Jump to content

Unlocking Bootloaders

From postmarketOS Wiki

On many devices the bootloader is locked and you must unlock it before you can flash a custom ROM or recovery. If you are installing a pre-existing port refer to the device wiki page of your device for the unlocking instructions. If you are porting a device you will have to find the unlocking instructions online.

If you have forgotten whether your device is unlocked or not, check to see if it displays "device unlocked" or something similar at the bottom in flash mode or during boot.

Unlocking the Bootloader

Warning WARNING: Unlocking the bootloader will result in a formatted userdata partition and loss of any personal data on the device. Make sure that you have a backup.

Generic Methods

Generic Fastboot Method

This is the generic Android unlocking method. This will usually work for devices from vendors such as Oneplus,Nothing or Google.

You have to put your device into fastboot mode before running the unlocking commands. This can usually be done by holding Volume Up and Power during boot, but refer to the specific combination for your device if stuck. If you are in Android on some devices you can enable adb and run adb reboot fastboot to enter fastboot mode.

The three possible generic unlocking commands are:

  • fastboot oem unlock
  • fastboot oem unlock-go
  • fastboot flashing unlock

Generic Fastboot + Code Method

Some devices may require a code from the vendor. These devices include Motorolas, Verizon's carrier-locked devices, and some others. Refer to your vendor's website to get a code.

Once you have a code you can unlock the bootloader by running: fastboot oem unlock [your-code-here]

If you run into any trouble check to see if your device requires another command or other steps by looking online.

BootUnlocker

Warning WARNING: It is never a good idea to rely on Android for unlocking. Attempt this method at your own risk.
Note This method only works on older versions of Android.
TODO TODO: Document minimum version requirement.

BootUnlocker This tool requires you to root your Android device. It will use root access to modify the lock status of the bootloader.

This tool seems to only work on old devices due to it not being updated. Also, rooting Android devices without unlocking the bootloader probably requires a vulnerability found in Android userland or the kernel.

Brute Force

If your phone uses a bootloader unlock key to unlock the bootloader you can try to brute force the key via this generator.

MTKClient

If your device uses a MediaTek SOC released before 2022 then you can most likely use the tool MTKClient to unlock your bootloader.

Per manufacturer/series

HMD Global

Warning WARNING: HMD Global no longer provides unlock codes.

There are several unofficial ways to unlock these devices. Some devices can be unlocked for free, while some are not.

See Unlocking Bootloaders/HMD Global

HTC

htcdev unlock site

Huawei

Huawei no longer provides unlock codes.

Huawei uses different brands of SOC. For MediaTek and Ziguang Spreadtrum, there is a chip level vulnerability that can unlock bootloader, but requires patching lk/uboot.

For Qualcomm, if it is a device before the release of the unlock code stops, oeminfo stores the encrypted unlock status and can read and modify the oeminfo partition through 9008, but the key needs to be known. For Qualcomm devices equipped with MSM8916, MSM8939, and earlier, the secure boot has not been activated. Simply patch the sbl and abort to unlock the bootloader.

For newer Qualcomm devices, a portion of the unlock status is stored in the RPMB, which can be unlocked by flashing the engineering ABL and executing the unlock command.

For Qualcomm 8+devices, the unlock status in the ABL is fixed as a locked state, but the engineering ABL is unlocked and only needs to be flashed. However, starting from a certain version of HarmonyOS 4.2, Huawei used an anti rollback mechanism to increase the version number, which prevented the project from being started.

For Kirin, the situation is much more complicated. There are two bootloader locks, userlock is responsible for avb checksum and flashing general system partitions, and there is also a factory lock fblock.

Unlocking fblock allows unrestricted flashing of all partitions and memory dumping under fastboot.

For Kirin 960 and previously released devices, the userlock unlock status is stored in the oeminfo partition, which is encrypted (aes128), and the key is stored in the nvme partition. Huawei has a com1.0 download mode, which exploits vulnerabilities by loading patched fastboot to unlock fblock, and then modifying the nvme partition to write a custom key to achieve a custom unlock code. This is what potatonv is doing.

And the fblock unlock status is simply stored in the nvme partition without encryption.

Starting from Kirin 970, the fblock unlock status is stored in the oeminfo partition, signed with RSA, and the RSA public key is fixed in Fastboot for secure boot protection. And the uselock unlock status is still stored in oeminfo, but the key is derived from the hardware. So for Kirin 970, Kirin 710, Kirin 980, and so on, to unlock userlock, you must find a way to execute the unlock function, which can be achieved through exploit.

However, starting from EMUI10, which is Android 10, Huawei has completely removed userlock unlocking, which means that the userlock locking status is fixed and cannot be changed in fastboot. Therefore, it is almost impossible to permanently unlock BL unless you have an RSA private key. There are some vulnerabilities that can allow us to temporarily unlock BL and boot to a custom system, but restarting it will fail.

We do not recommend using those paid tools because their principles cannot exceed those mentioned above, except for one NCK tool or HCU client that has a Kirin 970 fblock certificate, which can permanently unlock the fblock.


Another option is to try to #Brute Force the code. This takes time and might not work.

There is also this Open Source Solution for devices on Kirin SoC called PotatoNV which can be used to unlock the bootloader of Kirin-based devices, but this has the disadvantage that you have to open the device and short a "test point" (unique to each device) to ground. This will also change your bootloader unlock code to a new one instead of printing out the original code.

iPhones

TODO TODO: Document more jailbreak methods.

iPhones unlock differently from Android devices since there is no official way to install another operating system. Thus, we rely on exploits to allow code execution. These methods vary depending on the device.

checkm8

The checkm8 exploit is a use-after-free discovered in iBoot that allows us to gain a semi-tethered jailbreak on iPhone 5s through iPhone X and iOS 12.0 and up.

Under postmarketOS, we currently use palera1n to initiate the exploit and boot a custom bootloader.

See checkra1n for generic information.

Lenovo

For devices runining Android ZUI, see Category:Bootloaders/Unlocking/Lenovo ZUI

Motorola

Motorola unlock site

An exploit does exist, see here.

Sony

Note Sony does not provide OTA updates for unlocked devices.

Sony Unlock Page.

Wiko

Just enable OEM unlocking in the Developer options and then use fastboot oem unlock in fastboot mode.

Windows Phones

Use WPInternals. The tool contains the instructions for unlocking.

Xiaomi

Note The #Generic fastboot method method might work on some older Xiaomi devices (eg.Xiaomi Redmi 2 (xiaomi-wt88047)

Samsung

0. (On recent devices) Allow the device connect to the internet (and "phone home" to Samsung and Google) while completing the Android setup wizard. (Otherwise the "OEM unlocking" option will not apppear!)

1. Turn on OEM unlocking in the developer settings

2. Turn off the device

3. Press Volume Down + Power (+ Home if the device has a physical home button)
On more recent devices, hold Volume Up and Volume Down while plugging in a usb data cable connected to a PC.

4. You should see a blue screen on your phone. In that screen you should see this line of text : Volume up and long press: Device unlock mode. If you see it, then long press volume up. If you don't see it then you might need to try again or your device cannot be unlocked.

5. Press volume up and wait for the the bootloader unlock to reset the device.

Crom Service

If you see CROM SERVICE: LOCK in odin mode, then you need an app named Crom Service to unlock the bootloader (can be found in Galaxy Store or Internet Archive).

See Also

Bootloader Unlock Wall Of Shame (Contains bootloader unlock guides.)