# [GUIDE] How to unlock the bootloader of Nokia 4.2

436 posts
Thanks Meter: 654

By hikari_calyx, Senior Member on 28th August 2019, 04:03 AM
WARNING!
THIS GUIDE REQUIRES DISASSEMBLY, SO YOU WILL DEFINITELY LOSE THE WARRANTY!
DO IT AT YOUR OWN RISK!

Quote:

If you want to repost this guide to other websites, please let me know before you repost.
For Chinese users: 中文版教程将会在dospy发布。

Quote:

UPDATE: I've updated the new tool for unlocking the phone without understanding how to utilize such long commands.
You can watch the demonstration here: https://youtu.be/whrFsn8h7A4

So after I got a Nokia 4.2 prototype by opportunity, I just found the theory of bootloader unlocking.
Tricking development options for allowing "OEM unlocking" no longer works on latest security update.

What you need to have:
- a Nokia 4.2 unit that you finished back cover and upper plastic shell removal
- tweezers, and probably a standard philips screwdriver
- QPST (use at least 2.7.474) or any other app that could access the EDL, and Qualcomm USB port drivers are installed
- Full backup of your userdata

Step 1: Trigger the phone to EDL mode, then change the driver to "Qualcomm HS-USB QDLoader 9008"
Please take a look at the attachment below, about the location you need to use tweezers.

For Windows users:
If the driver is already indicated as "Qualcomm HS-USB QDLoader 9008", get to Step 2.
If the driver is indicated as either "QHSUSB__BULK" (For users who have installed Windows Device Recovery Tool before) or "Qualcomm HS-USB Diagnostics 9008", you must change the driver to "Qualcomm HS-USB QDLoader 9008".
After driver changed, you need to disconnect the phone, disconnect and reconnect the battery ribbon cable, then trigger the phone to EDL again.

Quote:

I assume the COM port number is 8 (COM8).

Step 2: Write config partition
As we already know, config partition is also the frp partition.
You need to create a config partition image that has "OEM Unlocking" function enabled, which need to alter the last byte, then change the overall checksum to make the config file valid.
For your convenience, I've created one.

Use QFIL included in QPST to load the firehose file. Choose "Flat Build" and choose the "prog_emmc_firehose_8937_ddr.mbn" you extracted from the attachment.

Choose "Tools" - "Partition Manager", then wait for the partition list appear.

As "Load Image" seems not reliable, we have to use command to write it manually.
For 64-bit Windows users, the command is:

Code:
"C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\where\you\extracted\N32_N42_unlock --sendimage=config.img --start_sector=16583680 --lun=0 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
If you use 32-bit Windows, you need to remove the " (x86)" (within space, without quotes) in the command above.

Step 3: Trigger the phone back to fastboot mode

Now hold the Volume down key, keep the phone connected, close the partition manager, then your phone will exit EDL mode and enter Fastboot mode directly.
Now check the unlock ability:
Code:
fastboot flashing get_unlock_ability
Expected output:
Code:
get_unlock_ability: 1
And you can unlock the bootloader with familiar commands.
Code:
fastboot flashing unlock_critical
Confirm unlock on the phone, then keep the volume down key pressed while the phone is erasing userdata.

Your phone will boot to fastboot mode again, and then:
Code:
fastboot flashing unlock
Confirm unlock on the phone again.

All done, that's how the bootloader is unlocked. You can reassemble the phone.
But strange enough, you can't see any unlock warning.

I will release boot image dumping guide and root guide very soon.

Special thanks:
Wingtech for leaking prototype units
Attached Thumbnails

Attached Files
 N32_N42_unlock.zip - [Click for QR Code] (239.5 KB, 1596 views) N32-N42_unlocker_V1.0.5.2.7z - [Click for QR Code] (1.73 MB, 1518 views)
7th September 2019, 09:38 AM |#2
Senior Member
Thanks Meter: 82

More
why must Nokia insist on locking their devices down so hard 😢?

great discovery, will definitely be useful once TWRP is released. just curious, but SafetyNet is tripped with this, right?
7th September 2019, 09:45 AM |#3
Senior Member
Vancouver
Thanks Meter: 455

More
Great!
Damn Nokia
7th September 2019, 10:08 AM |#4
Senior Member
Thanks Meter: 285

More
I don't even own this phone but I kinda want to weigh in, are we seriously at this point? No honestly, Android as a whole was basically were dev focused iOS is locked down to hell and back here's freedom. Google has the Nexus line made for developers companies embraced it I remember there being multiple Google play editions of phones that ran stock Android. I'm happy we as a community can keep this alive but damn are companies trying to make it difficult to do something I want to do to a device I paid for and own. Samsung you can't root (save for sampwn and samfail) LG locked down bootloaders and gimped fastboot on some models (fastboot seriously?) Nokia now requiring you to take apart the freaking phone to achieve this, I'm half asleep and can't think of any other major brands at the moment. It's a joke. (Above root methods were mainly for US variants and TMobile variants of LG) something has to change I know it won't and I understand the reasoning behind it security and such but still. Sorry for the rant congrats OP on what you did I consider it magic but it's more you accomplished something I could only wish I could do.
7th September 2019, 08:53 PM |#5
Junior Member
Thanks Meter: 2

More
Will it be possible to do without disassembly? Just in theory, not now
7th September 2019, 10:46 PM |#6
Senior Member
Thanks Meter: 307

More
Quote:
Originally Posted by kir23rus

Will it be possible to do without disassembly? Just in theory, not now

Unwise to say no with absolute certainly, but doubtful
8th September 2019, 05:58 AM |#7
OP Senior Member
Wuhan
Thanks Meter: 654

Donate to Me
More
Quote:
Originally Posted by kir23rus

Will it be possible to do without disassembly? Just in theory, not now

I think it will be possible.

There's a hidden command in aboot "fastboot reboot-emergency" but unusable, unless some sort of authentication is done or bootloader unlocked.

I still don't know how the authentication is done yet, but it's definitely not something that average developers can access to.
That's why disassembly is required for now.
8th September 2019, 09:13 PM |#8
Member
Thanks Meter: 11

More
Very interesting breakthrough. Great work ❣️
I'm facing the same bootloader unlock in my infinix hot s 3. I believe I can use your procedure to unlock my device. And if necessary how to make changes to the config file? I will be expecting your reply soon. Thanks
8th September 2019, 11:43 PM |#9
Senior Member
Khartoum
Thanks Meter: 85

More
Is it possible to explain how the config.img file is altered ? It might not be difficult to alter the last byte , but what does it mean to Change the overall checksum ? I have been trying to do something similar for a while , it would be great if you answered here or via PM , thank you
9th September 2019, 12:42 AM |#10
OP Senior Member
Wuhan
Thanks Meter: 654

Donate to Me
More
Quote:
Originally Posted by awab228

Is it possible to explain how the config.img file is altered ? It might not be difficult to alter the last byte , but what does it mean to Change the overall checksum ? I have been trying to do something similar for a while , it would be great if you answered here or via PM , thank you

Fill first 32 bytes with 0x00, then calculate SHA256 checksum and paste the new checksum as hex value at the first 32 bytes.
9th September 2019, 09:59 PM |#11
Senior Member
Khartoum
Thanks Meter: 85

More
Quote:
Originally Posted by hikari_calyx

Fill first 32 bytes with 0x00, then calculate SHA256 checksum and paste the new checksum as hex value at the first 32 bytes.

Thank you for taking the time to explain, great help and great effort, the last byte should be altered to 1 ? Or 0 ?

 Guest Quick Reply (no urls or BBcode) Message: