[Q] Lock screen PIN lost on 4.2.2 - How can I bypass this?

papinist · Feb 17, 2013

Hi guys, I need help!
My friend set the Lock screen PIN but now it is not recognised anymore.. maybe he set it wrong, or he forgot the correct numbers. Anyway, now the phone is stuck at the pin request and we can't do anything.

Situation: Galaxy Nexus on 4.2.2 stock with stock recovery - Unlocked bootloader, root permission, wifi on and connected.

these are the procedures I tried:

- first of all, inserting wrong pin 5 times should give a message to access with google accounts, but we have no message... perhaps this is only for locking screen with sequence.

- adb commands: requires usb debug on, and luckily we have it on. However, 4.2.2 introduces whitelist for usb debug connections (read of it on androidpolice): when connecting to a pc in usb debug mode, phone asks you confirmation. Since we can't get past the lock screen, we can't confirm that and adb finds the device 'offline'.

- install "screen lock bypass" from web play store: phone is connected to wifi, installing an app from web play store will send it to the phone and install it. Then, connecting phone to a charger would pop up a request to unlock it. Unfortunately that app is only compatible with android version from 2.2 to 4.0. Even if I download that .apk to trying manual installation, I can't push it with "adb install package.apk" since adb won't work (see previous procedure)

- flashing from recovery a modified update.zip that will overwrite lockscreen settings: simply put that modified update.zip into sdcard and flash it from recovery. But our nexus has not a removable sdcard, and connecting to pc won't show files because it is pin protected (very smart, android!). Moreover, it requires cwm or twrp recovery and I don't have that installed.

A real mess, right?
Is there anything else I could try? I really want to save his data..

iLeopard · Feb 18, 2013

Perhaps boot into fast boot, flash cwm or twrp via adb. ADB should work there. Then flash your update.zip or another ROM

papinist · Feb 18, 2013

iLeopard said:
Perhaps boot into fast boot, flash cwm or twrp via adb. ADB should work there. Then flash your update.zip or another ROM

thanks fro your instant reply!
If adb should work in fastboot mode, then I could send commands to blank password.
I found these commands:
adb shell
sqlite3 /data/data/com.android.providers.setting*s/databases/settings.db
update secure set value=65536 where name='lockscreen.password_type';
.exit
exit
adb reboot

do you think it should work?

Procedure with modified update.zip is here: http://www.garage4hackers.com/f54/r...ng-flashable-zip-tested-gingerbread-2630.html

another interesting procedure could be this? http://blog.thisisfeifan.com/2012/05/screen-unlock-apk-coming.html

I am not an expert, hope I can save that phone!

iLeopard · Feb 18, 2013

Hah NP, thank tapatalk for the updates.

As far as those methods go, I'm not entirely sure any will work as I have no experience with them. Is there data you wish to preserve?

papinist · Feb 18, 2013

iLeopard said:
Hah NP, thank tapatalk for the updates.

As far as those methods go, I'm not entirely sure any will work as I have no experience with them. Is there data you wish to preserve?

tried fastboot mode, but ADB won't see the device :-/

Yes my friend has a lot of data in it.. damn!

iLeopard · Feb 18, 2013

Install fast boot drivers, just stock drivers from Samsung. I've also heard PDAnet is a workaround for drivers.

Are we talking application data or personal data?

bodh · Feb 18, 2013

I found something similar to your sqlite code, http://null-byte.wonderhowto.com/ho...ss-android-pattern-lock-screen-0138807/...But i do not believe it would work with the newest adb rsa verification.

I'd think you need to flash a new factory image.
http://xdaforums.com/showthread.php?t=1626895, fastboot flash all except userdata.img
But maybe even that would not wipe the lockscreen.

If you get drivers working, you might be able to try and dd the proper partition to pc hard disk before wiping, but you'd have to research the specifics.

papinist · Feb 18, 2013

I finally manage to install the fastboot drivers and now fastboot recognises the phone. Obviously if fastboot works, adb does not work, so I can't use the commands I found.
An androidpolice user suggest me to flash a previous 4.2.1 image, wiping regular and dalvik cache, without flas the userdata.img. It will be unstable but stable enough to do some backup..

EDIT: I am now able to get into stock recovery, here I see something like "install from adb", so maybe I could send the modified update.zip?
Would it works?
It has this data inside:
ui_print("Mounting System");
ui_print("Mounting Data");
run_program("/sbin/busybox", "mount", "/system");
run_program("/sbin/busybox", "mount", "/data");
ui_print("Deleting Pattern/ PIN Lock Keys");
delete("/data/system/gesture.key");
delete("/data/system/password.key");
ui_print("Unmounting System");
ui_print("Unmounting Data");
run_program("/sbin/busybox", "umount", "/system");
run_program("/sbin/busybox", "umount", "/data");
ui_print("Done

");

Could I mess all up?

EDIT#2: the update.zip method does not work, the file load but phone says "installation aborted"

Herman76 · Feb 18, 2013

papinist said:
I finally manage to install the fastboot drivers and now fastboot recognises the phone. Obviously if fastboot works, adb does not work, so I can't use the commands I found.
An androidpolice user suggest me to flash a previous 4.2.1 image, wiping regular and dalvik cache, without flas the userdata.img. It will be unstable but stable enough to do some backup..

