1
adb shell getprop ro.product.cpu.abi
2
adb shell getprop ro.treble.enabled
3
adb shell getprop ro.boot.slot_suffix
4
adb shell getprop ro.boot.dynamic_partitions
5
adb shell getprop ro.virtual_ab.enabled
6
adb shell getprop ro.boot.hardware
7
adb reboot fastboot
8
fastboot getvar current-slot
9
fastboot getvar is-userspace

1
param(
2
    [int]$TimeoutSeconds = 900,
3
    [string]$OutputRoot = 'E:\ufs',
4
    [int]$SpdWaitSeconds = 300,
5
    [int]$MinimumFreeGB = 140,
6
    [switch]$NoHash
7
)
8

9
$ErrorActionPreference = 'Stop'
10

11
$ToolDir = Split-Path -Parent $MyInvocation.MyCommand.Path
12
$VidPidPattern = 'VID_1782&PID_4D00'
13
$ExecAddr = '0x65015f08'
14
$Fdl1Addr = '0x65000800'
15
$Fdl2Addr = '0x9efffe00'
16

17
# Full partition list captured from this BPad Mini SE / UMS9230 UFS device.
18
# READ ONLY: this script uses only spd_dump 'r <partition>' commands plus final reset.
19
$Partitions = @(
20
    'splloader',
21
    'prodnv','items','miscdata','misc',
22
    'trustos_a','trustos_b','sml_a','sml_b','uboot_a','uboot_b','uboot_log',
23
    'logo','fbootlogo',
24
    'l_fixnv1_a','l_fixnv2_a','l_fixnv1_b','l_fixnv2_b','l_runtimenv1','l_runtimenv2','persist',
25
    'l_modem_a','l_modem_b','l_deltanv_a','l_deltanv_b','l_gdsp_a','l_gdsp_b','l_ldsp_a','l_ldsp_b','l_agdsp_a','l_agdsp_b',
26
    'pm_sys_a','pm_sys_b','teecfg_a','teecfg_b','hypervsior_a','hypervsior_b',
27
    'boot_a','boot_b','vendor_boot_a','vendor_boot_b','init_boot_a','init_boot_b','dtb_a','dtb_b','dtbo_a','dtbo_b',
28
    'super','cache','blackbox','vbmeta_a','vbmeta_b','metadata','sysdumpdb',
29
    'vbmeta_system_a','vbmeta_system_b','vbmeta_vendor_a','vbmeta_vendor_b','vbmeta_system_ext_a','vbmeta_system_ext_b','vbmeta_product_a','vbmeta_product_b','vbmeta_odm_a','vbmeta_odm_b',
30
    'avbmeta_rs_a','avbmeta_rs_b','common_rs1_a','common_rs1_b','common_rs2_a','common_rs2_b','common_rs3_a','common_rs3_b',
31
    'reserve1','reserve2','calinv','userdata'
32
)
33

34
function Get-SprdDiagDevice {
35
    Get-CimInstance Win32_PnPEntity |
36
        Where-Object { $_.DeviceID -like "*$VidPidPattern*" -and $_.Status -eq 'OK' }
37
}
38

39
function Get-DriveFreeGB([string]$Path) {
40
    $item = Get-Item -LiteralPath $Path
41
    $driveName = $item.PSDrive.Name
42
    $drive = Get-PSDrive -Name $driveName
43
    [math]::Round($drive.Free / 1GB, 2)
44
}
45

46
foreach ($required in @('spd_dump.exe','Channel.ini','Channel9.dll','custom_exec_no_verify_65015f08.bin','fdl1-dl.bin','fdl2-dl.bin')) {
47
    if (-not (Test-Path -LiteralPath (Join-Path $ToolDir $required))) {
48
        throw "Missing required file in tool directory: $required"
49
    }
50
}
51

52
if (-not (Test-Path -LiteralPath $OutputRoot)) {
53
    New-Item -ItemType Directory -Path $OutputRoot | Out-Null
54
}
55

56
$freeGB = Get-DriveFreeGB $OutputRoot
57
Write-Host "Output root: $OutputRoot"
58
Write-Host "Free space on output drive: $freeGB GB"
59
if ($freeGB -lt $MinimumFreeGB) {
60
    throw "Not enough free space. Need at least $MinimumFreeGB GB for full backup with userdata."
61
}
62

