Unlocking Bootloaders: Difference between revisions
→Samsung: extra unlock notes for more recent devices. |
|||
(48 intermediate revisions by 8 users not shown) | |||
Line 1: | Line 1: | ||
On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. | On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the [[Help:Device Page| device wiki page]] of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online. | ||
If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot. | If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot. | ||
==Unlocking the | == Unlocking the Bootloader == | ||
{{Warning|Unlocking the bootloader will result in a formatted userdata partition. Make sure that you have | {{Warning|Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup.}} | ||
=== Generic Methods === | |||
==== Generic Fastboot Method ==== | |||
This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus or Nothing. | |||
===HMD Global=== | You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding {{Button|Volume Up}} and {{Button|Power}} during boot, but refer to the specific combination for your device if stuck. If you are in Android on some devices you can enable adb and run <code>adb reboot fastboot</code> to enter fastboot mode. | ||
The three possible generic unlocking commands are: | |||
* <code>fastboot oem unlock</code> | |||
* <code>fastboot oem unlock-go</code> | |||
* <code>fastboot flashing unlock</code> | |||
==== Generic Fastboot + Code Method ==== | |||
Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code. | |||
Once you have a code you can unlock the bootloader by running: | |||
<code>fastboot oem unlock [your-code-here]</code> | |||
If you run into any trouble check to see if your device requires another command or other steps by looking online. | |||
==== BootUnlocker ==== | |||
{{Warning|It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk.}} | |||
{{Note|This method only works on older versions of Android.}} | |||
{{Todo|Document minimum version requirement.}} | |||
[https://github.com/osm0sis/boot-unlocker BootUnlocker] | |||
This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader. | |||
This tool seems to only work on old devices due to it not being updated. Also,rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel. | |||
==== Brute Force ==== | |||
If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via [https://gist.github.com/alex-spataru/b187bdc3d987a0fcb1cae4e9b17c0e9e this generator]. | |||
==== MTKClient ==== | |||
If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool [[Mtkclient|MTKClient]] to unlock your bootloader. | |||
== Per manufacturer/series == | |||
=== HMD Global === | |||
{{Warning|HMD Global no longer provides unlock codes.}} | |||
There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not. | There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not. | ||
See [[ | See [[Unlocking Bootloaders/HMD Global]] | ||
===HTC=== | === HTC === | ||
[https://www.htcdev.com/bootloader/ htcdev unlock site] | [https://www.htcdev.com/bootloader/ htcdev unlock site] | ||
===Huawei=== | === Huawei === | ||
'''Huawei no longer provides unlock codes.''' | '''Huawei no longer provides unlock codes.''' | ||
Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are NO LONGER working. Even contacting their support has no effect. | Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are <b>NO LONGER working</b>. Even contacting their support has no effect. | ||
Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful | Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful, do your research and make sure that you're not on some fishy website before giving any of these services your money!<br> | ||
If you do try, please run wireshark usb capture, so there's a chance to understand how it works | If you do try, please run wireshark usb capture, so there's a chance to understand how it works. Try to replicate it if possible. | ||
Another option is to try [ | Another option is to try to [[#Brute Force]] the code. This takes time and might not work. | ||
There is also this [https://github.com/mashed-potatoes/PotatoNV Open Source Solution for devices on Kirin SoC] called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code. | There is also this [https://github.com/mashed-potatoes/PotatoNV Open Source Solution for devices on Kirin SoC] called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code. | ||
* [https://wiki.postmarketos.org/wiki/Huawei_Ascend_G7_(huawei-g7)#Preparation WIP Experimental work around which involves replace the entire bootloader] & [https://wiki.postmarketos.org/wiki/Huawei_Y635_(huawei-y635)#Flashing_custom_bootloader] | * [https://wiki.postmarketos.org/wiki/Huawei_Ascend_G7_(huawei-g7)#Preparation WIP Experimental work around which involves replace the entire bootloader] & [https://wiki.postmarketos.org/wiki/Huawei_Y635_(huawei-y635)#Flashing_custom_bootloader] | ||
* [https://github.com/hhj4ck/checkm30 A bootrom exploit of Huawei Hisilicon Smartphones that could be used to unlock Huawei bootloaders] | * [https://github.com/hhj4ck/checkm30 A bootrom exploit of Huawei Hisilicon Smartphones that could be used to unlock Huawei bootloaders] | ||
===Motorola=== | === iPhones === | ||
{{Todo|Document more jailbreak methods.}} | |||
iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits to allow code execution. These methods vary depending on device. | |||
==== checkm8 ==== | |||
The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on <b>iPhone 5s through iPhone X and iOS 12.0 and up</b>. | |||
Under postmarketOS, we currently use [https://github.com/palera1n/palera1n palera1n] to initiate the exploit and boot a custom bootloader. | |||
See [https://checkra.in/ checkra1n] for generic information. | |||
=== Lenovo === | |||
For devices runining Android ZUI, see [[:Category:Bootloaders/Unlocking/Lenovo ZUI]] | |||
=== Motorola === | |||
[https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a/ Motorola unlock site] | [https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a/ Motorola unlock site] | ||
Line 47: | Line 87: | ||
=== Sony === | === Sony === | ||
{{note| | {{note|Sony does not provide OTA updates for unlocked devices.}} | ||
[https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/ Sony Unlock Page]. | [https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader/ Sony Unlock Page]. | ||
