mirror of
https://github.com/zenfyrdev/bootloader-unlock-wall-of-shame.git
synced 2026-10-19 11:04:25 +00:00
Merge pull request #2 from havaianasdestruido/jules-6300918527596495494-157f5121
Fix grammar and spelling across Markdown files
This commit is contained in:
Pato (new acc)
GitHub
commit
0497b9cfbc
16 changed files with 62 additions and 62 deletions
|
|
@ -1,7 +1,7 @@
|
|||
## General Guidelines
|
||||
|
||||
### Sources
|
||||
You don't have to cite every word, but it's best practice to cite sources for key statements. It's preferred to source from the OEM directly, or device specific communities.
|
||||
You don't have to cite every word, but it's best practice to cite sources for key statements. It's preferred to source from the OEM directly, or device-specific communities.
|
||||
|
||||
Links should generally point to the original website, unless the original source is dead, in which case an archive.org link is fine. For this reason, it's a good idea to archive the page now.
|
||||
|
||||
|
|
|
|||
28
README.md
28
README.md
|
|
@ -16,7 +16,7 @@ Keeping track of companies that "care about your data 🥺"
|
|||
|
||||
</p>
|
||||
</details>
|
||||
Do note issues, pull requests and discussions on Codeberg and tangled are not monitored. Please use GitHub for these.
|
||||
Do note that issues, pull requests, and discussions on Codeberg and tangled are not monitored. Please use GitHub for these.
|
||||
|
||||
## Why?
|
||||
Over the past few years, a suspicious number of companies have started to "take care of your data", aka block/strictly limit your ability to unlock the bootloader on your *own* devices.
|
||||
|
|
@ -72,14 +72,14 @@ The following manufacturers have made it completely impossible to unlock their d
|
|||
|
||||
### [Windows phones](./brands/winphones/README.md)
|
||||
|
||||
### Carrier Locked Devices
|
||||
### Carrier-Locked Devices
|
||||
|
||||
> [!NOTE]
|
||||
> Phone brands handle carrier locks differently, so check your device manual or contact support.
|
||||
|
||||
Carrier locked devices are the ones you get after making a commitment with a carrier of your choice. This is quite common in North America and (supposedly) allows you to save some money on your device.
|
||||
Carrier-locked devices are the ones you get after making a commitment with a carrier of your choice. This is quite common in North America and (supposedly) allows you to save some money on your device.
|
||||
|
||||
As a rule, almost all carrier locked devices do not allow the bootloader to be unlocked. This usually makes sense, as it would allow you to completely bypass the contract. The problem is that many devices still do not allow you to unlock the bootloader even after the carrier lock has been lifted. For more details, see the [carriers page](./carriers/README.md).
|
||||
As a rule, almost all carrier-locked devices do not allow the bootloader to be unlocked. This usually makes sense, as it would allow you to completely bypass the contract. The problem is that many devices still do not allow you to unlock the bootloader even after the carrier lock has been lifted. For more details, see the [carriers page](./carriers/README.md).
|
||||
|
||||
## 🍅 Just terrible!
|
||||
|
||||
|
|
@ -153,31 +153,31 @@ The following manufacturers require an internet connection and/or a waiting peri
|
|||
|
||||
## Custom AVB Keys
|
||||
|
||||
Custom Android Verified Boot keys is a feature which allows you to run a custom OS with a locked bootloader.
|
||||
Custom Android Verified Boot keys are a feature that allows you to run a custom OS with a locked bootloader.
|
||||
|
||||
It's rare to see a device which supports custom AVB keys, but some devices can be found [here](https://github.com/chenxiaolong/avbroot/issues/299).
|
||||
It's rare to see a device that supports custom AVB keys, but some devices can be found [here](https://github.com/chenxiaolong/avbroot/issues/299).
|
||||
|
||||
## Universal SOC-based methods
|
||||
|
||||
### Kirin
|
||||
Kirin 620, 650, 655, 658, 659, 925, 935, 950, 960:<br/>
|
||||
It's possible to unlock using testpoints and [PotatoNV](https://github.com/mashed-potatoes/PotatoNV) (Read the readme)
|
||||
It's possible to unlock using test points and [PotatoNV](https://github.com/mashed-potatoes/PotatoNV) (Read the README)
|
||||
|
||||
### MediaTek
|
||||
If you own a MediaTek device exploitable by [mtkclient](https://github.com/bkerler/mtkclient) ([fork old version](https://github.com/R0rt1z2/mtkclient)) or [Penumbra](https://github.com/shomykohai/penumbra) you can unlock the bootloader using that.<br/>
|
||||
If you own a MediaTek device exploitable by [mtkclient](https://github.com/bkerler/mtkclient) ([fork old version](https://github.com/R0rt1z2/mtkclient)) or [Penumbra](https://github.com/shomykohai/penumbra), you can unlock the bootloader using it.<br/>
|
||||
If it also happens to be an OPPO/Realme device and you need to access fastboot: [lkpatcher](https://github.com/R0rt1z2/lkpatcher) ([web version](https://lkpatcher.r0rt1z2.com/))
|
||||
|
||||
If bootloader unlocking doesn't work on an Oppo Mediatek device using the SECCFG mod (unlocking via mtkclient), you can try unlocking fastboot by writing a modified boot1 (preloader). Writing a preloader also uses mtckclient: [oppo-mtk-fastboot-unlock](https://github.com/Shocked-Cat/oppo-mtk-fastboot-unlock).
|
||||
If bootloader unlocking doesn't work on an Oppo Mediatek device using the SECCFG mod (unlocking via mtkclient), you can try unlocking fastboot by writing a modified boot1 (preloader). Writing a preloader also uses mtkclient: [oppo-mtk-fastboot-unlock](https://github.com/Shocked-Cat/oppo-mtk-fastboot-unlock).
|
||||
|
||||
### Qualcomm
|
||||
|
||||
#### Snapdragon 8 Elite Gen 5/Snapdragon 8 ELite
|
||||
#### Snapdragon 8 Elite Gen 5/Snapdragon 8 Elite
|
||||
|
||||
**Patched in February/March 2026**
|
||||
|
||||
On Snapdragon 8E5/8E, Qualcomm introduced a [vulnerability (CN)](https://www.cnblogs.com/sakrain/p/-/unlock-your-qualcomm) [(POC)](https://github.com/kasnria001/qualcomm_gbl_exploit_poc) where the boot process would not perform signature verification for the Generic Bootloader, so with write access to the `efisp` partition it was possible to run arbitary code.
|
||||
On Snapdragon 8E5/8E, Qualcomm introduced a [vulnerability (CN)](https://www.cnblogs.com/sakrain/p/-/unlock-your-qualcomm) [(POC)](https://github.com/kasnria001/qualcomm_gbl_exploit_poc) where the boot process would not perform signature verification for the Generic Bootloader, so with write access to the `efisp` partition it was possible to run arbitrary code.
