CVE-2022-38694

PoC: spd_flasher

CVE-2022-38694 Hardened Exploit - RP2350 USB Host Auto Flasher for Unisoc devices

PoC: Bootloader_Unlock_Anbernic_T820

Bootloader unlock using CVE-2022-38694 for Anbernic Unisoc T820 devices

PoC: CRACK12

rooting an ATOZEE P12 on Android 14 using CVE-2022-38694 — because fastboot oem unlock said no, so we found another way.

PoC: BLU_G35

A self-contained Linux kit for BLU G35 (Unisoc SC9863A): unlock the bootloader via the publicly documented CVE-2022-38694 BootROM method, insure first with three cross-verified backups, gate every write behind typed consent, and roll back to full box state. Security research — read the pinned issue before running anything.

PoC: zte-blade-v40-vita-unlock

Unlocking the ZTE Blade V40 Vita (P606F02 / Unisoc UMS9230 / UFS) bootloader via CVE-2022-38694 - Linux scripts, the FBE post-unlock hang fix, and the two traps nobody documents

PoC: vankyo-s30-bootloader-unlock

Vankyo MatrixPad S30 (Unisoc SC9863A) — Bootloader unlock via CVE-2022-38694 FDL1 method

PoC: spd_dump-macos

UNISOC BootROM/FDL flasher for macOS: patched spd_dump with CVE-2022-38694 exec_addr2, protocol reference, partition rules, backup verification (UMS9621)

PoC: UnisocBootROMs

This is a collection of Unisoc BootROMs i've dumped from various Unisoc chipsets via CVE-2022-38694

PoC: ROOT-ZTE-X1001

Magisk root guide for ZTE Blade X1001 (Android 15, Unisoc UMS9230) using CVE-2022-38694 exploit. Contributions and screenshots welcome.

PoC: ztewaste

Extract a concerning amount of user information from Unisoc ZTE devices using CVE-2022-38694.

PoC: realme-c53-unlock-root

Bootloader unlock (CVE-2022-38694) & root guide for Realme C53 / RMX3760 (Unisoc T612)

PoC: ubl-itel-s23

Unlock Bootloader for Itel S23 (S665L) / Unisoc T606 using CVE-2022-38694

PoC: ubl-itel-s23

Unlock Bootloader for Itel S23 (S665L) / Unisoc T606 using CVE-2022-38694

PoC: UNISOCUnlocker

Free and Open-Source FRP Remover based on CVE-2022-38694

PoC: TigerSmash

CVE-2022-38694 implementation with GUI

PoC: Bootloader_Unlock_Retroid_Pocket_3Plus

Bootloader unlock using CVE-2022-38694 for Retroid Pocket 3+

PoC: ud710_patch

patch to compile jingpad source code (mainly use for CVE-2022-38694 now)

PoC: CVE-2022-38694_unlock_bootloader

unlock bootloader for unisoc T7510, only tyyh2021 supported now, tyyh2020 will be added soon, other T7510 model could be added (do it yourself)