spd_dump for macOS

English | 简体中文

macOS port of the UNISOC (Spreadtrum) BootROM/FDL flashing toolchain. Based on ilyakurdyukov/spreadtrum_flash (MIT), with exec_addr2 — the CVE-2022-38694 signature-verification bypass of the closed-source spd_dump — reimplemented, completing the full chain on macOS (arm64 + libusb):

BootROM → CVE out-of-bounds write → FDL1 → FDL2 → GPT parse → partition R/W → reset

Verified on UMS9621 (T158), Android 13, kernel 5.15, GKI (init_boot) layout. Address-compatible with the UMS9620 family; other SoCs: see Porting.

Build

Dependencies: Xcode CLT, brew install libusb.

./scripts/build-macos.sh   # produces ./spd_dump

Usage

Entering download mode

With the device powered off and disconnected, hold Reset (or the model-specific key combination) while plugging in USB; the device enumerates as 1782:4d00. The BootROM answers only for roughly 20 seconds after enumeration, then goes silent (still enumerated). Automation must trigger on the absent→present edge (see scripts/runner.sh).

Loading FDL2 and reading the partition table

./spd_dump --wait 3 exec_addr2 0x65017f08 verbose 1 \
    fdl fdl1-dl.bin 0x65000800 \
    fdl fdl2-dl.bin 0xbefffe00 \
    disable_transcode partition_list gpt.xml

Backup

python3 scripts/backup_gen.py gpt.xml backup/ --img-dir data/
./spd_dump --wait 3 verbose 0 disable_transcode $(cat backup_args.txt)

backup_gen.py generates the read_part sequence from the GPT (resume-safe; GPT size unit is MB) and patches vbmeta* images offline with AVB flags=3 (equivalent to verity 0).

Flashing

python3 scripts/flash_gen.py gpt.xml data/ flash_ops.txt
N=$(grep -c 'write_part\|erase_part' flash_ops.txt)
{ yes yes | head -n $N; sleep 3600; } | ./spd_dump --wait 3 verbose 0 \
    disable_transcode $(cat flash_ops.txt | tr '\n' ' ')

flash_gen.py applies the partition rules (runtimenv → erase, fixnv/calinv skipped, slotless aliases deduplicated by mtime) and appends erase_part userdata + reset.

Protocol notes

Details in docs/protocol-notes.md (Chinese):

• Custom commands must be consumed by the option-parsing loop; verbose 1 terminates that loop early
• FDL2 sessions survive across processes: exiting spd_dump does not kill FDL2, so partition commands can run in batches
• 0x8A (DOWN_SIZE_ERROR) is also returned for: standalone downloads to protected addresses, writes to runtimenv, oversized read blocks
• Read block size cap is below 0xffff; default 4096
• Name-addressed reads of NV partitions (nr_fixnv1) hang the session; rules in docs/partition-rules.md (Chinese)

Backup verification

Cross-checking static partitions (dtb etc.) against known same-model images by md5 validates the read path end-to-end.

Porting to other SoCs

References

• ilyakurdyukov/spreadtrum_flash — upstream (MIT); patched source in src/
• TomKing062/CVE-2022-38694_unlock_bootloader — CVE analysis and per-SoC artifacts
• YC-nw/SPRDClientCore — protocol constants and partition rules
• NCC Group — UNISOC ROM Vulnerabilities

Headless-device Magisk su pre-authorization: docs/headless-magisk-su.md (Chinese).

BootROM-level operations carry a brick risk; back up first. Provided AS IS.