Database Develop

[GUIDE] Downgrade + Bootloader Unlock

Hi there.
I decided to post a guide on how to downgrade and unlock the bootloader of "Huawei P Smart"
I've seen a lot of people now knowing how to downgrade, to a unlockable firmware.
Please note that "Bootloader unlocking" costs 4€ using this method!
I do not take responsibility for any phone that Is bricked or damaged In any way, by using this guide!
Required Stuff:
Huawei P Smart (any model)
Charging Cable
Windows PC
DC-Unlocker (easily found on google)
Firmware Finder Huawei (found on Play Store)
And of course 4€ If you are unlocking bootloader.
Downgrading
Here Is my current firmware:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
First of all we need Firmware Finder:
After that we open It and It should have a button with your phone model.
In my case I am using a FIG-LX1
On the list of firmware's I selected FIG-LX1C432B129 (8.0.0.129)
Now you should get to another menu and select the eRecovery option.
Then you should get this handy message with a DNS Address you need to enter In your Router.
In my case I found It under basic settings, and my default gateway was 192.168.0.1
After this Is done, disconnect, and reconnect to your WiFi on the phone.
Then press the "Open QUERY" button, on the same page as we got the DNS address.
Make sure the website looks like this.
Now press next, and you should get a "check availability" button
Should say this.
Press OK and press next.
Now press the "Register Update button.
Should come with a small popup saying that you registered It.
Now press next, and press OK on the second pop-up.
Now you need to power down your device.
Then you simply Insert the charger and immediately start holding volume up.
Release once you see this screen.
Press the "Download latest Version" button.
Then you should get into this screen.
Here you just need to press the "Download and Recovery"
It should connect to WiFi, and should start downloading like this.
Remember to check that It Is the 8.0.0.129(C432) Firmware!
After this Is done you should get into a bootloop.
This Is easily fixed by holding Power + Volume UP.
Now you should be In normal recovery.
Just press "Wipe Cache" and then "Factory Reset"
Now your phone will reset, and should boot into first time setup.
No need to set It up completely If you are going to unlock bootloader!
Here Is my Build Number after his procedure.
If your phone Is like mine, congratz on the Downgrade
Bootloader Unlock
Now for the bootloader unlocking.
As mentioned before you will need 4€ for this procedure!
First of all.
enable developer options. (press Build Number 7 times)
Then make sure USB Debugging, and OEM Unlock Is enabled!
Now we need to go to the dial pad, and enter In the number: *#*#2846579#*#*
It should get you to a menu like this one:
Once in that menu, go Into "Background Settings" and select "USB Port Settings"
In there select "Manufacture Mode"
Now plug In your USB, and open up, DC-Unlocker.
On the left Select "Huawei Phone", and press the Left button.
Then It should detect your phone like this:
Now you need to press the "Buy Credits" button, and go through their form.
Remember to buy 4 credits (he cost of bootloader code).
Even easier, you can get the DC-Unlocker app from the Play Store, and get credits through that.
They will send you a password for your account, once payment received.
Now press the "Server" Tab and login.
Then go to "Unlocking tab" and press "Read Bootloader Code"
It should give you your bootloader code.
Now comes the easy part!
Go Into the folder where you downloaded DC-Unlocker
In the address bar, type "CMD" (without the "") and press Enter.
You should get command prompt up like this.
Now you simply enter these commands.
adb devices. (make sure your phone Is listed)
adb reboot bootloader
fastboot devices (make sure device Is listed)
fastboot oem unlock *KEY* (replace *KEY* with your bootloader code from DC-Unlocker.
now you should see a "Yes or No" screen on your phone.
Press Vol up/down move and Power to select.
Now your phone will reboot, and automatically reset Itself.
All data will be erased.
After this It should pop-up like this, and then boot Into Android.
If everything went according to plan.
You should be unlocked and ready to flash some Roms
I recommend flashing OpenKirin roms, since they are specific for this chipset!
Sorry for the VERY big pictures, and hope you could use this tutorial :fingers-crossed:

good job ...an easy way to "buy credits " from dc unlocker is through their mobile application ( through google playstore) ..

KevMetal said:
good job ...an easy way to "buy credits " from dc unlocker is through their mobile application ( through google playstore) ..
Click to expand...
Click to collapse
That Is true.
I will add that to the Guide once I get home from work :good:

Is it okay to install firmware for the FIG-LX2ZAFC185 on my FIG-LX2C185? Firmware Finder can't find any software for my device. Edit: Yes it's okay, I had no problems!
Also, I can't put my phone into Manufacture mode; when I enter the dial code the dialer just resets :/ Edit: After downgrading Firmware it worked
Thanks so much for the guide man!

Nova 2
Hello,
Thank you so much for your tuto.
I have a problem with firmware finder. I'd like to downgrade my Huawei Nova 2 to Nougat so I chose one of the firmware proposed with EMUI 5. But when I click on "check availibility", It send me to the first page where I have to chose my phone model.
Please help me... I really need to unlock my bootloader, I thought I would succeed with your tuto I was so close...
Tell me if you have some suggestions.
Thank you so much.

pico777 said:
Hello,
Thank you so much for your tuto.
I have a problem with firmware finder. I'd like to downgrade my Huawei Nova 2 to Nougat so I chose one of the firmware proposed with EMUI 5. But when I click on "check availibility", It send me to the first page where I have to chose my phone model.
Please help me... I really need to unlock my bootloader, I thought I would succeed with your tuto I was so close...
Tell me if you have some suggestions.
Thank you so much.
Click to expand...
Click to collapse
Sorry for late reply, currently working on some stuff
I don't have a Huawei Nova 2 so I am not the best to ask
This guide with bootloader unlock is intended for Huawei P Smart.
That being said try: reinstalling the app, and select the earliest firmware for the phone

When i tried downgrade not working. Is there any new solution?

