Develop Bugs

[REF] How to unlock/unfreeze all SGS Models [NOW WORKS ON Vibrant 4G][Updated 4-9-11]

Vibrant 4G/SGS 4G manual method here
PRO App also works on Vibrant 4G/SGS 4G for anyone who doesn't feel comfortable with a hex editor
Do NOT try this or any other unlock method on the SC-02B Docomo phone. Please see thread here for progress on the SC-02B
Please note the same information used to develop the app is in the guide for free... the app just makes it easier
ALL METHODS FOR NEWER PHONES REQUIRE ROOT... PLEASE GO GET ROOT ON YOUR PHONE AND THEN COME BACK.
Oh and BTW... I cannot be held responsible for anything that happens to your phone.... EVER!
Before you start... if you don't have root you WILL need it unless you are on a really old version of android 2.1 (look in Appendix A for depreciated methods)
Step 1. - Retrieve nv_data.bin file
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
cat /efs/nv_data.bin >> /sdcard/nv_data.bin
Step 2. - Edit nv_data.bin file
mount the internal SD Card on your computer
make a backup copy of the nv_data.bin file on your computer
using your favorite HEX editor open the nv_data.bin on the sdcard
jump to address 0x181468
you should see a string like this
ff 01 00 00 00 00 46 46
there are 5 different types of locks in 5 different bytes
the FF byte should be left alone
the first byte after the FF is the network lock
the next byte is the network subset lock
the next byte is the sp lock
the next byte is the cp lock
the last byte appears to be a data lock.
the 46 46 should be left alone
Change any 0x01 to 0x00 (or 0x00 to 0x01 to lock for warranty)
It should read ff 00 00 00 00 00 46 46 for unlocked
save and close file
unmount SD Card
Step 3. - Replace nv_data.bin file
I want to say it again so no one misses it MAKE SURE YOU HAVE A BACKUP OF YOUR NV_DATA.BIN FILE BEFORE YOU CONTINUE!!!!!
use "adb shell" or a terminal emulator to get a terminal prompt and run the following commands
Code:
su
rm /efs/nv_data.bin
rm /efs/nv_data.bin.md5
cat /sdcard/nv_data.bin >> /efs/nv_data.bin
chmod 755 /efs/nv_data.bin
chown radio.radio /efs/nv_data.bin || chown 1001.1001 /efs/nv_data.bin
reboot
your phone is now unlocked... enjoy
[OPTIONAL] Use the PRO app [OPTIONAL]
Please note that this step is ONLY here for people that are not comfortable using a Hex editor.
Search "Vibrant unlock" in the market or scan the QR code:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Install and run app
press menu
press Unlock Phone
Select phone
allow root
at this point if you get an error code make SURE you mount your internal SD card on your computer and backup the nv_data.bin.orig file that is there.
press unlock
restart and your phone is now unlocked
to lock your phone for warranty
press lock instead of unlock
restart your phone, remove root, and take your phone in for warranty
APPENDIX A (DEPRECIATED)
DOES NOT WORK ON 90% PHONES PLEASE USE THE APP
Using ADB
Make sure that Network Lock is the only thing on... go to phone and enter *#7465625#
Make sure USB debugging is enabled (Settings->Applications->Development->USB Debugging)
Using APP (Thanks ClarkeHackworth and DaGentooBoy)
ClarkHackworth's page about the app
Same thing as before if this bricks your phone sorry but we aren't responsible.
Step A.1. – Get your code
Search Samsung Galaxy S Unlock Tool in the market or scan the QR code.
Install SGS_Unlock.apk
Applications->SGS Unlock
Menu->Root Gen Codes (Root method is the most reliable method at this point)
Jump to Step A.2.
Step A.1.alternate – Get your code
For Mac Updated!!! New Script
nbs11 said:
1. Download the Samsung Galaxy S Unlocker for Mac from this here:
http://www.multiupload.com/9NEBR6FAKD
2. Mount the DMG and drag the folder onto the hard drive. DO NOT DRAG THE ICON WITH THE LOCK (the app). Once the file is finished copying continue.
3. Open the application with the lock. It should open a terminal window. Let it run for a few seconds and then it should show a screen like this:
4. Write down your unlock code
Click to expand...
Click to collapse
For Windows UPDATED!!! With Un-Freeze Codes
Video Guide
Download and extract the attached Generate Unlock Windows.zip.
Run Generate_Code.bat
Look for the line Network Control Key:YourCode
Save the code
Step A.2. – Enter the code
Power down your phone
Put in a SIM card from another carrier
Power up your phone
When it boots up it will ask for the unlock code that you found above
OR
NO SIM Method (Thanks RazvanG)
(Apparently this just adds another SIM to the accepted SIM list... can someone confirm?)
remove sim card
power on phone without sim
enter *7465625*638*# and relock the phone to another network other than the one u have u'r sim card (eg 22610)
power off phone
insert sim card back
power on and enter nck code extracted from .bak file
phone unlocked
Step A.3. – Flash back (IF THE CODE DIDN'T WORK)
Flash back to an older firmware (I9000XXJF7 with 513.pit worked for me on an I9000)
Now enter the unlock code you generated in Step 2.
RazvanG said:
HOW TO LOCK SAMSUNG GALAXY S - FOR WARRANTY PURPOSES ONLY (TESTED)
After you get the NCK code using the method above, enter: *7465625*638*#
There will be a pop-up box.
Complete the first field (MCC/MNC) with the network you want your phone locked to (eg. 226 10 where 226 = romania; 10 = orange etc.) and the second field (Control Key) with the NCK extracted from the .bak file.
Press OK and your phone should relock.
RazvanG
Click to expand...
Click to collapse
Guide in Spanish here
Guide in Italian here
Guide in Chinese here
LEGAL NOTES (because information should be free for all):
YOU MAY NOT, BY ANY MEANS, USE THIS SOLUTION/CODE OR PART OF IT FOR COMMERCIAL PURPOSES.
DO NOT USE THIS EXTRACTION METHOD COMMERCIALLY
PLEASE give credit (and donations if you can) to
For those of you that have donated THANKS! (You know who you are... you paid for my developer account so I could post the app)
DaGentooBoy For this AWESOME guide, the free and PRO apps, finding the other unlock bits, the original mac and windows scripts, the no root cat nv_data method, the unfreeze code portion of the mac script, and a lot of troubleshooting (Paypal)
dawen, Helroz, and NWolf for discovering the hex location of the lock bit in the nv_data.bin file (donate to NWolf here)
RazvanG for pointing galaxysguy in the right direction, finding the Freeze Code location in the .bak file, the code for re-locking the phone to any network, and the solution to unlock with only one sim card (Paypal)
rbnet.it and marcopon for the cool SGUX utility for windows to extract both the Unlock and Unfreeze codes (donate to marcopon and rbnet.it Here)
nbs11 for the new mac script that makes it REALLY easy (donate here)
Bowsa2511 for the command to extract the unlock code on a Mac (Paypal here)
rhcp0112345 for finding the file and giving me (and others) a place to start (Donate here)
galaxysguy for confirming that I was looking at the right code (Paypal here)
AllGamer for starting the Bounty thread and giving the XDA devs the motivation to get started.
If you want me to extract the code for you just PM me with a link to your zipped bml3.bak or nv_data.bin file and I will send you back the code. If it works please feel free to donate via Paypal

