Where does bootloader store the state of locked/unlocked? - Upgrading, Modifying and Unlocking

I noticed that bootloader doesn't depend on kernel commandline variables to learn the state of device. Even if you wipe /system and /boot partition, you can still go to bootloader mode (fastboot mode/ Download mode) and check the locked/unlocked state of the bootloader.
That means bootloader itself stores some flag about the state somewhere. Android documentation lacks details about this but Google did mention that bootloader changes ro.boot.verifiedbootstate to set the value of ro.boot.flash.locked where the value is "0" if it is unlocked.
Google also didn't mention what flags are set if the custom Root of Trust (custom AVB) is enforced. I'm looking for this answer too.
I read about EFUSEs which are array of EEPROM where a bit can be written only once. But they are used for rollback protection and keys revocation, not for storing bootloader status.
Where exactly do most android devices store their bootloader state?

Most expected could be fastboot after recieving authentic unlock token rewrite aboot and aboot_bak partitions and devcfg if exist with unlock patch.

Camlin3 said:
Most expected could be fastboot after recieving authentic unlock token rewrite aboot and aboot_bak partitions and devcfg if exist with unlock patch.
Click to expand...
Click to collapse
I've found that it is saved in devInfo partition. Some even save it in eFuse.

Related

[q] [readme] - [arc s][ics beta][unlocked bootloader][userdata]

So I now have ICS Beta on the LT18i, bootloader unlocked.
EXCEPT I cannot 'flashboot.exe -i 0x0fce userdata userdata.img'
it returns 'FAILED (remote: partition not found)'
From the sony site:
'When the boot loader is unlocked, the sensitive data is removed, such as DRM certificates, and the user partition of the file system is wiped out. But all other functionality, such as the camera and other drivers, is left intact.'
http://developer.sonymobile.com/wp/2011/05/06/how-to-build-a-linux-kernel/
Does this mean that because the bootloader is unlocked I have no userdata partition to write to?
If I relock the bootloader (I have seen a tutorial around here), will that give me the userdata partition back?
Any help or pointers much appreciated, noob here!
Found my stock .62 Rom, flashed it over with flash tool, used fastboot from cmd to install ics, perfec'.
Sent from my LT18i using XDA

(Q) How to Re-Lock the LG G4 (H815) ?

Hi everyone,
I was wondering how does one can relock the bootloader, many people say it's impossible, but I'm pretty sure there is a solution.
Looking into the partition table to delete the unlocked status to locked status...
I saw in a fastboot mode with this command "fastboot erase unlock" and this cmd return "cannot erase this partition in unlocked state"
So i don't know at this point.
If anyone can help me it would be nice.
Best Regards. Aize147.
It can't be done. Not yet, anyway.
Aize147 said:
Hi everyone,
I was wondering how does one can relock the bootloader, many people say it's impossible, but I'm pretty sure there is a solution.
Looking into the partition table to delete the unlocked status to locked status...
I saw in a fastboot mode with this command "fastboot erase unlock" and this cmd return "cannot erase this partition in unlocked state"
So i don't know at this point.
If anyone can help me it would be nice.
Best Regards. Aize147.
Click to expand...
Click to collapse
There is no way to relock the Bootloader once unlocked as of yet. I also would not wait for it.
BTW; "unlock" is not a partition. Typing "fastboot erase XYZ" will always return "cannot erase this partition in unlocked state". You really think you'd simply stumble upon a command to relock the Bootloader, don't you? xD
Haven't Tried It Yet, but....
nitrous² said:
There is no way to relock the Bootloader once unlocked as of yet. I also would not wait for it.
BTW; "unlock" is not a partition. Typing "fastboot erase XYZ" will always return "cannot erase this partition in unlocked state". You really think you'd simply stumble upon a command to relock the Bootloader, don't you? xD
Click to expand...
Click to collapse
Fastboot does contain a command "fastboot oem lock." Am I correct in assuming from LG's statement that this command would fail on an unlocked bootloader? (The explanation of this command says it will "lock your phone’s bootloader once again if locking it is actually allowed.")

