Bootloader unlocking

Last updated
An unlocked bootloader, showing additional available options Bootloader Android HTC Pico.JPG
An unlocked bootloader, showing additional available options

Bootloader unlocking is the process of disabling the bootloader security that makes secure boot possible. It can make advanced customizations possible, such as installing a custom firmware. On smartphones this can be a custom Android distribution or another mobile operating system. Some bootloaders are not locked at all, others can be unlocked using a standard command, others need assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through a software exploit.

Contents

Bootloader unlocking is also done for mobile forensics purposes, to extract digital evidence from mobile devices, using tools such as Cellebrite UFED.

Background

Unlocking the bootloader usually voids any warranties and may make the device susceptible to data theft. [1] On Chromebooks, enabling developer mode makes the system less secure than a standard laptop running Linux. [2] Unlocking the bootloader may lead to data loss on Android and ChromeOS devices, as some data is impossible to back up without root permission. This will also lead to certain security apps not working, such as Samsung Knox for which the counter would be stuck at "0x1."

Sascha Segan from PCMag considered a locked bootloader a mistake on the Qualcomm Snapdragon Insiders phone, which is targeted at advanced users. [3]

Platforms

Android

Unlocking the bootloader is typically done during the process of obtaining root access and/or installing a custom ROM.

Android bootloader unlocking as of 2024
ManufacturerDifficulty levelMethod
Google Easy (non-Verizon)
Impossible (Verizon)		Command-line (unlocked variant, not restricted to carrier, and non-Verizon carrier variants when paid off fully)
Samsung Easy (anywhere)Development settings (except North American variants)
OnePlus Easy (non-T-Mobile)
Medium (T-Mobile)		Command-line, except on T-Mobile US variants where an unlock code is needed
Xiaomi Hard (outside China Mainland)

Very Hard (China Mainland)

Add Mi account, request code via Windows-only software, wait for 3 days on HyperOS or 1 week for MIUI (limited to one device per month and three devices per year).

On devices with HyperOS outside Mainland China, you need to request for bootloader unlock permission in the Xiaomi Community app before you can add your account. Your Xiaomi account needs to be at least 1 month old to be eligible. For Mainland China devices with HyperOS, you need to reach Xiaomi Community Level 5 and take a very difficult time-limited exam and pass the manual grading before you can add your account. On devices with Mediatek system on a chip it is easy with a third-party tool called MTKClient

Asus ImpossibleUnlocking was performed via a first-party unlocking tool, but servers and app were removed.
Sony MediumCommand-line, request code at Sony website
Fairphone MediumCommand-line, request code at Fairphone website or forum
Motorola Medium (non Verizon, AT&T, Tracfone)

Impossible (Verizon, AT&T, Tracfone)

Command-line, request code at Motorola website
Realme Medium-HardCommand-line, after installation of the in-depth test app and submitting a application for in-depth testing.
Nothing EasyCommand-line
Huawei Medium-Hard (Kirin SoCs, select Huawei phones)

Impossible, due to unlocking services being shut down (Other devices)

Select Huawei phones using the Kirin SoC can have their bootloader unlocked via potatonv: https://www.xda-developers.com/huawei-honor-bootloader-unlock-potatonv/

Other devices: N/A

OPPO Easy (MediaTek) or phones that bought in Mainland China [4]
Medium (Snapdragon) Only any phones in support list are possible to unlock Snapdragon-powered OPPO phone, [5] any phones that's not in support lists is still possible if using paid tool also known as UnlockTool, without paid tool. It would be impossible to unlock. Unlocking is possible on some mediatek SoCs via MTKClient. Note that about fastboot binaries were removed, or locked by RSA key		Snapdragon: https://us.docs.wps.com/l/sIIS95rToAcW2x7AG?v=v2 [6]

MediaTek: MTKClient, sometimes MTK bypass utility are required beforehand

Any phones that's bought from Mainland China and in device support lists of depth-test: Unlock by depth test regardless of SoC, depth test app can be downloaded from https://www.oppo.cn/thread-397164526-1 then unlock via adb with simple command line while in fastboot state

If you are getting "Handshake failed" on MTKCilent, then it is necessary to test point to force boot into boot ROM

