SPRD Flash Tool v0.6.0
Read-back extraction, and diagnostics hardened by real-device recovery testing.
Highlights
📤 Extract partitions off a device — dump
sprdflash dump --enter-download --pac firmware.pac --out ./dump
Reads every partition straight off the flash with READ_FLASH and writes one
<file_id>.bin per partition — read-only, no writes to the device. The PAC
supplies this device's FDL1/FDL2 stages and the partition layout (addresses +
sizes); the bytes come off the device.
Hardware-verified on an Air724UG (RDA8910): all four partitions (5.72 MiB) dump
byte-identical (SHA-256) to the flashed PAC — proving READ_FLASH reads
persistent flash, not just data written in the same session. A real
backup/clone/forensics primitive.
♻️ flash auto-recovers a module stuck in FDL2
If a previous flash aborted after loading FDL2 (e.g. a genuine read-back verify
failure), the module is left in FDL2 and a fresh flash's PDL handshake would
fail. flash now detects that, sends a NORMAL_RESET, waits for the module to
re-enumerate and its firmware to settle, and retries once — no manual reset
needed. Also available standalone as sprdflash reset.
🔎 Honest timeouts
Read timeouts reported deadline - now, which is always ~0 once the deadline has
passed, so every timeout read "after 0ns". They now report the real time waited
(e.g. after 5.00s).
Verifying downloads
Every binary ships with a detached SSH signature (.sig, Ed25519, namespace
file, key SHA256:1wCKrSPq3V4q7DkiomqRJKzr6Vc1bY+eKU1qRvEvGKk) and keyless
Sigstore build provenance:
echo 'ajsb85@firechip.dev ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXmKlNp62mfIFNHT4Duv6vcTwfqb/M6OUs34upSpN/L' > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I ajsb85@firechip.dev -n file \
-s sprdflash-v0.6.0-x86_64-unknown-linux-gnu.sig \
< sprdflash-v0.6.0-x86_64-unknown-linux-gnu
gh attestation verify sprdflash-v0.6.0-x86_64-unknown-linux-gnu --repo ajsb85/sprdflash-rsChanges
- feat(cli):
dump— extract partitions off the device (read-only) - fix(cli): auto-recover a flash from FDL2 (reset + retry)
- fix(transport): report the real read-timeout duration, not
0ns - refactor(flash): shared FDL bring-up for
runanddump
Full Changelog: v0.5.0...v0.6.0