 2026-10-01** on a JamboPhone JP1 (Unisoc UMS9230 / T606, 4 GB RAM, 64 GB **UFS**, Android 13, VAB A/B slots) \u2014 unlocked via CVE-2022-38694, backed up, rooted with Magisk 30.7, and running **LineageOS 22.2 GSI (Android 15)**.\n>\n> This guide documents the exact sequence that worked **and the bootloop trap that the generic GSI advice triggers on this device** (spoiler: it's the vbmeta flash everyone tells you to do).\n\n---\n\n## \u26a0\ufe0f Read this first\n\n- **This is for the JamboPhone JP1 (UMS9230) only.** Other Unisoc phones need their own package from the same repo \u2014 check your chip with an app like **Treble Info / Treble Check** first.\n- **Your phone's storage is UFS, not eMMC.** The GitHub release ships `ums9230_universal_unlock_EMMC.zip` **and** `ums9230_universal_unlock_UFS.dangerous.zip`. **You must use the UFS package.** Flashing the eMMC FDL2 onto a UFS phone is a documented brick. (Sanity check: when FDL2 starts, spd_dump prints `Storage is ufs` \u2014 if it says eMMC you have the wrong package.)\n- Unlocking **wipes your data**. Backup everything you care about first (photos \u2192 Google Photos / PC).\n- The unlock **cannot be reversed** (there is no stock firmware download for this phone \u2014 which is also why the backup in step 3 is sacred).\n- A failed flash can hard-brick. The **BootROM mode is not affected by software bricks** (it lives in mask ROM), so as long as you follow the recovery section you can always get back in. If you can enter BootROM, you're not bricked.\n- Do this on a **laptop or a PC with a UPS**, on a **good USB cable straight into the PC** (no hubs), with **>50% phone battery**.\n\n---\n\n## 1. What you need (downloads)\n\n| File | Link | Notes |\n|---|---|---|\n| Unlock package (**UFS!**) | https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/releases | grab `ums9230_universal_unlock_UFS.dangerous.zip` \u2014 contains `spd_dump.exe`, `fdl1-dl.bin`, `fdl2-dl.bin`, `fdl2-cboot.bin`, `gen_spl-unlock.exe`, `chsize.exe`, `misc-wipe.bin`, `custom_exec_no_verify_65015f08.bin` |\n| platform-tools (adb + fastboot) | https://dl.google.com/android/repository/platform-tools-latest-windows.zip | unzip anywhere |\n| Google USB driver | https://developer.android.com/studio/run/win-usb | for fastboot mode (VID_18D1/PID_4EE0) |\n| SPRD drivers | included in the unlock package (`SPD_Driver_*` folder) or https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki | for BootROM mode (VID_1782/PID_4D00, shows as `SPRD U2S Diag (COMx)`) |\n| Magisk APK | https://github.com/topjohnwu/Magisk/releases | v30.7 tested \u2014 targets the **boot** partition on this phone (not init_boot) |\n| LineageOS GSI | https://github.com/Doze-off/lineage_treble/releases | `LineageOS-22.2_treble_arm64_bgN.img.xz` = Android 15 **with Play Store**; `..._bvN.img.xz` = vanilla, no GApps. arm64 + A/B (\"b\") is correct for JP1. |\n| Treble Check | Play Store | confirms arm64 + A/B partitioning |\n\nAlternatives (if the Doze-off builds disappear): MisterZtr's [LineageOS_gsi](https://github.com/MisterZtr/LineageOS_gsi) and Andy Yan's [andyyan-gsi](https://sourceforge.net/projects/andyyan-gsi/files/) \u2014 but their files live on SourceForge, which (as of 2026-10) blocks CLI downloads and intermittently fails in browsers too. The GitHub-hosted Doze-off builds are the reliable path.\n\nUnzip the unlock package, e.g. to `C:\\ums9230_UFS\\`. All `spd_dump` commands below run **from that folder**.\n\n---\n\n## 2. Enter BootROM (download) mode\n\nBootROM is the mask-ROM inside the chip \u2014 unreachable by software bricks, but it has no signature check... except one that CVE-2022-38694 bypasses.\n\n**The gesture (learn this \u2014 you'll use it many times):**\n1. Power the phone **off** (hold POWER ~15 s if needed).\n2. **Cable first:** connect USB to the PC and wait for the charging icon.\n3. Now hold **POWER + VOL_DOWN for 7\u201310 seconds, until the screen goes black.