Line 56: | Line 96: | ||
Use [[Windows_Phone#Tools|WPInternals]]. The tool contains the instructions for unlocking. | Use [[Windows_Phone#Tools|WPInternals]]. The tool contains the instructions for unlocking. | ||
===Xiaomi=== | === Xiaomi === | ||
{{Note | The [[#Generic fastboot method]] method might work on some older Xiaomi devices (eg.[[Xiaomi Redmi 2 (xiaomi-wt88047)]] }} | |||
[https://en.miui.com/unlock/index.html Xiaomi Unlock Page]. | [https://en.miui.com/unlock/index.html Xiaomi Unlock Page]. | ||
=== Samsung === | === Samsung === | ||
0. (On recent devices) Allow the device connect to the internet (and "phone home" to samsung and google) while completing the android setup wizard. (Otherwise the "OEM unlocking" option will not apppear!) | |||
1. Turn on OEM unlocking in the developer settings | 1. Turn on OEM unlocking in the developer settings | ||
2. Turn off the device | 2. Turn off the device | ||
3. Press | 3. Press {{Button|Volume Down}} + {{Button|Power}} (+ {{Button|Home}} if the device has a physical home button)<br>On more recent devices, hold {{Button|Volume Up}} and {{Button|Volume Down}} while plugging in a usb data cable connected to a PC. | ||
{{ | |||
4. You should see blue screen on your phone. In that screen you should see this line of text : <code>Volume up and long press: Device unlock mode.</code> If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked. | |||
5. Press volume up and wait for the the bootloader unlock to reset the device. | |||
If you see | ==== Crom Service ==== | ||
If you see <code>CROM SERVICE: LOCK</code> in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or [https://archive.org/details/crom-service-1.0.7 Internet Archive]). | |||
== | == See Also == | ||
[https://github.com/ | [https://github.com/melontini/bootloader-unlock-wall-of-shame Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)] | ||
[[Category:Guide]] | [[Category:Guide]] | ||
[[Category:Software]] | [[Category:Software]] | ||
[[Category:Bootloaders]] |
Latest revision as of 04:02, 4 March 2025
On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the device wiki page of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online.
If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot.
Unlocking the Bootloader
WARNING: Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup. |
Generic Methods
Generic Fastboot Method
This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus or Nothing.
You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding adb reboot fastboot
to enter fastboot mode.
The three possible generic unlocking commands are:
fastboot oem unlock
fastboot oem unlock-go
fastboot flashing unlock
Generic Fastboot + Code Method
Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code.
Once you have a code you can unlock the bootloader by running:
fastboot oem unlock [your-code-here]
If you run into any trouble check to see if your device requires another command or other steps by looking online.
BootUnlocker
WARNING: It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk. |
This method only works on older versions of Android. |
TODO: Document minimum version requirement. |
BootUnlocker This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader.
This tool seems to only work on old devices due to it not being updated. Also,rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel.
Brute Force
If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via this generator.
MTKClient
If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool MTKClient to unlock your bootloader.
Per manufacturer/series
HMD Global
WARNING: HMD Global no longer provides unlock codes. |
There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.
See Unlocking Bootloaders/HMD Global
HTC
Huawei
Huawei no longer provides unlock codes.
Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are NO LONGER working. Even contacting their support has no effect.
Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful, do your research and make sure that you're not on some fishy website before giving any of these services your money!
If you do try, please run wireshark usb capture, so there's a chance to understand how it works. Try to replicate it if possible.
Another option is to try to #Brute Force the code. This takes time and might not work.
There is also this Open Source Solution for devices on Kirin SoC called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.
- WIP Experimental work around which involves replace the entire bootloader & [1]
- A bootrom exploit of Huawei Hisilicon Smartphones that could be used to unlock Huawei bootloaders
iPhones
TODO: Document more jailbreak methods. |
iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits to allow code execution. These methods vary depending on device.
checkm8
The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on iPhone 5s through iPhone X and iOS 12.0 and up.
Under postmarketOS, we currently use palera1n to initiate the exploit and boot a custom bootloader.
See checkra1n for generic information.
Lenovo
For devices runining Android ZUI, see Category:Bootloaders/Unlocking/Lenovo ZUI
Motorola
An exploit does exist, see here.
Sony
Sony does not provide OTA updates for unlocked devices. |
Wiko
Just enable OEM unlocking in the Developer options and then use fastboot oem unlock
in fastboot mode.
Windows Phones
Use WPInternals. The tool contains the instructions for unlocking.
Xiaomi
The #Generic fastboot method method might work on some older Xiaomi devices (eg.Xiaomi Redmi 2 (xiaomi-wt88047) |
Samsung
0. (On recent devices) Allow the device connect to the internet (and "phone home" to samsung and google) while completing the android setup wizard. (Otherwise the "OEM unlocking" option will not apppear!)
1. Turn on OEM unlocking in the developer settings
2. Turn off the device
3. Press
On more recent devices, hold and while plugging in a usb data cable connected to a PC.
4. You should see blue screen on your phone. In that screen you should see this line of text : Volume up and long press: Device unlock mode.
If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked.
5. Press volume up and wait for the the bootloader unlock to reset the device.
Crom Service
If you see CROM SERVICE: LOCK
in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or Internet Archive).
See Also
Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)