|
||||
|
||||
While the vulnerability itself is universal for the platform, it requires device/OEM specific tricks to get root and write the GBL. Some exist for [Xiaomi devices](./brands/xiaomi/README.md#snapdragon-8-elite8gen38gen28gen1).
|
||||
While the vulnerability itself is universal for the platform, it requires device/OEM-specific tricks to get root and write the GBL. Some exist for [Xiaomi devices](./brands/xiaomi/README.md#snapdragon-8-elite8gen38gen28gen1).
|
||||
|
||||
#### Other
|
||||
|
||||
|
|
@ -185,9 +185,9 @@ The general exploit:<br/>
|
|||
[alephsecurity.com](https://alephsecurity.com/2018/01/22/qualcomm-edl-2/) the bootloader unlock section.
|
||||
|
||||
### Unisoc
|
||||
If you own a phone with the Unisoc UMS9620 or older you can use [this](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) (UMS9621 need [this](https://github.com/TomKing062/exec_addr_v2) as exec address) to achieve temporary secure boot bypass and persistently unlock bootloader. This is valid for all devices except some devices with [modified uboot](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/patch_do_cboot%E2%80%90SPL#part-2-modify-fdl2ubootlk) which need [this](https://github.com/TomKing062/unisoc_chipram_signcheck_exploit) or [this](https://github.com/YC-nw/bsp_sign_fxxker) or [this](https://github.com/kasnria001/unisoc_secure_boot_bypass), note that the method used on all these three links is the same but implemented by different people and with possible differences, also by using this aside from bootloader unlock is possible to completely disable dm-verity by patching trustos partition which would allow booting of unsigned partitions.
|
||||
If you own a phone with the Unisoc UMS9620 or older, you can use [this](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) (UMS9621 needs [this](https://github.com/TomKing062/exec_addr_v2) as exec address) to achieve temporary secure boot bypass and persistently unlock the bootloader. This is valid for all devices except some devices with [modified uboot](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/patch_do_cboot%E2%80%90SPL#part-2-modify-fdl2ubootlk) which need [this](https://github.com/TomKing062/unisoc_chipram_signcheck_exploit) or [this](https://github.com/YC-nw/bsp_sign_fxxker) or [this](https://github.com/kasnria001/unisoc_secure_boot_bypass). Note that the method used in all three links is the same, but implemented by different people with possible differences. Also, using this, aside from unlocking the bootloader, it is possible to completely disable dm-verity by patching the trustos partition, which allows booting of unsigned partitions.
|
||||
|
||||
If you own a phone with the Unisoc UMS312, UMS512, or UD710, you can use [this](https://github.com/TomKing062/CVE-2022-38691_38692) exploit to achieve persistently secure boot bypass, which means all firmwares including splloader,uboot can be modified and resigned.
|
||||
If you own a phone with the Unisoc UMS312, UMS512, or UD710, you can use [this](https://github.com/TomKing062/CVE-2022-38691_38692) exploit to achieve persistent secure boot bypass, which means all firmware, including splloader and uboot, can be modified and re-signed.
|
||||
|
||||
Otherwise, you can also look into this: [Spectrum_UnlockBL_Tool](https://github.com/zhuofan-16/Spectrum_UnlockBL_Tool) <br/>
|
||||
This: [xdaforums.com](https://xdaforums.com/t/alldocube-t803-smile_1-bootloader-unlock-w-unisoc-t310.4393389/) <br/>
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ An [Example Link][example-link] in the middle.
|
|||
[example-link]:https:...
|
||||
```
|
||||
|
||||
Or you can also do this:
|
||||
Or you can do this:
|
||||
|
||||
```
|
||||
An [Example Link] in the middle.
|
||||
|
|
@ -55,4 +55,4 @@ An [Example Link] in the middle.
|
|||
### Images
|
||||
It's fine to use images in brand pages, but they should have descriptive alt text and be small. The smaller size can be achieved by converting your images to lossy `.webp`.
|
||||
|
||||
Also, avoid using the markdown `![]()` syntax as it does not have a way to set `width` and `height` of the image.
|
||||
Also, avoid using the markdown `![]()` syntax as it does not provide a way to set the `width` and `height` of the image.
|
||||
|
|
@ -5,7 +5,7 @@
|
|||
As expected, Apple does not allow bootloader unlocking, and never has. Most Apple devices also have an aggressive anti-rollback system, stopping you from downgrading to an older iOS version for jailbreaking purposes.
|
||||
|
||||
## Firmware signing
|
||||
Apple has a server called "Tatsu Signing Server", typically shortened to TSS. When you try to install firmware on an Apple device, iTunes or Finder will send several things to TSS so it can generate a signed SHSH blob to allow the restore, the following being
|
||||
Apple has a server called "Tatsu Signing Server", typically shortened to TSS. When you try to install firmware on an Apple device, iTunes or Finder will send several things to TSS so it can generate a signed SHSH blob to allow the restore, which are:
|
||||
|
||||
- The Model ID, this tells it what device you have. For example, the global model of the iPhone 5s is iPhone6,2, the Wi-Fi only model of the iPad Air 3 is iPad11,3, the global model of the iPhone X is iPhone10,3, etc.
|
||||
- The build ID, this identifies the exact build of iOS you are trying to install, iOS 14.3 is 18B92, iOS 10.3.3 is 14G60, etc.
|
||||
|
|
@ -29,7 +29,7 @@ Firmware signing was only introduced in 2009 with the iPhone 3GS and "new bootro
|
|||
|
||||
Usually, Apple unsigns old versions 3-7 days after a new version comes out, however, there are some rare cases, for example, it isn't possible for iOS 5.0.x to directly OTA to iOS 7, for iOS 6 to directly OTA to iOS 9, or for iOS 7 to directly OTA to iOS 11, so for the iPhone 4S and older revisions of the iPad 2, iOS 6.1.3 is still signed, for the iPhone 4S, iPhone 5, iPad 2, iPad 3, iPad 4, iPad mini 1, and iPod Touch 5, iOS 8.4.1 is still signed, and for the iPhone 5s, iPad Air 1, and iPad mini 2, iOS 10.3.3 is still signed. However, you can't restore directly with iTunes or Finder to downgrade, as TSS will only provide the blob for OTA. [Legacy iOS Kit] is able to grab the OTA blob and restore with it using the checkm8 exploit, however. You can also spoof your iOS version by editing a plist file when jailbroken, however this method is unreliable and usually doesn't work anymore.
|
||||
|
||||
If your device has a bootROM exploit, you can extract the blob, and then use software such as [futurerestore] to restore to that version in certain cases, but Apple being Apple, added yet another thing to make downgrading more difficut, that being SEP:
|
||||
If your device has a bootROM exploit, you can extract the blob, and then use software such as [futurerestore] to restore to that version in certain cases, but Apple being Apple, added yet another thing to make downgrading more difficult, that being SEP:
|
||||
|
||||
### SEP
|
||||
In the Apple A7 SoC, Apple introduced a coprocessor called the Secure Enclave Processor, typically shortened to SEP. It is used for data protection, touch ID and face ID, the SEP's purpose is to handle keys that are sensitive enough to require isolation from the rest of the device. The SEP's firmware is frequently updated, and the updates typically make it incompatible with older iOS versions, and the SEP has its own firmware signing process, so without a SEP exploit, you cannot downgrade to an older version without a SEP exploit, even if you have an SHSH blob and bootrom exploit. The SEP is present in all Apple devices made in 2013 or later (excluding the iPhone 5c, as the 5c uses the older Apple A6 SoC.). There are only two known SEP exploits, [blackbird], which affects the A8-A10 (2014-2016), and [hardbird], which affects the A7 (2013)
|
||||
|
|
@ -37,9 +37,9 @@ In the Apple A7 SoC, Apple introduced a coprocessor called the Secure Enclave Pr
|
|||
For devices using the Apple A9, Apple A10, or associated variants, you can use [turdus merula] to downgrade, untethered if you have SHSH blobs, otherwise a tethered downgrade. turdus merula uses the blackbird exploit. A8 is currently not supported.
|
||||
|
||||
## bootROM and iBoot exploits
|
||||
The bootROM is an SoC-level code, and the first thing that runs on an Apple device upon boot, and the code is read-only. A bootROM exploit is the Apple equivelant of a hardware-level bootloader unlock exploit. However, the attack vector is very small, and only two have been found in the last ten years.
|
||||
BootROM is SoC-level code and the first thing that runs on an Apple device upon boot, and the code is read-only. A bootROM exploit is the Apple equivalent of a hardware-level bootloader unlock exploit. However, the attack vector is very small, and only two have been found in the last ten years.
|
||||
|
||||
iBoot is Apple's bootloader. an iBoot exploit is Apple's equivelant of a software-level bootloader unlock exploit, however, since it's software level, and iBoot is usually updated in every iOS update, exploits are usually quickly patched and the last iOS version with a known iBoot exploit is 7.1.2, which released in 2014.
|
||||
iBoot is Apple's bootloader. An iBoot exploit is the Apple equivalent of a software-level bootloader unlock exploit; however, since it's software level, and iBoot is usually updated in every iOS update, exploits are usually quickly patched and the last iOS version with a known iBoot exploit is 7.1.2, which was released in 2014.
|
||||
### checkm8
|
||||
[checkm8] (CVE-2019-8900) was a bootROM exploit discovered in 2019, and from 2019 to 2026, it was the only bootROM exploit to affect 64-bit devices. It was the first major bootROM exploit discovery since 2010's limera1n. It is a very capable exploit, affecting all Apple SoCs from the A5 to the A11, meaning it affects all Apple devices made from 2011 to 2017, and also the iPad 6 (2018), iPad 7 (2019), and iPod Touch 7 (2019). The main part of the exploit also affects the A12 and A13, however the A12 patched a memory leak in DFU, which makes it impossible to actually execute the exploit, unless you leave your device in DFU mode for several months. checkm8 is used by many jailbreaks and iOS tools, including turdus merula, Legacy iOS Kit, checkra1n, palera1n, and even [Project Sandcastle], which allows you to run a very broken Android build on the iPhone 7. However, there are a number of issues with checkm8:
|
||||
- It is a tethered exploit, so once you reboot or power off your phone, you'll have to connect to your computer to re-run the exploit.
|
||||
|
|
|
|||
|
|
@ -2,13 +2,13 @@
|
|||
|
||||
- Verdict: **⛔ Avoid at all costs!**
|
||||
|
||||
Asus originally allowed you to unlock your bootloader via their website, however in November 2023, the website went down "for maintanence", Asus claimed it would come back, but it never did.
|
||||
Asus originally allowed you to unlock your bootloader via their website; however, in November 2023, the website went down "for maintenance". Asus claimed it would come back, but it never did.
|
||||
|
||||
Someone eventually found a way to unlock the bootloader on the Zenfone 9, and Asus responded, not by finally bringing the site back, but by [patching the method and introducing anti-rollback][anti-rollback].
|
||||
|
||||
Following Asus's false claims of a bootloader unlock eventually coming back, a UK customer sued Asus for a refund of their phone, [and Asus lost][lawsuit].
|
||||
|
||||
Asus claimed the bootloader unlock program would come back for two years, however in October 2025, upon someone asking when the unlock program will return, An Asus employee finally confirmed it's [not coming back], saying "Regarding the Bootloader Unlock Tool for mobile devices: ASUS phones released after January 2024 will no longer actively provide the Bootloader Unlock Tool. For models released in 2023 or earlier, we sincerely apologize for any inconvenience caused, as the Unlock Tool has been discontinued from the ASUS official website due to stability considerations. Thank you for your understanding and support."
|
||||
Asus claimed the bootloader unlock program would come back for two years; however, in October 2025, upon someone asking when the unlock program will return, an Asus employee finally confirmed it's [not coming back], saying "Regarding the Bootloader Unlock Tool for mobile devices: ASUS phones released after January 2024 will no longer actively provide the Bootloader Unlock Tool. For models released in 2023 or earlier, we sincerely apologize for any inconvenience caused, as the Unlock Tool has been discontinued from the ASUS official website due to stability considerations. Thank you for your understanding and support."
|
||||
|
||||
In 2024, an XDA user had their Zenfone 9 bricked following a borked update, Asus denied warranty and refused to replace the phone due to the bootloader being unlocked. After Asus's "RMA Revamp", Asus offered to replace the phone, but the bootloader would be relocked and would not be able to be unlocked again due to the unlock program shutdown. After the OP of the thread said it was an advertised feature and they just can't remove it, Asus offered to unlock their bootloader, but for the absolutely outrageous price of [200 USD.][200 usd unlock]. Extremely sketchy behaviour from Asus, and that is a ridiculous price just for a bootloader unlock.
|
||||
|
||||
|
|
|
|||
|
|
@ -3,14 +3,14 @@
|
|||
- Verdict: **🍅 Just terrible!**
|
||||
- Verdict: **⛔ Avoid at all costs!** (Unisoc/Spreadtrum)
|
||||
|
||||
Following Honor's split from Huawei in 2020, Honor re-introduced the unlock command in fastboot, however when you run it, it'll act like the bootloader has been unlocked, but it [won't actually unlock][fake unlock]. Possibly Honor is slowly re-adding unlocks? No one really knows. Someone in that thread also claims they managed to unlock their bootloader, so maybe bootloaders are unlockable. Best off to avoid Honor for now but things could improve in the future for them. Unisoc and Spreadtrum devices will never be unlockable, this is *not* Honor's fault, Unisoc/Spreadtrum does not allow unlocking.