Great work dagentooboy. I was working on a free unlock myself but approaching it from a slightly different angle. Unfortunately bricking my phone held me up a lot but I'm glad to see someone has done it now.

re: credits
apparently marcopon helped rbnet.it to write that sgux utility.

AllGamer said:
re: credits
apparently marcopon helped rbnet.it to write that sgux utility.
Click to expand...
Click to collapse
thanks... I saw the bounty thread is updated. Feel free to link to the instructions on this thread so that they all go to one place.

AllGamer said:
re: credits
apparently marcopon helped rbnet.it to write that sgux utility.
Click to expand...
Click to collapse
Yes! It's shown in the credits:
Uploaded with ImageShack.us

This is just the thing I've been looking for. Thanks a lot. Just out of curiosity, why do you have to flash back to older firmware after entering the unlock code?

Yes, I usually go by the Mark0 nick but it was already used in the forum (IIRC).
I want also to thanks andars05 for a post he made that provided some inspiration.
Nice to see that the tool is proving to be useful!
Feel free to donate to the PayPal link rbnet.it provided!

Got "Permission denied" after su in step 1 - I've got rooted Captivate with stock firmware - I know that is probably problem with access to root account, but all apps are working properly with it. Any idea for solution?
I've Windows 7, tried running command line with administrator privileges, but it didn't helped.

TheNaturat said:
Got "Permission denied" after su in step 1 - I've got rooted Captivate with stock firmware - I know that is probably problem with access to root account, but all apps are working properly with it. Any idea for solution?
I've Windows 7, tried running command line with administrator privileges, but it didn't helped.
Click to expand...
Click to collapse
After "su", have you allowed the root access on the phone?

Jreddekopp said:
This is just the thing I've been looking for. Thanks a lot. Just out of curiosity, why do you have to flash back to older firmware after entering the unlock code?
Click to expand...
Click to collapse
Sorry That is what it took to unlock mine. I updated the first post... you don't have to do that if the code works.

Thanks so much, it worked on my Globe locked SGS (Philippines).
MAC users use 0xED Hex Editor and just search SSNV and you'll get your 8 digits unlock code.

TheNaturat said:
Got "Permission denied" after su in step 1 - I've got rooted Captivate with stock firmware - I know that is probably problem with access to root account, but all apps are working properly with it. Any idea for solution?
I've Windows 7, tried running command line with administrator privileges, but it didn't helped.
Click to expand...
Click to collapse
I found the same code in the nv_data.bin file... if you can't get the dd thing to work try
Code:
cat /efs/nv_data.bin >> /sdcard/nv_data.bin

having problems pulling the file but I have SU permissions.
$ su
su
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
Permission denied
$ dd: can't open '/dev/block/bml3': Permission denied
$

antz88c said:
Thanks so much, it worked on my Globe unlocked SGS (Philippines).
MAC users use 0xED Hex Editor and just search SSNV and you'll get your 8 digits unlock code.
Click to expand...
Click to collapse
I used HexEdit
http://sourceforge.net/projects/hexedit/
You can try both but the important thing is finding the code. Searching for SSNV should get you right there.

nickbarbs said:
having problems pulling the file but I have SU permissions.
$ su
su
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
dd if=/dev/block/bml3 of=/sdcard/bml3.bak
Permission denied
$ dd: can't open '/dev/block/bml3': Permission denied
$
Click to expand...
Click to collapse
Try this and let me know if it works.

samsung galaxy s sgh-i897
has anyone unlocked the samsung galaxy s sgh-i897 useing this method?