Pixel XL stuck in boot animation

I have a rooted Pixel XL. I kept the OEM ROM. Besides being rooted it's stock. I'm selling the phone and did a factory reset within the menu. It rebooted and now it's stuck in the boot animation screen. I went into recovery mode and wiped it that way as well. When I reboot, it's the same thing. I see the "Google" logo, but then it's just stuck on the animation screen. Did I forget to do something? Do I have to re-lock it before I wipe it? Thank you
flint24 said:
I have a rooted Pixel XL. I kept the OEM ROM. Besides being rooted it's stock. I'm selling the phone and did a factory reset within the menu. It rebooted and now it's stuck in the boot animation screen. I went into recovery mode and wiped it that way as well. When I reboot, it's the same thing. I see the "Google" logo, but then it's just stuck on the animation screen. Did I forget to do something? Do I have to re-lock it before I wipe it? Thank you
Click to expand...
Click to collapse
First and foremost don't relock it. If you want to clean it up for selling purposes, then you're best bet is to flash a full factory image. Nice and easy and the phone will be complete stock after.
Post above is dead on, just flash all. Also remember to properly remove your Google account so the buyer doesn't have problems.
Sent from my Pixel XL using XDA Labs
toknitup420 said:
First and foremost don't relock it. If you want to clean it up for selling purposes, then you're best bet is to flash a full factory image. Nice and easy and the phone will be complete stock after.
Click to expand...
Click to collapse
Thanks. It actually came back up after rebooting it a few times. I'm still a little concerned as I don't want the buyer to go through the same hassle should he also try to factory reset it from the menu. I didn't change the image at all, just unlocked the bootloader and rooted the phone. I'm afraid to **** with it any more. It's working now. I'm just hoping the buyer doesn't a) play with the factory reset and b) mind the "bootloader is unlocked" message when the phone is rebooted.
flint24 said:
Thanks. It actually came back up after rebooting it a few times. I'm still a little concerned as I don't want the buyer to go through the same hassle should he also try to factory reset it from the menu. I didn't change the image at all, just unlocked the bootloader and rooted the phone. I'm afraid to **** with it any more. It's working now. I'm just hoping the buyer doesn't a) play with the factory reset and b) mind the "bootloader is unlocked" message when the phone is rebooted.
Click to expand...
Click to collapse
Wait I'm confused. Did you sell the phone in a non bootable state? Do you have twrp on it?
toknitup420 said:
Wait I'm confused. Did you sell the phone in a non bootable state? Do you have twrp on it?
Click to expand...
Click to collapse
No it boots. It boots into whatever image was on it when I bought it at Verizon. I just unlocked the bootloader and gave myself root access. I didn't use TWRP.
Ok now I have a new problem. The guy I sold the phone to didn't like that the bootloader was unlocked. He called Google who made him re-lock the bootloader. So he sent the phone back to me completely bricked. Now I get a RED exclamation triangle on the boot screen, saying the device is corrupt and can't be trusted. Then it shuts off. It doesn't even go to the bouncing ball Google startup screen. I'm able to get into the bootloader screen which confirms that it's locked. However I'm unable to get to a recovery. When I press the vol up/down buttons to choose recovery, it just reboots and shuts off like before. I can only get to the bootloader.
Is there anything I can do to salvage this phone? Thanks guys.
Edit 1: I'm able to boot into safe mode.
Edit 2: I'm not longer able to get into safe mode. It freezes during the boot and the bouncing balls just stop. A "G" comes up, then it turns off.
Nevermind disregard
Is there any way to boot into safe mode from fastboot? Or install a recovery, even stock recovery, without the bootloader being unlocked?
Sent from my EDI-AL10 using Tapatalk
flint24 said:
Is there any way to boot into safe mode from fastboot?
Click to expand...
Click to collapse
This was the very first result when I googled your question. Hope it helps?
https://recomhub.com/blog/how-to-start-google-pixel-and-pixel-xl-in-safe-mode/
flint24 said:
Or install a recovery, even stock recovery, without the bootloader being unlocked?
Click to expand...
Click to collapse
I'm pretty sure it's not possible. About 97% sure.
But I haven't researched it or anything.
CZ Eddie said:
This was the very first result when I googled your question. Hope it helps?
https://recomhub.com/blog/how-to-start-google-pixel-and-pixel-xl-in-safe-mode/
I'm pretty sure it's not possible. About 97% sure.
But I haven't researched it or anything.
Click to expand...
Click to collapse
Thanks but I've been trying to get back into safe mode this way for days now. I was able to do it once, but never again for some strange reason. Since it turns off immediately after boot, I have to go into fastboot then run the fastboot continue command just to get to the Google startup screen. Then I press and hold volume down. It's only worked once.
Sent from my EDI-AL10 using Tapatalk
flint24 said:
Thanks but I've been trying to get back into safe mode this way for days now. I was able to do it once, but never again for some strange reason. Since it turns off immediately after boot, I have to go into fastboot then run the fastboot continue command just to get to the Google startup screen. Then I press and hold volume down. It's only worked once.
Sent from my EDI-AL10 using Tapatalk
Click to expand...
Click to collapse
I get it now. You're looking for a way to access Safe Mode specifically from within Fastboot.
Try this link?
http://android.stackexchange.com/questions/131188/entering-safe-mode-from-adb-shell
Please let us know what you find out.
Sharing [info] is caring.
EDIT: That link is for ADB, not Fastboot. oops.
CZ Eddie said:
I get it now. You're looking for a way to access Safe Mode specifically from within Fastboot.
Try this link?
http://android.stackexchange.com/questions/131188/entering-safe-mode-from-adb-shell
Please let us know what you find out.
Sharing [info] is caring.
EDIT: That link is for ADB, not Fastboot. oops.
Click to expand...
Click to collapse
Do you have to be in recovery mode to run adb commands? I'm only able to get into fastboot mode.
Sent from my EDI-AL10 using Tapatalk
flint24 said:
Do you have to be in recovery mode to run adb commands? I'm only able to get into fastboot mode.
Click to expand...
Click to collapse
Yep, sorry. That's why I edited my post.
ADB only works from recovery.
I googled for a couple minutes but couldn't find a Safe Mode command for fastboot. Sorry.
---------- Post added at 05:18 PM ---------- Previous post was at 05:17 PM ----------
What happens if you get into Fastboot and run the command "fastboot continue"?
CZ Eddie said:
Yep, sorry. That's why I edited my post.
ADB only works from recovery.
I googled for a couple minutes but couldn't find a Safe Mode command for fastboot. Sorry.
Click to expand...
Click to collapse
You see my pain here man lol. My phone is completely jacked. Whoever this guy called who bought my phone (I think it was Google) had him hack proof the phone.
Sent from my EDI-AL10 using Tapatalk
CZ Eddie said:
Yep, sorry. That's why I edited my post.
ADB only works from recovery.
I googled for a couple minutes but couldn't find a Safe Mode command for fastboot. Sorry.
---------- Post added at 05:18 PM ---------- Previous post was at 05:17 PM ----------
What happens if you get into Fastboot and run the command "fastboot continue"?
Click to expand...
Click to collapse
It starts to boot. I see the spinning balls, then they stop and stand in place. Sometimes I see a "G" and then the screen goes dark. It's not off though. The screen just does dark
Sent from my EDI-AL10 using Tapatalk
flint24 said:
It starts to boot. I see the spinning balls, then they stop and stand in place. Sometimes I see a "G" and then the screen goes dark. It's not off though. The screen just does dark
Click to expand...
Click to collapse
There does not appear to be a safe mode option for fastboot.
I'm very uncomfortable offering suggestions here because I'm out of my depth and your phone is a Verizon that was unlocked and then re-locked which is even more of an unknown for me.
Have you tried to fasboot anything like flash-all.bat or fastboot boot twrp.img just to see what happens?
I'm just throwing stuff on the wall here. TWRP probably won't work because it sounds like you're relocked.
Anything you do from here on could likely brick your phone even harder.
Here's a list of fastoot commands.
I'm really interested to know if unlock works, or if the critical unlock works and lets you boot a boot img or something to gain access to recovery.
Check out all the various unlock options.
Again, I'm out of my depth and doing ANYTHING here could brick you harder.
May be best to wait for some better help.
Code:
C:\Users\xxx\AppData\Local\Android\sdk1\platform-tools>fastboot
usage: fastboot [ <option> ] <command>
commands:
update <filename> Reflash device from update.zip.