|
||||
Following Honor's split from Huawei in 2020, Honor re-introduced the unlock command in fastboot; however, when you run it, it acts like the bootloader has been unlocked, but it [won't actually unlock][fake unlock]. Possibly Honor is slowly re-adding unlocks? No one really knows. Someone in that thread also claims they managed to unlock their bootloader, so maybe bootloaders are unlockable. You are best off avoiding Honor for now, but things could improve in the future for them. Unisoc and Spreadtrum devices will never be unlockable; this is *not* Honor's fault, as Unisoc/Spreadtrum does not allow unlocking.
|
||||
|
||||
Certain Kirin-based phones can use [PotatoNV].
|
||||
|
||||
## Older phones (from the Huawei EMUI era)
|
||||
Apparently you can call Honor customer service, invent a pretext that would require the device to be unlocked (like someone working in cybersecurity needing to remove google services), after being redirected to the good support team, they should be able to give you the code for your device. They might not have it and will in this case redirect you to Huawei's support team, just do the same on Huawei's end.
|
||||
|
||||
__This will not work__ for __Honor 50 devices__ as both Honor and Huawei __don't have tokens for this lineup__. It is most likely that they lost some part of their databases during the seperation of Huawei and Honor, which was happening at the time. This also will not work on Unisoc/Spreadtrum devices due to __Unisoc preventing bootloader unlocking__.
|
||||
__This will not work__ for __Honor 50 devices__ as both Honor and Huawei __don't have tokens for this lineup__. It is most likely that they lost some part of their databases during the separation of Huawei and Honor, which was happening at the time. This also will not work on Unisoc/Spreadtrum devices due to __Unisoc preventing bootloader unlocking__.
|
||||
|
||||
***
|
||||
Authored by [Ivy/Lost-Entrepreneur439](https://github.com/lost-entrepreneur439).
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ Until recently, international Samsung devices (e.g. ones sold in Europe or Asia)
|
|||
> </details>
|
||||
|
||||
The Galaxy XR, Samsung's XR headset, does NOT have an unlockable bootloader as of the December 9th, 2025 update, this was the headset's first update post-launch. Firmware prior to this date have an unlockable bootloader.
|
||||
The April 8th, 2026 update now seemingly prevents downgrading to older firmware that allows for unlocking the booloader.
|
||||
The April 8th, 2026 update now seemingly prevents downgrading to older firmware that allows for unlocking the bootloader.
|
||||
[Source](https://doc.samsungmobile.com/SM-I610/TXV/doc.html). Note the change: ``The device is protected with improved security.``
|
||||
|
||||
Snapdragon phones prior to the S7/Note7 (2016) can be unlocked regardless of region, as long as it's not locked to a carrier like AT&T or Verizon. The Canadian S7 can also be unlocked as it uses an Exynos SoC, despite Canada normally being a Snapdragon region.
|
||||
|
|
@ -142,7 +142,7 @@ If you want to unlock the bootloader, first update your phone to any firmware re
|
|||
|
||||
|
||||
## SoC level exploits
|
||||
One of the first things Samsung bootloaders do on phone bootup is check if the bootloader is unlocked, and if it is, and a bootloader unlock has not been authorized, the bootloader will automatically relock. This means SoC level exploits such as mtkclient or EDLUnlock will not work on Samsung devices, unless you reverse engineer, modify and re-flash Samsung's bootloader to stop the bootloader from re-locking (something you cannot do because Samsung always verifies their bootloaders).
|
||||
One of the first things Samsung bootloaders do on phone boot-up is check if the bootloader is unlocked, and if it is, and a bootloader unlock has not been authorized, the bootloader will automatically relock. This means SoC level exploits such as mtkclient or EDLUnlock will not work on Samsung devices, unless you reverse engineer, modify and re-flash Samsung's bootloader to stop the bootloader from re-locking (something you cannot do because Samsung always verifies their bootloaders).
|
||||
|
||||
## KnoxPatch
|
||||
|
||||
|
|
@ -155,11 +155,11 @@ Samsung's IMS service is not compatible with AOSP's, so VoLTE will not work on G
|
|||
There is an [open source VoLTE service] developed by phh, but it's incomplete and not stable.
|
||||
|
||||
## Galaxy Watch
|
||||
All Galaxy Watches that runs Wear OS(Galaxy Watch4 or newer) got a rollback prevention update in March 2026. This prevents you from downgrading to older software. There's no way to revert this change right now. So if you want to downgrade, DO NOT UPDATE.
|
||||
All Galaxy Watches that run Wear OS (Galaxy Watch4 or newer) got a rollback prevention update in March 2026. This prevents you from downgrading to older software. There's no way to revert this change right now. So if you want to downgrade, DO NOT UPDATE.
|
||||
|
||||
### Bootloader Unlock
|
||||
Unlike other Samsung devices, One UI 8 Watch brought a proper OEM Unlock and bootloader unlock. However, the device does not seem to work correctly(bootloop) after flashing custom binaries.
|
||||
Also, **LTE models has the risk of HARD BRICKING THE DEVICE.**
|
||||
Also, **LTE models have the risk of HARD BRICKING THE DEVICE.**
|
||||
There's no EDL mode or EUB mode to fix this. You have to replace the motherboard or find a way to fix it.
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ Since Sony likes to ruin a perfect thing:
|
|||
|
||||
Some carrier locked and US devices can never be unlocked. On Sony devices ([but not all?][service-menu-gone]) you can check if the bootloader is unlockable using the service menu.
|
||||
|
||||
Additonally, only Xperia (Sony's main consumer phone/tablet line) is unlockable. Their other Android devices (such as their [Bravia TVs][Bravia unlock]) are not unlockable.
|
||||
Additionally, only Xperia (Sony's main consumer phone/tablet line) is unlockable. Their other Android devices (such as their [Bravia TVs][Bravia unlock]) are not unlockable.
|
||||
|
||||
1. Dial `*#*#7378423#*#*` in the dialer.
|
||||
2. Tap "Service Info", then "Configuration", then "Rooting Status".
|
||||
|
|
@ -22,9 +22,9 @@ Additonally, only Xperia (Sony's main consumer phone/tablet line) is unlockable.
|
|||
|
||||
For devices made [before 2019][TA patch 2019], Sony devices have a partition called `TA`, which contains files needed for things such as enhanced camera image processing, DRM keys, and display enhancements. Upon unlocking the bootloader, this partition is wiped and these features are lost, even on re-locking. If running Android Marshmallow or earlier, you can [back up][TA backup] the partition.
|
||||
|
||||
Sony supports [Custom AVB](../../README.md#custom-avb-keys) Since 2020.
|
||||
Sony supports [Custom AVB](../../README.md#custom-avb-keys) since 2020.
|
||||
|
||||
You also can't unlock Japan carrier variants, for some reason - Japanese factory unlocked is unaffected.
|
||||
You also can't unlock Japanese carrier variants for some reason—Japanese factory-unlocked devices are unaffected.
|
||||
|
||||
All Sony devices using the Snapdragon 835 and Snapdragon 845 can be unlocked via the [xperable exploit][xperable].
|
||||
|
||||
|
|
|
|||
|
|
@ -13,14 +13,14 @@ Make sure to disable device encryption before unlocking the bootloader with any
|
|||
> Bootloader specification B includes Lumia 43x, 53x (except 535), 540, 550, 63x, 640, 640 XL, 650, 73x, 830, 929 Icon, 930, 950, 950 XL, 1520.
|
||||
>
|
||||
An open source tool named [WPInternals][wpinternals] allows bootloader unlocking by 2 methods depending on the bootloader specification of the device.
|
||||
- The first method for spec. A devices requires the stock firmware for the phone, [HEX loaders][hex-loaders], an [engineering SBL3 partition][eng-sbl3] and a [donor firmware file][donor-ffu]. The unlock mostly goes smooth, just follow the instructions of the tool.
|
||||
- The first method for spec. A devices requires the stock firmware for the phone, [HEX loaders][hex-loaders], an [engineering SBL3 partition][eng-sbl3] and a [donor firmware file][donor-ffu]. The unlock mostly goes smoothly, just follow the instructions of the tool.
|
||||
- The second method for spec. B devices requires the stock firmware for the phone, [the correct emergency files for the device][emergency-files] and depending on your model a [donor firmware file][donor-ffu]. The unlock method **requires** that the phone is plugged in to a USB 2.0 or earlier port (a USB 2.0 hub works just fine), or you **will** encounter a "Failed to write to pipe" error. Also the unlocked bootloader flashing may get stuck at any point, if that happens reboot by holding Vol- and Power, on the red screen open WPInternals and unlock the bootloader again, repeat that until it works. If you encounter a bootloop with gears, disconnect the phone, click Interrupt Boot Process in the Manual mode tab of WPInternals and connect it while it is on the boot logo, flash the stock firmware and try unlocking again.
|
||||
|
||||
## Lumia 535 and other OEM devices running Windows 10 Mobile
|
||||
While no full bootloader unlocking method is made, a partial unlock allowing full file system access is possible.
|
||||
You need to have Interop Tools app installed with registry access, a [guide][interop-guide] is here.
|
||||
Once you have registry access, in the Registry menu navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MTP and select the DataStore key. Press Read Data and change change the string to C:\EFIESP and write the data. Connect the phone to a computer, go to Windows\System32\Boot and rename the resetphone.efi executable to anything else and replace the executable with [developermenu.efi][devmenu] and disconnect the phone from the computer.
|
||||
Now reboot and hold down Vol-, you should see a developer menu. Scroll down to the USB Mass Storage Mode option by using Vol- and press Power, now you have full file system access. From here you can disable the OS's driver and system file integrity checks by enabling TESTSIGNING and NOINTEGRITYCHECKS on the BCD and unlock full sideloading capabilities, but its nowhere as close to a full bootloader unlock.
|
||||
Once you have registry access, in the Registry menu navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MTP and select the DataStore key. Press Read Data and change the string to C:\EFIESP and write the data. Connect the phone to a computer, go to Windows\System32\Boot and rename the resetphone.efi executable to anything else and replace the executable with [developermenu.efi][devmenu] and disconnect the phone from the computer.
|
||||
Now reboot and hold down Vol-, you should see a developer menu. Scroll down to the USB Mass Storage Mode option by using Vol- and press Power, now you have full file system access. From here you can disable the OS's driver and system file integrity checks by enabling TESTSIGNING and NOINTEGRITYCHECKS on the BCD and unlock full sideloading capabilities, but it's nowhere near as close to a full bootloader unlock.
|
||||
|
||||
## Lumia 510, 610, 610C, 710, 800, 900
|
||||
Certain Lumia 710s, 800s and 900s shipped with a Qualcomm bootloader instead of the Nokia bootloader (a way for determining is in the guide for switching 710 bootloaders). If you have a Qualcomm bootloader, your bootloader is unlocked from the factory for some reason. An unlock guide for Lumia 710s with a Nokia bootloader is available [here][lumia-wp7]. Switching the bootloader on other devices is possible with special equipment and some work. [A guide for Lumia 900][lumiawp7-blswitch] with information linking to other guides is available, but it is not specific to 900s and works on others.
|
||||
|
|
@ -29,7 +29,7 @@ Certain Lumia 710s, 800s and 900s shipped with a Qualcomm bootloader instead of
|
|||
They can be bootloader unlocked using HSPL / RSPL. There are guides for [first generation][first-gen-htc] and [second generation (except Titan II)][second-gen-htc] devices. SPL versions 4.x and 5.x are impossible to unlock, a downgrading guide is available [here][htc-downgrade-spl].
|
||||
|
||||
## Other devices
|
||||
All Windows Phone 8.x devices can be upgraded to Windows 10 Mobile unofficially, however Windows Phone 7.x devices cant. Unfortunately, there are no workarounds for other WP7.x devices.
|
||||
All Windows Phone 8.x devices can be upgraded to Windows 10 Mobile unofficially; however, Windows Phone 7.x devices can't. Unfortunately, there are no workarounds for other WP7.x devices.
|
||||
|
||||
[wpinternals]:https://github.com/ReneLergner/WPinternals
|
||||
[eng-sbl3]:https://archive.org/download/sbl-3-no-buggy-62x/SBL3_NoBuggy62x.zip
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ Devices shipping with MIUI or HyperOS require activating your phone with Xiaomi
|
|||
|
||||
After enabling Developer options, go to Settings > Additional settings > Developer options, enable OEM Unlock and go to Device Unlock Status page, and if it shows "Locked" then you can proceed pressing "Add account and device" button to initiate the process.
|
||||
|
||||
Doing these won't unlock your device immediately, but will grant you a permission to unlock in the end. So, to be able to eligible for unlocking, you will be asked to do these steps.
|
||||
Doing this won't unlock your device immediately, but will grant you permission to unlock in the end. So, to be eligible for unlocking, you will be asked to perform these steps.
|
||||
|
||||
Xiaomi will let you know what is required right now when you press "Add account and device", but to explain fully in order, it tells you to do:
|
||||
|
||||
|
|
@ -35,7 +35,7 @@ When you complete all above steps, pressing "Add account and device" button now
|
|||
|
||||
To actually *perform* the unlocking, you will need to use [Mi Unlock][miunlock] tool for Windows and follow prompts to enter fastboot mode and connect your device. If you cannot or don't want to use official tool, you can also use alternative tools such as [offici5l][offici5l]'s [MiUnlockTool][py-miunlock] made in Python.
|
||||
|
||||
The unique key is to unlock the bootloader of your device is retrieved from Xiaomi servers, but there is a server-side (thus no tool can't bypass server time) countdown that will start running only after completing all steps above. For the most cases, the countdown is 3 days (= 72 hours) for HyperOS and 7 days (= 168 hours) for MIUI, but there are some reports people being forced to wait even more, such as 14 or 30 days instead.
|
||||
The unique key to unlock the bootloader of your device is retrieved from Xiaomi servers, but there is a server-side (thus no tool can bypass server time) countdown that will start running only after completing all steps above. In most cases, the countdown is 3 days (= 72 hours) for HyperOS and 7 days (= 168 hours) for MIUI, but there are some reports of people being forced to wait even longer, such as 14 or 30 days instead.
|
||||
|
||||
You can continue using your device as usual and check with the unlock tool anytime to see how much time is left. Meanwhile, DON'T remove your Xiaomi account or factory reset your phone, doing these may result in the countdown being reset to what it was initially.
|
||||
|
||||
|
|
@ -57,12 +57,12 @@ The [requirements for the Community App][global-requirements] request are as fol
|
|||
* [As of January 1st, 2025][updated-policies], Xiaomi only let you unlock 1 device per year. This requirement has also been extended to MIUI 14.
|
||||
* Make sure to select "Global" region in Xiaomi Community app to see "Unlock bootloader" section under "Me" tab.
|
||||
|
||||
Additionally, [on XDA forums][community-app-cap] people have found that there is a cap on the amount of people (belived to be around 50 people) who can request per day inside the Community App, and it gets filled pretty much instantly, so your only chance to make a successful request there is if you get lucky spamming the request at midnight, Beijing time ([GMT+8][gmt+8]).
|
||||
Additionally, [on XDA forums][community-app-cap] people have found that there is a cap on the number of people (believed to be around 50 people) who can request per day inside the Community App, and it gets filled pretty much instantly, so your only chance to make a successful request there is if you get lucky spamming the request at midnight, Beijing time ([GMT+8][gmt+8]).
|
||||
|
||||
There is a [AQLR][aqlr] (abbreviation of "application quota limit reached") script to do that automatically, so it would send a request to Xiaomi just before entering a new day in China, and you can have your computer running that script 7/24.
|
||||
|
||||
> [!WARNING]
|
||||
> Even if it appears like you missed the today's quota, Xiaomi may report "application quota limit reached" [by a mistake even though you actually did placed in the quota][quota-error-problem]. So the only way is to be sure about that is to pressing "Add account and device" in Device Unlock Status page in Settings.
|
||||
> Even if it appears like you missed today's quota, Xiaomi may report "application quota limit reached" [by mistake even though you actually placed in the quota][quota-error-problem]. So the only way to be sure about that is by pressing "Add account and device" on the Device Unlock Status page in Settings.
|
||||
|
||||
## Workarounds & Exploits
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
Carrier locked devices are the ones you get after making a commitment with a carrier of your choice. This is quite common in North America and (supposedly) allows you to save some money on your device.
|
||||
Carrier-locked devices are the ones you get after making a commitment with a carrier of your choice. This is quite common in North America and (supposedly) allows you to save some money on your device.
|
||||
|
||||
As a rule, almost all carrier locked devices do not allow the bootloader to be unlocked. This usually makes sense, as it would allow you to completely bypass the contract. The problem is that many devices still do not allow you to unlock the bootloader even after the carrier lock has been lifted. This page is keeping track of those carriers.
|
||||
As a rule, almost all carrier-locked devices do not allow the bootloader to be unlocked. This usually makes sense, as it would allow you to completely bypass the contract. The problem is that many devices still do not allow you to unlock the bootloader even after the carrier lock has been lifted. This page keeps track of those carriers.
|
||||
|
||||
> [!NOTE]
|
||||
> This page is a WIP! If you have any details about a carrier who isn't here, please open a pull request!
|
||||
|
|
@ -19,7 +19,7 @@ Land of the free... unless you want your phone to be free. American carriers hav
|
|||
### [Spectrum](./brands/spectrum/README.md)
|
||||
|
||||
## Canada
|
||||
All devices sold in Canada after December 1, 2017 are sold unlocked, and any devices sold before then legally have to be unlocked for free, thanks to [the Wireless Code](https://crtc.gc.ca/eng/archive/2017/2017-200.htm). For devices sold before then however..
|
||||
All devices sold in Canada after December 1, 2017, are sold unlocked, and any devices sold before then legally have to be unlocked for free, thanks to [the Wireless Code](https://crtc.gc.ca/eng/archive/2017/2017-200.htm). For devices sold before then, however...
|
||||
|
||||
### [Bell/Virgin/Lucky](./brands/bell/README.md)
|
||||
|
||||
|
|
@ -28,7 +28,7 @@ All devices sold in Canada after December 1, 2017 are sold unlocked, and any dev
|
|||
### [Telus/Koodo/Public](./brands/telus/README.md)
|
||||
|
||||
## Japan
|
||||
If you buy a Sony or Sharp phone used, high chance it's going to be locked to a Japanese carrier as that's just where Sony and Sharp are popular.
|
||||
If you buy a used Sony or Sharp phone, there's a high chance it will be locked to a Japanese carrier, as that's where Sony and Sharp are popular.
|
||||
|
||||
### [NTT Docomo/b-mobile/IIJMIO/DMM](./brands/nttdocomo/README.md)
|
||||
|
||||
|
|
@ -42,4 +42,4 @@ Safe but be aware of one carrier
|
|||
### [Mobily](./brands/Mobily/README.md)
|
||||
|
||||
### [Zain](./brands/Zain/README.md)
|
||||
(Note: Zain is mostly available in the most GCC like Bahrain and Kuwait as well as STC)
|
||||
(Note: Zain is available in most GCC countries like Bahrain and Kuwait, as is STC.)