HMD-Nokia ImpossibleN/A
vivo Impossible [7] Unless there are XDA forums that have methods to unlock, but some method cannot be used after updated phone patched exploit.Vivo X70 Pro+ https://xdaforums.com/t/vivo-x70-pro-bootloader-unlock-how-to-guide.4444989/ Vivo Y31 2021 https://xdaforums.com/t/unlocking-bootloader-rebooting-in-edl-without-testpoint-vivo-y31-2021.4440801/
LG Hard Possible, with the help of leaked engineering bootloaders available to be flashed via QFIL utility
Tecno MediumCommand-line, (requires Tecno ID account on the phone, registered in two weeks or more, to activate OEM unlocking.)
Infinix MediumCommand-line, (requires Infinix ID account on the phone, registered in two weeks or more, to activate OEM unlocking.)
Itel MediumCommand-line, (requires Itel ID account on the phone, registered in two weeks or more, to activate OEM unlocking.)
TCL Medium (Ion V only)

Unknown (other phones)

For Ion V you can use a Python tool to reboot to a normally hidden fastboot then enter fastboot flashing unlock to unlock it
Amazon (fire hd)MediumBrick while fastbooting via adb command line (only Linux)

History

The bootloaders of Nexus and Pixel devices can be unlocked by using the fastboot command fastboot oem unlock or if it doesn't recognize the command fastboot flashing unlock. [8]

When Motorola released a bootloader unlocking tool for the Droid Razr, Verizon removed the tool from their models. [9]

In 2011, Sony Ericsson released an online bootloader unlocking tool. [10] Sony requires the IMEI number to be filled in on their website. [11] For the Asus Transformer Prime TF201, Asus has released a special bootloader unlock tool. [12]

In 2012, Motorola released a limited tool for unlocking bootloaders. [13] They require accepting terms and conditions and creating an account before the bootloader can be unlocked for your Motorola device. [14]

HTC phones have an additional layer of lock called "S-OFF/S-ON".

Bootloaders can be unlocked using an exploit or using a way that the vendor supplied. The latter method usually requires wiping all data on the device. [15] In addition, some manufacturers prohibit unlocking on carrier locked phones. Although Samsung phones and cellular tablets sold in the US and Canada do not allow bootloader unlocks regardless of carrier status, a service has allowed users on an earlier version to unlock their US/Canadian Samsung phone(s) and/or tablet(s) [16] [17]

In 2018, a developer from XDA Developers launched a service which allowed users to unlock the bootloader of some Nokia smartphone models. [18] Similarly, another developer from XDA Developers launched a service to allow users to unlock the bootloaders of Samsung Galaxy S20 and Samsung Galaxy S21 Phones.

Huawei announced plans to allow users to unlock the bootloader of the Mate 30 series, but later retracted that. [19] Huawei has stopped providing bootloader unlock codes since 2018. [20] A bootloader exploit named checkm30 has been developed for HiSilicon based Huawei phones. [21] [ non-primary source needed ]

When the bootloader of the Samsung Galaxy Z Fold 3 was unlocked, the camera became less functional. This could be restored by re-locking the bootloader. [22] This issue was later fixed by Samsung. [23] For the Samsung Galaxy S22 series, unlocking the bootloader has no effect on the camera. [24]

Others

Microsoft

The WPInternals tool is able to unlock bootloaders of all Nokia Lumia phones running Windows Phone, but not phones like the Alcatel Idol 4 or HP Elite x3. [25] [26] Version 1.0 was released in November 2015. [27] In October 2018, the tool was released as open source software when the main developer René Lergner (also known as HeathCliff74) stepped down. [28]

The slab bootloader used by Windows RT could be unlocked using a vulnerability, but was silently patched by Microsoft in 2016. [29] UEFI Secure Boot on x86 systems can generally be unlocked.

Apple

The boot ROM protection on iOS devices with an A11 processor or older can be bypassed with a hardware exploit known as checkm8, which makes it possible to run other operating systems including Linux. [30]

The bootloader on Apple Silicon-based Macs can be unlocked. [31] However, other Apple devices like the iPhone and iPad cannot be bootloader unlocked even when using the same chip used in a Mac.

Google

The equivalent of bootloader unlocking is called developer mode in Chromebooks. [32] Chromebooks use custom bootloaders that can be modified or overwritten by removing a Write-protect screw. [33] Some models lack a screw and instead may or may not require disabling the onboard Cr50 chip.

In 2013, the bootloader of the Chromecast was hacked using an exploit. [34] In 2021, it was hacked again for newer versions. [35]

Asus

Asus used to provide an Unlocking tool for both of their smartphone lines, the Zenfone and ROG Phone. This worked as an installable .apk file that the user could install on their phone, then unlock the bootloader. The app worked by contacting Asus unlocking servers, then prompting the user to perform a factory reset.

In 2023 Asus removed the tool from their website and closed the unlocking servers, so even phones with the .apk file installed couldn't unlock their bootloaders. Representatives on the Asus forums claimed the tool would be available again, but as of March 2024 no additional information has been provided, even after the release of their latest device the ROG Phone 8 and the upcoming release of the Zenfone 11 Ultra.

A user on the popular forum XDA (website) filed a court claim application against Asus due to the unlock tool never being released and alleged that Asus censored comments about the unlock tool on their form. [36]

SpaceX

In August 2022, security researcher Lennert Wouters applied a voltage injection attack to bypass firmware verification of a Starlink satellite dish from SpaceX. [37]

Relocking

On Android, it is possible to relock the bootloader. [38]

VNeID app changes

According to information from technology groups in Vietnam, after updating version 2.1.6 of the VNeID application released on May 30, 2024, some Android phone users have received warnings : "Your device is not safe, there is a risk of containing malicious code...". As a result, users are thrown to the main screen and cannot use the VNeID application, even though before the update they could still log in and use it normally.

This is because VNeID 2.1.6 update has added new security measures to stop working on Android devices with root access, unlocked bootloader and developer mode enabled. To use, users must disable root access to the device, relock bootloader and turn off developer options. [39]

Shutdown of online services

In 2018, Huawei stopped providing bootloader unlock codes. [40] On 31 December 2021, LG shut down their website which provided bootloader unlock codes. [41] In August 2023, ASUS removed the unlocking tool from their website and shut down the servers used to unlock the bootloader. [42]

See also

Related Research Articles

Android is a mobile operating system based on a modified version of the Linux kernel and other open-source software, designed primarily for touchscreen mobile devices such as smartphones and tablets. Android has historically been developed by a consortium of developers known as the Open Handset Alliance, but its most widely used version is primarily developed by Google. It was unveiled in November 2007, with the first commercial Android device, the HTC Dream, being launched in September 2008.

The Android Dev Phone (ADP) is a SIM-unlocked and bootloader unlocked Android device that is designed for advanced developers. While developers can use regular consumer devices purchased at retail to test and use their apps, some developers may choose not to use a retail device, preferring an unlocked or no-contract device.

Rooting is the process by which users of Android devices can attain privileged control over various subsystems of the device, usually smartphones and tablets. Because Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

Google Nexus is a discontinued line of consumer electronic mobile devices that ran a stock version of the Android operating system. Google managed the design, development, marketing, and support of these devices, but some development and all manufacturing were carried out by partnering with original equipment manufacturers (OEMs). Alongside the main smartphone products, the line also included tablet computers and streaming media players; the Nexus started out in January 2010 and reached its end in October 2016, replaced by Google Pixel family.

<span class="mw-page-title-main">Hacking of consumer electronics</span>

The hacking of consumer electronics is a common practice that users perform to customize and modify their devices beyond what is typically possible. This activity has a long history, dating from the days of early computer, programming, and electronics hobbyists.

<span class="mw-page-title-main">Nexus S</span> 2010 smartphone by Google and Samsung

The Nexus S is a smartphone co-developed by Google and Samsung and manufactured by Samsung Electronics for release in 2010. It was the first smartphone to use the Android 2.3 "Gingerbread" operating system, and the first Android device to support Near Field Communication (NFC) in both hardware and software.