**\n4. Windows plays the USB-connect sound: Device Manager shows **`SPRD U2S Diag (COMx)`**.\n\nThe window is only ~12 s, so **start the waiting `spd_dump` command first**, then do the gesture. If it prints `find port failed`, close it, re-arm, retry the gesture.\n\n\u26a0\ufe0f If you ever see \"black screen with charging icon, no PC sound\" \u2014 that's just off-mode charging, not BootROM. No USB device = not in BootROM.\n\n---\n\n## 3. BACKUP (do not skip \u2014 it's the only \"firmware\" that will ever exist for this phone)\n\nThere is no official firmware image for the JP1. Your own backup is the only recovery source. Backup everything critical:\n\n**Arm the catch + dump the small critical partitions** (BootROM session #1, note: **no `reset` at the end** so the session stays alive):\n\n```bat\nspd_dump --wait 600 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r splloader r uboot r miscdata r misc r prodnv r trustos_a r trustos_b r sml_a r sml_b r uboot_log\n```\n\n**Then, fast, in a second command, reconnect to the same session and bulk-dump the rest** (use the `backup_list.xml` from this gist \u2014 55 partitions, ~700 MB total):\n\n```bat\nspd_dump --stage 2 blk_size 63488 path backup read_parts backup_list.xml reset\n```\n\nNotes:\n- Do **not** use plain `r all` \u2014 it also dumps the 9 GB `super` partition (hours over USB). The trimmed list covers everything *except* super/cache/userdata/blackbox, which you can't restore meaningfully anyway.\n- `--stage 2` attaches to the still-running FDL2 session without redoing the exploit. It's one-shot per session \u2014 run it promptly after command 1.\n- `blk_size 63488` raises transfer speed to several MB/s (default is slow).\n- When done, **copy the `backup\\` folder somewhere safe** (cloud + a second drive). It contains your IMEI/NV (`prodnv`, `l_fixnv*`), modem, trustzone, and every boot chain piece.\n\n---\n\n## 4. Unlock the bootloader (CVE-2022-38694)\n\nHow it works, briefly: dump SPL + uboot \u2192 erase SPL \u2192 write a cboot-flavored FDL2 into the uboot slot \u2192 boot a signature-check-NOPed SPL, which boots that cboot, which flips the `miscdata` unlock flag \u2192 restore originals.\n\nRun each block from the unlock package folder. After each `reset` the phone reboots \u2014 re-enter BootROM (section 2) for the next block.\n\n**4.1 \u2014 dump SPL + uboot, then erase SPL** (this dump doubles as the backup from step 3):\n\n```bat\nspd_dump --wait 600 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r splloader r uboot e splloader e splloader_bak reset\n```\n\n**4.2 \u2014 prepare the patched SPL and a size-fixed uboot backup:**\n\n```bat\ngen_spl-unlock splloader.bin\nren splloader.bin u-boot-spl-16k-sign.bin\nchsize uboot.bin\nren uboot.bin uboot_bak.bin\n```\n\n(`gen_spl-unlock` truncates the SPL to its real size and NOPs 4 signature checks \u2192 `u-boot-spl-16k-sign.bin` is now unsigned-boot-capable; `chsize` pads the uboot dump so it can be written back later.)\n\n**4.3 \u2014 park cboot in the uboot slot:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w uboot fdl2-cboot.bin reset\n```\n\n**4.4 \u2014 boot the NOPed SPL** (it chains cboot from flash, which rewrites `miscdata` = unlock; the phone reboots by itself when done \u2014 this may need to be run **twice**):\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800\n```\n\n**4.5 \u2014 verify the unlock flag:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec read_part miscdata 8192 64 miscdata_check.bin reset\n```\n\nOpen `miscdata_check.bin` in a hex editor: **64 zero bytes = still locked**; **non-zero data with two 16-byte blocks = unlocked** \u2705\n\n**4.6 \u2014 restore SPL + uboot and wipe the boot command block:**\n\n```bat\nspd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r boot w splloader u-boot-spl-16k-sign.bin w uboot uboot_bak.bin w misc misc-wipe.bin reset\n```\n\n(The `r boot` grabs your stock boot image too \u2014 keep `boot.bin`! You'll use it for Magisk.)