Jump to content

Unlocking Bootloaders

From postmarketOS Wiki
Revision as of 22:09, 21 February 2025 by Justsoup (talk | contribs) (Add information on MTKClient and iPhones)

On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the device wiki page of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online.

If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during the boot.

Unlocking the Bootloader

Warning WARNING: Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup.

Generic Methods

Generic Fastboot Method

This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus or Nothing.

You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding Volume Up and Power during boot, but refer to the specific combination for your device if stuck. If you are in Android on some devices you can enable adb and run adb reboot fastboot to enter fastboot mode.

The three possible generic unlocking commands are:

  • fastboot oem unlock
  • fastboot oem unlock-go
  • fastboot flashing unlock

Generic Fastboot + Code Method

Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code.

Once you have a code you can unlock the bootloader by running: fastboot oem unlock [your-code-here]

If you run into any trouble check to see if your device requires another command or other steps by looking online.

BootUnlocker

Warning WARNING: It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk.
Note This method only works on older versions of Android.
TODO TODO: Document minimum version requirement.

BootUnlocker This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader.

This tool seems to only work on old devices due to it not being updated. Also,rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel.

Brute Force

If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via this generator.

MTKClient

If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool MTKClient to unlock your bootloader.

Per manufacturer/series

HMD Global

Warning WARNING: HMD Global no longer provides unlock codes.

There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.

See Unlocking Bootloaders/HMD Global

HTC

htcdev unlock site

Huawei

Huawei no longer provides unlock codes.

Tutorials that tell you to go to some Huawei website, log in with your Huawei ID and sign the unlock agreement to get a code are NO LONGER working. Even contacting their support has no effect.

Some services claim to be able to unlock these devices, but they charge money for it (e.g. DC-Unlocker charges 4€). Be careful, do your research and make sure that you're not on some fishy website before giving any of these services your money!
If you do try, please run wireshark usb capture, so there's a chance to understand how it works. Try to replicate it if possible.

Another option is to try to #Brute Force the code. This takes time and might not work.

There is also this Open Source Solution for devices on Kirin SoC called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.

iPhones

TODO TODO: Document more jailbreak methods.

iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits in the iBoot bootloader to allow code execution. These methods vary depending on device.

checkm8

The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on iPhone 5s through iPhone X and iOS 12.0 and up.

Under postmarketOS, we currently use palera1n to initiate the exploit and boot a custom bootloader.

See checkra1n for generic information.

Lenovo

For devices runining Android ZUI, see Category:Bootloaders/Unlocking/Lenovo ZUI

Motorola

Motorola unlock site

An exploit does exist, see here.

Sony

Note Sony does not provide OTA updates for unlocked devices.

Sony Unlock Page.

Wiko

Just enable OEM unlocking in the Developer options and then use fastboot oem unlock in fastboot mode.

Windows Phones

Use WPInternals. The tool contains the instructions for unlocking.

Xiaomi

Note The #Generic fastboot method method might work on some older Xiaomi devices (eg.Xiaomi Redmi 2 (xiaomi-wt88047)

Xiaomi Unlock Page.

Samsung

1. Turn on OEM unlocking in the developer settings

2. Turn off the device

3. Press Volume Down + Power (+ Home if the device has a physical home button)

4. You should see blue screen on your phone. In that screen you should see this line of text : Volume up and long press: Device unlock mode. If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked.

5. Press volume up and wait for the the bootloader unlock to reset the device.

Crom Service

If you see CROM SERVICE: LOCK in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or Internet Archive).

See Also

Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)