<span class="mw-page-title-main">Motorola Atrix 4G</span> Android smartphone developed by Motorola Mobility

The Motorola Atrix 4G is an Android-based smartphone developed by Motorola, introduced at CES 2011 along with the Motorola Xoom, Motorola Droid Bionic, and Motorola Cliq 2 on January 5, 2011. It was made available in the first quarter of 2011.

<span class="mw-page-title-main">HTC Sensation</span> Smartphone model

The HTC Sensation is a smartphone designed and manufactured by HTC Corporation that runs the Android 2.3 Gingerbread software stock. Officially announced by HTC on April 12, 2011, the HTC Sensation was launched by Vodafone in key European markets including the United Kingdom on May 19, 2011 and by T-Mobile in the United States on June 12, 2011. It was HTC's fifth flagship Android phone and the first HTC phone to support the HTC Sense 3.0 user interface. At the time of its release, the Sensation XE was the world's fastest Android phone.

<span class="mw-page-title-main">Droid Razr</span> Android smartphone developed by Motorola Mobility

The Verizon Droid Razr is an Android-based, 4G LTE-capable smartphone designed by Motorola that launched on Verizon Wireless on November 11, 2011. It was announced on October 18, 2011 in New York City.

A lock screen is a computer user interface element used by various operating systems. They regulate immediate access to a device by requiring the user to perform a certain action in order to receive access, such as entering a password, using a certain button combination, or performing a certain gesture using a device's touchscreen. There are various authentication methods to get past the lock screen, with the most popular and common ones being personal identification numbers (PINs), the Android pattern lock, and biometrics.

<span class="mw-page-title-main">Wear OS</span> Smartwatch operating system by Google

Wear OS is a version of Google's Android operating system designed for smartwatches and other wearables. By pairing with mobile phones running Android version 6.0 "Marshmallow" or newer, or iOS version 10.0 or newer with limited support from Google's pairing application, Wear OS integrates Google Assistant technology and mobile notifications into a smartwatch form factor. Wear OS is closed-source, in contrast to the free and open-source Android.

<span class="mw-page-title-main">Redmi 1S</span>

The Xiaomi Redmi 1S, code-named armani HM 1S, is a smartphone released in May 2014, developed by the Chinese company Xiaomi Inc. It is a part of the Redmi series of smartphones, and succeeded the Redmi 1. Visually similar to its predecessor, it comes with a 4.7-inch screen, a quad-core 1.6 GHz Cortex-A7 processor and runs Android version 4.3 (Jellybean), bundled with the proprietary MIUI v5 user interface, which can be upgraded to MIUI v9 based on Android 4.4.4 KTU84P.

Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles, mobile phones, and various embedded device types to provide new features or to unlock hidden functionality. In the video game console community, the term is often written as custom firmware or simply CFW, referring to an altered version of the original system software inside a video game console such as the PlayStation Portable, PlayStation 3, PlayStation Vita/PlayStation TV, PlayStation 4, Nintendo 3DS, Wii U and Nintendo Switch. Installing custom firmware on some devices requires bootloader unlocking.

<span class="mw-page-title-main">Moto G4</span> Android smartphone developed by Motorola Mobility

The Moto G4 is a line of Android smartphones manufactured by Motorola Mobility, a subsidiary of Lenovo. It is the successor to the third-generation Moto G, and was first released in Brazil and India on May 17, 2016, with other markets following.

<span class="mw-page-title-main">Samsung DeX</span> Feature that enables users to extend their phone to a desktop-like experience

Samsung DeX is a feature included on some high-end Samsung handheld devices that enables users to extend their device into a desktop-like experience by connecting a keyboard, mouse, and monitor. The name "DeX" is a contraction of "Desktop eXperience".

postmarketOS Free and open-source operating system for smartphones, based on Alpine Linux

postmarketOS is an operating system primarily for smartphones, based on the Alpine Linux distribution.

<span class="mw-page-title-main">Foldable smartphone</span> Smartphone form factors that use flexible displays

A foldable smartphone is a smartphone with a folding form factor. It is reminiscent of the clamshell design of many earlier feature phones. Some variants of the concept use multiple touchscreen panels on a hinge, while other designs utilise a flexible display. Concepts of such devices date back as early as Nokia's "Morph" concept in 2008, and a concept presented by Samsung Electronics in 2013, while the first commercially available folding smartphones with OLED displays began to emerge in November 2018.

