ubl-itel-s23/
├── README.md
├── CLAUDE.md
├── recovery/
│   ├── TWRP_S665L.img              # TWRP recovery image
│   └── OrangeFox_S665L.img         # OrangeFox recovery image
└── tools/
    └── spreadtrum_flash_linux/
        ├── spd_dump                 # BootROM communication tool
        ├── gen_spl-unlock           # Unlock payload generator
        ├── unlock.sh                # Automated unlock script
        ├── fdl1-dl.bin              # First-stage loader
        ├── fdl2-dl.bin              # Second-stage loader
        ├── fdl2-cboot.bin           # Modified uboot for unlock
        ├── custom_exec_no_verify_65015f08.bin  # CVE exploit payload
        ├── custom_exec_no_verify_65015f48.bin  # CVE exploit payload (alt)
        ├── splloader.bin            # SPL backup (generated during process)
        ├── uboot.bin                # uboot backup (generated during process)
        ├── spl-unlock.bin           # Unlock payload (generated during process)
        └── ums9230/itel/            # FDL binaries for Itel UMS9230

Normal:   BootROM → verify(FDL1) → REJECT (unsigned)
Exploit:  BootROM → overwrite verify() → verify = always_true
               → accept(FDL1) → ACCEPT → unlock bootloader

sudo tee /etc/udev/rules.d/51-android.rules << 'EOF'
# Google/Android (ADB & Fastboot)
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
# Spreadtrum/Unisoc
SUBSYSTEM=="usb", ATTR{idVendor}=="1782", MODE="0666", GROUP="plugdev"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger

cd tools/spreadtrum_flash_linux
cp ums9230/itel/fdl1-dl.bin ums9230/itel/fdl2-dl.bin ums9230/itel/fdl2-cboot.bin .
cp ums9230/custom_exec_no_verify_65015f08.bin ums9230/custom_exec_no_verify_65015f48.bin .
chmod +x spd_dump gen_spl-unlock

sudo ./spd_dump exec_addr 0x65015f48 fdl fdl1-dl.bin 0x65000800 \
  fdl fdl2-dl.bin 0x9efffe00 exec \
  r splloader r uboot e splloader e splloader_bak reset

cp splloader.bin uboot.bin backup_spl/

./gen_spl-unlock splloader.bin 0xfd28

sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
  fdl fdl2-dl.bin 0x9efffe00 exec \
  w uboot fdl2-cboot.bin reset

sudo ./spd_dump exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800

sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
  fdl fdl2-dl.bin 0x9efffe00 exec \
  verbose 2 read_part miscdata 8192 64 m.bin reset

sudo ./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 \
  fdl fdl2-dl.bin 0x9efffe00 exec \
  w splloader splloader.bin w uboot uboot.bin reset

adb shell getprop ro.boot.vbmeta.device_state
# Expected: unlocked

adb shell getprop ro.boot.flash.locked
# Expected: 0