FIG-LA1
I can't downgrade at Erecovery it says get download information failed.

Karu12 said:
I can't downgrade at Erecovery it says get download information failed.
Click to expand...
Click to collapse
use only full OTA stock update you downloaded from internet on pc using chrome but download from creators of firmware finder team MT... then global search in XDA for hurupdater.. follow instructions to apply stock rom sd card.. doesnt matter if it's a downgrade it will flash

But if i use hurupdater, do i need bootloader unlocked.
So now my bootloader is locked and can i use hurupdater?

santalimi said:
When i tried downgrade not working. Is there any new solution?
Click to expand...
Click to collapse
I paid a guy who did it all for me downgrade and bootloader £9, if you can downgrade yourself it's only 5£ for bootloader unlock. I've been around a while but I class myself as a noob. The website is called MOS ministry of solutions. However now I've been there done unlock, root, twrp which was only last week I'd say it's a waste of time, unless you really know what your doing but even then these guys in here have gone full circle back to stock. I've gone full circle not just to stock, removed root and back to stock recovery. Only thing I took from root was I managed to make the speaker louder as one of my motivations for root was viper which don't work on Huawei or specifically psmart for sure. So sorry to say this but at this stage there isn't much development for psmart which is because Huawei have made it difficult. I'd advise against mods of any kind at this stage. I was rooted less than a week and multiple resets, soft bricks and not much success with magisk modules that count like viper.

i used erecovery method also, i think my version block all methods using firmware finder. my version FIG-LX1 8.0.0.163(C432). Any one have success downgrade with this version?

Finally, yesterday i bought new sd card 16gb and dowload a firmware which is old one from androidhost ru. And downgrade is completed. I bought bootloader unlock code reader from google play store dc unlocker and happy ending

santalimi said:
Finally, yesterday i bought new sd card 16gb and dowload a firmware which is old one from androidhost ru. And downgrade is completed. I bought bootloader unlock code reader from google play store dc unlocker and happy ending
Click to expand...
Click to collapse
Do you mind guiding me on how you did it ?

santalimi said:
Finally, yesterday i bought new sd card 16gb and dowload a firmware which is old one from androidhost ru. And downgrade is completed. I bought bootloader unlock code reader from google play store dc unlocker and happy ending
Click to expand...
Click to collapse
Thanks, santalimi for share name russian website android host!

shortcut333 said:
I confirm that this metod works.
1. I downloaded from androidhost.ru:
Huawei P Smart Figo-L31 FIG-L31 FIG-LX1 8.0.0.128a(C432) Firmware Android 8.0.0 EMUI 8.0.0 05014XMW androidhost.ru.zip.
2. I unpacket the zip file
3. I copyed dload folder from archive to sdcard (withouth change anything)
4. I opened the phone Huawei P Smart fig-lx1 (C432) in force upgrade mode
5. The new (OLD) firmware was installed (downgraded OK)
6. Then, with dc unlocker I readed the bootloader and rooted my phone
Thanks, santalimi for share name russian website android host!
Click to expand...
Click to collapse
This is the exact method I used and it worked perfectly, I second this!

Linux Lounge said:
This is the exact method I used and it worked perfectly, I second this!
Click to expand...
Click to collapse
with this method your firmware will be changed like 8.0.0.046.
when your bootloader unlocked succesfully.
VolUp + Power and use Erecovery to dowmload correct version

santalimi said:
with this method your firmware will be changed like 8.0.0.046.
when your bootloader unlocked succesfully.
VolUp + Power and use Erecovery to dowmload correct version
Click to expand...
Click to collapse
This is true, unless you plan to install a custom ROM like Open Kirin, then there is no point

Linux Lounge said:
This is true, unless you plan to install a custom ROM like Open Kirin, then there is no point
Click to expand...
Click to collapse
Yes, i used aosp 9.0 but battery performance was bad. I turn back stock version. I could not find custom rom with better battery performance.

Did someone tried to unlock P Smart 2019 model?

Lenovo Smart Clock (Bootloader/AVB unlock, Firmware, Region Changer, Kernel Source)

How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB A cable (Example here)
2. You will need fastboot drivers on your PC
3. Unplug your clock
4. Plug the USB A to A cable into your computer and clock
5. Hold the volume + button and plug in the power cord
6. Keep holding volume + for about 20-30 seconds (It is slow to boot to fastboot)
7. On your computer in a terminal run, fastboot flashing unlock
Part 1 of unlocking is now done
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Normally doing this on an Android Things device is not possible due to their Private key unlock system. But due to a leak, the private key for the Lenovo Smart Clock is available. Word of warning doing this causes the stock android things not to boot only the factory firmware located on Slot A will boot. Consistently if you don't AVB unlock the factory firmware on Slot A doesn't boot If you have already set up your device once the factory firmware is deleted and currently there is not a way to get it back (Hopefully will change soon).
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB Unlock zip
2. Run this command in terminal
Code:
at_auth_unlock.exe cube_unlock_credentials_v2.zip
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command:
Code:
fastboot oem at-lock-vboot!
Downloads:
Stock Shipping fastboot firmware:
Here
AVB Unlock tool:
Here
Factory partition changer (Locale changer):
Here
Google released kernel source:
https://github.com/deadman96385/android_kernel_lenovo_mt8167s
Dump of stock partitions for easy viewing:
https://github.com/deadman96385/things_mt8167s_som_dump
Credit to @deletescape for the leak of the AVB Unlock Key, Stock firmware, region changer

Screenshots of the stock android things on Slot A if you don't setup the device :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
TWRP (Coming Soon)

Excited to see what you manage to do with this!

This is great! I have one of these and it felt way too restrictive, looking forward to seeing what comes out of this.

