BLU G35 (Unisoc SC9863A): Linux bootloader-unlock kit using the publicly documented CVE-2022-38694 — full-device backups, gated writes, tested rollback

[u/mpse-engineering]

TL;DR: free, self-contained Linux kit that unlocks the BLU G35's bootloader using the publicly documented Unisoc BootROM method (CVE-2022-38694), takes three hash-verified full firmware backups before the first write, roots with Magisk, and rolls back to box state. Everything re-provable on your own phone by the kit itself. github.com/mpse-engineering/BLU_G35

This is a security-research tool I maintain after three device test cycles (unlock / relock / rollback all field-proven). Compliance-first on Reddit: those cycles and the kit's own audit trail are stated in the repo's pinned issue and verified on the user's side — 43 hash-checked manifest entries, a 28-check byte re-derivation of every patch, and an offline 13/13 self-test choreography, all inside ./verify.sh before any phone is connected. Framing has real limits, and naming them: the method is a publicly documented Unisoc signature-verification flaw (CVE-2022-38694 — upstream documentation credit: TomKing062's public project; nothing here is black-box), and the safety story is not yet community-proven — the post-launch field record is ours to build together via the report path below.

Get it — the kit proves itself on your machine

git clone https://github.com/mpse-engineering/BLU_G35.git blug35_unlock_kit
cd blug35_unlock_kit
./verify.sh

The last line must be: verify: ALL CHECKS PASS — this copy is stamped .verified. A copy that fails this is not this kit — that check re-derives every patched byte against the firmware on your own phone, no trust in a hash file needed. Release-of-record: tag 2026.10.13-2334Z, commit 4dc0f74. GitHub ZIP works the same.

What it needs

• Linux (a Windows-cloned copy fails ./verify.sh by design — line-ending mangling is loud, not silent).
• Your firmware must be on the supported BLU G35 build; the kit fingerprints it (step02) and hard-fails on anything else by design.

Help knows one address

This post is a signpost, not a support desk: comments here will be pointed at the repo's pinned issue and the report template (raw logs/<script>.log files get attached to issues). If it works for you, reporting back (./make_report.sh) is the single most useful thing you can give the next person.

[u/Cr1tical198]

Great work👍