Sets the flashed slot as active.
flashall Flash boot, system, vendor, and --
if found -- recovery. If the device
supports slots, the slot that has
been flashed to is set as active.
Secondary images may be flashed to
an inactive slot.
flash <partition> [ <filename> ] Write a file to a flash partition.
flashing lock Locks the device. Prevents flashing.
flashing unlock Unlocks the device. Allows flashing
any partition except
bootloader-related partitions.
flashing lock_critical Prevents flashing bootloader-related
partitions.
flashing unlock_critical Enables flashing bootloader-related
partitions.
flashing get_unlock_ability Queries bootloader to see if the
device is unlocked.
flashing get_unlock_bootloader_nonce Queries the bootloader to get the
unlock nonce.
flashing unlock_bootloader <request> Issue unlock bootloader using request
.
flashing lock_bootloader Locks the bootloader to prevent
bootloader version rollback.
erase <partition> Erase a flash partition.
format[:[<fs type>][:[<size>]] <partition>
Format a flash partition. Can
override the fs type and/or size
the bootloader reports.
getvar <variable> Display a bootloader variable.
set_active <slot> Sets the active slot. If slots are
not supported, this does nothing.
boot <kernel> [ <ramdisk> [ <second> ] ] Download and boot kernel.
flash:raw boot <kernel> [ <ramdisk> [ <second> ] ]
Create bootimage and flash it.
devices [-l] List all connected devices [with
device paths].
continue Continue with autoboot.
reboot [bootloader] Reboot device [into bootloader].
reboot-bootloader Reboot device into bootloader.
help Show this help message.
options:
-w Erase userdata and cache (and format
if supported by partition type).
-u Do not erase partition before
formatting.
-s <specific device> Specify a device. For USB, provide ei
ther
a serial number or path to device por
t.
For ethernet, provide an address in t
he
form <protocol>:<hostname>[:port] whe
re
<protocol> is either tcp or udp.
-p <product> Specify product name.
-c <cmdline> Override kernel commandline.
-i <vendor id> Specify a custom USB vendor id.
-b, --base <base_addr> Specify a custom kernel base
address (default: 0x10000000).
--kernel-offset Specify a custom kernel offset.
(default: 0x00008000)
--ramdisk-offset Specify a custom ramdisk offset.
(default: 0x01000000)
--tags-offset Specify a custom tags offset.
(default: 0x00000100)
-n, --page-size <page size> Specify the nand page size
(default: 2048).
-S <size>[K|M|G] Automatically sparse files greater
than 'size'. 0 to disable.
--slot <slot> Specify slot name to be used if the
device supports slots. All operations
on partitions that support slots will
be done on the slot specified.
'all' can be given to refer to all sl
ots.
'other' can be given to refer to a
non-current slot. If this flag is not
used, slotted partitions will default
to the current active slot.
-a, --set-active[=<slot>] Sets the active slot. If no slot is
provided, this will default to the va
lue
given by --slot. If slots are not
supported, this sets the current slot
to be active. This will run after all
non-reboot commands.
--skip-secondary Will not flash secondary slots when
performing a flashall or update. This
will preserve data on other slots.
--unbuffered Do not buffer input or output.
--version Display version.
-h, --help show this message.
C:\Users\xxx\AppData\Local\Android\sdk1\platform-tools>
---------- Post added at 05:39 PM ---------- Previous post was at 05:37 PM ----------
Here is my guide for the flash-all.bat if you want to see if it works.
I think you might have to be unlocked though?
https://forum.xda-developers.com/pixel-xl/how-to/info-how-restored-to-stock-soft-t3494478
CZ Eddie said:
There does not appear to be a safe mode option for fastboot.
I'm very uncomfortable offering suggestions here because I'm out of my depth and your phone is a Verizon that was unlocked and then re-locked which is even more of an unknown for me.
Have you tried to fasboot anything like flash-all.bat or fastboot boot twrp.img just to see what happens?
I'm just throwing stuff on the wall here. TWRP probably won't work because it sounds like you're relocked.
Anything you do from here on could likely brick your phone even harder.
Here's a list of fastoot commands.
I'm really interested to know if unlock works, or if the critical unlock works and lets you boot a boot img or something to gain access to recovery.
Check out all the various unlock options.
Again, I'm out of my depth and doing ANYTHING here could brick you harder.
May be best to wait for some better help.
Code:
C:\Users\xxx\AppData\Local\Android\sdk1\platform-tools>fastboot
