[hovatek]

This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader unlock guide but had no success due to fastboot commands not getting recognized e.g

Code:

FAILED (remote: 'unknown cmd.')
fastboot: error: Command failed

For the purpose of this guide, the abd & fastboot folders were first downloaded then copied to /home/ubuntu/Desktop

Requirements

• Basic Linux and command line knowledge
  
• A Linux based PC or Ubuntu setup on a Windows PC
  
• Enable USB Debugging and OEM Unlocking on the device
  
• Download platform-tools for Linux @ https://forum.hovatek.com/thread-17104.html
  
• Download modified fastboot @ [ Login / Register to download free]
  

How to unlock Unisoc (SPD) bootloader using Identifier Token

Follow the steps below to unlock the bootloader of Unisoc (SPD) devices

1. Extract the Platform Tools and Modified Fastboot zips to your desktop (this guide uses /home/ubuntu/Desktop). You should now have modified_fastboot & platform-tools folders
   
   
2. Launch Terminal
   
   
3. cd to the desktop
   
   Code:

   cd /home/ubuntu/Desktop
   
   
4. cd to the platform-tools folder
   
   Code:

   cd platform-tools
   
   
5. Connect the device via USB cable while powered ON then test adb connection
   
   Code:

   ./adb devices
   
   
6. If detected, you should see something like
   List of devices attached
   XXXXXXXXXXXX
   
   
7. Get the device into Bootloader using
   
   Code:

   ./adb reboot-bootloader
   
   
8. Once the device is in bootloader (with fastboot text), test fastboot detection
   
   Code:

   ./fastboot devices
   
   
9. If detected, you should have something like
   XXXXXXXX fastboot
   
   
10. cd back to desktop then to the modified_fastboot folder
    
    Code:

    cd ..
cd modified_fastboot
    
    
11. Get Identifier Token using
    
    Code:

    ./fastboot oem get_identifier_token
    
    
12. You should get an output like
    Identifier token:
    XXXXXXXXXXXXXXXXXXXXXXXX
    OKAY [ 0.019s]
    finished. total time: 0.019s
    
    
13. Copy out the Identifier token
    
    
14. Run this command ; replace XXXXXXXXXXXXXXXXXXXXXXXX with your Identifier token
    
    Code:

    ./signidentifier_unlockbootloader.sh XXXXXXXXXXXXXXXXXXXXXXXX rsa4096_vbmeta.pem signature.bin
    
    
15. You should have an output like
    Identifier sign script, ver 0.10
    1+0 records in
    1+0 records out
    50 bytes copied, 0.000257562 s, 194 kB/s
    Identifier sign successfully
    
    
16. You should also see a signature.bin file in the modified_fastboot folder
    
    
17. Finally, run this command
    
    Code:

    ./fastboot flashing unlock_bootloader signature.bin
    
    
18. You should get a prompt on the device asking you to push a volume button to confirm unlock, do so
    
    
    
    
19. You should now have an output like
    downloading 'unlock_message'...
    OKAY [ 0.001s]
    unlocking bootloader...
    Info:Unlock bootloader success! OKAY [ 85.787s]
    finished. total time: 85.788s
    
    
20. Reboot the device using
    
    Code:

    ./fastboot reboot
    
    
21. Your bootloader should now be unlocked
    

Important Notice

• You can also enter bootloader by first booting the device into recovery mode then selecting Reboot to Bootloader
  
• You could install adb and fastboot using sudo apt update then sudo apt install android-tools-adb android-tools-fastboot instead of downloading platform tools . This guide just tries to cater to those who end up with old adb / fastboot binaries or no internet connection once in Linux / Ubuntu
  
• This guide isn't guaranteed to work on all Unisoc devices especially if they require a different private key
  
• Unlocking bootloader wipes your data so ensure to backup important stuff first
  

Video Transcript

In this video tutorial, I'll be explaining
how to build a Factory Reset Protection (FRP)


and Privacy Protection Password (PPP) bypass
pac file using Research Download tool.


This guide will come in handy in a case where
you frequently bypass FRP or PPP for a particular


device model or you wish to send your bypass
pac file to somebody else.


That is because this approach gives you a
pac file that is just about a couple of megabytes


as opposed to having to load or upload a firmware
/pac file of about a GB plus.


For you to use this guide, you need to have
the pac file for your device mode.


You also need the persist.img and prodnv.img
backup from a working phone of the same model.


I'll link to a guide on how to extract those
using Research Download tool.


You're also going to need Research Download
tool.


I'll link to that in the description.


Now, once you have these in place, you launch
Research Download tool.


In Research Download tool, you click Load
Packet.


Navigate to the location of the pac file for
your device model then you click Open.


You wait while the pac file gets loaded.


Once the pac file is done loading, you're
going to have the information at the top-right


corner.


Next you click on Settings.


Under Settings, you click this item, that's
going to uncheck all items except FDL 1&2.


Next, you're going to tick the ProdNV item
and Persist items then you're going to be


loading both of them.


You double-click, click the browse icon.


I'll select persist.img for this.


I'll do the same for ProdNV; double-click,
browse icon..


ProdNV is for Privacy Protection Password
while Persist is for Factory Reset Protection


or FRP.


Now, you can include these items; EraseUBOOTLOG,
EraseRuntimeNV, EraseMisc and you can check


the UBOOT_LOADER.


These are all the items you'll be going with.


Now, you click on Packet, click on Yes, click
on Yes.


You can give your pac file a name, a version
and you select the location you wish to save


the pac file to.


I can give it a name; lets say P80X_PPP_FRP_bypass
pac the


click on Save.


You click OK.


Once that is done, you'll have Packeting Complete
and you can click on OK.


Now, you're going to have the pac file located
here.


To flash the pac file, you just need to load
it.


Click OK here.


Just load it by clicking Load Packet, select
then you click Open.


Don't forget that when you're trying to bypass
Privacy Protection Password, you should uncheck


backup of ProdNV under Settings.


Under backup, you should uncheck prodnv before
you flash.


That's how to build a Privacy Protection Password
and Factory Reset Protection bypass pac file


using Research Download tool.


If you got stuck at any point in this guide
then ensure to drop your comment(s) and we'll


be happy to assist you and if you found this
guide helpful then subscribe and share to


keep getting tutorials from Hovatek.