HarmonyOS (HMOS) is a distributed operating system developed by Huawei for smartphones, tablets, smart TVs, smart watches, personal computers and other smart devices. It has a multi-kernel design with dual frameworks: the operating system selects suitable kernels from the abstraction layer in the case of devices that use diverse resources.

The Linux kernel can run on a variety of devices made by Apple, including devices where the unlocking of the bootloader is not possible with an official procedure, such as iPhones and iPads.

References

  1. ↑ Tamma, Rohit; Donnie Tindall (2015). Learning Android forensics: a hands-on guide to Android forensics, from setting up the forensic workstation to analyzing key forensic artifacts. Birmingham, UK. ISBN   978-1-78217-444-8. OCLC   910639389.{{cite book}}: CS1 maint: location missing publisher (link)
  2. ↑ Porup, J. M. (2017-06-19). "How to install Linux on a Chromebook (and why you should)". Ars Technica . Archived from the original on 2017-06-19. Retrieved 2021-09-06.
  3. ↑ "Qualcomm Smartphone for Snapdragon Insiders Review". PCMag . Archived from the original on 2021-08-16. Retrieved 2021-09-06.
  4. ↑ "帖子详情 - Oppo社区".
  5. ↑ "Proton Drive".
  6. ↑ "Tutorial can be foun…". 12 May 2024.
  7. ↑ "vivo Smartphone FAQs | vivo India". www.vivo.com. Retrieved 2022-11-29.
  8. ↑ "Factory Images for Nexus and Pixel Devices | Google Play services". Google Developers. Retrieved 2022-11-07.
  9. ↑ Ingraham, Nathan (2011-10-24). "GSM Motorola RAZR hits the FCC; Verizon model has locked bootloader". The Verge . Retrieved 2022-06-14.
  10. ↑ By (2011-04-14). "Sony Ericsson Promotes Android Bootloader Unlocking". Hackaday . Retrieved 2022-06-14.
  11. ↑ Kotipalli, Srinivasa Rao; Mohammed A. Imran (2016). Hacking Android: explore every nook and cranny of the Android OS to modify your device and guard it against security threats. Birmingham, UK. ISBN   978-1-78588-800-7. OCLC   957298786.{{cite book}}: CS1 maint: location missing publisher (link)
  12. ↑ Tiefenthäler, Ronald (22 February 2012). "Asus: Bootloader Unlock Tool für Tablet Transformer Prime TF201 verfügbar". Notebookcheck (in German). Retrieved 2021-08-04.
  13. ↑ Rodgers, Evan (2012-08-17). "Motorola unveils Android bootloader unlocking tool with limited device support". The Verge . Archived from the original on 2012-08-19. Retrieved 2021-09-10.
  14. ↑ Viscomi, Rick; Andy Davies; Marcel Duran (2015). Using WebPageTest: web performance testing for novices and power users. Sebastopol, CA. ISBN   978-1-4919-0281-3. OCLC   927108295.{{cite book}}: CS1 maint: location missing publisher (link)
  15. ↑ Afonin, Oleg (2016). Mobile Forensics ' Advanced Investigative Strategies (1 ed.). Packt Publishing. ISBN   978-1-78646-408-8. OCLC   960040717.
  16. ↑ "USA/Canada - Samsung Bootloader Unlock". Telegram. Retrieved 2024-06-18.
  17. ↑ "[CLOSED][Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices". XDA Forums. 2021-01-08. Retrieved 2024-06-18.
  18. ↑ Rox, Ricci (2 April 2018). "Nokia users can now unofficially unlock their bootloaders but the methodology is as sketchy as it gets". Notebookcheck. Retrieved 2021-09-06.
  19. ↑ "Huawei Mate 30 will not have an unlocked bootloader". The Indian Express . 2019-09-25. Archived from the original on 2019-09-26. Retrieved 2021-09-06.
