FORUMS
Remove All Ads from XDA

[GUIDE] How to unlock the bootloader of Nokia 4.2

345 posts
Thanks Meter: 522
 
Post Reply Email Thread
WARNING!
THIS GUIDE REQUIRES DISASSEMBLY, SO YOU WILL DEFINITELY LOSE THE WARRANTY!
DO IT AT YOUR OWN RISK!


Quote:

If you want to repost this guide to other websites, please let me know before you repost.
For Chinese users: 中文版教程将会在dospy发布。

So after I got a Nokia 4.2 prototype by opportunity, I just found the theory of bootloader unlocking.
Tricking development options for allowing "OEM unlocking" no longer works on latest security update.

What you need to have:
- a Nokia 4.2 unit that you finished back cover and upper plastic shell removal
- tweezers, and probably a standard philips screwdriver
- QPST (use at least 2.7.474) or any other app that could access the EDL, and Qualcomm USB port drivers are installed
- Latest Google Platform Tools
- Full backup of your userdata

Step 1: Trigger the phone to EDL mode, then change the driver to "Qualcomm HS-USB QDLoader 9008"
Please take a look at the attachment below, about the location you need to use tweezers.

For Windows users:
If the driver is already indicated as "Qualcomm HS-USB QDLoader 9008", get to Step 2.
If the driver is indicated as either "QHSUSB__BULK" (For users who have installed Windows Device Recovery Tool before) or "Qualcomm HS-USB Diagnostics 9008", you must change the driver to "Qualcomm HS-USB QDLoader 9008".
After driver changed, you need to disconnect the phone, disconnect and reconnect the battery ribbon cable, then trigger the phone to EDL again.

Quote:

I assume the COM port number is 8 (COM8).

Step 2: Write config partition
As we already know, config partition is also the frp partition.
You need to create a config partition image that has "OEM Unlocking" function enabled, which need to alter the last byte, then change the overall checksum to make the config file valid.
For your convenience, I've created one.

Now download and extract the attachment below.
Use QFIL included in QPST to load the firehose file. Choose "Flat Build" and choose the "prog_emmc_firehose_8937_ddr.mbn" you extracted from the attachment.

Choose "Tools" - "Partition Manager", then wait for the partition list appear.

As "Load Image" seems not reliable, we have to use command to write it manually.
For 64-bit Windows users, the command is:

Code:
"C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\where\you\extracted\N32_N42_unlock --sendimage=config.img --start_sector=16583680 --lun=0 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
If you use 32-bit Windows, you need to remove the " (x86)" (within space, without quotes) in the command above.

Step 3: Trigger the phone back to fastboot mode

Now hold the Volume down key, keep the phone connected, close the partition manager, then your phone will exit EDL mode and enter Fastboot mode directly.
Now check the unlock ability:
Code:
fastboot flashing get_unlock_ability
Expected output:
Code:
get_unlock_ability: 1
Step 4: Unlock the bootloader!
And you can unlock the bootloader with familiar commands.
Code:
fastboot flashing unlock_critical
Confirm unlock on the phone, then keep the volume down key pressed while the phone is erasing userdata.
Unlock Confirmation
Your phone will boot to fastboot mode again, and then:
Code:
fastboot flashing unlock
Confirm unlock on the phone again.

All done, that's how the bootloader is unlocked. You can reassemble the phone.
But strange enough, you can't see any unlock warning.

I will release boot image dumping guide and root guide very soon.

Special thanks:
Wingtech for leaking prototype units
Attached Thumbnails
Click image for larger version

Name:	N42_unlock.jpg
Views:	4608
Size:	181.0 KB
ID:	4812085  
Attached Files
File Type: zip N32_N42_unlock.zip - [Click for QR Code] (239.5 KB, 150 views)
The Following 24 Users Say Thank You to hikari_calyx For This Useful Post: [ View ] Gift hikari_calyx Ad-Free
 
 
7th September 2019, 09:38 AM |#2  
xDark_'s Avatar
Senior Member
Thanks Meter: 78
 
More
why must Nokia insist on locking their devices down so hard 😢?

