Skip to content

SPRD Flash Tool v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 11:31
v0.7.0
This tag was signed with the committer’s verified signature.
ajsb85 Alexander Salas Bastidas
SSH Key Fingerprint: 1wCKrSPq3V4q7DkiomqRJKzr6Vc1bY+eKU1qRvEvGKk
Verified
Learn about vigilant mode.
8ee99a7
This commit was signed with the committer’s verified signature.
ajsb85 Alexander Salas Bastidas
SSH Key Fingerprint: 1wCKrSPq3V4q7DkiomqRJKzr6Vc1bY+eKU1qRvEvGKk
Verified
Learn about vigilant mode.

Golden-device cloning and flexible extraction, built on the proven read-back path.

Highlights

🧬 Clone a reference unit into a flashable golden PAC — clone

sprdflash clone --enter-download --pac reference.pac --out golden.pac

Reads a device's partitions off the flash (read-only) and splices them into a
copy of the reference PAC — same FDL stages, layout, markers, and XML — then
refreshes the header + payload CRC-16-ARC and validates the result before
writing. The output is a flashable .pac capturing a configured reference
unit's firmware, which you can flash to other units — no vendor tool.

Hardware-verified on an Air724UG (RDA8910): cloning a device that holds the
reference firmware produces a golden PAC byte-identical (SHA-256) to the
reference — a lossless round-trip.

🎯 Arbitrary-region dump — dump --region

sprdflash dump --enter-download --pac any-rda8910.pac \
    --region 0x60000000:42112 --region 0x60010000:2468352 --out ./dump

Read any flash range(s) as ADDR:SIZE (hex or decimal, repeatable) instead of
the PAC's partition layout — the PAC is then used only for the FDL stages.

🔁 Any RDA8910 PAC works for the FDL stages

The FDL1/FDL2 download agents are interchangeable across firmware versions for
the same chip. Hardware-verified: dumping an Air-firmware device using a LuatOS-
HMI PAC's FDLs yields byte-identical bytes to a dump with the matching PAC. So
you don't need a device's exact firmware to extract or clone it — any PAC for the
chip supplies the FDLs.

Note: fully PAC-free extraction (no PAC at all) is intentionally not shipped
— it would require redistributing Unisoc's proprietary FDL blobs (a licensing
problem) and reverse-engineering on-device partition-table discovery. Bring any
RDA8910 PAC for the FDLs instead.

Verifying downloads

echo 'ajsb85@firechip.dev ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXmKlNp62mfIFNHT4Duv6vcTwfqb/M6OUs34upSpN/L' > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I ajsb85@firechip.dev -n file \
    -s sprdflash-v0.7.0-x86_64-unknown-linux-gnu.sig \
    < sprdflash-v0.7.0-x86_64-unknown-linux-gnu
gh attestation verify sprdflash-v0.7.0-x86_64-unknown-linux-gnu --repo ajsb85/sprdflash-rs

Changes

  • feat(cli): clone — capture a device into a flashable golden PAC
  • feat(cli): dump --region ADDR:SIZE for arbitrary flash ranges

Full Changelog: v0.6.0...v0.7.0

Assets 10
Loading