You can also unlock the boot loader simply with what's below... device does boot with this btw
fastboot flashing unlock
Although I've been messing with the device quite a bit. Plug in a usb keyboard, and you can get a web browser to recognize it and go to websites and such using the touch screen as a cursor, but you can't download APK files and install them and such. I've NEVER had the device recognized by ADB, so I can't pass commands from there either.

KaptinBoxxi said:
You can also unlock the boot loader simply with what's below... device does boot with this btw
fastboot flashing unlock
Although I've been messing with the device quite a bit. Plug in a usb keyboard, and you can get a web browser to recognize it and go to websites and such using the touch screen as a cursor, but you can't download APK files and install them and such. I've NEVER had the device recognized by ADB, so I can't pass commands from there either.
Click to expand...
Click to collapse
Just doing step one does not actually get you anything because if you flash something that isn't stock on the verified partitions it will not boot until you flash back the stock one. I have gotten adb to show up but not properly so it is offline. Still hacking away at it trying to get it to go so i can more easily debug TWRP and make edits to the system.

deadman96385 said:
Just doing step one does not actually get you anything because if you flash something that isn't stock on the verified partitions it will not boot until you flash back the stock one. I have gotten adb to show up but not properly so it is offline. Still hacking away at it trying to get it to go so i can more easily debug TWRP and make edits to the system.
Click to expand...
Click to collapse
Ahhhhh got it. I couldn't find anything when I was messing with it like you've found with those commands. I'm kinda new to all this myself at something with nearly zero support, although I have a ton of experience with phones. Had to find my own exploit with my HTC One M7 because the version of android on the phone was the final supported update when I got it, and everyone said "nothing is possible with this android version" as far as rooting... so I figured out my own way lol
I'll continue trying myself though for sure

I also own one of these clocks, so if anyone has anything that I could test out, please share!

I think I'm bit late to party. Anyone who has a backup for those lenovo products, maybe it's a good idea to torrent them.

Honami754 said:
I think I'm bit late to party. Anyone who has a backup for those lenovo products, maybe it's a good idea to torrent them.
Click to expand...
Click to collapse
I don't have the time to test this stuff out for at least a few weeks, but if when I get to it, I'll try to upload my Backups somewhere before I tinker with the system. I'll update this comment when I do.

[/COLOR]
CiriousJoker said:
I don't have the time to test this stuff out for at least a few weeks, but if when I get to it, I'll try to upload my Backups somewhere before I tinker with the system. I'll update this comment when I do.
Click to expand...
Click to collapse
That's not really what I mean... I was referring to some interesting documents from lenovo. Have a few of those hardware but unfortunately didn't grab those files. Anyone also interested in these can PM me maybe we can do something about it.

when will twrp be avable

Interesting as there has a been a few of these turn up to auction of late .
I have gone with the 10' for main room and 8' for bedroom.. love them..
Got the oldies the little 7'
Great for streaming too..

The one I wish it did was announce the time by voice when the internet was down and we said "Hey Google". I am blind without my glasses and often when I am in bed, the internet is down in my area for maintenance period. The clock becomes useless when the internet goes down.

How are people getting the web browser to appear? I'm able to unlock the bootloader but can not boot with the AVB unlocked (well...technically it boots but still shows the spinning circle even though it will let you go to settings). I tried flashing the stock fastboot img and booting with avb unlocked and still get spinning circle. Not trying to get too fancy with this...just want to be able to point to a status page that I can leave it on.

Does anyone try to build a new firmware image and install this instead of stock?
Maybe compiling Android Things from source is possible, but looks like Google has stopped the development. The Lenovo Smart Frame seems to have the same MT8167S and runs on Android 10. Maybe it's possible to compile a LineageOS version?
lenovo.com/us/en/coming-soon/Lenovo-CD-3L501/p/ZZISZSDCD04
Another option might be fuchsia that contains a mt8167s board ref.
fuchsia.googlesource.com/fuchsia/+/master/boards/mt8167s_ref.gni
Googles Coral announced a Dev Board Mini based on MT8167s, maybe they port the Debian-based Mendel Linux to it.
coral.ai/products/dev-board-mini

hugo987 said:
Does anyone try to build a new firmware image and install this instead of stock?
Maybe compiling Android Things from source is possible, but looks like Google has stopped the development. The Lenovo Smart Frame seems to have the same MT8167S and runs on Android 10. Maybe it's possible to compile a LineageOS version?
lenovo.com/us/en/coming-soon/Lenovo-CD-3L501/p/ZZISZSDCD04
Another option might be fuchsia that contains a mt8167s board ref.
fuchsia.googlesource.com/fuchsia/+/master/boards/mt8167s_ref.gni
Googles Coral announced a Dev Board Mini based on MT8167s, maybe they port the Debian-based Mendel Linux to it.
coral.ai/products/dev-board-mini
Click to expand...
Click to collapse
I suppose the smart frame is running android things as well. Compiling android things does make much sense except to prove the drivers are sort of working, this is not designed to let users have fun (ie installing apps).
Google *really* loves mt8167s for some reason. I'd say there's a good chance of we having full android on it but everyone's busy.