  20. ↑ "Huawei will no longer offer bootloader unlock codes for its Android devices". 9to5Google . 2018-05-24. Retrieved 2021-09-06.
  21. ↑ "Checkmate Mate 30 - Attack the bootrom of Huawei smartphones" (PDF). Archived (PDF) from the original on 2021-09-06.
  22. ↑ Clark, Mitchell (2021-08-24). "Samsung will let you unlock your Z Fold 3's bootloader, but at the cost of your cameras". The Verge . Archived from the original on 2021-08-24. Retrieved 2021-09-06.
  23. ↑ "Unlocking the bootloader no longer kills the Galaxy Z Fold 3's cameras". xda-developers. 2021-12-07. Retrieved 2022-03-14.
  24. ↑ "Unlocking the bootloader doesn't break the camera on the Samsung Galaxy S22 series". xda-developers. 2022-02-26. Retrieved 2022-02-26.
  25. ↑ "Tool van Nederlandse ontwikkelaar kan custom roms op alle Lumia's flashen". Tweakers (in Dutch). Retrieved 2021-08-04.
  26. ↑ "Windows Phone Internals 2.2 Unlocks the Bootloader on all Windows 8 & 10 Lumia Smartphones". xda-developers . 2017-12-04. Retrieved 2021-08-04.
  27. ↑ Andrew Orlowski. "Rooting and modding a Windows Phone is now child's play". The Register . Retrieved 2022-06-14.
  28. ↑ "Windows 10 Mobile's bootloader unlocker is now open source". Neowin . Retrieved 2022-06-14.
  29. ↑ Francisco, Shaun Nichols in San. "Microsoft silently kills dev backdoor that boots Linux on locked-down Windows RT slabs". www.theregister.com. Retrieved 2021-09-06.
  30. ↑ Lundberg, Anders. "16-year-old runs Linux on iPhone 7". Macworld UK . Retrieved 2021-08-04.
  31. ↑ January 2021, Michelle Ehrhardt 19 (2021-01-19). "Linux is Finally on Apple M1...Kind Of". Tom's Hardware . Retrieved 2021-08-04.{{cite web}}: CS1 maint: numeric names: authors list (link)
  32. ↑ December 2014, Lucian Armasu 31 (2014-12-31). "You Can Now Run Full Linux Apps Inside A Chrome OS Window". Tom's Hardware . Retrieved 2021-09-06.{{cite web}}: CS1 maint: numeric names: authors list (link)
  33. ↑ Robert, Foss (2017-03-08). "Quick hack: Removing the Chromebook Write-Protect screw". Collabora . Retrieved 2021-09-04.
  34. ↑ "Chromecast bootloader exploit surfaces, opens up plenty of possibilities (video)". Engadget . 28 July 2013. Archived from the original on 2020-09-04. Retrieved 2021-09-06.
  35. ↑ "Modders ontgrendelen bootloader van Google Chromecast met Google TV". Tweakers (in Dutch). Archived from the original on 2021-08-01. Retrieved 2021-09-06.
  36. ↑ "Court Action against Asus' false promise on bootloader unlock tool". XDA Forums. 2024-02-18. Retrieved 2024-03-23.
  37. ↑ Hardcastle, Jessica Lyons. "Starlink satellite dish cracked on stage at Black Hat". The Register . Retrieved 2022-11-22.
  38. ↑ Wilde, Damien (2021-09-09). "How to downgrade from Android 12 Beta to Android 11 on Google Pixel [Video]". 9to5Google . Retrieved 2021-09-28.
  39. ↑ "Người dùng Android Root/Unlock Bootloader không cập nhật được VNeID 2.1.6: Làm sao để khắc phục?". 24hstore.vn (in Vietnamese). 2024-05-30. Retrieved 2024-06-07.
  40. ↑ "Huawei stopt met het uitdelen van codes om bootloader vrij te geven". Tweakers (in Dutch). Retrieved 2023-05-07.
  41. ↑ "LG stopt eind dit jaar met tool voor unlocken van smartphonebootloaders". Tweakers (in Dutch). Retrieved 2023-05-07.
  42. ↑ "ASUS is apparently killing the ability to root Zenfones". Android Authority . 8 August 2023. Retrieved 2024-01-30.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.