Jump to content

Unlocking Bootloaders: Difference between revisions

From postmarketOS Wiki
Exkc (talk | contribs)
R00t (talk | contribs)
Samsung: extra unlock notes for more recent devices.
 
(48 intermediate revisions by 8 users not shown)
Line 1: Line 1:
On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery.
On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the [[Help:Device Page| device wiki page]] of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online.
Unlocking is therefore also required for [[Installation_guide|installing postmarketOS]].


If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot.
If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot.


==Unlocking the bootloader==
== Unlocking the Bootloader ==
{{Warning|Unlocking the bootloader will result in a formatted userdata partition. Make sure that you have backed up your data.}}
{{Warning|Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup.}}
On some devices it is enough to enter:
<code>
fastboot oem unlock
</code>


Others will require you to enter a code:
=== Generic Methods ===
<code>
==== Generic Fastboot Method ====
fastboot oem unlock your-code-here
This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus or Nothing.
</code>


===HMD Global===
You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding {{Button|Volume Up}} and {{Button|Power}} during boot, but refer to the specific combination for your device if stuck. If you are in Android on some devices you can enable adb and run <code>adb reboot fastboot</code> to enter fastboot mode.
'''HMD Global no longer provides unlock codes.'''
 
The three possible generic unlocking commands are:
* <code>fastboot oem unlock</code>
* <code>fastboot oem unlock-go</code>
* <code>fastboot flashing unlock</code>
 
==== Generic Fastboot + Code Method ====
Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code.
 
Once you have a code you can unlock the bootloader by running:
<code>fastboot oem unlock [your-code-here]</code>
 
If you run into any trouble check to see if your device requires another command or other steps by looking online.
 
==== BootUnlocker ====
{{Warning|It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk.}}
{{Note|This method only works on older versions of Android.}}
{{Todo|Document minimum version requirement.}}
[https://github.com/osm0sis/boot-unlocker BootUnlocker]
This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader.
 
This tool seems to only work on old devices due to it not being updated. Also,rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel.
 
==== Brute Force ====
If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via [https://gist.github.com/alex-spataru/b187bdc3d987a0fcb1cae4e9b17c0e9e this generator].
 
==== MTKClient ====
If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool [[Mtkclient|MTKClient]] to unlock your bootloader.
 
== Per manufacturer/series ==
 
=== HMD Global ===
{{Warning|HMD Global no longer provides unlock codes.}}


There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.
There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.


See [[Category:Bootloaders/Unlock Bootloaders/HMD Global]]
See [[Unlocking Bootloaders/HMD Global]]


===HTC===
=== HTC ===
[https://www.htcdev.com/bootloader/ htcdev unlock site]
[https://www.htcdev.com/bootloader/ htcdev unlock site]


===Huawei===
=== Huawei ===
'''Huawei no longer provides unlock codes.'''
'''Huawei no longer provides unlock codes.'''


Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are NO LONGER working. Even contacting their support has no effect.
Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are <b>NO LONGER working</b>. Even contacting their support has no effect.


Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful and try to do your research and make sure that you're not one some fishy website before giving any of these services your money!<br>
Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful, do your research and make sure that you're not on some fishy website before giving any of these services your money!<br>
If you do try, please run wireshark usb capture, so there's a chance to understand how it works and replicate that
If you do try, please run wireshark usb capture, so there's a chance to understand how it works. Try to replicate it if possible.


Another option is to try [https://github.com/SkyEmie/huawei-honor-unlock-bootloader brute forcing] the code. This takes time and might not work.
Another option is to try to [[#Brute Force]] the code. This takes time and might not work.


There is also this [https://github.com/mashed-potatoes/PotatoNV Open Source Solution for devices on Kirin SoC] called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.
There is also this [https://github.com/mashed-potatoes/PotatoNV Open Source Solution for devices on Kirin SoC] called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.


* [https://wiki.postmarketos.org/wiki/Huawei_Ascend_G7_(huawei-g7)#Preparation WIP Experimental work around which involves replace the entire bootloader] & [https://wiki.postmarketos.org/wiki/Huawei_Y635_(huawei-y635)#Flashing_custom_bootloader]
* [https://wiki.postmarketos.org/wiki/Huawei_Ascend_G7_(huawei-g7)#Preparation WIP Experimental work around which involves replace the entire bootloader] & [https://wiki.postmarketos.org/wiki/Huawei_Y635_(huawei-y635)#Flashing_custom_bootloader]
* [https://github.com/hhj4ck/checkm30 A bootrom exploit of Huawei Hisilicon Smartphones that could be used to unlock Huawei bootloaders]
* [https://github.com/hhj4ck/checkm30 A bootrom exploit of Huawei Hisilicon Smartphones that could be used to unlock Huawei bootloaders]


===Motorola===
=== iPhones ===
{{Todo|Document more jailbreak methods.}}
iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits to allow code execution. These methods vary depending on device.
 