Network unlock successful
Click to expand...
Click to collapse
Thank you guys!

WOWOOWOWOWOOWWWW
NETWORK UNLOCK SUCCESSFULL
as soon as i get my 25$ refund from this guy and 6£ from someone else you'll get it
EDIT: I'm Samsung Captivate Sgh-i897

turilo said:
has anyone unlocked the samsung galaxy s sgh-i897 useing this method?
Click to expand...
Click to collapse
I haven't heard of anyone but you are welcome to give it a try. Please let me know if it works.

ok i will try so first i download the file? then follow the directions? if this works im definetly donateing

Root LG G4 Marshmallow without bootloader Unlocked

Hi guys,i've updated yesterday my LG G4 (H815) to marshmallow,but i've lost the root.
Could you show me a method to reroot my G4 without unlock the Bootloader please?
Unfortunately i can't unlock my bootloader because of an error and i can only root with another method...
Thanks a lot.

robsup79 said:
Hi guys,i've updated yesterday my LG G4 (H815) to marshmallow,but i've lost the root.
Could you show me a method to reroot my G4 without unlock the Bootloader please?
Unfortunately i can't unlock my bootloader because of an error and i can only root with another method...
Thanks a lot.
Click to expand...
Click to collapse
I'm interested: What error do you get? You maybe do something wrong while unlocking the bootloader? Maybe not copying the token entirely?
Well, for now, there is no method to root your LG G4 on android 6.0, if the bootloader is locked. I'm sorry that I have to disappoint you Greetz

Follow_and_Feel said:
I'm interested: What error do you get? You maybe do something wrong while unlocking the bootloader? Maybe not copying the token entirely?
Well, for now, there is no method to root your LG G4 on android 6.0, if the bootloader is locked. I'm sorry that I have to disappoint you Greetz
Click to expand...
Click to collapse
Hi,i try explain you (sorry for the english):
When i'm on the second stage in command line and i enter "fastboot oem device-id",i don't receive the strings with the ID Number but i receive "Waiting for device" and i can't go on.
I've installed and uninstalled 3 times the SDK and the LG Drivers but the problem remain....
The passeges i've done are:
-Installed the SDK from this file in the website "installer_r24.4.1-windows"
-Installed last LG drivers "LG-Mobile-Driver_v4.0.3.0"
-Connect the phone with debug and Oem flagged

robsup79 said:
Hi,i try explain you (sorry for the english):
When i'm on the second stage in command line and i enter "fastboot oem device-id",i don't receive the strings with the ID Number but i receive "Waiting for device" and i can't go on.
I've installed and uninstalled 3 times the SDK and the LG Drivers but the problem remain....
The passeges i've done are:
-Installed the SDK from this file in the website "installer_r24.4.1-windows"
-Installed last LG drivers "LG-Mobile-Driver_v4.0.3.0"
-Connect the phone with debug and Oem flagged
Click to expand...
Click to collapse
Ok that sounds like you didn't tick "enable OEM-unlock" in the developer options of your phone, did you?

Follow_and_Feel said:
Ok that sounds like you didn't tick "enable OEM-unlock" in the developer options of your phone, did you?
Click to expand...
Click to collapse
Yes,i tick that voice i'm going crazy....damn

robsup79 said:
Yes,i tick that voice i'm going crazy....damn
Click to expand...
Click to collapse
Ok. Maybe you need to confirm the connection on your phone if it says "Waiting for device"? Did you check it? Is your device definately H815 Eu Model? ANd do you have adb.exe and fastboot on your pc?
Please open a command prompt in the adb folder and type:
adb.exe devices
What is the output?

Follow_and_Feel said:
Ok that sounds like you didn't tick "enable OEM-unlock" in the developer options of your phone, did you?
Click to expand...
Click to collapse
Follow_and_Feel said:
Ok. Maybe you need to confirm the connection on your phone if it says "Waiting for device"? Did you check it? Is your device definately H815 Eu Model?
Click to expand...
Click to collapse
Yes is the H815 Italian Model no brand.
How do you mean with "you need to confirm the connection?

robsup79 said:
Yes is the H815 Italian Model no brand.
How do you mean with "you need to confirm the connection?
Click to expand...
Click to collapse
Ok forget about it! You're already in fastboot mode then right? Do you have the fastboot.exe on your computer? You need fastboot.exe and adb.exe on your device if you want to get the unlock token.
Please open a command prompt in windows and type
fastboot.exe devices
and tell me what's the output. Please do the same with
adb.exe devices
Maybe the computer doesn't recognize your phone because you don't have a fastboot.exe

Follow_and_Feel said:
Ok forget about it! You're already in fastboot mode then right? Do you have the fastboot.exe on your computer? You need fastboot.exe and adb.exe on your device if you want to get the unlock token.
Please open a command prompt in windows and type
fastboot.exe devices
and tell me what's the output. Please do the same with
adb.exe devices
Maybe the computer doesn't recognize your phone because you don't have a fastboot.exe
Click to expand...
Click to collapse
Ok when i type "adb.exe devices":
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
And when i type "fastboot.exe devices":
And this is the folder where i have the files to open the command:

And now when i try to catch the id,before my control panel recognizes the G4 but i don't know how like Samsung model:
After i open the command and insert the strings:
And in control panel the LG change and becomes an Alcatel:
How is it possibile....damn....

robsup79 said:
Ok when i type "adb.exe devices":
And when i type "fastboot.exe devices":
And this is the folder where i have the files to open the command:
Click to expand...
Click to collapse
Okay. So these screenshots were taken when you were in the bootloader? The problem is, that your PC doesn't recognize your device in fastboot mode! There should be an output if you type fastboot.exe devices, but there isn't. Which windows are you on?
The problem is not your phone or the unlock method. It's you computer I guess. Maybe you do a google search on how to get your device recognized.
And because this is far off the original topic you posted, please change the name of the thread to "Can't unlock bootloader (H815)" or something
EDIT: You're in the bootloader right?

Follow_and_Feel said:
Okay. So these screenshots were taken when you were in the bootloader? The problem is, that your PC doesn't recognize your device in fastboot mode! There should be an output if you type fastboot.exe devices, but there isn't. Which windows are you on?
The problem is not your phone or the unlock method. It's you computer I guess. Maybe you do a google search on how to get your device recognized.
And because this is far off the original topic you posted, please change the name of the thread to "Can't unlock bootloader (H815)" or something
EDIT: You're in the bootloader right?
Click to expand...
Click to collapse
I'm in windows 7....
Yes i'm in the bootloader

robsup79 said:
I'm in windows 7....
Yes i'm in the bootloader
Click to expand...
Click to collapse
Ok. So the problem is your PC not detecting your phone as a fastboot device! This is why you always get the message: "Waiting for device", if you enter "fastboot oem device id". I don't know how to fix that. Maybe you have to download another fastboot.exe for windows 7. But I'm pretty sure that this is the only problem why you can't unlock the bootloader. Maybe you try these. I'm really sorry that I can't help you

Follow_and_Feel said:
Ok. So the problem is your PC not detecting your phone as a fastboot device! This is why you always get the message: "Waiting for device", if you enter "fastboot oem device id". I don't know how to fix that. Maybe you have to download another fastboot.exe for windows 7. But I'm pretty sure that this is the only problem why you can't unlock the bootloader. Maybe you try these. I'm really sorry that I can't help you
Click to expand...
Click to collapse
Ok i try with Minimal ADB and Fastboot and workssssss
But now i've the Unlock.bin on my desktop and i don't know how i can go on...please help me :highfive:

robsup79 said:
Ok i try with Minimal ADB and Fastboot and workssssss
But now i've the Unlock.bin on my desktop and i don't know how i can go on...please help me :highfive:
Click to expand...
Click to collapse
Haha! Glad that I could help (please hit thanks button ). So if you have the unlock token go to this site, register and do steps 10-16 and voila - you're bootloader is now unlocked

Follow_and_Feel said:
Haha! Glad that I could help (please hit thanks button ). So if you have the unlock token go to this site, register and do steps 10-16 and voila - you're bootloader is now unlocked
Click to expand...
Click to collapse
Ahahaha yes but i'm stopped on point 14
I've the Unlock.bin on my desktop and i don't know i can insert it on the terminal....
When i open the Minimal Adb i don't know what i have to type...

robsup79 said:
Ahahaha yes but i'm stopped on point 14
I've the Unlock.bin on my desktop and i don't know i can insert it on the terminal....
When i open the Minimal Adb i don't know what i have to type...
Click to expand...
Click to collapse
you need to retrieve the unlock.bin via email. Do all the steps again from the beginning please and you'll have no problems
EDIT: If you already have received the unlock.bin put everything (ADB and fastboot exe AND the unlock.bin in one folder! Should work then

robsup79 said:
Ahahaha yes but i'm stopped on point 14
I've the Unlock.bin on my desktop and i don't know i can insert it on the terminal....
When i open the Minimal Adb i don't know what i have to type...
Click to expand...
Click to collapse
First question; Where'd you get the unlock.bin file? Was it generated with your specific device?
Boot back into Android on your phone. Go to "Settings>General>Developer Options> Activate "Enable OEM unlock"". In the same menu, with the USB-Cable detached, enable "USB debugging".
Put the unlock.bin file in the same folder as the ADB and Fastboot files (Usually C:/adb/)
Plugin your phone via USB. It's better you use a port on the back of your PC.
Type adb reboot bootloader
Type fastboot flash unlock unlock.bin
If this fails, try a different PC.
EDIT: Which version of ADB do you use? I know that 1.4.2 has some issues. It's worth a shot to try ADB 1.3 Minimal installer.
EDIT2: Sorry, overlooked that your thread has two pages and you already enabled OEM unlock. I'd say you try it on another PC. I also have issues with ADB and Fastboot on Marshmallow.
EDIT3: You're missing a file in your ADB folder. Extract and put the attached .dll file into the same folder as your ADB files.

Hi,i've solved with Adb Minimal and "Follow_and_Feel" help.
Thanks a lot to all,you're the best.

robsup79 said:
Hi,i've solved with Adb Minimal and "Follow_and_Feel" help.
Thanks a lot to all,you're the best.
Click to expand...
Click to collapse
Some time ago I had a similar issue with a permanent message, either 'waiting for device' or 'downloading <file>' (sorry, I don't remember what exactly was in a message). But I have solved that problem by changing usb data cable. I tried a few pieces until I found a good one. It's preferable to use an original data cable.

{Boot-Loader} How To Unlock The Boot-Loader ( Need Temp Root )

I have seen reports of getting Temp-Root.
Please share how you are getting Temp Root.
Enable OEM-UNLOCKING ---->>> Without the switch in the Developer Options.
The OEM-UNLOCKING switch simply sets the last byte of the FRP partition to 01 or 00.
00 means the boot loader can not be unlocked.
01 means it can.
Steps
1 ) Enable developer options on the device and turn on usb debugging.
2 ) Get the Temp Root Access ( We need to use the adb shell )
3 ) Copy the FRP partition to a image file. (execute the below command in adb shell)
Code:
dd if=/dev/block/bootdevice/by-name/frp of=/sdcard/frp.img
3 ) Copy the FRP image file to a computer . (execute the below command in command window)
Code:
adb pull /sdcard/frp.img
4 ) Open the frp.img in a hex editor like HXD.
change the last byte from 00 to 01. See pics below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
5) First copy the edited frp.img to the sdcard.
Code:
adb push frp.img /sdcard/
6) Flash the edited frp.img to the device
Code:
dd if=/sdcard/frp.img of=/dev/block/bootdevice/by-name/frp
Now boot the device into download mode
7) Get the unlock token for the htc dev site.
Code:
fastboot oem get identifier token
Go to HTC-DEV site and finish unlocking the Boot-Loader.
To Get Perm Root
1) After unlocking the boot loader flash TWRP recovery.
Code:
fastboot flash recovery twrprecovery.img
I can build the TWRP recovery ( Possibly even use Desire 626s TWRP Recovery )
2) Install supersu using TWRP.
3) Enjoy the Rooted Desire 526 ( VERIZON Model)
Can someone please share with us how you are obtaining temp root

So I guess No One is getting temp root ???
A thought on how to get root.
I'm not an app guy but what I suggest is.......
On a HTC Desire 626s toggle the OEM_UNLOCKING switch on and off.
Capture the command the switch uses to set the last byte of the FRP partition.
Create a app or command that is the same to run on the desire 526.
If we can set the last byte to 01 instead of 00 then we can unlock the bootloader with the normal HTC DEV.
If you tell me how to caputre / log that command I can do it on my desire 626s.

Work around
BigCountry907 said:
So I guess No One is getting temp root ???
A thought on how to get root.
I'm not an app guy but what I suggest is.......
On a HTC Desire 626s toggle the OEM_UNLOCKING switch on and off.
Capture the command the switch uses to set the last byte of the FRP partition.
Create a app or command that is the same to run on the desire 526.
If we can set the last byte to 01 instead of 00 then we can unlock the bootloader with the normal HTC DEV.
If you tell me how to caputre / log that command I can do it on my desire 626s.
Click to expand...
Click to collapse
Are you saying you need a screenshot of the oem token for the 626? I have both the Verizon 526 and cricket 626. If necessary, I can get it. Really hoping you find a workaround.

@Darcliet
Are you saying you need a screenshot of the oem token for the 626? I have both the Verizon 526 and cricket 626. If necessary, I can get it. Really hoping you find a workaround.
Click to expand...
Click to collapse
No thats bot what i'm saying.
This is a way to get the needed OEM Unlock Token from the desire 526.
If we can set the last byte of the FRP partition to 01 then FASTBOOT OEM_UNLOCK will generate the TOKEN.
So what we need to accomplish is
Either:
A) find a way to get temp root so we can dd flash the frp partition.
B) Replicate the command that is executed on the android system to set the byte.
My reference to the Desire 626s is that the 626s has the Enable OEM Unlocking in the Developer Options.
So if we turn on and off the oem unlocking switch and then logcat the command that is executed we can use the logged command to set the FRP on the 526.
If someone tells me how to get temp root, or how to log the command from the 626s. We can give it a try.

Logcat of the switch
So I toggled on and off my Oem-Unlocking Switch in Developer Options ( Desire 626s)
This is the output I believe for that switch.
Code:
[COLOR="SeaGreen"]V/WindowManager( 911): not Base app: Adding window Window{52eef4 u0 com.android.settings/com.android.settings.SubSettings} at 4 of 10
I/PhoneStatusBar( 4325): setSystemUiNavVisibility(swipe=false hasFocus=false hasPolicy=false shadeState=true)
I/PhoneStatusBar( 4325): hiding the MENU button mLongPressHomeMenu = false
D/FindExtension(15804): FindExtension: before mHardwareRenderer.initialize, mSurface.isValid() = true
I/ThreadedRenderer(15804): Defer allocateBuffers to drawing time
W/Settings(15804): Setting adb_blocked has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
W/Settings(15804): Setting bugreport_in_power_menu has moved from android.provider.Settings.Secure to android.provider.Settings.Global.
I/PhoneStatusBar( 4325): setSystemUiNavVisibility(swipe=false hasFocus=false hasPolicy=false shadeState=true)
I/PhoneStatusBar( 4325): hiding the MENU button mLongPressHomeMenu = false
W/InputMethodManagerService( 911): Window already focused, ignoring focus gain of: [email protected] attribute=null, token = [email protected], client pid=15804, inputType=0x(null)[/COLOR]
So someone who knows more about how this works, maybe they can come up with a way to replicate those commands.
So we could execute them on the 526.
It looks like this is setting the byte maybe???
Window already focused, ignoring focus gain of: [email protected] attribute=null, token = [email protected], client pid=15804, inputType=0x
I'm not sure, this is a little out of my realm of expertise.
One thing I do know is if we can set the last bit of FRP to 01 then we can get the oem unlock token from fastboot.

flashed new frp with 0 changed to 1...
but when proceeding to htcdev website to enter my device identifier token i get the following error
"We're sorry, but it appears your attempt to unlock the bootloader on this device has failed. This could be caused by several factors including simple errors in the entry of the unlock token, problems with your device, or a lack of manufacturer support for the unlocking process. Please see the specific error code listed below, and try again if necessary.
Error Code: 170.
Error Reason: CID Not Allowed."

Gators850 said:
flashed new frp with 0 changed to 1...
but when proceeding to htcdev website to enter my device identifier token i get the following error
"We're sorry, but it appears your attempt to unlock the bootloader on this device has failed. This could be caused by several factors including simple errors in the entry of the unlock token, problems with your device, or a lack of manufacturer support for the unlocking process. Please see the specific error code listed below, and try again if necessary.
Error Code: 170.
Error Reason: CID Not Allowed."
Click to expand...
Click to collapse
Ok so at least your getting the unlock token now
We can try to edit the misc.img the same way.
Pull it off your phone and open in hex editor.
You will find the CID in there.
Change it to the cid for metro pcs.
We might need to edit the board_info.img the same way too.
Then try again.
Im trying to get my temp root back.
I had it and had to factory reset my phone.
now kingo is not working again.
Took me like 20 times before.

is the highlighted section what im looking for??
BigCountry907 said:
Ok so at least your getting the unlock token now
We can try to edit the misc.img the same way.
Pull it off your phone and open in hex editor.
You will find the CID in there.
Change it to the cid for metro pcs.
We might need to edit the board_info.img the same way too.
Then try again.
Im trying to get my temp root back.
I had it and had to factory reset my phone.
now kingo is not working again.
Took me like 20 times before.
Click to expand...
Click to collapse

No that's not it.
Got to look at build.prop
# begin build properties
# autogenerated by buildinfo.sh
htc.build.stage=2
ro.aa.customizationid=3026008
ro.aa.project=A13_WL_L51_DESIRE_SENSE70_VZW
ro.prot=true
ro.aa.maincid=VZW__003
ro.aa.cidlist=VZW__003
ro.aa.rid=205
ro.aa.modelid=0PM310000
ro.aa.report=com
ro.aa.skulist=603
ro.aa.taskid=448911
ro.aa.mainsku=603
ro.aa.romver=1.07.603.5
ro.onecid=1
ro.cwkey=VZW__003
ro.build.id=LMY47O
ro.build.display.id=LMY47O release-keys
ro.build.version.incremental=564390.5
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1
This is the CID:
ro.aa.maincid=VZW__003
This is the MAINVER:
ro.aa.romver=1.07.603.5
If you search for 1.07.603.5
you will see the CID right by it.
You might only find.
0PM310000
We should change that too.
I'm kinda thinking there is more in the frp.img thats causing the problem.
I want to drop the FRP.img from my desire 626s and give it a try.
Be careful could end up bricking.

If I can get this thing to root again im going to try and push my misc.img and frp.img from my desire 626s to the 526.
they are both msm8909 chipsets so should be compatible.
Crossing things up like that could cause a brick.
But ill take the chance. only paid $35 for the thing.

Heres the info for the 626s
# begin build properties
# autogenerated by buildinfo.sh
htc.build.stage=2
ro.aa.customizationid=3031505
ro.aa.project=A32E_UL_L51_DESIRE_SENSE70
ro.prot=true
ro.aa.maincid=METRO001
ro.aa.modelid=0PM911000
ro.aa.rid=427
ro.aa.taskid=455088
ro.aa.cidlist=METRO001
ro.aa.report=com
ro.aa.skulist=1550
ro.aa.mainsku=1550
ro.aa.romver=1.23.1550.3
ro.onecid=1
ro.cwkey=METRO001
ro.build.id=LMY47O
ro.build.display.id=LMY47O release-keys
ro.build.version.incremental=637541.3
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1
use the CID and Mainver And device model from here.
If you are changing your misc.img.
mainver = 1.23.1550.3
cid = METRO001
mid= 0PM911000
change mainver to 1.00.0000.0

Theese are the files from my 626s.
You can try to dd them over.
dd if=/sdcard/frp.img of=/dev/block/bootdevice/by-name/frp
dd if=/sdcard/misc.img of=/dev/block/bootdevice/by-name/misc
dd if=/sdcard/board_info.img of=/dev/block/bootdevice/by-name/board_info
It Could cause you not to boot.
I would do frp.img and try unlock
then if dont work add misc.img
then if dont work add board_info
Backup your original files first so if it goes wrong there might be a chance to put them back.