\n\n**4.7 \u2014 boot Android.** It will factory-reset and show a bootloader-unlock warning at power-on. Verify from adb:\n\n```\nadb shell getprop ro.boot.flash.locked     \u2192 0\nadb shell getprop ro.boot.verifiedbootstate \u2192 orange\n```\n\nRe-enable Developer options + USB debugging after the reset.\n\n---\n\n## 5. Root with Magisk\n\n1. `adb install Magisk-v30.7.apk`\n2. `adb push backup-from-step-4\\boot.bin /sdcard/Download/boot_a.bin`  *(the stock boot you dumped in 4.6 \u2014 it must be the image for the **currently active slot**, check with `adb shell getprop ro.boot.slot_suffix`)*\n3. Magisk app \u2192 **Install** \u2192 **Select and Patch a File** \u2192 pick `Download/boot_a.bin` \u2192 **LET'S GO** \u2192 wait for *All done!*\n4. Pull it:\n   ```bat\n   adb pull /sdcard/Download/magisk_patched-XXXXX.img magisk_patched.img\n   ```\n5. Flash it \u2014 **in bootloader fastboot, and note the explicit `_a` name**:\n   ```bat\n   adb reboot bootloader\n   fastboot flash boot_a magisk_patched.img\n   fastboot reboot\n   ```\n\n\u26a0\ufe0f Quirks on this device:\n- `fastboot flash boot ...` (bare name) fails with `Write img fail!` \u2014 always use `boot_a`/`boot_b`.\n- **`fastboot flash vbmeta_a` (any vbmeta!) in bootloader mode hangs the phone mid-write** and needs a physical restart. Never flash vbmeta in bootloader mode here. (In fact \u2014 see section 7 \u2014 never flash vbmeta at all.)\n- Reboot \u2192 `adb shell su -c id` \u2192 `uid=0(root)` after you approve Magisk's Shell prompt. \u2705\n\n---\n\n## 6. Flash LineageOS GSI (the safe way)\n\n```bat\nadb reboot bootloader\nfastboot reboot fastboot                  :: boots userspace fastbootd (shows \"fastbootd\" on screen)\nfastboot flash system LineageOS-22.2_treble_arm64_bgN.img\nfastboot -w                               :: wipes userdata+cache \u2014 REQUIRED when switching ROMs\nfastboot reboot\n```\n\n- Decompress the GSI first (`LineageOS-22.2_treble_arm64_bgN.img.xz` \u2192 `.img`, ~3 GB): use 7-Zip, or `xz -d` / Windows' built-in `tar.exe`.\n- `system_a` on the JP1 is ~3.8 GiB; this GSI is ~3.05 GiB \u2014 fits. fastbootd auto-resizes the logical partition.\n- First boot takes 5\u201315 min (boot splash \u2192 LineageOS animation \u2192 setup wizard).\n- Expect the \"orange state\" bootloader warning at every power-on \u2014 normal for an unlocked phone.\n\n---\n\n## 7. \ud83d\udd25 THE BOOTLOOP TRAP \u2014 and how to recover\n\n**Every generic GSI guide says:** `fastboot flash vbmeta vbmeta.img --disable-verity --disable-verification`.\n**On this phone that command causes a hard bootloop, even with the bootloader unlocked.**\n\nWhy: that flag rewrite **invalidates the vbmeta's cryptographic signature**. Unisoc's bootloader (cboot/LK) **panics on any signature-invalid vbmeta in the chain \u2014 regardless of unlock state**. It fills a panic counter, then locks you into a boot-cycle (splash logo \u2192 fastboot text \u2192 reboot). The GSI itself is *fine*: with all **stock signed vbmetas** left in place, cboot boots the GSI happily \u2014 the AVB hashtree mismatch on an unlocked device just means no dm-verity (orange state).\n\n**Rules:**\n1. **Never flash any vbmeta on this device. Not with flags, not at all.**\n2. Bootloader-mode vbmeta writes additionally hang the phone mid-write.\n\n**If you already did it and are bootlooping** (this exact recovery worked):\n\n1. Enter BootROM (section 2), keep the phone on USB.\n2. Restore all six stock vbmetas of the active slot from your backup, and reset the panic counters (they live in `sysdumpdb`):\n   ```bat\n   spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w vbmeta_a backup\\vbmeta_a.bin w vbmeta_system_a backup\\vbmeta_system_a.bin w vbmeta_vendor_a backup\\vbmeta_vendor_a.bin w vbmeta_system_ext_a backup\\vbmeta_system_ext_a.bin w vbmeta_product_a backup\\vbmeta_product_a.bin w vbmeta_odm_a backup\\vbmeta_odm_a.bin w sysdumpdb backup\\sysdumpdb.bin reset\n   ```\n3. **True cold boot:** hold POWER ~20 s until really off, then power on. (The stale \"reboot into fastboot\" reason lives in a register that only clears on cold boot.)\n4. If it still loops, diagnose from BootROM \u2014 the bootloader keeps logs you can read:\n   ```bat\n   spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r uboot_log read_part sysdumpdb 0 10485760 sysdumpdb.bin reset\n   ```\n   Extract strings from `uboot_log.bin` (16 MB ring buffer; find the last `welcome to lk` block) and look at `sysdumpdb.bin` (text lines: `reboot reg`, `reset mode`, `reason is ...`). `reason is bootloader panic` = something in the boot chain is wrong (usually vbmeta); kernel panics appear differently.\n5. Still stuck? Restore the whole step-4.6 state (SPL/uboot/misc) from backup and boot \u2014 with slot b never flashed, `fastboot set_active b` from bootloader is your fallback to stock.\n\n---\n\n## 8. Bonus: 24/7 dashboard setup (chart display use-case)\n\nRooted LineageOS settings that make a plugged-in display phone behave:\n\n```bat\nadb shell settings put global stay_on_while_plugged_in 7    :: screen never sleeps on charger\nadb shell settings put system screen_off_timeout 2147480000  :: fallback timeout, maxed\nadb shell settings put system accelerometer_rotation 1       :: auto-rotate for the landscape stand\nadb shell dumpsys deviceidle whitelist +org.mozilla.firefox  :: never let Android kill Firefox\nadb shell cmd appops set org.mozilla.firefox RUN_ANY_IN_BACKGROUND allow\n```\n\n- zRAM is on by default here (2.27 GiB compressed swap) \u2014 no config needed.\n- This phone's charger IC ignores software charge-limit writes, so a 24/7-plugged battery sits at 100%; slow 2.5 W charging keeps it cool. Recommend a weekly drain to ~50\u201360%.\n- Battery temperature watchdog (Magisk service script, alerts above 42 \u00b0C) \u2014 drop this in `/data/adb/service.d/batterywatch.sh`, `chmod 755`:\n  ```sh\n  #!/system/bin/sh\n  while true; do\n      T=$(cat /sys/class/power_supply/battery/temp 2>/dev/null)\n      if [ -n \"$T\" ] && [ \"$T\" -ge 420 ]; then\n          cmd notification post -S bigtext -t \"BatteryWatch\" BatteryWatch \"Battery is $((T/10)).$((T%10))C - hot!\"\n      fi\n      sleep 600\n  done &\n  ```\n\n---\n\n## FAQ\n\n**Q: Is my phone bricked if it only shows the splash / fastboot screen?**\nNo. If BootROM mode works (section 2 gesture + `SPRD U2S Diag` appears), you can read/write every partition and recover. The splash-then-fastboot cycle is usually the bootloader panic of section 7.\n\n**Q: Can I use the eMMC package if I can't find the UFS one?**\nNo. UFS device + eMMC FDL2 = brick risk. The FDL2 log line `Storage is ufs` is your green light.\n\n**Q: Which Magisk partition?**\n`boot` (via `boot_a`/`boot_b`) \u2014 not `init_boot` on this phone (issue #116 in the unlock repo confirms).\n\n**Q: Why Android 15 and not 16?**\n4 GB RAM. LOS 22.2 (A15) runs comfortably; A16 GSIs are heavier. Same reasoning says pick the `-bgN` (GApps included) variant over vanilla + separate GApps flash.\n\n**Q: Does the unlock trip anything permanent?**\nThe orange warning at boot and an unlocked `miscdata` flag \u2014 that's it. There's no re-lock on this device.\n\n---\n\n## Credits\n\n- **TomKing062** \u2014 CVE-2022-38694 research, `spd_dump`, the unlock packages, and the wiki. The JP1 was confirmed working in [issue #116](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/issues/116).\n- **Doze-off** \u2014 TrebleDroid-based LineageOS GSI builds ([releases](https://github.com/Doze-off/lineage_treble/releases)).\n- **MisterZtr, Andy Yan, phhusson / TrebleDroid** \u2014 GSI ecosystem.\n- **topjohnwu** \u2014 Magisk.\n\n*Guide compiled 2026-10-01 from a live end-to-end session on a JamboPhone JP1. Follow at your own risk \u2014 but do the backup and nothing here is unrecoverable.*\n", "creation_timestamp": "2026-10-01T12:57:41.000000Z"}