Related
Root achieved via kingroot. Looking for info on recovery bootloader and anything else. Anyone willing to help? Tester. Will provide logcats.
doesn't the c50 have option to unlock bootloader in developers settings?
"OEM" Mode
I have an LG L33L c50 & i've never seen that but I think I know what your talking about. Because in some Motorola phones like the Droid Ultra/MAXX/Turbo & Turbo 2 There is an OEM Mode or Unlock function in the Developer Options.
Now LG L33L/c50 or LG SUNSET whatever you wanna call it has a similar function but you have to punch in the DIAL CODE *#*#759#*#* to get to the menu for it, which is a
RLz DebugUI Hidden Menu and one of the options is to turn on "OEM Mode" & "OEM" Mode aka "Original Equipment Manufacturer" Mode has usually always been required for Unlocking your devices BOOTLOADER. You can do it on a few other LG, Moto & Samy devices.
I've attached a Screenshot of my phone at that menu.
I hope this was helpful.
Actually now that I think about it every phone that I've ever punched that dial code into accepted it. This other attachment is a picture of my old Huawei running an old school Gingerbread 2.3.6 OS at that menu
I know this is a long shot, but wondering if anyone has a before/after photo of what the camera takes before and after unlocking the bootloader. I'm not concerned with audio because V4A can easily overcome whatever software limitations there. More looking to see what I'd have to deal with on the camera front.
joesee said:
I know this is a long shot, but wondering if anyone has a before/after photo of what the camera takes before and after unlocking the bootloader. I'm not concerned with audio because V4A can easily overcome whatever software limitations there. More looking to see what I'd have to deal with on the camera front.
Click to expand...
Click to collapse
by all accounts, the "photos" the camera takes after unlocking bootloader are just a slab of plain green. so we're not talking a greenish hue that you could edit out, we're talking a camera that flat out doesn't work. see here: https://forum.xda-developers.com/showpost.php?p=74632491&postcount=5
For a visual example, check out this poor fellow's screenshot: https://talk.sonymobile.com/t5/Gene...capture-with-unlocked-XZ-Premium/td-p/1232964
Note the preview of the photo in the bottom right corner.
Granted, that was a XZ Premium user, but here's strong evidence that the same applies to our XZ1 Compact: https://forum.xda-developers.com/xperia-xz1-compact/help/green-photos-unlocked-bootloader-t3693195
Hello!
I would like to do a 3D-Scan of an object: however, I would have to do a full face scan before. Unfortunately, I can't immagine who I should scan. I would like to scan myself, but that's not possible.
So: is there a solution to do face-scans with the front-camera (with the XZ2 that should work) and is there a possibility to do an object scan without prior to have a full face scan done?
Are you rooted? If yes I can provide a backup of the app with all modes unlocked. But Im not sure if it will work fine on your device, since it has to be calibrated - and the calibration from the backup is specifically for my device
Thanks for the offer! However, I am not rooted at the moment..
BR
Sopur
Isn't that true, there is an update, not yet OTA pushed of the app which introduces this feature?
UPDATE:
https://www.apkmirror.com/apk/sony-mobile-communications/3d-creator/3d-creator-1-0-a-3-18-release/
Cool - Selfy-Scan works with the update!
So the bootloader allows 5 tries before forcing a reboot. I'm working on a brute force method to send unlock codes until one is successful. Basically send 4 codes, do a fastboot reboot bootloader, send 4 more - until a valid code is found. It takes 6 seconds on my system for the fastboot command to function again after issuing a reboot. At this rate I can only do 12,342 codes per day (give or take a few hundred). Total possible combinations is 7,958,661,109,946,400,884,391,936. This is based on 16 character alpha numeric (36^16). Of course, if there was a pattern like (111AA1111A1AA111), it would greatly reduce this. I'm within my 30 day window, so I'm likely just to send it back and put my $800 in a company that supports the community, but if I find enough of a pattern to consider brute forcing, I might consider keeping it around. I love the hardware, hating the UI and my inability to install my favorite apps from F-Droid that require root...
I think you would also need the IMEIs and Serial Numbers as the unlock code most probably gets generated with them.