flashed the files you provided,again once proceeding to the htcdev website to enter the token i get same error as before
BigCountry907 said:
Theese are the files from my 626s.
You can try to dd them over.
dd if=/sdcard/frp.img of=/dev/block/bootdevice/by-name/frp
dd if=/sdcard/misc.img of=/dev/block/bootdevice/by-name/misc
dd if=/sdcard/board_info.img of=/dev/block/bootdevice/by-name/board_info
It Could cause you not to boot.
I would do frp.img and try unlock
then if dont work add misc.img
then if dont work add board_info
Backup your original files first so if it goes wrong there might be a chance to put them back.
Click to expand...
Click to collapse

flashed the files you provided,again once proceeding to the htcdev website to enter the token i get same error as before
Click to expand...
Click to collapse
Well that makes things much more complicated.
Chances are it's probably coded in the boot-loader itself.
If you don't mind I want to have you pull all the firmware files off the phone.
All of them.
I'll write you a script. (I still never got my temp root back).
I would like to take a look at the recovery and the kernel in the boot.img.
Like I said the Desire 626s and the Desire 530 both are msm8909 chipsets. This also includes the newer Desire 526 as well. This means that the actual firmware running the chips is the same. My initial Idea was to build my own firmware for the 626s and test flash it on the 526. If that works then theoretically we could take the boot-loader and radio images from a S-off device and flash it to a non s-off and have s-off.
Yes I know there is no way to write to those partitions without s-off ( By normal means anyway ).
Now if you intentionally cause the right kind of brick by removing the right firmware and not removing the wrong firmware to force the device into Emergency Download Mode then provided that we have the other files we need for QPST and or QFIL ( for msm8909 chips ) we can take the firmware files from the RUU for the 626s and push it to the 526.
Pretty crazy I know. For sure not easy. And also after such a flash the 526 would actually be a 626s.
If you want to know how we could do this then go here and download the whole Qualcomm Tech Folder.
https://github.com/dante198406/Qual...0-NR964-4_C_MSM8909_LA_SW_User_Manual_SPD.pdf
Learn the QPST - QFIL stuff and away we go.
Not sure what my issue is getting root now.
Kingo keeps getting stuck at lime 52% till I reboot and then stuck at 65% till reboot then stuck at 77% till fail root.
Any Ideas?

Heres a Link To the process in general.
http://www.droidsavvy.com/unbrick-qualcomm-mobiles/

Ya im frustrated now.
I spent a whole day trying to get temp root back.
No luck.
It Seems to be an issue with the kingo link app on the phone.
When i did get root it wasnt poping up now it keeps popping up.

cmd
Would this be the correct code I'd go about to back up Img?
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/sdcard1/backup.img bs=512 count=30535646
New to this so do apologize

Would this be the correct code I'd go about to back up Img?
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/sdcard1/backup.img bs=512 count=30535646
Click to expand...
Click to collapse
Almost but not quite.
If you ran that command go to your sdcard1 folder and delete the backup.img.
Otherwise your phone memory is more than full.
The htc devices seem to use sdcard2 as the external sd card.
So first you will need a 32gb sd card.
The image size will be like 16gb.
then the command I would use is.
Code:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/sdcard2/backup.img
then
Code:
exit
exit
so that you are at the regular command window.
then
Code:
adb pull /sdcard2/backup.img
To get it to the computer.
That is 1 of the backups we need.
But we need each partition individually too.
Give me a little wile and Ill post the commands.
And Please don't try to intentionally brick your phone.
It might not be so easy to use qfil or qpst to fix it.
There are other files we need to get for qpst first.

so this code gave me a file or directory does not exsit:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/sdcard2/backup.img
So I Changed It To The Following:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/ext_sd/backup.img
BigCountry907 said:
Almost but not quite.
If you ran that command go to your sdcard1 folder and delete the backup.img.
Otherwise your phone memory is more than full.
The htc devices seem to use sdcard2 as the external sd card.
So first you will need a 32gb sd card.
The image size will be like 16gb.
then the command I would use is.
Code:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/sdcard2/backup.img
then
Code:
exit
exit
so that you are at the regular command window.
then
Code:
adb pull /sdcard2/backup.img
To get it to the computer.
That is 1 of the backups we need.
But we need each partition individually too.
Give me a little wile and Ill post the commands.
And Please don't try to intentionally brick your phone.
It might not be so easy to use qfil or qpst to fix it.
There are other files we need to get for qpst first.
Click to expand...
Click to collapse

Ok as long as the file goes to the external sdcard your good to go.
I found the kingoroot issue. The root works fine but the kingosuperuser app is not giving me the prompt to grant root permission. They need to fix kingosuperuser. Get it out to them and if they fix it many more people will easily get temp root. After you have it working the 1st time. Like actually working with adb shell
su
after reboot run kingoroot again and temp root comes right back.
I cant get past the su part again.

Bootloader

I have read, I have searched thread after thread. I have the Google Pixel XL on Verizon. I have followed the directions to the letter for unlocking bootloader using dePixel. The issue I have is with the Developer Options. I am unable to enable the OEM Unlocking because it is grayed out. I have reset the device like 10 times. I have automatic updates disable in developer options. I need to be point in the right direction or have someone that can relate, to chime in. I am not looking for root....I just want the bootloader unlocked
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

That button will always be greyed out on the VZW firmware. After you unlocked do you see a warning message on boot? How do you know you are not, in fact, unlocked?