usage: fastboot [ <option> ] <command>
commands:
update <filename> Reflash device from update.zip.
Sets the flashed slot as active.
flashall Flash boot, system, vendor, and --
if found -- recovery. If the device
supports slots, the slot that has
been flashed to is set as active.
Secondary images may be flashed to
an inactive slot.
flash <partition> [ <filename> ] Write a file to a flash partition.
flashing lock Locks the device. Prevents flashing.
flashing unlock Unlocks the device. Allows flashing
any partition except
bootloader-related partitions.
flashing lock_critical Prevents flashing bootloader-related
partitions.
flashing unlock_critical Enables flashing bootloader-related
partitions.
flashing get_unlock_ability Queries bootloader to see if the
device is unlocked.
flashing get_unlock_bootloader_nonce Queries the bootloader to get the
unlock nonce.
flashing unlock_bootloader <request> Issue unlock bootloader using request
.
flashing lock_bootloader Locks the bootloader to prevent
bootloader version rollback.
erase <partition> Erase a flash partition.
format[:[<fs type>][:[<size>]] <partition>
Format a flash partition. Can
override the fs type and/or size
the bootloader reports.
getvar <variable> Display a bootloader variable.
set_active <slot> Sets the active slot. If slots are
not supported, this does nothing.
boot <kernel> [ <ramdisk> [ <second> ] ] Download and boot kernel.
flash:raw boot <kernel> [ <ramdisk> [ <second> ] ]
Create bootimage and flash it.
devices [-l] List all connected devices [with
device paths].
continue Continue with autoboot.
reboot [bootloader] Reboot device [into bootloader].
reboot-bootloader Reboot device into bootloader.
help Show this help message.
options:
-w Erase userdata and cache (and format
if supported by partition type).
-u Do not erase partition before
formatting.
-s <specific device> Specify a device. For USB, provide ei
ther
a serial number or path to device por
t.
For ethernet, provide an address in t
he
form <protocol>:<hostname>[:port] whe
re
<protocol> is either tcp or udp.
-p <product> Specify product name.
-c <cmdline> Override kernel commandline.
-i <vendor id> Specify a custom USB vendor id.
-b, --base <base_addr> Specify a custom kernel base
address (default: 0x10000000).
--kernel-offset Specify a custom kernel offset.
(default: 0x00008000)
--ramdisk-offset Specify a custom ramdisk offset.
(default: 0x01000000)
--tags-offset Specify a custom tags offset.
(default: 0x00000100)
-n, --page-size <page size> Specify the nand page size
(default: 2048).
-S <size>[K|M|G] Automatically sparse files greater
than 'size'. 0 to disable.
--slot <slot> Specify slot name to be used if the
device supports slots. All operations
on partitions that support slots will
be done on the slot specified.
'all' can be given to refer to all sl
ots.
'other' can be given to refer to a
non-current slot. If this flag is not
used, slotted partitions will default
to the current active slot.
-a, --set-active[=<slot>] Sets the active slot. If no slot is
provided, this will default to the va
lue
given by --slot. If slots are not
supported, this sets the current slot
to be active. This will run after all
non-reboot commands.
--skip-secondary Will not flash secondary slots when
performing a flashall or update. This
will preserve data on other slots.
--unbuffered Do not buffer input or output.
--version Display version.
-h, --help show this message.
C:\Users\xxx\AppData\Local\Android\sdk1\platform-tools>
---------- Post added at 05:39 PM ---------- Previous post was at 05:37 PM ----------
Here is my guide for the flash-all.bat if you want to see if it works.
I think you might have to be unlocked though?
https://forum.xda-developers.com/pixel-xl/how-to/info-how-restored-to-stock-soft-t3494478
Click to expand...
Click to collapse
Yes it definitely has to be unlocked to run the flash-all.bat or flash-all.sh (I'm using a mac). I've tried it and it gives me an "oem unlock not allowed" message. I'll try the other commands I haven't tried yet from your list
Sent from my EDI-AL10 using Tapatalk
What about flashing unlock_bootloader request? Also fastboot flashing unlock critical. I am sure this can get fixed.
biggiesmalls657 said:
What about flashing unlock_bootloader request? Also fastboot flashing unlock critical. I am sure this can get fixed.
Click to expand...
Click to collapse
I can only do flashboot oem, not flashboot flashing. I think the newer versions of fastboot only does the oem command.
flashboot oem unlock_bootloader and flashboot oem unlock critical both fail (remote: oem unlock is not allowed)
Sent from my EDI-AL10 using Tapatalk