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
- Verdict: **⛔ Avoid!**
|
||||
|
||||
AT&T does not allow you to unlock your bootloader until your phone is network unlocked, and AT&T has a history of refusing to network unlock phones for zero reason. However, some recent posts on XDA have claimed the AT&T Pixel 9's bootloader can be unlocked if you set up the phone [without an AT&T SIM inserted](https://xdaforums.com/t/at-t-pixel-9-pro-xl-bootloader-unlockable.4689083/). AT&T also has an artifical blacklist, meaning you are limited only to the devices they officially support. You're best off avoiding AT&T.
|
||||
AT&T does not allow you to unlock your bootloader until your phone is network unlocked, and AT&T has a history of refusing to network unlock phones for zero reason. However, some recent posts on XDA have claimed the AT&T Pixel 9's bootloader can be unlocked if you set up the phone [without an AT&T SIM inserted](https://xdaforums.com/t/at-t-pixel-9-pro-xl-bootloader-unlockable.4689083/). AT&T also has an artificial blacklist, meaning you are limited only to the devices they officially support. You're best off avoiding AT&T.
|
||||
|
||||
Additionally, AT&T subsidiary Cricket has recently begun [blocking developer options] on certain Motorola devices. This makes you unable to use ADB or Shizuku.
|
||||
***
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
* Verdict **ℹ️ "Safe for now" :trollface:**
|
||||
|
||||
In general, T-Mobile generally lets you unlock your bootloader, even if your phone is still carrier locked, likely related to the fact T-Mobile has always supported Android (they were the first carrier in the world to sell an Android device), way back in 2011, T-Mobile said on Twitter that CyanogenMod (a very popular custom ROM, now known as LineageOS) was great, and they were excited to see what Cyanogen would do [for T-Mobile's new phone](https://x.com/TMobile/status/60111542494048256). T-Mobile has also seemingly forced certain manufacturers to not require a bootloader unlock token on T-Mobile versions, as phones like the LG G6 (normally only unlockable by flashing a leaked engineering bootloader), are unlockable via the [standard unlock procedure](../../../misc/generic-unlock.md) for T-Mobile models. T-Mobile models also have most fastboot commands removed on LG devices.
|
||||
Do note that this does *not* account for phones made by T-Mobile, these phones have a number of different OEMs, usually Wingtech for newer models, and [HTC](../../../brands/htc/README.md) for older models, however they've been made by a varity of different OEMs, including [TCL](../../../brands/tcl/README.md), [Samsung](../../../brands/samsung/README.md), [Sharp](../../../brands/sharp/README.md), Danger, [LG](../../../brands/lg/README.md) and [Huawei](../../../brands/huawei/README.md).
|
||||
In general, T-Mobile lets you unlock your bootloader, even if your phone is still carrier-locked, likely related to the fact that T-Mobile has always supported Android (they were the first carrier in the world to sell an Android device). Way back in 2011, T-Mobile said on Twitter that CyanogenMod (a very popular custom ROM, now known as LineageOS) was great, and they were excited to see what Cyanogen would do [for T-Mobile's new phone](https://x.com/TMobile/status/60111542494048256). T-Mobile has also seemingly forced certain manufacturers not to require a bootloader unlock token on T-Mobile versions, as phones like the LG G6 (normally only unlockable by flashing a leaked engineering bootloader) are unlockable via the [standard unlock procedure](../../../misc/generic-unlock.md) for T-Mobile models. T-Mobile models also have most fastboot commands removed on LG devices.
|
||||
Do note that this does *not* account for phones made by T-Mobile. These phones have a number of different OEMs, usually Wingtech for newer models and [HTC](../../../brands/htc/README.md) for older models; however, they've been made by a variety of different OEMs, including [TCL](../../../brands/tcl/README.md), [Samsung](../../../brands/samsung/README.md), [Sharp](../../../brands/sharp/README.md), Danger, [LG](../../../brands/lg/README.md), and [Huawei](../../../brands/huawei/README.md).
|
||||
***
|
||||
Authored by [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439).<br/>
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ The standard unlocking process is to enable **OEM unlocking** from the developer
|
|||
|
||||
## Getting Ready
|
||||
|
||||
To unlock you phone, you have to download SDK Platform Tools.
|
||||
To unlock your phone, you have to download SDK Platform Tools.
|
||||
|
||||
Go to [developer.android.com](https://developer.android.com/tools/releases/platform-tools#downloads) and download the package for your OS (most likely Windows) and extract the archive where appropriate.
|
||||
On Linux it may be better to use your distro's package manager, although the package may be quite old.
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
> [!CAUTION]
|
||||
> Read in full before you act!
|
||||
|
||||
The standard unlocking process for Samsung is to enable OEM Unlocking, then go to the "Warning!" screen and hold down a button to unlock the bootloader. On older devices (prior to 2019), all you have to do is enable OEM unlocking, and your bootloader is unlocked, no data wipe is required on pre 2017 devices.
|
||||
The standard unlocking process for Samsung is to enable OEM Unlocking, then go to the "Warning!" screen and hold down a button to unlock the bootloader. On older devices (prior to 2019), all you have to do is enable OEM unlocking, and your bootloader is unlocked; no data wipe is required on pre-2017 devices.
|
||||
|
||||
## Requirements
|
||||
|
||||
|
|
@ -32,15 +32,15 @@ now tap the button several times until a confirmation toast/prompt appears.
|
|||
Now you can search for Developer options and from there enable OEM Unlocking.
|
||||
|
||||
## Download mode
|
||||
Power off your phone. The next procedure will depend on what buttons you device has
|
||||
- Devices with home button: Hold Power+Volume Down+Home until phone goes to the Warning screen
|
||||
- Devices with Bixby button: Hold Power+Volume Down+Bixby until phone goes to the Warning screen.
|
||||
- Devices with neither buttons: Hold down Volume Down+Volume Up, connect phone to computer, continue holding buttons until you see the Warning screen.
|
||||
Power off your phone. The next procedure will depend on what buttons your device has:
|
||||
- Devices with a home button: Hold Power + Volume Down + Home until the phone goes to the Warning screen.
|
||||
- Devices with a Bixby button: Hold Power + Volume Down + Bixby until the phone goes to the Warning screen.
|
||||
- Devices with neither button: Hold down Volume Down + Volume Up, connect the phone to a computer, and continue holding buttons until you see the Warning screen.
|
||||
|
||||
The next step will depend on what your device's warning screen looks like.
|
||||
|
||||
|
||||
If it's variation 1 or 2, your bootloader is already unlocked. If you have variation 3, hold down volume up until it asks if you'd like to unlock the bootloader, then press volume up again to wipe data and unlock bootloader.
|
||||
If it's variation 1 or 2, your bootloader is already unlocked. If you have variation 3, hold down volume up until it asks if you'd like to unlock the bootloader, then press volume up again to wipe data and unlock the bootloader.
