Vankyo S30 Bootloader Unlock

Unlock the bootloader on a Vankyo MatrixPad S30 (Unisoc SC9863A) using the CVE-2022-38694 FDL1 method.

The S30's BootROM accepts unsigned FDL1 in download mode without requiring the ROP bypass, which simplifies the unlock significantly.

Quick Start

./unlock.sh --prebuilt    # Use prebuilt binaries (no compilation needed)
./unlock.sh --source      # Build from source (needs PAC firmware + distrobox)

After unlocking, verify:

./verify.sh

Two Paths

Prerequisites

• Linux host with usbutils (lsusb) and libusb
• USB cable (data-capable)
• The S30 tablet, powered off
• For source builds: a Vankyo S30 PAC firmware file (see vankyo-s30-vendor-pac repo)

Entering Download Mode

1. Power off the tablet completely
2. Hold Volume Down
3. Press the recessed reset button beside the power button (use a paperclip)
4. Release reset, then release Volume Down
5. Verify: lsusb | grep 1782 should show 1782:4d00

Unlock Sequence

The interactive script guides you through 5 phases:

1. Backup & erase SPL — reads and saves original splloader/uboot, erases SPL
2. Write patched u-boot — flashes fdl2-cboot.bin which calls set_lock_status(1)
3. Send spl-unlock — sends patched SPL (usually unnecessary with FDL1 method)
4. Verify unlock — reads miscdata to confirm unlock data was written
5. Restore originals — writes back original splloader/uboot, wipes misc

Documentation

See docs/ for:

• GUIDE.md — comprehensive unlock guide with technical details
• CVE-2022-38694-ANALYSIS.md — exploit vulnerability analysis
• CHAIN_OF_TRUST.md — Unisoc boot chain documentation
• HANDOFF-full.md — AVB bypass research notes
• Full exploit analysis, format docs, and historical logs

Repository Layout

unlock.sh          — guided interactive unlock script
verify.sh          — verify unlock status
prebuilt/          — prebuilt binaries (no compilation needed)
source/            — build-from-source scripts + CVE-2022-38694 exploit source
exploit-artifacts/  — FDL2 AVB bypass experiment images
docs/              — guides, analysis, and historical logs