re-locked Fairphone 3 won't start after installation of /e/-OS and TWRP

Hi.
So I managed to put /e/ OS (by doing the HOWTO on docDOTeDOTfoundation/devices/FP3/install ) and TWRP 3.4 (by doing the HOWTO on twrpDOTme/fairphone/fairphone3.htm ) plus doing a 'fastboot oem lock' and a 'fastboot oem unlock') on my FP3.
As long as I keep bootloader unlocked it starts /e/ OS on power-on or TWRP when I power on with holding PWR and volume-up.
However, when I lock the phone all I get is a:
<!>
Your device is corrupt. It can't be trusted and will not boot.
Visit this link on another device:
g.co/ABH​
As far as I understood some checksum is calculated and if it does not match … well - whoever took the decision to make it work that way didn't care about users of custom ROMs - probably knowing that this will make it hard for such users… This reminds me on others OS which restrict what a user can do with his phone / PC …
Anyhow, I didn't find how to override that check. Maybe the checksum can be "corrected" or maybe I just have to set a variable and I'm good.
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: true​So i'ts probably not the device tampered status…
Just in case: "Fix Recovery Bootloop" from the TWRP howto from above failed and fails again and again (even after reboot into the bootloader) with
cd /tmp/repackorig/ && /sbin/magiskboot hexpatch kernel <a_long_hex_number> <another_long_hex_number> process ended with
Error: 1
Error patching kernel.​
What can I do?
Thanks in advance!
I think that you cannot lock the bootloader since you install TWRP. If you do that, FP3 won't boot.
It's a matter of security.
bootloader must be unlocked
Locking an AVB device is possible but requires the system image be properly signed, no other modifications to system made, and flashing the AVB key to the avb_custom_key partition.