==== checkm8 ====
The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on <b>iPhone 5s through iPhone X and iOS 12.0 and up</b>.
 
Under postmarketOS, we currently use [https://github.com/palera1n/palera1n palera1n] to initiate the exploit and boot a custom bootloader.
 
See [https://checkra.in/ checkra1n] for generic information.
 
=== Lenovo ===
For devices runining Android ZUI, see [[:Category:Bootloaders/Unlocking/Lenovo ZUI]]
 
=== Motorola ===
[https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a/ Motorola unlock site]
[https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a/ Motorola unlock site]


Line 47: Line 87:


=== Sony ===
=== Sony ===
{{note|This is your last chance to download the latest ROM via OTA update before unlocking the bootloader. Sony does not provide OTA updates for unlocked devices.}}
{{note|Sony does not provide OTA updates for unlocked devices.}}
[https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/ Sony Unlock Page].
[https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/ Sony Unlock Page].


Line 56: Line 96:
Use [[Windows_Phone#Tools|WPInternals]]. The tool contains the instructions for unlocking.
Use [[Windows_Phone#Tools|WPInternals]]. The tool contains the instructions for unlocking.


===Xiaomi===
=== Xiaomi ===
{{Note | The [[#Generic fastboot method]] method might work on some older Xiaomi devices (eg.[[Xiaomi Redmi 2 (xiaomi-wt88047)]] }}
[https://en.miui.com/unlock/index.html Xiaomi Unlock Page].
[https://en.miui.com/unlock/index.html Xiaomi Unlock Page].


=== Samsung ===
=== Samsung ===
0. (On recent devices) Allow the device connect to the internet (and "phone home" to samsung and google) while completing the android setup wizard. (Otherwise the "OEM unlocking" option will not apppear!)


{{Note|If you don't see OEM unlocking option, then your device's bootloader can't be unlocked or your device has a bootloader that can't be locked (usually that is case for old devices).}}
1. Turn on OEM unlocking in the developer settings
1. Turn on OEM unlocking in the developer settings


2. Turn off the device
2. Turn off the device


3. Press vol down + power button + home key (if the phone has it)
3. Press {{Button|Volume Down}} + {{Button|Power}} (+ {{Button|Home}} if the device has a physical home button)<br>On more recent devices, hold {{Button|Volume Up}} and {{Button|Volume Down}} while plugging in a usb data cable connected to a PC.
 
{{Note|If you don't see that line of text, then your device's bootloader can't be unlocked.}}
4. You should see blue screen on your phone. In that screen you should see this line of text : <source>Volume up and long press: Device unlock mode.</source> If you see it, then long press volume up.
 
5. Press volume up and wait for to reset the device.


4. You should see blue screen on your phone. In that screen you should see this line of text : <code>Volume up and long press: Device unlock mode.</code> If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked.


==== Crom Service (For some Samsung phones only) ====
5. Press volume up and wait for the the bootloader unlock to reset the device.


If you see this line of text: <source>CROM SERVICE: LOCK in odin mode</source> then you need a app named Crom Service to unlock the bootloader (can be found in Galaxy Store or [https://archive.org/details/crom-service-1.0.7 Internet Archive]).
==== Crom Service ====
If you see <code>CROM SERVICE: LOCK</code> in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or [https://archive.org/details/crom-service-1.0.7 Internet Archive]).