You don't mess with that button. Just follow the directions for dePixel8
Sent from my Pixel XL using Tapatalk

DualSportDad said:
You don't mess with that button. Just follow the directions for dePixel8
Sent from my Pixel XL using Tapatalk
Click to expand...
Click to collapse
I followed to the letter and I get nothing

Mike02z said:
That button will always be greyed out on the VZW firmware. After you unlocked do you see a warning message on boot? How do you know you are not, in fact, unlocked?
Click to expand...
Click to collapse
well for starters after I entered the cmd lines.....device never rebooted into fastboot for me to run the unlock cmd line

Ok first before we can help you, can you post the screen of the cmd window or copy paste the results of it?

mikeutsey said:
well for starters after I entered the cmd lines.....device never rebooted into fastboot for me to run the unlock cmd line
Click to expand...
Click to collapse
Set the phone from charging to file transfer. After hitting enter for the last command line op pen the chrome browser app. I don't know why but that's what worked for me.
Sent from my Pixel XL using Tapatalk

Why not just flash the Google factory image once you run the depixel8 program?
Edit: Looks like you missed a step somewhere. Make sure your device is connected to your computer via adb. I would run the 15 second adb install (Google it) than put the depixel8 file in your tools folder. Open tool folder shift and right click to to open cmd promt. Type adb devices and see if it's connected. Also be sure to turn on USB debugging in dev options.

jaxenroth said:
Why not just flash the Google factory image once you run the depixel8 program?
Edit: Looks like you missed a step somewhere. Make sure your device is connected to your computer via adb. I would run the 15 second adb install (Google it) than put the depixel8 file in your tools folder. Open tool folder shift and right click to to open cmd promt. Type adb devices and see if it's connected. Also be sure to turn on USB debugging in dev options.
Click to expand...
Click to collapse
The dePixel8 Program has yet to work for me. Still have not successfully unlocked bootloader

Marghost said:
Ok first before we can help you, can you post the screen of the cmd window or copy paste the results of it?
Click to expand...
Click to collapse

On the pic you posted i see that you need to put a Space between 755 and /...
Can you post the full log If this is not working!

Was able to get it to reboot with cmd line but still not working. Thanks for all of your help with this
Marghost said:
On the pic you posted i see that you need to put a Space between 755 and /...
Can you post the full log If this is not working!
Click to expand...
Click to collapse

OK I see try close your phone and boot to the bootloader screen with power and vol down pressed at boot. After run the command
fastboot oem unlock
And tell me what you see!

That did it.....thanks guys....never would have even considered physically turning off device and and manually fastboot :highfive:
Marghost said:
On the pic you posted i see that you need to put a Space between 755 and /...
Can you post the full log If this is not working!
Click to expand...
Click to collapse

Np bro glad I helped. If you want give me some thumbs up hehe
Great day
Sent from my Pixel XL using XDA Labs

Is ADB working for you? I'm not sure where your are in the process, so forgive me if you've done these steps:
- enable debugging in developer options (must first tap on build number 10x or whatever
- if you do adb devices from command prompt, do you get the device id? You need to allow the computer to talk to the phone (security authorization on the phone the first time you attempt adb), as well as have drivers properly installed on computer
- assuming adb is writing properly, people seem to have best success with depixel8 if they set screen timeout to 5 min or longer, and after starting depixel8 commands on the computer, is screen blanks out, truth screen back on and try and run an app ...
Hope this helps

OnePlus Nord | N10 | N100 [TMO/MPCS] Network Unlock & Enable OEM Unlocking (April 19th, 2021)

1.) ADB access must be enabled
-Tap build number 7 times until Developer Options are enabled
2.) Enable USB Debugging
-For PC-less enable Wireless Debugging
Optional if PC-less
3.) Go to Play Store or F-Droid and download Shizuku
4.) Tap Shizuku in Terminal Apps and configure the shizuku file reflect the terminal package is "com.termux" and Start Shizuku
5.) Navigate to where the shizuku and shizuku.dex files are andn enter
cat shizuku > $PREFIX/bin/shizuku && chmod 755 $PREFIX/bin/shizuku
cat shizuku.dex > $PREFIX/bin/shizuku.dex && chmod 755 $PREFIX/bin/shizuku.dex && shizuku sh
TADA Now you have an ADB Shell locally on your OnePlus. One last command to enter.
settings put secure device_provisioned 0
Either nothing is returned or one word 'Success'is the only way to confirm the command was executed properly.
If with computer :
adb shell settings put secure device_provisioned 0
Congratulations your phone is now Network Unlocked. But wait, there's more to this groundbreaking method.
To enable OEM Unlocking in the Developers Menu this is where things get chipote-cray
In your terminal (termux, bash) enter this command
MOD EDIT: Link removed
Enter accordingly to onscreen prompts and then exit the script.
For finalization of effects Enter
adb reboot-bootloader
Toggle for the Start option.
Go to Network and Sim and there is confirmation that the Network Unlock is persistent. Go to Developer Options and viola, the Enable OEM Unlock button is enabled again. This is also persistent. Make sure to leave enabled in case of accidental/intentional factory reset. Good job everyone.
To get unlock code for the OnePlus.com/unlock_token form Enter
adb reboot-bootloader && fastboot oem get_unlock_code
0day from Jay . This isn't cosmetic, this directly impact's the kernel and is thus persistent.
Support for this is located
MOD EDIT: Link removed