Question T-Mobile USA Oneplus 9 pro how to turn into Global Oneplus 9 pro

Good day to us all and terribly sorry for posting this question. I have tried to follow all the steps in the T-mobile Oneplus 9 pro change to Global but I'm unsuccessful, I have ADB tool to make this work but I'm not unable to get to the unlock bootloader. I have tried fastboot OEM unlock command and fastboot flashing unlock. Here is what I get when trying both comands:
PS C:\platform-tools> fastboot oem unlock
...
FAILED (remote: Please flash unlock token first.)
finished. total time: 0.008s
PS C:\platform-tools> fastboot devices
57295106 fastboot
PS C:\platform-tools> fastboot oem unlock
...
FAILED (remote: Please flash unlock token first.)
finished. total time: 0.007s
PS C:\platform-tools> fastboot flashing unlock
usage: fastboot [ <option> ] <command>
commands:
update <filename> reflash device from update.zip
flashall flash boot, system, vendor and if found,
recovery
flash <partition> [ <filename> ] write a file to a flash partition
erase <partition> erase a flash partition
format[:[<fs type>][:[<size>]] <partition> format a flash partition.
Can override the fs type and/or
size the bootloader reports.
getvar <variable> display a bootloader variable
boot <kernel> [ <ramdisk> [ <second> ] ] download and boot kernel
flash:raw boot <kernel> [ <ramdisk> [ <second> ] ] create bootimage and
flash it
devices list all connected devices
continue continue with autoboot
reboot reboot device normally
reboot-bootloader reboot device into bootloader
help show this help message
options:
-w erase userdata and cache (and format
if supported by partition type)
-u do not first erase partition before
formatting
-s <specific device> specify device serial number
or path to device port
-l with "devices", lists device paths
-p <product> specify product name
-c <cmdline> override kernel commandline
-i <vendor id> specify a custom USB vendor id
-b <base_addr> specify a custom kernel base address.
default: 0x10000000
-n <page size> specify the nand page size.
default: 2048
-S <size>[K|M|G] automatically sparse files greater
than size. 0 to disable
PS C:\platform-tools>
Please, someone, advise what I'm doing wrong?
First, you need to have your phone PERMANENTLY unlocked, you can check this in settings > about phone > click the lock, do a permanent unlock.
Afterwards, you need to enable developer settings, in about phone keep tapping build number until it says dev options enabled, then go to settings > system > developer options > check OEM unlock.
I would suggest you use the MSM here at this point https://forum.xda-developers.com/t/...7-to-eu-via-msm-no-unlock-bin-needed.4272837/ to convert to EU, it's better than global IMO, but if you want global lemme know.
razercortex said:
First, you need to have your phone PERMANENTLY unlocked, you can check this in settings > about phone > click the lock, do a permanent unlock.
Afterwards, you need to enable developer settings, in about phone keep tapping build number until it says dev options enabled, then go to settings > system > developer options > check OEM unlock.
I would suggest you use the MSM here at this point https://forum.xda-developers.com/t/...7-to-eu-via-msm-no-unlock-bin-needed.4272837/ to convert to EU, it's better than global IMO, but if you want global lemme know.
Click to expand...
Click to collapse
Would this work to convert to Global as this instructions are for Europe convertion??
The MSM tool provided has EU conversion. You could try using the EU MSM, downloading the global upgrade package and doing a local upgrade to convert to global.
razercortex said:
First, you need to have your phone PERMANENTLY unlocked, you can check this in settings > about phone > click the lock, do a permanent unlock.
Afterwards, you need to enable developer settings, in about phone keep tapping build number until it says dev options enabled, then go to settings > system > developer options > check OEM unlock.
I would suggest you use the MSM here at this point https://forum.xda-developers.com/t/...7-to-eu-via-msm-no-unlock-bin-needed.4272837/ to convert to EU, it's better than global IMO, but if you want global lemme know.
Click to expand...
Click to collapse
I check the phone as you instructed and yes it says that the device is permanently unlocked and can be used with any carrier.
Ok, I downloaded both files, now what?