EDIT: I am now able to get into stock recovery, here I see something like "install from adb", so maybe I could send the modified update.zip?
Would it works?
It has this data inside:
ui_print("Mounting System");
ui_print("Mounting Data");
run_program("/sbin/busybox", "mount", "/system");
run_program("/sbin/busybox", "mount", "/data");
ui_print("Deleting Pattern/ PIN Lock Keys");
delete("/data/system/gesture.key");
delete("/data/system/password.key");
ui_print("Unmounting System");
ui_print("Unmounting Data");
run_program("/sbin/busybox", "umount", "/system");
run_program("/sbin/busybox", "umount", "/data");
ui_print("Done ");

Could I mess all up?

EDIT#2: the update.zip method does not work, the file load but phone says "installation aborted"

Did you activate lockscreen PIN or SIM card PIN. If SIM card ping, you need the PUK code provided by your operator to unlock that.

Anyway, just a thought.

papinist · Feb 18, 2013

Herman76 said:
Did you activate lockscreen PIN or SIM card PIN. If SIM card ping, you need the PUK code provided by your operator to unlock that.

Anyway, just a thought.

no Herman, it's the screen lock pin. I was able to flash the twrp recovery from fastboot, backup data partition, factory reset (phone boots normally without asking for a pin!), but after restoring data partition, pin request come back :-/

bodh · Feb 18, 2013

Is adb working with the 4.2.1 image? You can boot to custom recovery to gain adb access, then those adb commands should work..
Perhaps that .zip doesn't work bc you don't have busybox utilities. In fact, you may have to adb push sqlite to system/bin first with proper permissions and ownership. So push, remount, shell, mv, chmod, chown, exit, then try the code to remove it.

papinist · Feb 18, 2013

I tried with 'terminal' in twrp, but after the first command I get an error: sqlite3 not found (or similar)

papinist · Feb 18, 2013

SOLVED!!!
As always, it was so simple that I can't see it at first.
I used info from the update.zip method: it automates deletion of two files, gesture.key and password.key.
I simply navigate through /data/system with twrp file explorer and delete password.key.
Reboot and done!!

Thanks to all who help me, guys you are great!

EDIT:
I'll report here the small guide I wrote just in case someone had the same problem.

REMOVING PIN/PASSWORD/GESTURE SCREEN LOCK

- start in fastboot
- use galaxy nexus toolkit to boot twrp recovery without permanently flash it (option 10)
(if for some reason you can't do that, simply flash twrp recovery with fastboot commands)
- in twrp, use file explorer and navigate to /data/system and delete password.key and/or gesture.key
- reboot.

that's all!

bodh · Feb 18, 2013

I might have to give the twrp a try! This is the first i've heard that it includes a file explorer. Btw, what the toolkit is doing you could've done yourself: "fastboot boot twrp*.img" Glad you got it though, and maybe this'll help others.

papinist · Feb 18, 2013

I used the toolkit because I didn't know that command "fastboot boot"

jpinsl · Apr 5, 2013

papinist said:
SOLVED!!!
As always, it was so simple that I can't see it at first.
I used info from the update.zip method: it automates deletion of two files, gesture.key and password.key.
I simply navigate through /data/system with twrp file explorer and delete password.key.
Reboot and done!!

Thanks to all who help me, guys you are great!

EDIT:
I'll report here the small guide I wrote just in case someone had the same problem.

REMOVING PIN/PASSWORD/GESTURE SCREEN LOCK

- start in fastboot
- use galaxy nexus toolkit to boot twrp recovery without permanently flash it (option 10)
(if for some reason you can't do that, simply flash twrp recovery with fastboot commands)
- in twrp, use file explorer and navigate to /data/system and delete password.key and/or gesture.key
- reboot.

that's all!

Thanks for the tip. Somehow, my PIN was corrupted, and all I did was reboot to recovery, run AROMA File Manager (available here)

and deleted /data/system/password.key.

Back in business in under 5 minutes!

papinist · Apr 5, 2013

I'm glad you solved! And great tip the use of Aroma file manager (the link you posted doesn't work.. available here)

jpinsl · Apr 16, 2013

You've already found a solution, but for anyone searching this thread:

A random reboot scrambled my unlock PIN and I was locked out of the phone.

USB Debug was disabled so ADB would not work.

I was considering fastboot or ODIN as a bypass, then realized that because I had previously installed
Aroma File Manager from
http://xdaforums.com/show....php?t=1646108

I rebooted to recovery,
ran Aroma,
navigated to /data/system and
deleted the files password.key and/or gesture.key
reboot

Note that this also represents a security hole in that someone could use it to break into your phone. Use at your own risk.

If you don't have Aroma installed already, you can side-load it as a ZIP, then load it in recovery to have a working file manager whilst in recovery mode.

Simple and useful.

fredsky2 · Aug 12, 2013

i did the whole "adb shell rm /data/system/gesture.key". Now i cant use the pattern lock anymore (i did reformated the phone after that but still no luck)
is that gesture.key anywhere to be found? (anywhere on the rom.zip i flashed or literally anywhere else?)

[Q] Lock screen PIN lost on 4.2.2 - How can I bypass this?

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Similar threads

Top Liked Posts