P-Chan80 said:
So the bootloader allows 5 tries before forcing a reboot. I'm working on a brute force method to send unlock codes until one is successful. Basically send 4 codes, do a fastboot reboot bootloader, send 4 more - until a valid code is found. It takes 6 seconds on my system for the fastboot command to function again after issuing a reboot. At this rate I can only do 12,342 codes per day (give or take a few hundred). Total possible combinations is 7,958,661,109,946,400,884,391,936. This is based on 16 character alpha numeric (36^16). Of course, if there was a pattern like (111AA1111A1AA111), it would greatly reduce this. I'm within my 30 day window, so I'm likely just to send it back and put my $800 in a company that supports the community, but if I find enough of a pattern to consider brute forcing, I might consider keeping it around. I love the hardware, hating the UI and my inability to install my favorite apps from F-Droid that require root...
Click to expand...
Click to collapse
Hello P-Chan80,
Did you success ?
I'm also thinking in brute forcing the unlocking oem code on my Honor 6c Pro.
In my case I can try as many code as I want without rebooting but I have to confirm the fastboot unlocking command by pressing Volume UP and Power on the phone. Do you have this procedure on your Huawei ? I was thinking if it is possible to automate it by opening the phone and sending electrical impulses where the buttons are (with an arduino or a raspberry pi for instance).
Hey. It's a very interesting idea - try to brute the code. BUT I think that it is irrational - as the wear of the phone buttons will cost more than the cost of paid methods of obtaining the code. The question is-how do these services get the codes? I can only assume two options: they take the codes from huawei's database or they know the code generation algorithm(If Huawei use one), because they only need the imei or serial numbe to get unlock code. Do you think it is possible to to find this algorithm too?(Having a data: Imei – unlock code)?
May be it's sounds silly, but what do you think about it?
P-Chan80 said:
So the bootloader allows 5 tries before forcing a reboot. I'm working on a brute force method to send unlock codes until one is successful. Basically send 4 codes, do a fastboot reboot bootloader, send 4 more - until a valid code is found. It takes 6 seconds on my system for the fastboot command to function again after issuing a reboot. At this rate I can only do 12,342 codes per day (give or take a few hundred). Total possible combinations is 7,958,661,109,946,400,884,391,936. This is based on 16 character alpha numeric (36^16). Of course, if there was a pattern like (111AA1111A1AA111), it would greatly reduce this. I'm within my 30 day window, so I'm likely just to send it back and put my $800 in a company that supports the community, but if I find enough of a pattern to consider brute forcing, I might consider keeping it around. I love the hardware, hating the UI and my inability to install my favorite apps from F-Droid that require root...
Click to expand...
Click to collapse
Did eventually worked?
Equivalent is winning the lottery. Considering the number of possible combinations it would take years to complete the whole sequence. Not practical at all.
It would help a lot if you get some sort of pattern but that would be hard to get unless all people with the unlock phones provide their IMEI and unlock codes.
If you get enough matching pairs you might be able to figure out the logic. Then should not be too hard to create a generator by putting together a small script (python/perl/php/bash/whatever). The hard bit is to get the pairs and then the script should not be too hard to create. I could try.
I ask this not knowing anything about the Android bootloader process. Is it possible to dump the bootloader of a locked or unlocked phone and analyse the code to identify where and how it identifies a valid unlock code? And then work backwards from there? Or are codes signed by Huawei using a private key and such an analysis would prove unfeasible?
If the unlock codes are signed, but dumping the bootloader is possible, could an analysis of the bootloader code from a dump allow for an exploit to be developed similar to the Amonet exploit used on the 5th, 7th and 9th gen Fire 7 tablets?
It seems someone is trying this method: https://github.com/SkyEmie/huawei-honor-unlock-bootloader
However no-one has confirmed if it actually works, but some users said it doesn't.
EDIT: Started the process 5 hours ago and it did like 1%. The Huawei M3 Lite I'm testing this on doesn't reboot ever. Not sure I'll keep it running for 20 days.
would it be possible to pause it and resume other time?
that would be great.
hfmls said:
would it be possible to pause it and resume other time?
that would be great.
Click to expand...
Click to collapse
Considering it's a command window, you can make a selection with the mouse and it will "block" / pause until you unselect. That should help run the whole thing to the end.
Are you sure the unlock codes are alphanumeric?