great discovery, will definitely be useful once TWRP is released. just curious, but SafetyNet is tripped with this, right?
The Following User Says Thank You to xDark_ For This Useful Post: [ View ] Gift xDark_ Ad-Free
7th September 2019, 09:45 AM |#3  
thanhnvt194's Avatar
Senior Member
Flag Hanoi
Thanks Meter: 401
 
More
Great!
Damn Nokia
7th September 2019, 10:08 AM |#4  
Joe199799's Avatar
Senior Member
Thanks Meter: 235
 
More
I don't even own this phone but I kinda want to weigh in, are we seriously at this point? No honestly, Android as a whole was basically were dev focused iOS is locked down to hell and back here's freedom. Google has the Nexus line made for developers companies embraced it I remember there being multiple Google play editions of phones that ran stock Android. I'm happy we as a community can keep this alive but damn are companies trying to make it difficult to do something I want to do to a device I paid for and own. Samsung you can't root (save for sampwn and samfail) LG locked down bootloaders and gimped fastboot on some models (fastboot seriously?) Nokia now requiring you to take apart the freaking phone to achieve this, I'm half asleep and can't think of any other major brands at the moment. It's a joke. (Above root methods were mainly for US variants and TMobile variants of LG) something has to change I know it won't and I understand the reasoning behind it security and such but still. Sorry for the rant congrats OP on what you did I consider it magic but it's more you accomplished something I could only wish I could do.
The Following 17 Users Say Thank You to Joe199799 For This Useful Post: [ View ] Gift Joe199799 Ad-Free
7th September 2019, 08:53 PM |#5  
Junior Member
Thanks Meter: 0
 
More
Will it be possible to do without disassembly? Just in theory, not now
7th September 2019, 10:46 PM |#6  
Mesmurized's Avatar
Senior Member
Thanks Meter: 296
 
More
Quote:
Originally Posted by kir23rus

Will it be possible to do without disassembly? Just in theory, not now

Unwise to say no with absolute certainly, but doubtful
8th September 2019, 05:58 AM |#7  
hikari_calyx's Avatar
OP Senior Member
Flag Wuhan
Thanks Meter: 522
 
Donate to Me
More
Quote:
Originally Posted by kir23rus

Will it be possible to do without disassembly? Just in theory, not now

I think it will be possible.

There's a hidden command in aboot "fastboot reboot-emergency" but unusable, unless some sort of authentication is done or bootloader unlocked.

I still don't know how the authentication is done yet, but it's definitely not something that average developers can access to.
That's why disassembly is required for now.
8th September 2019, 09:13 PM |#8  
Skyhuppa's Avatar
Member
Thanks Meter: 6
 
More
Very interesting breakthrough. Great work ❣️
I'm facing the same bootloader unlock in my infinix hot s 3. I believe I can use your procedure to unlock my device. And if necessary how to make changes to the config file? I will be expecting your reply soon. Thanks
8th September 2019, 11:43 PM |#9  
Senior Member
Flag Khartoum
Thanks Meter: 57
 
More
Is it possible to explain how the config.img file is altered ? It might not be difficult to alter the last byte , but what does it mean to Change the overall checksum ? I have been trying to do something similar for a while , it would be great if you answered here or via PM , thank you
9th September 2019, 12:42 AM |#10  
hikari_calyx's Avatar
OP Senior Member
Flag Wuhan
Thanks Meter: 522
 
Donate to Me
More
Quote:
Originally Posted by awab228

Is it possible to explain how the config.img file is altered ? It might not be difficult to alter the last byte , but what does it mean to Change the overall checksum ? I have been trying to do something similar for a while , it would be great if you answered here or via PM , thank you

Fill first 32 bytes with 0x00, then calculate SHA256 checksum and paste the new checksum as hex value at the first 32 bytes.
The Following User Says Thank You to hikari_calyx For This Useful Post: [ View ] Gift hikari_calyx Ad-Free
9th September 2019, 09:59 PM |#11  
Senior Member
Flag Khartoum
Thanks Meter: 57
 
More
Quote:
Originally Posted by hikari_calyx

Fill first 32 bytes with 0x00, then calculate SHA256 checksum and paste the new checksum as hex value at the first 32 bytes.

Thank you for taking the time to explain, great help and great effort, the last byte should be altered to 1 ? Or 0 ?
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes