[GUIDE]Unlocking Bootloader + Magisk Root for Huawei Mate 20 Pro

[Newbie at this]

No BL Unlock? Bye bye Huawei!

I upgraded to the Mate20 Pro 20 months ago, from a Samsung S7 Edge *still a capable device and naturally has been rooted and a custom ROM now as a backup phone* .

Huawei's decision to apparently permanently lock the devices BL so it can't be rooted or custom ROM'd etc, really has 100% decided that I will never own one of their devices again. Quite a shame really as shortly after I got the Mate20 Pro I actually got to really like & enjoy using it, and said then "next upgrade will be another Huawei"!

A strange and possibly questionable decision to treat buyers & owners of Huawei devices by locking to their own firmware only. Sure I can imagine a large number of people don't mind and just use their chosen phone as purchased, and there is certainly nothing wrong with that at all.

But it does feel insulting and a slap in the face if you wanted to modify it at some point, we pay good money to buy new devices after all. Bye bye HUAWEI!

 

[K14_Deploy]

Is there hope?

Has anyone tried fastboot oem unlock-go on this? What it should do is immediately unlock bootloader.

It's a method borrowed from a Lenovo device, but it seems that nobody had tried it here. I would try it, but I really can't afford to lose the data on what is a daily driver phone. I already lost the data on a Lenovo tablet because I expected there to be a confirmation message or SOMETHING of a safety net. If it does work, let us know and I shall try it as soon as I switch to OnePlus. Then maybe we can finally get android dev rolling on this thing...

Other than that, is there something we can exploit in Huawei's DLOAD system in the same way we exploited Samsung's ODIN system?

Sidenote: I am not a developer, nor do I claim to be. I just use custom ROMs. I can probably make a ROM build, but it would take time. This isn't my area of expertise at all sadly.

 

[dimon222]

@K14_Deploy
What do you mean? Doesn't first post already include instruction on running "fastboot oem unlock"?

 

[K14_Deploy]

It's not the same command. It acts very differently. The -go makes it a valid command on the Lenovo, so it may work as well here.

I believe that getting in is the hard part. The rest is sure to be a cakewalk. I was just giving ideas of how we might be able to get in. Does Huawei supply the source code for DLOAD?

Thanks for replying by the way.

 

[dimon222]

@K14_Deploy
No, this command is OEM specific and doesn't exist on Huawei's fastboot listing. Our device simply doesn't have it. In EMUI 9 and earlier Huawei had only "fastboot oem unlock UNLOCK CODE" command. Beginning with EMUI 10 Huawei completely flushed away this command from fastboot, and on top of it, locked automatically bootloader back for whoever had it unlocked. There's no way to bypass it even for people who were able to get bootloader unlock code previously. Also, you can't dump DLOAD without root, but to get root you need to get unlocked bootloader. Chicken and egg.

Tl;Dr best we could try is Project Treble with worse stability, but I'm not risking to brick this device honestly

 

[K14_Deploy]

There has to be a way. Pretty sure there's laws involved here. I know for a fact that providing kernel code (or something) isr required by law.

DLOAD works by plugging the drive in and turning the device on. It doesn't care about root or bootloader. Very similar to ODIN in this regard, but it's self contained. If we could make a DLOAD file that replaced the recovery (we know it's possible, since recovery is updated through OTA in many cases) with TWRP or OrangeFox then we have a way in. Samsung doesn't allow unlocks either, but we wrote TWRP with the ODIN tool, so it's not even necessary. DLOAD is designed for flashing a carrier specific ROM. What would it take to replace that with LAOS? The only downside of DLOAD is that it wipes the entire storage, which makes loading a a ROM more complex.

You need an unlocked bootloader to load a GSI. And even then, it's not Qualcomm based so good luck. Honestly, it's useless to me if I can't put a ROM on it after I upgrade so bricking it doesn't really affect me that much.

Still, there must be something. I run 10.1 and have an OEM unlock switch in my OS. Maybe it's a specific command that nobody knows. I shall mess with it when I get a OnePlus.