They are throwing these things at our head now. 35/40 USD during black fridays.
I don't think you can order the components for that price
Anybody still working on it ? Lenovo claims it's still working on the sound bug - hxxps :// forums.lenovo.com/t5/Lenovo-Smart-Display-Lenovo-Smart-Clock-with-Google-Assistant/Smart-clock-alarm-volume-too-loud-at-first/m-p/5040962?page=4 (latest reply 2020-13-11 from Lenovo) and they did some unanounced pretty good updates in september 2020 - hxxps :// 9to5google.com/2020/09/21/lenovo-smart-clock-night-light/
They also claim the source is on their website hxxps :// smartsupport.lenovo.com/us/en/products/smart/smart-home/smart-clock/za4r/downloads/ds539701
So is this dead ?

deadman96385 said:
How to Bootloader Unlock (Part 1 of 2):
1. You will need a USB A to USB A cable (Example here)
2. You will need fastboot drivers on your PC
3. Unplug your clock
4. Plug the USB A to A cable into your computer and clock
5. Hold the volume + button and plug in the power cord
6. Keep holding volume + for about 20-30 seconds (It is slow to boot to fastboot)
7. On your computer in a terminal run, fastboot flashing unlock
Part 1 of unlocking is now done
AVB/DM-Verity Unlock (Part 2 of 2)
Unlocking the bootloader really does not give a lot to us because all the partitions are still being verified and the device will not boot if they don't match. Normally doing this on an Android Things device is not possible due to their Private key unlock system. But due to a leak, the private key for the Lenovo Smart Clock is available. Word of warning doing this causes the stock android things not to boot only the factory firmware located on Slot A will boot. Consistently if you don't AVB unlock the factory firmware on Slot A doesn't boot If you have already set up your device once the factory firmware is deleted and currently there is not a way to get it back (Hopefully will change soon).
If you are coming from part 1 you can start right away, if not you need to reboot to fastboot again.
1. Extract the downloaded AVB Unlock zip
2. Run this command in terminal
Code:
at_auth_unlock.exe cube_unlock_credentials_v2.zip
3. Wait till it finishes
4. Keep in mind the stock system does not boot properly with AVB off (It is weird some UI elements work but the boot animation never goes away)
5. To relock AVB in the future run the following command:
Code:
fastboot oem at-lock-vboot!
Locale changer instructions:
Coming soon (Need to figure it out)
Downloads:
Stock Shipping fastboot firmware:
Here
AVB Unlock tool:
Here
Factory partition changer (Locale changer):
Here
Google released kernel source:
https://github.com/deadman96385/android_kernel_lenovo_mt8167s
Dump of stock partitions for easy viewing:
https://github.com/deadman96385/things_mt8167s_som_dump
Credit to @deletescape for the leak of the AVB Unlock Key, Stock firmware, region changer
Click to expand...
Click to collapse
how about smart display ,the same way?

jasonzhang1987 said:
how about smart display ,the same way?
Click to expand...
Click to collapse
We do not have the AVB unlock files for the smart displays sadly.

General [CLOSED] --

USE UPDATED POST, HERE!
THIS POST IS NOW ONLY REFERENCE ONLY - WILL BE DELETED SOON.
Well I figured I'd make a quick How-To on how I successfully Carrier/Sim unlocked my Samsung Galaxy S21 Ultra 5G running the NEWEST Android update on bootloader 5 (USQU5BULJ)released in January of 2022.
***This does NOT trip Know and does NOT require a root or a paid service. ***
****Also Note - This is the process I took, you may find some of these steps are not needed but for the purpose or recreating my results, I'll be posting my exact process.
****This has ONLY BEEN TESTED ON SNAPDRAGON BASED SAMSUNG GALAXY S21 ULTRA 5G SM-G998 U & U1, if you try it on a different model or phone you may (and likely will) receive different results!!!!
Here's what you'll need:
•ANY (activated or not) Sim from the carrier you wish to switch too.(or a way to replicate the carriers cert from one)
•A computer
•Patched Odin
•BOTH the NEWEST U & U1 ROMs/Firmware - theres a full post on these and how to flash them here on XDA (Reminder for myself or mod to link it) or visit SamFW.com, it has both Odin and the ROM/Firmware files you will need.
•Android ADB platform tools (You can find them on the official Android Developers page here or use any ADB software of your choice, fastboot is not required or used in this process.(Google "Android Developer Platform Tools" to get them from the official Android devs page. )
STEP 1:
So let's presume you have a Verizon or T-Mobile carrier locked phone, if you look at your baseband, which you can find in Settings > About > Software Info, you should see this "SM-G998Uxxxxxxx"
*****IF YOU SEE "SM-G998U1xxxxxxx" STOP - Skip to step 2******
Head over to your preferred site to get stock Samsung Roms (Refer to link above if you don't know where to find) and download the U1 XAA rom and the U rom of the CARRIER YOU WISH TO USE. IMPORTANT! MAKE SURE YOU DOWNLOAD THE "U" ROM FOR BOTH THE CARRIER YOU WISH TO SWITCH TO AND THE U1 UNLOCKED ROM.
Put you device in download mode (Hold Vol up and Vol down and plug in the USB, which should be connected to your PC and now your phone at this point.)
Flash the U1 XAA Rom, place appropriate files in appropriate places in Odin, when you get to CSC, DO NOT use the "HOME_CSC" use the other.
Leave the rest of Odin settings alone and hit Start, wait for it to finish and reboot.
Step 2:
Once the phone boots, return to Settings>About>Software and confirm you are using the XAA rom by looking at Service Provider Software Version and it should say something like "SM-G998U1_XAA blah blah blah" you just want to see the U1 and XAA.
Now put in the Sim from the carrier you desire. A pop-up should appear prompting you to restart your device. Follow the prompt.
!MOST IMPORTANT STEP!
BEFORE the device fully restarts, force it into RECOVERY MODE, I was able to achieve this by holding the power and Vol Down buttons at the same time, starting to hold the directly after the "Samsung" Logo fades away upon initial restart. If you have trouble getting into recovery please comment below.
Once in recovery, use the volume keys to navigate to "Clear Cache" select and execute. Now go to Factory Data Reset/Wipe, select and execute. It should be the option directly above "Clear cache".
Once done, go up to "Reboot to Bootloader", Select, Execute.
AGAIN, Very Important step,you MUST interrupt the boot process again and force the phone BACK into download mode this time, so once the phone attempts to reboot, you need to hold the Vol Down and Vol Up buttons at the same time and the USB MUST be already plugged in.
We should now be back in download mode and be on the U1 rom. We have verified all of this in the steps above.
STEP 3:
Now it's time to flash the ROM from the carrier you wish to use. Make SURE you have a Sim from that carrier inserted during this process. It doesn't need to be a working or activated Sim, just simply one from the carrier you wish to have your S21 work on.
Flash all items as you did earlier, but using the "U" ROM for your desired carrier as described above. Same deal with CSC, DO NOT use the "Home_CSC"
BE SURE that you use the USERDATA file if there is one for your carrier. Very important to have the phone working properly.
Start the Odin flashing process.
Phone will Auto-Reboot.
Done!
You should now be on the carrier you wish to use. This can be (in theory, test at own risk) replicated for ANY carrier supported by Samsung, and, I should soon find out if it will lead to what my original goal was, a bootloader unlock on the QualComm SnapDragon variant of the S21 and future Galaxy devices.
If you have any issues please comment below.
PoC, results after doing above process.
Good luck.
-k0mrade
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