=== Mixed ===
== See Also ==
[https://github.com/osm0sis/boot-unlocker BootUnlocker] for [[Google_Galaxy_Nexus_GSM_(samsung-maguro)|Google Galaxy Nexus (maguro)]] ''& (toro, toroplus)'', [[Google_Nexus_4_(lg-mako)|Google Nexus 4 (mako)]], [[Google_Nexus_5_(lg-hammerhead)|Google Nexus 5 (hammerhead)]], [[Google_Nexus_7_2013_(asus-flo)|Google Nexus 7 2013 (flo)]], [[Google_Nexus_7_2013_LTE_(asus-deb)|Google Nexus 7 2013 (deb)]], [[Google_Nexus_10_(samsung-manta)|Google Nexux 10 (manta)]], [[OnePlus_One_(oneplus-bacon)|OnePlus One (bacon)]], [[OnePlus_Two_(oneplus-oneplus2)|OnePlus Two (oneplus2)]], [[OnePlus_X_(oneplus-onyx)|OnePlus X (onyx)]], YU Yuphoria (lettuce), [[Yu_Yureka_(yu-tomato)|YU Yureka (tomato)]], [[Zuk_Z1_(zuk-z1-ham)|Lenovo Zuk Z1 (ham)]], InFocus M810 (VNA), InFocus M812 (VN2), or Yota Phone 2 (yotaphone2).
[https://github.com/melontini/bootloader-unlock-wall-of-shame Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)]


[[Category:Guide]]
[[Category:Guide]]
[[Category:Software]]
[[Category:Software]]
[[Category:Bootloaders]]

Latest revision as of 04:02, 4 March 2025

On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the device wiki page of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online.

If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot.

Unlocking the Bootloader

Warning WARNING: Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup.

Generic Methods

Generic Fastboot Method

This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus or Nothing.

You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding Volume Up and Power during boot, but refer to the specific combination for your device if stuck. If you are in Android on some devices you can enable adb and run adb reboot fastboot to enter fastboot mode.

The three possible generic unlocking commands are:

  • fastboot oem unlock
  • fastboot oem unlock-go
  • fastboot flashing unlock

Generic Fastboot + Code Method

Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code.

Once you have a code you can unlock the bootloader by running: fastboot oem unlock [your-code-here]

If you run into any trouble check to see if your device requires another command or other steps by looking online.

BootUnlocker

Warning WARNING: It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk.
Note This method only works on older versions of Android.
TODO TODO: Document minimum version requirement.

BootUnlocker This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader.

This tool seems to only work on old devices due to it not being updated. Also,rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel.

Brute Force

If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via this generator.

MTKClient

If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool MTKClient to unlock your bootloader.

Per manufacturer/series

HMD Global

Warning WARNING: HMD Global no longer provides unlock codes.

There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.

See Unlocking Bootloaders/HMD Global

HTC

htcdev unlock site

Huawei

Huawei no longer provides unlock codes.

Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are NO LONGER working. Even contacting their support has no effect.

Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful, do your research and make sure that you're not on some fishy website before giving any of these services your money!
If you do try, please run wireshark usb capture, so there's a chance to understand how it works. Try to replicate it if possible.

Another option is to try to #Brute Force the code. This takes time and might not work.

There is also this Open Source Solution for devices on Kirin SoC called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.

iPhones

TODO TODO: Document more jailbreak methods.

iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits to allow code execution. These methods vary depending on device.

checkm8

The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on iPhone 5s through iPhone X and iOS 12.0 and up.

Under postmarketOS, we currently use palera1n to initiate the exploit and boot a custom bootloader.

See checkra1n for generic information.

Lenovo

For devices runining Android ZUI, see Category:Bootloaders/Unlocking/Lenovo ZUI

Motorola

Motorola unlock site

An exploit does exist, see here.

Sony

Note Sony does not provide OTA updates for unlocked devices.

Sony Unlock Page.

Wiko

Just enable OEM unlocking in the Developer options and then use fastboot oem unlock in fastboot mode.

Windows Phones

Use WPInternals. The tool contains the instructions for unlocking.

Xiaomi

Note The #Generic fastboot method method might work on some older Xiaomi devices (eg.Xiaomi Redmi 2 (xiaomi-wt88047)

Xiaomi Unlock Page.

Samsung

0. (On recent devices) Allow the device connect to the internet (and "phone home" to samsung and google) while completing the android setup wizard. (Otherwise the "OEM unlocking" option will not apppear!)

1. Turn on OEM unlocking in the developer settings

2. Turn off the device

3. Press Volume Down + Power (+ Home if the device has a physical home button)
On more recent devices, hold Volume Up and Volume Down while plugging in a usb data cable connected to a PC.

4. You should see blue screen on your phone. In that screen you should see this line of text : Volume up and long press: Device unlock mode. If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked.

5. Press volume up and wait for the the bootloader unlock to reset the device.

Crom Service

If you see CROM SERVICE: LOCK in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or Internet Archive).

See Also

Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)