63
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
64
$BackupDir = Join-Path $OutputRoot "backup-full-readonly-$stamp"
65
New-Item -ItemType Directory -Path $BackupDir | Out-Null
66

67
foreach ($required in @('spd_dump.exe','Channel.ini','Channel9.dll','custom_exec_no_verify_65015f08.bin','fdl1-dl.bin','fdl2-dl.bin')) {
68
    Copy-Item -LiteralPath (Join-Path $ToolDir $required) -Destination (Join-Path $BackupDir $required) -Force
69
}
70

71
$partListPath = Join-Path $BackupDir 'PARTITIONS_REQUESTED.txt'
72
$Partitions | Set-Content -LiteralPath $partListPath -Encoding ASCII
73
$LogPath = Join-Path $BackupDir 'spd_dump-full-readonly.log'
74

75
Write-Host "Waiting for SPRD U2S Diag ($VidPidPattern) for up to $TimeoutSeconds seconds..."
76
$deadline = (Get-Date).AddSeconds($TimeoutSeconds)
77
$device = $null
78
while ((Get-Date) -lt $deadline) {
79
    $device = Get-SprdDiagDevice | Select-Object -First 1
80
    if ($device) { break }
81
    Start-Sleep -Seconds 1
82
}
83
if (-not $device) {
84
    throw "SPRD U2S Diag device not found. Re-enter download mode and retry."
85
}
86
Write-Host "Found: $($device.Name) [$($device.DeviceID)]"
87
Write-Host "Backup directory: $BackupDir"
88
Write-Host "Partitions to read: $($Partitions.Count)"
89
Write-Host "This is READ ONLY: no erase/write/unlock payload commands are used."
90

91
$argsList = @(
92
    '--wait', "$SpdWaitSeconds",
93
    'exec_addr', $ExecAddr,
94
    'fdl', 'fdl1-dl.bin', $Fdl1Addr,
95
    'fdl', 'fdl2-dl.bin', $Fdl2Addr,
96
    'exec'
97
)
98
foreach ($partition in $Partitions) {
99
    if ($partition -match '^(e|w|write|erase|reset|exec|fdl)$') {
100
        throw "Refusing suspicious partition token: $partition"
101
    }
102
    $argsList += @('r', $partition)
103
}
104
$argsList += 'reset'
105

106
Push-Location $BackupDir
107
try {
108
    & .\spd_dump.exe @argsList 2>&1 | Tee-Object -FilePath $LogPath
109
} finally {
110
    Pop-Location
111
}
112

113
Get-ChildItem -LiteralPath $BackupDir -File |
114
    Where-Object { $_.Name -notin @('spd_dump.exe','Channel.ini','Channel9.dll','custom_exec_no_verify_65015f08.bin','fdl1-dl.bin','fdl2-dl.bin') } |
115
    Select-Object Name,Length,LastWriteTime |
116
    Format-Table -AutoSize |
117
    Out-String |
118
    Set-Content -LiteralPath (Join-Path $BackupDir 'FILES.txt') -Encoding ASCII
119

120
if (-not $NoHash) {
121
    Write-Host "Computing SHA256 manifest. This can take a long time for userdata..."
122
    $hashLines = foreach ($file in Get-ChildItem -LiteralPath $BackupDir -File | Where-Object { $_.Name -notin @('spd_dump.exe','Channel.ini','Channel9.dll','custom_exec_no_verify_65015f08.bin','fdl1-dl.bin','fdl2-dl.bin') }) {
123
        $h = Get-FileHash -Algorithm SHA256 -LiteralPath $file.FullName
124
        "$($h.Hash)  $($file.Name)"
125
    }
126
    $hashLines | Set-Content -LiteralPath (Join-Path $BackupDir 'SHA256SUMS.txt') -Encoding ASCII
127
}
128

129
Write-Host "Full read-only backup complete."
130
Write-Host "Backup directory: $BackupDir"
131
Get-Content -LiteralPath (Join-Path $BackupDir 'FILES.txt')

1
cd F:\project\pad\unisoc_unlock\ums9230_universal_unlock_UFS.dangerous
2
powershell -ExecutionPolicy Bypass -File .\backup_full_readonly_wait_sprd.ps1