Can someone who have unlocked bootloader send me the code and IMEI in PM ? - I know that is private info, but Unlock code should be related to the IMEI
I do a little research today using this bootloader dump: https://forum.xda-developers.com/hu...rch-requesting-bootloader-dump-t3897062/page2
There are two interesting functions that are taking a param - I think it should be a unlock code, and then one of them is passing the code to other function:
void FUN_000be4e6(void)
{
undefined *puVar1;
undefined *puVar2;
undefined *in_pc;
longlong lVar3;
undefined4 in_cr5;
undefined auStack140 [140];
coprocessor_storelong(0xe,in_cr5,auStack140);
puVar1 = (undefined *)0x3e8;
puVar2 = (undefined *)0x3f0;
lVar3 = 8;
while( true ) {
*in_pc = *puVar1;
in_pc[1] = *puVar2;
in_pc = in_pc + 2;
lVar3 = lVar3 + -1;
if (lVar3 == 0) break;
puVar1 = puVar1 + 1;
puVar2 = puVar2 + 1;
}
/* WARNING: Bad instruction - Truncating control flow here */
halt_baddata();
}
Click to expand...
Click to collapse
I think it should be related because it is getting two elements at a time and the loop iterates 8 times - 8*2=16 - the length of the unlock code
Pretty sure that Huawei only asked for my serial, can't remember them asking for my IMEI, but then it has been a couple of years nearly.
Also seem to remember the code being numbers only, but again it's been a while.
dladz said:
Pretty sure that Huawei only asked for my serial, can't remember them asking for my IMEI, but then it has been a couple of years nearly.
Also seem to remember the code being numbers only, but again it's been a while.
Click to expand...
Click to collapse
What device are you referring to?
Certainly that's not how it worked o.n the latest devices.
They asked for imei number only and on the devices with multiple imeis I think only 1st one was needed. The code that they provide also is alphanumeric : FNHHZ85YQ3WP2T0X
If I find my old imei I'll share it as well, I hope I have a backup somewhere ( I actually found old transcripts from Huawei support including my 1st imei, I'll look for the 2nd one in the following days )
Imei #1 - 866219037075115
borovaka said:
Are you sure the unlock codes are alphanumeric?
Can someone who have unlocked bootloader send me the code and IMEI in PM ? - I know that is private info, but Unlock code should be related to the IMEI
I do a little research today using this bootloader dump: https://forum.xda-developers.com/hu...rch-requesting-bootloader-dump-t3897062/page2
There are two interesting functions that are taking a param - I think it should be a unlock code, and then one of them is passing the code to other function:
I think it should be related because it is getting two elements at a time and the loop iterates 8 times - 8*2=16 - the length of the unlock code
Click to expand...
Click to collapse
I was the one who started that thread. I couldn't narrow down on any functions related to unlock code verification though in any of those dumps. Can you share some more light on how you identified that particular function? I'd be interested in taking this up again in my spare time too.
The reasons why I didn't purse it further at that time (as far as I remember) were:
1. There's no partition titled "boot" or "aboot" on atleast EMUI 9. I remember doing some more research on this but seemed to hit a dead-end.
2. Fastboot dump seems to be encrypted. This would make sense since the device has roots-of-trust implemented. Not sure if they only check & verify signatures or also if important sections are encrypted at rest. Didn't pursue this further due to lack of time.
Aodrulez said:
I was the one who started that thread. I couldn't narrow down on any functions related to unlock code verification though in any of those dumps. Can you share some more light on how you identified that particular function? I'd be interested in taking this up again in my spare time too.
Click to expand...
Click to collapse
I used ghidra with the image from the other post. With ARM CORTEX little endian profile
Rstment ^m^ said:
What device are you referring to?
Certainly that's not how it worked o.n the latest devices.
They asked for imei number only and on the devices with multiple imeis I think only 1st one was needed. The code that they provide also is alphanumeric : FNHHZ85YQ3WP2T0X
If I find my old imei I'll share it as well, I hope I have a backup somewhere ( I actually found old transcripts from Huawei support including my 1st imei, I'll look for the 2nd one in the following days )
Imei #1 - 866219037075115
Click to expand...
Click to collapse
It was two years ago, can't remember giving my IMEI out, 100% my serial via the official Huawei bootloader unlock method, cannot remember if it was alpha it not.
Either way. Best of luck with this, would love to see someone crack this, could make a tonne of money if you did.
Or even better free
Did some more research on this & it turns out, on recent Huawei devices, the bootloader is named "xloader". The fastboot dump from my rooted phone is encrypted & so won't yield anything useful. It's also very rare to find references to detailed information on this "xloader" image/partition on the internet. Will dig some more when I get time.
Rstment ^m^ said:
What device are you referring to?
Certainly that's not how it worked o.n the latest devices.