There are some parts of my tutorial that are not well expressed and may be misleading. Please don't hesitate to post in comments if you need clarity.

IMPORTANT!!! I LEFT OUT ONE MAJOR STEP! ************ ----- BETWEEN STEP ONE AND STEP 2 - After you do the factory data reset/Wipe cache -> reboot to Bootloader -> force into download, you need to flash the U1 rom BEFORE putting in your desirced carriers SIM, then reboot, let phone fully boot, THEN insert your desired carriers SIM -> restart phone-> interrupt boot by forcing into recovery and repeat factory data wipe and cache wipe and reboot bootloader -> interrupt Boot Process again, but into Download Mode -> Flash your desired "U" carrier Firmware (must be same carrier as the SIM you put in as described above). -> Done.

And when/where does one need to use the required ADB-Tools?

tested and work only on S21 ULTRA 5G SM-G998 U & U1
thank you

OnnoJ said:
And when/where does one need to use the required ADB-Tools?
Click to expand...
Click to collapse
Lol this is likely one of those steps thats unneeded. i cant remeber off the top of my head why exactly i added that in. But it wont hurt to have the drivers, thats for sure.

Ive made a (Slightly) more clear post, hopefully better detailing this, Here. Mods may close this thread as they feel free but i will leave it up as a resource for the time being.

How many different devices have you tested this on?

iBowToAndroid said:
How many different devices have you tested this on?
Click to expand...
Click to collapse
ive just finished doing it on my 6th one device, 4 were Verizon 1 was Tmobile and 1 was ATT. I seem to be able to replicate this process over and over again so far with no issues so far, but i am making sure to update each device manually via odin 1st to latest u1 Firmware first as described above.

K0mraid3 said:
ive just finished doing it on my 6th one device, 4 were Verizon 1 was Tmobile and 1 was ATT. I seem to be able to replicate this process over and over again so far with no issues so far, but i am making sure to update each device manually via odin 1st to latest u1 Firmware first as described above.
Click to expand...
Click to collapse
And for each device, did you personally verify that it was not already unlocked before starting?
Because normally you can't get that restart popup prompt on U1 firmware unless the device is already unlocked

iBowToAndroid said:
And for each device, did you personally verify that it was not already unlocked before starting?
Because normally you can't get that restart popup prompt on U1 firmware unless the device is already unlocked
Click to expand...
Click to collapse
thats essentially the point of going from u to u1 then back to u after you booted atleast once into u1 with the desired carriers sim, somewhere along in the process of interrupting the bootloader and flashing the carriers U Firmware its overwriting the system policy. Theres a hole in here somewhere im positive. still trying to pin point exactly where this weakness lies.

iBowToAndroid said:
And for each device, did you personally verify that it was not already unlocked before starting?
Because normally you can't get that restart popup prompt on U1 firmware unless the device is already unlocked
Click to expand...
Click to collapse
End Game is to find a BL exploit to force enable OEM Unlocking on these qcomm s21s.

K0mraid3 said:
End Game is to find a BL exploit to force enable OEM Unlocking on these qcomm s21s.
Click to expand...
Click to collapse
You're definitely not going to find that, as that's not related to SIM unlocking whatsoever

iBowToAndroid said:
And for each device, did you personally verify that it was not already unlocked before starting?
Because normally you can't get that restart popup prompt on U1 firmware unless the device is already unlocked
Click to expand...
Click to collapse
And sorry to answer your initial question, yes, verfied carrier lock, getting errors like this, see attached.

iBowToAndroid said:
You're definitely not going to find that, as that's not related to SIM unlocking whatsoever
Click to expand...
Click to collapse
I like a challenge

This "temporary" thread is now closed. Main thread is here.

Question Update OnePlus 10 Pro from HydrogenOS (CN) to OxygenOS (EU/GL/IN) without rooting

This process uses Oxygen Updater as I haven't found the full EU/GL/IN stock ROMs anywhere else.
Update OnePlus 10 Pro NE2210 (CN) from HydrogenOS (NE2210_11_A.12) to OxygenOS EU (NE2213_11_A.12)
Download [Play Store] apk and install
[Play Store] install [Oxygen Updater]
[Oxygen Updater] Device: One Plus 10 Pro EU
[Oxygen Updater] Update method: Stable (full)
[Oxygen Updater] Settings > Advanced Mode - activate
[Oxygen Updater] Update > Download the full stock ROM (4.15 GB)
Activate Developer Options
Update > Local install
CURRENT STATUS: Verification failed
I've done this process before for other OnePlus phones and it was very straightforward. For some reason is not working with this OnePlus 10 Pro. Any insight on how to continue?
Thanks!

Bump, redownloaded again the EU version, resetted phone, still fails. Whyyy! Anyone can advise how to go from Hydrogen to Oxygen? Thanks!