Maybe I shall inquire about DLOAD on the Huawei subreddit. Doubt they will listen, but they might offer advice.

 

[dimon222]

@K14_Deploy
For sure you could give it a try, tho, they don't read Reddit. Their crew is sitting in Huawei official forums and they occasionally respond to any communication there and on twitter with wording "It's not safe to unlock bootloader for end user, so beginning few years ago we no longer allow to do that". It's really a dead end.

They do have their variant of ODIN, the Huawei Flash Tool (you can find it in nearby threads about flashing official firmwares with locked bootloader), but it requires to boot in Huawei download mode, which does signature verification of firmware archive to ensure that it's verified Huawei official firmware (similar to vbmeta of Samsung, but with no public way to override). There's no modified variant of this "download mode" subsystem and no public method to impact on it. Before running actual flashing of firmware, it will first flash the stock recovery that is embedded to this dload zip by huawei, then apply factory reset, and flash the verified firmware after. During all this process you can't preserve root or anything (factory reset is important part of process). On top of it, when jumping from EMUI 9.1 to EMUI 10 new bootloader gets flashed without unlock command available with factory reset of unlock status.

To make stuff even more complicated, they added headache in new filesystem EROFS in EMUI 9.1 which made whole development community to just ditch away Huawei, rather than rewrite whole stack of software that does repacking of firmware in classic ext4. But it's less related to topic.

What you want to know - it's complicated, and in most of cases efforts not worth it. At this rate it might cheaper (time-wise) to just buy new phone from another brand that has a different vision on custom ROMs. Pixel, OnePlus, Xiaomi, etc

 

[K14_Deploy]

@dimon222
I shall try the environmental argument. Let's see how they like that.

Probably been tried before, but maybe it can be tried again.

Locking down DLOAD to their firmware isn't a good sign. Breaking companies encryption isn't something we tend to do on here. File system they're using isn't really here or there, we can probably change or ourselves. Either in whatever recovery or with an SPI flasher.

I have other devices with include an already modded LG G5. I just want to be able to run lineageos on here. And unfortunately that doesn't seem like it's going to be possible. Maybe we can pester Huawei for the source code like we did Lenovo for the Tab 4 series.

 

[blackspp]

There has to be a way. Pretty sure there's laws involved here. I know for a fact that providing kernel code (or something) isr required by law.

Kernel code or something? So you don't know for a fact.

BTW, which law, in which country are you referring to?

 

[K14_Deploy]

I was referring to source code. There was a manure storm on the Lenovo forums that I can no longer find about how Lenovo took forever to publish it, even though it was said (might have been USA so it probably doesn't help this device) that they were legally bound to do so. They did eventually, but 6 months after it came out.

The lack of USA presence probably means Huawei is not subject to this rule. Source code includes kernel code and is how custom ROMs can be built for Android devices. At least this is my understanding.

Or they might have released the source code and made it basically impossible to use because of non unlockable bootloader, I cannot say. What I can say is I am willing to push Huawei for a solution.

 

[Shadabd.k]

Plz halp me

 

[flyl0]

Plz halp me

Don't expect any help with just a plz help me lol
We can't guess what help you need.

 

[donkeyman1234]

There is still a hope, I finally got my mate 20 pro unlocked. Rooted as well.

 

[temijun]

I have an unlocked bootloader L29 running 9.1.0.301.
I followed the instructions got everything flashed. But everytime I boot into recovery mode it shows me an erecovery with a bunch of options, I'm not sure how to continue from a normal boot with magisk loaded.

 

[mutahharbashir]

I have an unlocked bootloader L29 running 9.1.0.301.
I followed the instructions got everything flashed. But everytime I boot into recovery mode it shows me an erecovery with a bunch of options, I'm not sure how to continue from a normal boot with magisk loaded.