They asked for imei number only and on the devices with multiple imeis I think only 1st one was needed. The code that they provide also is alphanumeric : FNHHZ85YQ3WP2T0X
If I find my old imei I'll share it as well, I hope I have a backup somewhere ( I actually found old transcripts from Huawei support including my 1st imei, I'll look for the 2nd one in the following days )
Imei #1 - 866219037075115
Click to expand...
Click to collapse
P20 Pro, Huawei method..
Like I said it's been 2 years so may be remembering it wrong..
dladz said:
P20 Pro, Huawei method..
Like I said it's been 2 years so may be remembering it wrong..
Click to expand...
Click to collapse
I got myne from support so who knows, I didn't get a chance to use website
Is there anyone for whom the OEM Unlock option in developer options is not grayed out?
So far from my research, it's always grayed out, so I'm trying to gather information about it, and see if there are any situations in which it is not grayed out.
Tested so far:
European Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Demo Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Chinese Mate 20 Pro - No such option, so bootloader can be unlocked successfully.
i thought it was huaweis new policy to not allow anyone to unlock the BL
Will the Mate 20 Pro sell in Southeast Asia to be grayed out too? Hopefully not, since I wont upgrade my Mate 10 Pro to this flagship if I cannot root the device (fully owned the device system).
Hmm this is a concern to me. As much as this device is amazing, root at the very least is important let alone custom roms! Hmm
**** this is a serious problem !! if they all start to block the bootloader is a real peoblema!
What do you guys root for? Genuine question, I'm sure you have valid use cases, I've just never had a need to.
daz_2000 said:
What do you guys root for? Genuine question, I'm sure you have valid use cases, I've just never had a need to.
Click to expand...
Click to collapse
Macrodroid (for automation tasks etc.), system wide ad blocking (directly mod the hosts file without any battery draining app or vpn), titanium backup for app backups, uninstalling system apps/debloating, system app/user app themes (black, making most of that oled screen). Shortcutter, as app that adds loads more quick settings.
With magisk manager, custom modules such as vanced YouTube and the amazing viper4android a system wide equaliser. Some developers create custom performance/battery enhancement scripts that vastly improve stock performance. Plus some custom features roms have app ops which greatly allows app level permission.
Not to mention custom roms with additional features bringing to the user experience. But I'm fearful at present!
I'm awaiting the Mate 20 Pro arriving on Friday and listed my Pixel 2 XL for sale. I've messaged @topjohnwu who seemingly may be the only person who could help with making root possible. But with the bootloader unlock situation this may prove rather difficult. Especially given hearing about the greyed out OEM unlock option, but perhaps full retail releases will allow it, here's hoping anyways....
cd993 said:
Macrodroid (for automation tasks etc.), system wide ad blocking (directly mod the hosts file without any battery draining app or vpn), titanium backup for app backups, uninstalling system apps/debloating, system app/user app themes (black, making most of that oled screen). Shortcutter, as app that adds loads more quick settings.
With magisk manager, custom modules such as vanced YouTube and the amazing viper4android a system wide equaliser. Some developers create custom performance/battery enhancement scripts that vastly improve stock performance. Plus some custom features roms have app ops which greatly allows app level permission.
Not to mention custom roms with additional features bringing to the user experience. But I'm fearful at present!
I'm awaiting the Mate 20 Pro arriving on Friday and listed my Pixel 2 XL for sale. I've messaged @topjohnwu who seemingly may be the only person who could help with making root possible. But with the bootloader unlock situation this may prove rather difficult. Especially given hearing about the greyed out OEM unlock option, but perhaps full retail releases will allow it, here's hoping anyways....
Click to expand...
Click to collapse
That was some great info man, well written, cant believe we are both coming to same phone from xl2, do u use aod all the yourself? And like double tap to wake the screen on pixie?
misiokicio said:
That was some great info man, well written, cant believe we are both coming to same phone from xl2, do u use aod all the yourself? And like double tap to wake the screen on pixie?
Click to expand...
Click to collapse
Thanks mate!
Nagh I'm not that fussed about AOD ill use the notification led, I like having that e.g. Red for missed call, green for WhatsApp etc and I don't use double tap to wake either
duraaraa said:
Is there anyone for whom the OEM Unlock option in developer options is not grayed out?
So far from my research, it's always grayed out, so I'm trying to gather information about it, and see if there are any situations in which it is not grayed out.