baracuda1974 said:
Ok, I downloaded both files, now what?
Click to expand...
Click to collapse
Run the MSMDownloadTool.exe, make sure it says other, continue, make sure phone is connected, press start and it'll convert it.
After you pass setup, download the global zip, move to internal storage and go to upgrade > local upgrade.
razercortex said:
First, you need to have your phone PERMANENTLY unlocked, you can check this in settings > about phone > click the lock, do a permanent unlock.
Afterwards, you need to enable developer settings, in about phone keep tapping build number until it says dev options enabled, then go to settings > system > developer options > check OEM unlock.
I would suggest you use the MSM here at this point https://forum.xda-developers.com/t/...7-to-eu-via-msm-no-unlock-bin-needed.4272837/ to convert to EU, it's better than global IMO, but if you want global lemme know.
Click to expand...
Click to collapse
Is the permanent sim unlock really necessary? I was able to get the bin to unlock my bootloader which, to my understanding, is said to not be possible without first being sim unlocked.
If you already have the bin, you can just do `fastboot flash cust-unlock unlock-code.bin`, replacing unlock-code.bin with the path to your file.
Then, just run `fastboot flashing unlock` and unlock your phone that way. You will lose your data, so make sure to back it up.
razercortex said:
If you already have the bin, you can just do `fastboot flash cust-unlock unlock-code.bin`, replacing unlock-code.bin with the path to your file.
Then, just run `fastboot flashing unlock` and unlock your phone that way. You will lose your data, so make sure to back it up.
Click to expand...
Click to collapse
Yeah, I did that. I would like to convert to global or EU if it's better, but I want to make backups of my modem/persist and haven't really found an answer on how to do that.
EDIT: Found out that I need to root first, but my phone recently updated to version 12 and there's no official build release to pull a boot image from. Is there another way to get the boot image?
You don't need to root. Open up any MSM, press F8, select modem_a and modem_b, enter password "oneplus" and put your phone in EDL mode, then press the read back button.
Use the T-Mobile MSM to return to Android 11
razercortex said:
Use the T-Mobile MSM to return to Android 11
Click to expand...
Click to collapse
Hello, my T-mobile 9 pro just updated to android 12 and its messing with my work. I cannot get it to connect with my work network now so I'm trying to downgrade back to 11. Would you mind clarifying a bit, I've done a bit of searching but every downgrade tutorial is for a global 9 pro. Am I able to use any MSM tool to rollback to 11?
mahnameisjaime1 said:
Hello, my T-mobile 9 pro just updated to android 12 and its messing with my work. I cannot get it to connect with my work network now so I'm trying to downgrade back to 11. Would you mind clarifying a bit, I've done a bit of searching but every downgrade tutorial is for a global 9 pro. Am I able to use any MSM tool to rollback to 11?
Click to expand...
Click to collapse
Here's your MSM https://www.androidfilehost.com/?fid=2188818919693804752
And here are all of the MSMs
OP9Pro - Repository of MSM Unbrick Tools (TMO, EU, GLO, IN)
By using these tools, you accept full responsibility for your actions. Your warranty is void should you run any of these utilities without OnePlus support present. I am not responsible for bricks, fires, nuclear war, etc. If you modified any...
forum.xda-developers.com
razercortex said:
Here's your MSM https://www.androidfilehost.com/?fid=2188818919693804752
And here are all of the MSMs
OP9Pro - Repository of MSM Unbrick Tools (TMO, EU, GLO, IN)
By using these tools, you accept full responsibility for your actions. Your warranty is void should you run any of these utilities without OnePlus support present. I am not responsible for bricks, fires, nuclear war, etc. If you modified any...
forum.xda-developers.com
Click to expand...
Click to collapse
Thanks, I appreciate it! For future reference, is there a thread or how could I find this myself?
I literally just posted the thread lol
razercortex said:
I literally just posted the thread lol
Click to expand...
Click to collapse
ah yes I see that now lol, thought it was a link to the android file host site lmao thanks again!

Categories

Resources