Short description for "How to switch from ColorOS (Chinese version) to OxygenOS (IND/EU) on OnePlus 10 Pro". I did the flash under Windows 10, even if I'm usually a Linux guy...
BEFORE DOING THIS MANUAL, MAKE A BACKUP OF THE DATA OF YOUR DEVICE! Your phone will be DELETED completely!
1.)
- Download the desired ROM (Oxygen OS 12.1 A11 (IND) or Oxygen OS 12.1 A12 (EU) (Auntie Google has the answer, effective April 2022) -> extract
- download OnePlus_USB_driver.zip:
https://oneplususbdrivers.com/download-oneplus-usb-driver/ -> extract
- download Android Platform SDK:
https://www.techspot.com/downloads/downloadnow/5425/?evp=de0a68064118855fcddcc3980a2143c4&file=6062 -> extract
- download "Fastboot Enhance Tool": https://forum.xda-developers.com/t/...enhance-payload-dumper-image-flasher.4310553/ -> extract
2.) First of all, disable driver signature check for Windows 10, because the OnePlus drivers are not signed (yet).
3.) After restarting Windows, install the OnePlus drivers by executing the .exe file from the extracted folder.
4.) Copy the payload.bin file from the downloaded ROM into the folder where the fastbootenhance tool is located
5.) Enable Developer Options on your phone
6.) Enter the Developer Options, enable OEM unlock and USB debugging there
7.) Now connect your OnePlus 10 Pro to your computer by a USB cable. Make sure it's started, screen unlocked and charged over 60%
8.) On your computer, open File Explorer and switch to the Android SDK folder. Click in the address line above and type CMD [Enter]. A CMD window opens in the SDK folder.
9.) In CMD, type "adb devices". A new line should appear with the encrypted name of your device. When an empty line is returned, check the driver installation. If this line returns the name, but the suffix "not allowed", you must first allow this connection ON YOUR PHONE. Disconnect and reconnect your device and confirm the popup that appears on your phone! (Best is to enable "Always allow connections from this computer"!)
10.) Now type "adb reboot bootloader" in CMD. Your telephone restarts automatically to bootloader mode. In this mode your phone should tshow you it's name and beside of some other information you don't need, that the bootloader is LOCKED.
11.) Type in CMD "adb flashing unlock [Enter]". Now your phone should restart and ask you, if you want to unlock the bootloader or do not unlock the bootloader. With the volume buttons, switch to "UNLOCK BOOTLOADER" and confirm by pressing the Power Button.
12.) After doing so, restart your phone. After rebooting, go back to CMD and type "adb reboot fastboot". Your phone now should restart to "FASTBOOTD MODE". You are asked to choose a language (I recommend english after all... ;-) )
13.) Open the "Device Manager" on your computer.
14.) If device manager shows you some unknown device like "Android: ! 'ossi'" or similar, your device is not recognized in fastbootd mode. In that case continue with pt. 15. Otherwise continue with pt. 19
15.) Right-click on the unknown Android device and choose "Update driver..." -> "Search my computer for drivers" -> "Pick from a list of available drivers on my computer"
16.) When OnePlus drivers where installed correctly some steps above, Device Manager should suggest you 3 different possible drivers. Choose "OnePlus ADB Interface Manager" and confirm your choice. Windows will warn you that a wrong choice will crash Windows. Confirm also this warning.
17.) If everything went good, the before unknown device will change to an Android ADB Interface Device. When that happend, everything is good and you're good to go on.
18.) Just to be really sure: Type in CMD again "fastboot devices" and your computer should tell you the s/n of your phone with the suffix "fastboot". This will tell you your device is recognized in fastboot mode.
19.) Start "FASTBOOTENHANCE" tool from the respective folder (Folder name "release")
20.) Now you can follow the instructiions here at pt. 8.:
How to Install Indian ROM on Chinese OnePlus 10 Pro
In this comprehensive tutorial, we will show you the detailed steps to install the Indian ROM on the Chinese OnePlus 10 Pro.
www.droidwin.com
Puuuuuuh! That was enoying..! Maybe I have missed something... If so, please tell me by PN and I will complement this manual. But at this time, I guess it should work. I did it right like that this day - and it works fine! Finally I have my foremost chinese OP10Pro with a EU ROM in (swiss) german!
And if it works just like that (after my manual), please let me know as well!
Have fun! Oliver
Oh, there's something I forgot: I had after flashing still about a dozen of chinese apps I had to delete manually. Don't be surprised by that!

Thank you! Can you relock the bootloader afterwards? What model shows in the phone info screen?

This worked for me! Thanks very much.
After installing EU firmware, I factory reset the phone but Google Pay wont work saying the phone is rooted but when I launch Root Checker, it says ' Sorry! Root access is not properly installed on this device'
Is the root broken? Do I need to root again? Any ideas how to fix?

Lynxy0 said:
This worked for me! Thanks very much.
After installing EU firmware, I factory reset the phone but Google Pay wont work saying the phone is rooted but when I launch Root Checker, it says ' Sorry! Root access is not properly installed on this device'
Is the root broken? Do I need to root again? Any ideas how to fix?
Click to expand...
Click to collapse
If you relock the bootloader and reset, does it behave like a normal non-rooted phone with EU firmware?

Ultimatum99 said:
If you relock the bootloader and reset, does it behave like a normal non-rooted phone with EU firmware?
Click to expand...
Click to collapse
Good shout - Let me try that and get back to you.

Yes, this worked

Lynxy0 said:
Yes, this worked
Click to expand...
Click to collapse
Did the Chinese apps disappear once you locked the bootloader and resetted? Which method did you use to relock? What model is being shown in the phone info page? Thanks!!!

No they did not. After the first flash, the OP Launcher was back (previously it was Google Phone Launcher) . I factory reset and Chinese apps were back.

Ultimatum99 said:
Thank you! Can you relock the bootloader afterwards? What model shows in the phone info screen?
Click to expand...
Click to collapse
Hi Ultimatum99
I didn't relock my bootloader yet, but I'll do it in the next days, I'll post the update here. (Speaking technically it's possible, yes, but I don't know yet what happens...) And my model shows "NE2213" after the update.

Lynxy0 said:
This worked for me! Thanks very much.
After installing EU firmware, I factory reset the phone but Google Pay wont work saying the phone is rooted but when I launch Root Checker, it says ' Sorry! Root access is not properly installed on this device'
Is the root broken? Do I need to root again? Any ideas how to fix?
Click to expand...
Click to collapse
Hi Lynxy0
No, your phone is not rooted, but the bootloader is still unlocked, even after the update. And that means your phone is vulnerable to attacks from outside. So Google Pay tells you your phone is rooted, just to keep you safe. Try to relock your bootloader, this should solve the problem. (I didn't do it yet, but I'll post the update when I've done it.)

Lynxy0 said:
Yes, this worked
Click to expand...
Click to collapse
Haha... I was too late then!(See my last replay...) But thanks for the feedback!

Lynxy0 said:
No they did not. After the first flash, the OP Launcher was back (previously it was Google Phone Launcher) . I factory reset and Chinese apps were back.
Click to expand...
Click to collapse
This is unfortunately a bad thing... Some chinese apps are really back, even after flashing and resetting the device. But I could delete them manually. Yeah, it took me a few minutes, but at least, I had (finally) my beloved OxygenOS back! (After I crashed my OP6T almost 2 years ago, I chose a Oppo FindX 2 Pro - and after almost 2 years I still regret to have paid for this phone... The hardware was really cool, but ColorOS is ... So I was really terrified when I learned my brand new [chinese] OP10Pro had ColorOS installed by default..!)

Loba74 said:
This is unfortunately a bad thing... Some chinese apps are really back, even after flashing and resetting the device. But I could delete them manually. Yeah, it took me a few minutes, but at least, I had (finally) my beloved OxygenOS back! (After I crashed my OP6T almost 2 years ago, I chose a Oppo FindX 2 Pro - and after almost 2 years I still regret to have paid for this phone... The hardware was really cool, but ColorOS is ... So I was really terrified when I learned my brand new [chinese] OP10Pro had ColorOS installed by default..!)
Click to expand...
Click to collapse
Let us know if you manage to relock the bootloader and share the full process please, I can update the guide with your findings. Thanks!

Loba74 said:
Hi Lynxy0
No, your phone is not rooted, but the bootloader is still unlocked, even after the update. And that means your phone is vulnerable to attacks from outside. So Google Pay tells you your phone is rooted, just to keep you safe. Try to relock your bootloader, this should solve the problem. (I didn't do it yet, but I'll post the update when I've done it.)
Click to expand...
Click to collapse
It was pretty straight forward, unroot by uninstalling Magisk. adb into the bootloader and send the adb bootloader lock command, then boom, its locked. It wipes your phone in doing so, so you will have to everything again.

Lynxy0 said:
It was pretty straight forward, unroot by uninstalling Magisk. adb into the bootloader and send the adb bootloader lock command, then boom, its locked. It wipes your phone in doing so, so you will have to everything again.
Click to expand...
Click to collapse
Thanks @Lynxy0
So, just to clarify, after relocking the bootloader (which causes a full wipe) Google Pay works again?
Also, do you know if Netflix installs after relocking the bootloader? (Because in most phones once the bootloader is unlocked the status changes from "L1" and doesn't change back again after locking. Netflix reads that status, and Netflix will only install if it is L1.)
Many thanks

Hi Guys
It seems like a straight forward process, It was all good until I try flash it. . When I loaded the downloaded zip file, I couldn't get the payload file in fastbootd and flash it those buttons are missing(after I load it to payloadDumper .) . I thought it might be file download has some issue. I tried different ones , the same thing.
any ideas?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
C.

never mind , I figured it out . My case is the ADB driver problem , even u unlocked the bootloader , somehow the fastbootenhance wont work correctly , strange , ... but.
C

@Loba74 I think there is an error in your guide, in step 11 maybe it should say "fastboot flashing unlock" rather than "adb flashing unlock" ?

Question How to remove an encrypted custom os

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have a pixel 5a that was flashed with a custom os the restricted developer options and locked the bootloader is there any way for me to remove the os and go back to stock android?
This is what they sent me
(I was told that I might be able to flash the snapdragon soc directly by putting the phone in edl mode does anyone know if it’s feasible?)

I am certainly far from the sharpest tool in the shed here, but since no one else is speaking up, I'll try my hand at it.
You shouldn't be concerned with the bootloader being locked - you should be concerned if it can be UNLOCKED. The keys are writable from fastboot- custom ROMs like CalyxOS can be built and flashed with the proper keys to boot with a locked bootloader. The process of signing is described in AOSP documentation, and works on the 5A 5G (I have a customized variant of CalyxOS, signed by myself, with locked bootloader).
Carriers make special deals with the phone companies to OEM lock the bootloaders so that they cannot be unlocked via fastboot, without a key (likely IMEI specific). I don't know of anyone who has figured out how to OEM lock without actually being an OEM, but maybe it is possible.
Are you just finding a phone cheaper than the stock Pixel, hoping to reflash, or is this more complicated? The retail Google phone is most certainly unlockable with /no/ drama...

SomeRandomGuy said:
I am certainly far from the sharpest tool in the shed here, but since no one else is speaking up, I'll try my hand at it.
You shouldn't be concerned with the bootloader being locked - you should be concerned if it can be UNLOCKED. The keys are writable from fastboot- custom ROMs like CalyxOS can be built and flashed with the proper keys to boot with a locked bootloader. The process of signing is described in AOSP documentation, and works on the 5A 5G (I have a customized variant of CalyxOS, signed by myself, with locked bootloader).
Carriers make special deals with the phone companies to OEM lock the bootloaders so that they cannot be unlocked via fastboot, without a key (likely IMEI specific). I don't know of anyone who has figured out how to OEM lock without actually being an OEM, but maybe it is possible.
Are you just finding a phone cheaper than the stock Pixel, hoping to reflash, or is this more complicated? The retail Google phone is most certainly unlockable with /no
SomeRandomGuy said:
I am certainly far from the sharpest tool in the shed here, but since no one else is speaking up, I'll try my hand at it.
You shouldn't be concerned with the bootloader being locked - you should be concerned if it can be UNLOCKED. The keys are writable from fastboot- custom ROMs like CalyxOS can be built and flashed with the proper keys to boot with a locked bootloader. The process of signing is described in AOSP documentation, and works on the 5A 5G (I have a customized variant of CalyxOS, signed by myself, with locked bootloader).
Carriers make special deals with the phone companies to OEM lock the bootloaders so that they cannot be unlocked via fastboot, without a key (likely IMEI specific). I don't know of anyone who has figured out how to OEM lock without actually being an OEM, but maybe it is possible.
Are you just finding a phone cheaper than the stock Pixel, hoping to reflash, or is this more complicated? The retail Google phone is most certainly unlockable with /no/ drama...
Click to expand...
Click to collapse
im not even sure that I can access it from fastboot because as I said developer options is restricted on the phone so I can’t enable usb debugging and oem unlocking
Click to expand...
Click to collapse

I need to find someway to flash stock android back onto it

Google's support website for the Pixels lets you do it... directly from any browser that supports WebUSB (e.g. Chrome and its variants, newer FF's, etc).

SomeRandomGuy said:
Google's support website for the Pixels lets you do it... directly from any browser that supports WebUSB (e.g. Chrome and its variants, newer FF's, etc).
Click to expand...
Click to collapse
I dont think it’ll work without enabling usb debugging

CustomOShacks said:
I dont think it’ll work without enabling usb debugging
Click to expand...
Click to collapse
you can flash the stock factory image from here in bootloader mode (power + vol down)
Factory Images for Nexus and Pixel Devices | Google Play services | Google for Developers
developers.google.com
i use to this site remove non stock keys. at the very bottom of the webpage if i want to return to stock and flashed calyxos or graphenos to my phone.
GrapheneOS web installer
Web-based installer for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.
grapheneos.org

rchris494 said:
you can flash the stock factory image from here in bootloader mode (power + vol down)
Factory Images for Nexus and Pixel Devices | Google Play services | Google for Developers
developers.google.com
i use to this site remove non stock keys. at the very bottom of the webpage if i want to return to stock and flashed calyxos or graphenos to my phone.
GrapheneOS web installer
Web-based installer for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.
grapheneos.org
Click to expand...
Click to collapse
The bootloader is locked

CustomOShacks said:
The bootloader is locked
Click to expand...
Click to collapse
i did run across this. i am not sure how trust worthy the tools this person has are
https://www.youtube.com/c/5MinuteSolutions-DZ
i also did not see anything pixel 5a related.
also maybe there is something on 4pda that can help with the problem

rchris494 said:
i did run across this. i am not sure how trust worthy the tools this person has are
https://www.youtube.com/c/5MinuteSolutions-DZ
i also did not see anything pixel 5a related.
also maybe there is something on https://4pda.to/ that can help with the problem
Click to expand...
Click to collapse
Can you please post something more specific

Do you know if these tools will work without usb debugging enabled because the custom rom that my 5a is running restricts developer options so I don’t know how to enable usb debugging

So, by chance (and my stupidity) I am now in the same boat. This is a very frustrating situation that is close to making me swear off the entire Pixel line, forever.
TL;DR: Is there ANYTHING that works in fastboot mode with a locked bootloader?
Long version:
- I have a properly signed custom OS, and all the images AOSP would build (the factory image, the OTA image, etc).
- When the phone was last booted, "Enable OEM Unlocking" was ON, with the bootloader locked. Everything worked nicely.
- I stupidly let Magisk update itself, which of course borked the boot
- I can no longer get into recovery from fastboot (whines about broken OS) (e.g. to sideload OTA update)
- Despite OEM unlocking being on (or having been on and cursed with somehow it getting turned off), I can't unlock bootloader from fastboot
- I can't flash ANY partition (at least that I tried); all whine about locked bootloader
- I can't flash original Google image either (from Google web installer), whines about unlocking
- I can't use the GrapheneOS web installer to unlock bootloader (just fails)
- I can't fastboot boot <signed_boot_image> (e.g. to get to sideload from recovery), whines about unlocking
Especially with a device that doesn't allow SDCards, I'm far more concerned with something bad happening (like whoops, clicked the wrong button and autoupdated => brick) and me not being able to pull my data (SMS/MMS stuff, pictures, etc) than I am about all the (mostly valid) reasons for verified boot.
I would assume that I could still flash partitions that were properly signed by whatever keys were installed. Guess not. What a stupid restriction.
I'd also assume I could flash partitions signed by Google (if secure boot can tell me I'm running something other than stock, that means it has keys to verify stock, right?). Guess not. What a stupid restriction.
On a OnePlus, a quick EDL flash would unbrick this (would destroy data, of course, but at least I am not out $~500). I understand there are no EDL images published anyway (and I certainly can't find any).
I've read the above posts about overwriting the FBI's version of Android, and didn't find any functional means of unlocking and/or returning to stock (e.g the web installers for GrapheneOS or Google).
Is there maybe something I've missed? A lower level fastboot command I can use to restore the boot partition (again, I've got a properly signed one).