Disconnect phone from computer before starting phone

 

[flyl0]

There is still a hope, I finally got my mate 20 pro unlocked. Rooted as well.

this phone is no longer of interest to developers, and we cannot root Android 10 and 11 so there is no hope for custom roms development

 

[donkeyman1234]

this phone is no longer of interest to developers, and we cannot root Android 10 and 11 so there is no hope for custom roms development

Too bad we cannot root 10 and 11, my last huawei phone.

 

[flyl0]

Too bad we cannot root 10 and 11, my last huawei phone.

My last one too sadly

 

[yjjmpl]

Why can't I see anything?

 

[jawadshaalan]

I read through quite a few post here to get everything sorted out and in order to save every one some time here is a summary of all the info I have gathered so far, and my way to thank the forum for offering me so many helpful tips. I'll try to keep this thread updated as information comes in.

All credit goes to their respective owners, I am only aggregating all the information here.

Current status on BL Unlock:

China version: OEM unlock not greyed out, direct BL unlock possible
EU/NA version (L09/L29/L0C): OEM unlock greyed out in developer options, BL unlock possible via FunkyHuawei method by upgrading to .170.
UPDATE 2019/01/02: Some users reported they have already received the .171 update from carrier (https://xdaforums.com/showpost.php?p=78571337&postcount=6), if that is the case you can skip the FH Method part and go directly to unlock BL.

Note: Currently .170 is not GooglePay certified, so Google Pay won't work on this, if you must have Google pay please wait for your carrier to update to some version that support OEM unlock (tap build number 7x to get Developer Options in Settings -> System -> About Phone and then go to Settings -> System -> Developer Options and see if Enable OEM Unlock option is enabled).

Also current recovery install requires you to boot into recovery (Power and volume up with phone disconnected from USB) every single time if you want root, which is not perfect.

The only time you'd be required to wipe your phone is right after your BL is unlocked with fastboot OEM unlock, please make sure you have a backup before doing that step.

Where to get unlock code?
In order to get BL unlocked, you need both allow OEM unlock option NOT greyed out (i.e., you can enable it) AND a BL unlock code. BL unlock code can only be purchased either from FunkyHuawei (55 USD one time for BL unlock code only or if you buy an unlimited pass 132USD for unlimited flashing + BL unlock code (note that it is locked to your phone and can not be transferred)), or MinistryOfSolutions (30 Euro, https://ministryofsolutions.com/huawei-bootloader-unlock-service-all-new-models-new-firmwares, BL unlock code only).

FunkyHuawei Method (for non-China version)
1. Create an account in https://funkyhuawei.club/membersarea, buy 1 credit (if you just want to download .170 firmware, each credit cost 18USD).
2. Go to Select Firmware tab, use LYA-Global if you don't see the exact model. Then select .171 version.
3. Follow instructions here: https://pastebin.com/raw/Db5ZSyqu, you must download the specific HiSuite version (9.0.2.301）and the specific installer executable. Run the executable FHHiSuiteInstaller.exe as administrator (right-click and choose Run As Administrator) <- must run as admin since it will need to modify your host file. Make sure the script runs without error.
3.1 (Additional step for L0C): Edit the c:\users\YOURHOMEFOLDER\appdata\local\hisuite\userdata\updatedogdev\hisuiteconfig.xml file and change LYA-L29 to LYA-L0C everywhere it occurs and save the file. (Thanks to FunkyHuawei Support for pointing this one out).
4. Put the phone into fastboot mode (adb reboot-bootloader or with the phone off connect the usb cable while holding volume down, or boot the phone holding volume down with USB cable connected to PC).
5. Go to HiSuite on your PC and click on System Recovery (furthest to the right towards the bottom of the main screen), and let it do the magic. You will see some cmd windows pop up however it should get to the download progress with a percentage pretty fast, if you don't see that pop up then please check to make sure you have at least one credit in the FH Select Firmware tab and you have installed the specific versions of HiSuite and ran the installer as admin in Step 3.
6. Once everything is completed please verify to see if your firmware version is .171.