Tested so far:
European Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Demo Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Chinese Mate 20 Pro - No such option, so bootloader can be unlocked successfully.
Click to expand...
Click to collapse
try with this solution!
You have to reset your device while the sim card is in the device , then in the setup you have to log in to your both google and samsung accounts , then wait 7 days , and it should appear , if it doesnt appearing simply use google to check how to fix the missing OEM Unlock option
I remember the days with the Xperia Z3, where the bootloader was also locked. Still it was possible to unlock it after someone found a way. We know that nothing is secure, so I hope for out great developers to fix this in the future!
Or do you think it will be simply imposssible without the Code?
Maddinuser said:
I remember the days with the Xperia Z3, where the bootloader was also locked. Still it was possible to unlock it after someone found a way. We know that nothing is secure, so I hope for out great developers to fix this in the future!
Or do you think it will be simply imposssible without the Code?
Click to expand...
Click to collapse
See attached for my email conversation with Funky Huawei.
Seems that so long as we can check that setting then perhaps they can generate an unlock code with our IMEI number. I've used their service before for firmware flashing, they're reputable.
Just hope it's possible....
We can now offer bootloader unlock codes for all Huawei models (including recent models like P20, P20 Pro, Honor Play, and so on.)
These unlock codes can be provided for free to customers who purchase an unlimited pass from today.
See details here:
(https://twitter.com/FunkyHuawei/status/1050739731443544064?s=03)
So we would just need a hack that enables the tick in developer options.
Maddinuser said:
So we would just need a hack that enables the tick in developer options.
Click to expand...
Click to collapse
I guess so yeah, but also I remain hopeful that perhaps retail devices (as opposed to the early release ones that people seem to have early) may have the option....
@BurningRain, you have a retail verison, can please check if you can tick/untick the OEM unlock option in the developer settings?
duraaraa said:
Is there anyone for whom the OEM Unlock option in options is not grayed out?
So far from my research, it's always grayed out, so I'm trying to gather information about it, and see if there are any situations in which it is not grayed out.
Tested so far:
European Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Demo Mate 20 Pro - Grayed out, so bootloader can't be unlocked with code.
Chinese Mate 20 Pro - No such option, so bootloader can be unlocked successfully.
Click to expand...
Click to collapse
On older huawei devices (Honor9, Honor10, HuaweiP20), I noticed after the device is totally erased (low level format, cache wiped and settings to factory defaults) : you had to connect to internet to get the OEM Unlock option to not be greyed out.
So maybe it will be enabled on huawei's server side in a few days...
ventu87 said:
try with this solution!
You have to reset your device while the sim card is in the device , then in the setup you have to log in to your both google and samsung accounts , then wait 7 days , and it should appear , if it doesnt appearing simply use google to check how to fix the missing OEM Unlock option
Click to expand...
Click to collapse
I'm guessing you meant 'google playstore account' by 'samsung account'...
Did you enable it yourself on your Mate 20 Pro ? which cust variant ?
Interesting...
Just watched this video:
4 Reasons I SWITCHED to the Huawei Mate 20 Pro | The Tech Chap
And at 3:10 I noticed that the option (on his presumably prelease device, given he is from the UK but has a 2 pin charger and not UKL 3 pin) is greyed out and interestingly says "connect to the internet or contact your network provider" under the OEM unlock option - see attached screen snip
Hmm.....!
cd993 said:
Interesting...
Just watched this video:
4 Reasons I SWITCHED to the Huawei Mate 20 Pro | The Tech Chap
And at 3:10 I noticed that the option (on his presumably prelease device, given he is from the UK but has a 2 pin charger and not UKL 3 pin) is greyed out and interestingly says "connect to the internet or contact your network provider" under the OEM unlock option - see attached screen snip
Hmm.....!
Click to expand...
Click to collapse
That's is an interesting one
Reuben_skelz92 said:
That's is an interesting one
Click to expand...
Click to collapse
I guess all will be revealed Friday eh...!
cd993 said:
Interesting...
Just watched this video:
4 Reasons I SWITCHED to the Huawei Mate 20 Pro | The Tech Chap
And at 3:10 I noticed that the option (on his presumably prelease device, given he is from the UK but has a 2 pin charger and not UKL 3 pin) is greyed out and interestingly says "connect to the internet or contact your network provider" under the OEM unlock option - see attached screen snip
Hmm.....!
Click to expand...
Click to collapse
Yes, I have the phone in Spain and I have the same message in oem unlock