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
|
|
|||
14
ru/README.md
14
ru/README.md
|
|
@ -30,7 +30,7 @@
|
|||
# Список:
|
||||
|
||||
> [!CAUTION]
|
||||
> Не забывайте, что какой бы милой компания не была, <br/>
|
||||
> Не забывайте, что какой бы милой компания ни была, <br/>
|
||||
> вы не должны доверять ей, <br/>
|
||||
> если процесс разблокировки нельзя провести на 100% в режиме офлайн!
|
||||
|
||||
|
|
@ -107,7 +107,7 @@
|
|||
|
||||
## ⚠️ Действуйте осторожно!
|
||||
|
||||
Следующие производители требуют подключение к интернету и/или период ожидания перед разблокировкой.
|
||||
Следующие производители требуют подключения к интернету и/или периода ожидания перед разблокировкой.
|
||||
|
||||
### [Fairphone](brands/fairphone/README.md)
|
||||
|
||||
|
|
@ -161,13 +161,13 @@
|
|||
|
||||
### Kirin
|
||||
Kirin 620, 650, 655, 658, 659, 925, 935, 950, 960:<br/>
|
||||
Возможно разблокировать используя тестпоинты и [PotatoNV](https://github.com/mashed-potatoes/PotatoNV) (прочтите readme).
|
||||
Возможно разблокировать, используя тестпоинты и [PotatoNV](https://github.com/mashed-potatoes/PotatoNV) (прочтите README).
|
||||
|
||||
### MediaTek
|
||||
Если у вас устройство на MediaTek, пригодное к использованию эксплойта [mtkclient](https://github.com/bkerler/mtkclient), вы можете использовать его для разблокировки загрузчика.<br/>
|
||||
Если же речь идёт об устройстве OPPO/Realme и вам нужно так же получить доступ к fastboot: [lkpatcher](https://github.com/R0rt1z2/lkpatcher) ([веб-версия](https://lkpatcher.r0rt1z2.com/)).
|
||||
Если же речь идёт об устройстве OPPO/Realme и вам нужно также получить доступ к fastboot: [lkpatcher](https://github.com/R0rt1z2/lkpatcher) ([веб-версия](https://lkpatcher.r0rt1z2.com/)).
|
||||
|
||||
Если разблокировка загрузчика не работает на устройстве Oppo Mediatek с использованием модификации SECCFG (разблокировка через mtkclient), вы можете попробовать разблокировать fastboot, записав модифицированный boot1 (preloader). Запись preloader также использует mtckclient: [oppo-mtk-fastboot-unlock](https://github.com/Shocked-Cat/oppo-mtk-fastboot-unlock).
|
||||
Если разблокировка загрузчика не работает на устройстве Oppo Mediatek с использованием модификации SECCFG (разблокировка через mtkclient), вы можете попробовать разблокировать fastboot, записав модифицированный boot1 (preloader). Запись preloader также использует mtkclient: [oppo-mtk-fastboot-unlock](https://github.com/Shocked-Cat/oppo-mtk-fastboot-unlock).
|
||||
|
||||
### Qualcomm
|
||||
|
||||
|
|
@ -177,7 +177,7 @@ Kirin 620, 650, 655, 658, 659, 925, 935, 950, 960:<br/>
|
|||
|
||||
На чипах Snapdragon 8E5/8E Qualcomm представила [уязвимость (CN)](https://www.cnblogs.com/sakrain/p/-/unlock-your-qualcomm) ([POC](https://github.com/kasnria001/qualcomm_gbl_exploit_poc)), при которой процесс загрузки не выполнял проверку подписи для Generic Bootloader, поэтому при наличии доступа на запись к разделу `efisp` было возможно выполнение произвольного кода.
|
||||
|
||||
Хотя сама уязвимость является универсальной для платформы, для получения root-доступа и записи GBL требуются устройства/ OEM-специфические трюки. Некоторые из них существуют для [устройств Xiaomi](../brands/xiaomi/README.md#snapdragon-8-elite8gen38gen28gen1).
|
||||
Хотя сама уязвимость является универсальной для платформы, для получения root-доступа и записи GBL требуются устройство-/OEM-специфические трюки. Некоторые из них существуют для [устройств Xiaomi](../brands/xiaomi/README.md#snapdragon-8-elite8gen38gen28gen1).
|
||||
|
||||
#### Другие
|
||||
|
||||
|
|
@ -185,7 +185,7 @@ Kirin 620, 650, 655, 658, 659, 925, 935, 950, 960:<br/>
|
|||
[alephsecurity.com](https://alephsecurity.com/2018/01/22/qualcomm-edl-2/) — секция разблокировки загрузчика.
|
||||
|
||||
### Unisoc
|
||||
Если у вас телефон с чипсетами Unisoc UMS9620 или старше, вы можете использовать [эту уязвимость](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) для получения постоянного обхода защищённой загрузки и разблокировки загрузчика. Это работает на всех устройствах, кроме некоторых с [модифицированным uboot](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/patch_do_cboot%E2%80%90SPL#part-2-modify-fdl2ubootlk), которые требуют [этот](https://github.com/TomKing062/unisoc_chipram_signcheck_exploit), [этот](https://github.com/YC-nw/bsp_sign_fxxker) или [этот](https://github.com/kasnria001/unisoc_secure_boot_bypass) эксплойт. Все три последних ссылки используют один и тот же метод, но реализованы разными людьми с возможными различиями. Кроме того, помимо разблокировки загрузчика, с помощью этого метода можно полностью отключить dm-verity, пропатчев раздел trustos, что позволит загружать неподписанные разделы.
|
||||
Если у вас телефон с чипсетами Unisoc UMS9620 или старше, вы можете использовать [эту уязвимость](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader) для получения постоянного обхода защищённой загрузки и разблокировки загрузчика. Это работает на всех устройствах, кроме некоторых с [модифицированным uboot](https://github.com/TomKing062/CVE-2022-38694_unlock_bootloader/wiki/patch_do_cboot%E2%80%90SPL#part-2-modify-fdl2ubootlk), которые требуют [этот](https://github.com/TomKing062/unisoc_chipram_signcheck_exploit), [этот](https://github.com/YC-nw/bsp_sign_fxxker) или [этот](https://github.com/kasnria001/unisoc_secure_boot_bypass) эксплойт. Все три последних ссылки используют один и тот же метод, но реализованы разными людьми с возможными различиями. Кроме того, помимо разблокировки загрузчика, с помощью этого метода можно полностью отключить dm-verity, пропатчив раздел trustos, что позволит загружать неподписанные разделы.
|
||||
|
||||
Для телефонов с Unisoc UMS312, UMS512, UD710 вы можете использовать [этот](https://github.com/TomKing062/CVE-2022-38691_38692) эксплойт для получения постоянного обхода защищённой загрузки, что означает, что все прошивки, включая splloader и uboot, могут быть модифицированы и переподписаны.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue