Unisoc T615 (UMS9230_6h10) · UFS · A/B slots
Wipes the device. Back up first. Verified only on the build stamped above — re-verify before using on any other build.
One exploit, two separate interventions. The unlock (Steps 1–5) neuters the lock check inside splloader. Root (Step 6) is a later, unrelated patch to Android's own init_boot image.
| Term | What it does |
|---|---|
| BROM | Factory boot ROM, burned into the chip — never erasable. Your panic button if anything goes wrong. |
| FDL1 / FDL2 | Helper programs smuggled past BROM. FDL1 wakes RAM; FDL2 can read, write, or erase any flash partition. |
| spd_dump verbs | r read · w write · e erase · read_part raw read · reset reboot |
| splloader | First stage of the normal boot chain. Holds the bootloader-lock check that Steps 1–5 patch. |
| uboot | The regular bootloader (gives you fastboot). Swapped for a cooperative copy mid-unlock, restored after. |
| miscdata | Small hidden partition holding the unlock flag. |
| prodnv / nvitem / l_fixnv | Factory radio calibration (IMEI, Wi-Fi/BT MAC). NEVER READ/WRITE/ERASE |
Download the unlock package from Releases — cubot_es3_unlock_package_amd64.zip for a normal PC (x86-64), cubot_es3_unlock_package_arm64.zip for ARM64 machines — unzip, and build:
Verify you built the right thing — both checks must pass:
You'll also need Android's adb and fastboot for Step 6 — install them now so you're not stuck mid-guide:
Where every file comes from
| spd_dump, gen_spl-unlock, chsize | Built from the package source just now |
| fdl1-dl.bin, fdl2-dl.bin, fdl2-cboot.bin, misc-wipe.bin, custom_exec_no_verify_65015f08.bin | Ship ready-made inside the package — don't rename or move them |
| splloader.bin, uboot.bin | You dump them off your own phone in Step 1 |
| spl-unlock.bin | gen_spl-unlock creates it from your dumped splloader.bin — the lock check, neutered |
| u-boot-spl-16k-sign.bin, uboot_bak.bin | Your renamed Step 1 backups — restore the phone in Step 5 |
| init_boot.img | Not in the package — extracted from your own stock PAC, below |
| magisk_patched-*.img | The Magisk app creates it on the phone (Step 6) |
Getting init_boot.img out of the stock PAC — a .pac file is Unisoc's all-in-one firmware container; you need exactly one image out of it.
CUBOT_KINGKONG_ES_3_F071_V16_20260309. Unzip it — inside is the .pac file (~3 GB).extracted/, find init_boot.img (rename from init_boot_a.img if needed) and copy it into the package folder.Stay inside the package folder the whole time — dumps land in the current directory.
Enter BROM: power off → hold Volume Down → plug USB (or press Power) → keep holding. If 1782:4d00 doesn't appear, retry with Volume Up. Confirm:
Dump splloader + uboot off the phone:
Opens BROM with the exploit → loads FDL1+FDL2 → reads splloader/uboot into files → erases the splloader slots (rewritten in Step 5) → reboots.
Wait for the reset. find port failed → close and re-run — do not continue past that error.
Generate the unlock payload, resize + stash the backups:
Temporarily replaces the uboot partition with fdl2-cboot.bin, a cooperative copy of FDL2 — stock uboot would refuse to take part in what comes next. Your original returns in Step 5.
Re-enter BROM (Step 1), then:
Wait ~10 seconds after the reset.
Sends the neutered spl-unlock.bin up through BROM and runs it — the mere act of it running flips the unlock flag in miscdata. That flag flip IS the unlock; there's no "restore" dance after.
Re-enter BROM, then:
What you'll see, and why it's all good:
CHECK_BAUD FAIL — expected. The patched build reconnects by itself.CHECK_BAUD FDL1 → BSL_REP_VER: "SPRD3" → CMD_CONNECT FDL1 — this IS the success signal.timeout reached after that — this is what you want, not an error. Don't re-run; move to Step 4. (Only re-run if you never saw CMD_CONNECT FDL1.)Don't trust what the tool printed — read the flag itself out of miscdata:
Check m.bin with xxd m.bin:
A trailing timeout here is normal.
Puts the phone back together — writes your original splloader/uboot backups back, and writes misc-wipe.bin to force the factory reset an unlock requires.
Let the phone factory-reset and boot. Orange/unlocked warning screen = success.
The bootloader is unlocked — root is just Magisk patching init_boot.img and flashing the patched copy, done in fastbootd (userspace fastboot), not the plain bootloader.
Install the Magisk app on the phone if you haven't already. Boot Android → Settings → About Phone → tap Build Number ×7 → Developer Options → USB debugging. Then:
In the Magisk app: Install → Select and Patch a File → init_boot.img, pull the patched image back, and flash it in fastbootd:
Open Magisk → root active. Done — unlocked and rooted.
| Symptom | Fix |
|---|---|
| LIBUSB_ERROR_BUSY | sudo systemctl stop ModemManager, replug |
| LIBUSB_ERROR_NO_DEVICE | Start spd_dump first, then plug the phone |
| find port failed | Close and re-run the same command |
| Connection drops / won't detect | Make sure you're on USB 2.0 |
| Two CHECK_BAUD FAIL → device removed | Your build is missing the reconnect fix — rebuild (common.c must contain reopen_port) |
| Boot loop / soft brick | BROM (Step 1) always answers — reflash stock firmware, redo the guide |
| In spd_dump | NEVER run repartition, erase_all, or ufs repart/rawerase/setattr — they truncate the GPT |