Vankyo S30 Bootloader Unlock

Unlock the bootloader on a Vankyo MatrixPad S30 (Unisoc SC9863A) using the CVE-2022-38694 FDL1 method.

The S30's BootROM accepts unsigned FDL1 in download mode without requiring the ROP bypass, which simplifies the unlock significantly.

Quick Start

./unlock.sh --prebuilt    # Use prebuilt binaries (no compilation needed)
./unlock.sh --source      # Build from source (needs PAC firmware + distrobox)

After unlocking, verify:

./verify.sh

Two Paths

Prerequisites

• Linux host with usbutils (lsusb) and libusb
• USB cable (data-capable)
• The S30 tablet, powered off
• For source builds: a Vankyo S30 PAC firmware file (see vankyo-s30-vendor-pac repo)

Entering Download Mode

1. Power off the tablet completely
2. Hold Volume Down
3. Press the recessed reset button beside the power button (use a paperclip)
4. Release reset, then release Volume Down
5. Verify: lsusb | grep 1782 should show 1782:4d00

Unlock Sequence

The interactive script guides you through the phases:

1. Backup & erase SPL — reads and saves original splloader/uboot, erases SPL
2. Build native patched u-boot (recommended) — regenerates fdl2-cboot/fdl2-dl from the device's own uboot backup (anchors identical across all observed builds)
3. Write patched u-boot — flashes fdl2-cboot.bin which calls set_lock_status(1) when booted. Note: this phase alone does not write the unlock data — the stock SPL verifies u-boot and boots uboot_bak instead.
4. Send spl-unlock — required. Boots the patched u-boot through the BootROM fallback path, which writes the unlock data to miscdata. CHECK_BAUD FAIL output here is normal (an SPL does not speak the FDL1 diag protocol).
5. Verify unlock — reads miscdata to confirm unlock data was written
6. Restore originals — writes back original splloader/uboot, wipes misc

Documentation

See docs/ for:

• FINDINGS.md — field-observed behaviour catalog: corrected unlock semantics, spd_dump console output reference, USB/connection quirks, hardware failure modes (cold BGA joints), firmware build comparison
• GUIDE.md — comprehensive unlock guide with technical details
• CVE-2022-38694-ANALYSIS.md — exploit vulnerability analysis
• CHAIN_OF_TRUST.md — Unisoc boot chain documentation
• HANDOFF-full.md — AVB bypass research notes
• Full exploit analysis, format docs, and historical logs

reference/ contains full download-mode partition readbacks from real devices (e.g. reference/S30_20201020-S3032GBUSTUVWXYZ018151/ — a second tablet running the otherwise-unavailable S30_20201020 build, including its locked and unlocked miscdata blobs).

Repository Layout

unlock.sh          — guided interactive unlock script
verify.sh          — verify unlock status
prebuilt/          — prebuilt binaries (no compilation needed)
source/            — build-from-source scripts + CVE-2022-38694 exploit source
exploit-artifacts/  — FDL2 AVB bypass experiment images
reference/         — full partition readbacks from real devices
docs/              — guides, analysis, and historical logs