Unlock Bootloader
Again, get the BL code and go to Settings -> System -> Developer Options and make sure Enable OEM Unlock option is enabled. Also check to make sure you have everything backed up. Also enable USB Debugging in the same screen as well.
Rest is pretty standard:

adb devices (will bring up the authorization window on your phone, click on Always Trust)
adb reboot-bootloader
fastboot devices (make sure the device is in fastboot mode)
fastboot oem unlock *UNLOCK CODE*

at this point there will be a format operation performed on the phone, if it didn't complete successfully don't worry, your phone is wiped. During the boot you should see a black window with yellow text of warnings to tell you your phone is unlocked and not secured.

Go through all the steps to initialize the phone, turn on Developer options again, and enable USB Debugging again.

Root

1. Download and install Magisk Manager from this XDA post: https://xdaforums.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
2. Switch channel, go to Magisk Manager -> Settings -> Update Channel , set it to Custom, and the URL is https://bit.ly/2N8UVlq (at the moment, per https://xdaforums.com/apps/magisk/dev-magisk-canary-channel-bleeding-edge-t3839337). Go back to main screen and down swipe to refresh, it should say Latest Version > v18.0.
3. You will need to find the stock RECOVERY_RAMDIS.img file, I used HW Firmware Finder (https://xdaforums.com/tools/general/huawei-firmware-finder-team-mt-t3469146) to help me with the task, however I couldn't find the L0C update file and ended up using L09 update file instead, which appear to work. I also couldn't find the update.zip for .171 so I ended up using the latest full update version that was available to me (http://update.hicloud.com:8180/TDS/...69/g1750/v181585/f1/full/update_full_base.zip).
4. Unzip the file, drag out UPDATE.APP file in the zip package, and opened it with Huawei Firmware Extractor (I used 0.9.9.5 in this thread: https://xdaforums.com/showthread.php?t=2433454). Extract and open the UPDATE.APP in update file. If you get a checksum error make sure to uncheck both of the verify checksum in Settings -> Extract.
5. Now you should see a RECOVERY_RAMDIS.img file, right click and extract it.
6. Send the RECOVERY_RAMDIS.img file back to your phone (anywhere is fine), go back to Magisk Manager -> Install -> Patch boot, get the patched_boot.img file from the phone back to the PC.
UPDATE 2019/01/02: @pvillasuso was kind enough to post the ramdisk image (both original and Magisk modified) for Mate 20 Pro LYA-L09 (Firmware version .171):https://xdaforums.com/showpost.php?p=78575496&postcount=13, obviously use it at your own risk.
7. Go to fastboot mode again:

adb devices
adb reboot-bootloader
fastboot devices
fastboot flash recovery_ramdisk "PATH_TO_patched_boot.img"
fastboot reboot

Now your phone should be back to normal with no root yet, turn off your phone and turn it back on by booting into recovery (Power and volume up with phone disconnected from USB)

Boot up and if you go to Magisk now you should be able to see Magisk installed with Installed Version same as Latest Version.

Congrats you are now rooted!

In future you will need to boot into recovery each time to maintain root (which requires you to turn phone off and power + vol up), if you prefer not to do so @ThatsJustLogic suggested you can use the app https://xdaforums.com/showpost.php?p=78569733&postcount=2 to add a one-click reboot from your dropdown menu.

Credits:
@ThatsJustLogic - Figured out the installation steps to patch ramdisk: https://xdaforums.com/showpost.php?p=78554707&postcount=125
@duraaraa - Guy behind FunkyHuawei for figuring out the .171 upgrade and make everything works smoothly https://xdaforums.com/mate-20-pro/how-to/unlock-rebrand-unbrick-update-t3855065
@mutahharbashir - Guy behind MinistryOfSolutions for the unlock BL code.
And creators of Magisk, HWFirmwareFinder, HWUpdateExtractor.

I get this message : your divece is unlocked and cant be trrusted . It goes to huawei erecovery though I have tried installing twrp through fastboot. I get a message saying "okay" but still goes to huawei recovery. Any idea?