aureliusivan/ubl-itel-s23Unlock Bootloader for Itel S23 (S665L) / Unisoc T606 using CVE-2022-38694
Guide to unlock the bootloader on the Itel S23 (S665L) using the CVE-2022-38694 exploit on the Unisoc T606 (UMS9230) chipset.
| Property | Value |
|---|---|
| Brand | Itel |
| Model | S665L (S23) |
| Android | 12 (SDK 31) |
| Build | S665L-F065OPRSUVApAqAr-S-GL-20250207V533 |
| SoC | Unisoc T606 (UMS9230) |
| CPU | 2x Cortex-A75 + 6x Cortex-A55 (ARMv8, 64-bit) |
| Storage | UFS |
| Slot | A/B |
adb and fastboot installedubl-itel-s23/
├── README.md
├── CLAUDE.md
├── recovery/
│ ├── TWRP_S665L.img # TWRP recovery image
│ └── OrangeFox_S665L.img # OrangeFox recovery image
└── tools/
└── spreadtrum_flash_linux/
├── spd_dump # BootROM communication tool
├── gen_spl-unlock # Unlock payload generator
├── unlock.sh # Automated unlock script
├── fdl1-dl.bin # First-stage loader
├── fdl2-dl.bin # Second-stage loader
├── fdl2-cboot.bin # Modified uboot for unlock
├── custom_exec_no_verify_65015f08.bin # CVE exploit payload
├── custom_exec_no_verify_65015f48.bin # CVE exploit payload (alt)
├── splloader.bin # SPL backup (generated during process)
├── uboot.bin # uboot backup (generated during process)
├── spl-unlock.bin # Unlock payload (generated during process)
└── ums9230/itel/ # FDL binaries for Itel UMS9230
This exploit takes advantage of a vulnerability in the Unisoc BootROM that allows writing data to a memory region before signature verification completes.
Normal: BootROM → verify(FDL1) → REJECT (unsigned)
Exploit: BootROM → overwrite verify() → verify = always_true
→ accept(FDL1) → ACCEPT → unlock bootloader
The custom_exec_no_verify payload (96 bytes) overwrites the signature verification function pointer at address 0x65015f08, causing the BootROM to accept any FDL1 without checking its signature.
sudo tee /etc/udev/rules.d/51-android.rules << 'EOF'
# Google/Android (ADB & Fastboot)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
# Spreadtrum/Unisoc
SUBSYSTEM=="usb", ATTR{idVendor}=="1782", MODE="0666", GROUP="plugdev"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger
cd tools/spreadtrum_flash_linux
cp ums9230/itel/fdl1-dl.bin ums9230/itel/fdl2-dl.bin ums9230/itel/fdl2-cboot.bin .
cp ums9230/custom_exec_no_verify_65015f08.bin ums9230/custom_exec_no_verify_65015f48.bin .
chmod +x spd_dump gen_spl-unlock
Phone must be powered on and connected via USB. After this step, the phone will not boot until Step 6.
sudo ./spd_dump exec_addr 0x65015f48 fdl fdl1-dl.bin 0x65000800 \
fdl fdl2-dl.bin 0x9efffe00 exec \
r splloader r uboot e splloader e splloader_bak reset
Back up splloader.bin and uboot.bin to a safe location:
cp splloader.bin uboot.bin backup_spl/
./gen_spl-unlock splloader.bin 0xfd28
Output: spl-unlock.bin
The offset
0xfd28is specific to this firmware. Check the size ofsplloader.bin— the offset should match the file size.
Enter BROM mode: power off the phone, hold Volume Down, then plug in USB.
sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
fdl fdl2-dl.bin 0x9efffe00 exec \
w uboot fdl2-cboot.bin reset
Enter BROM mode again, then:
sudo ./spd_dump exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800
If you see device removed, exiting... it means success.
Enter BROM mode again, then:
sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
fdl fdl2-dl.bin 0x9efffe00 exec \
verbose 2 read_part miscdata 8192 64 m.bin reset
recv 64 zero = still LOCKED (failed)recv 32 string + hash data = UNLOCKED (success)Enter BROM mode again, then:
sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
fdl fdl2-dl.bin 0x9efffe00 exec \
w splloader splloader.bin w uboot uboot.bin reset
The phone will reboot. Select Factory Reset when Android Recovery appears.
After the phone boots into Android:
adb shell getprop ro.boot.vbmeta.device_state
# Expected: unlocked
adb shell getprop ro.boot.flash.locked
# Expected: 0
splloader.bin and uboot.bin — they are needed for restore if something goes wrong0x65015f48, steps 3-6 use 0x65015f08spd_dump / CVE-2022-38694 Unlock Bootloader by TomKing062 / QuTick102 https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader
Recovery Collections & Spreadtrum Flash Tool (Linux) by Massatriof16 https://massatriof16.github.io/recovery-collections/#alat
unisoc-unlock (Python alternative) by patrislav1 https://github.com/patrislav1/unisoc-unlock