1
@echo off
2
setlocal enabledelayedexpansion
3
cd /d "%~dp0"
4
echo === STAGED UMS9230 UFS UNLOCK START ===
5
echo This script uses pre-generated backup-derived files.
6
echo It WILL erase splloader/splloader_bak, write temporary uboot, run unlock payload, then restore splloader/uboot and wipe misc.
7
echo.
8

9
echo [1/5] Erase splloader and splloader_bak for fallback path
10
spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec e splloader e splloader_bak reset
11
if errorlevel 1 goto fail
12

13
timeout /t 10 /nobreak
14

15
echo [2/5] Write temporary fdl2-cboot into active uboot
16
spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w uboot fdl2-cboot.bin reset
17
if errorlevel 1 goto fail
18

19
timeout /t 10 /nobreak
20

21
echo [3/5] Run unlock payload, may need twice on some devices
22
spd_dump --wait 300 exec_addr 0x65015f08 fdl spl-unlock.bin 0x65000800
23
if errorlevel 1 echo unlock payload returned non-zero; continuing to check/restore
24

25
timeout /t 10 /nobreak
26

27
echo [4/5] Check unlock data in miscdata. Locked: 64 zeros. Unlocked: 32 string + 16 hash + 16 hash.
28
spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec verbose 2 read_part miscdata 8192 64 m.bin reset
29
if errorlevel 1 echo miscdata check failed; continuing to restore
30

31
timeout /t 10 /nobreak
32

33
echo [5/5] Restore splloader and active uboot, wipe misc, reset
34
spd_dump --wait 300 exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec r boot w splloader u-boot-spl-16k-sign.bin w uboot uboot_bak.bin w misc misc-wipe.bin reset
35
if errorlevel 1 goto restore_fail
36

37
echo === STAGED UMS9230 UFS UNLOCK COMPLETE ===
38
exit /b 0
39

40
:restore_fail
41
echo === RESTORE FAILED. DO NOT PANIC, KEEP DEVICE CONNECTED/IN DIAG IF POSSIBLE. ===
42
exit /b 2
43

44
:fail
45
echo === UNLOCK SCRIPT FAILED BEFORE RESTORE STAGE ===
46
exit /b 1

1
cd /d F:\project\pad\unisoc_unlock\ums9230_universal_unlock_UFS.dangerous
2
unlock_staged_no_pause.bat

1
adb reboot fastboot
2
fastboot getvar is-userspace
3
fastboot getvar current-slot
4
fastboot getvar unlocked

1
adb reboot fastboot
2
fastboot getvar is-userspace
3
fastboot getvar current-slot
4
fastboot getvar unlocked

1
fastboot flash system E:\ufs\gsi\crDroid-11.6_treble_arm64_bgN-ab.img
2
fastboot -w
3
fastboot reboot

1
adb shell settings put global captive_portal_mode 1
2
adb shell settings put global captive_portal_http_url http://connect.rom.miui.com/generate_204
3
adb shell settings put global captive_portal_https_url https://connect.rom.miui.com/generate_204
4
adb shell settings put global captive_portal_fallback_url http://connectivitycheck.platform.hicloud.com/generate_204
5
adb shell settings put global captive_portal_other_fallback_urls http://www.google.cn/generate_204
6
adb shell settings put global captive_portal_use_https 1
7
adb shell svc wifi disable
8
adb shell svc wifi enable

1
adb reboot fastboot
2
fastboot getvar is-userspace
3
fastboot getvar current-slot
4
fastboot flash super E:\ufs\backup-full-readonly-20260527-202422\super.bin
5
fastboot -w
6
fastboot reboot

1
fastboot flash boot_b E:\ufs\backup-full-readonly-20260527-202422\boot_b.bin
2
fastboot flash vendor_boot_b E:\ufs\backup-full-readonly-20260527-202422\vendor_boot_b.bin
3
fastboot flash init_boot_b E:\ufs\backup-full-readonly-20260527-202422\init_boot_b.bin
4
fastboot flash dtb_b E:\ufs\backup-full-readonly-20260527-202422\dtb_b.bin
5
fastboot flash dtbo_b E:\ufs\backup-full-readonly-20260527-202422\dtbo_b.bin
6
fastboot flash vbmeta_b E:\ufs\backup-full-readonly-20260527-202422\vbmeta_b.bin