How To Guide 100% successfully unlock the Bootloader of your ROG Phone5/5s

Search This thread

azoth428

New member
May 21, 2022
4
0
Ok so I have done everything except flashing the original firmware back to the device. I am not sure how to do this as it was unclear. just says flash it back but doesnt give me any idea on how to do this and everything I have tried has failed.
 

azoth428

New member
May 21, 2022
4
0
Ok so I have done everything except flashing the original firmware back to the device. I am not sure how to do this as it was unclear. just says flash it back but doesnt give me any idea on how to do this and everything I have tried has failed.
NVM. I figured it out. I was actually going into recovery and entering fastbootd. Once it tried it at the first screen it installed flawlessly.
 

stev4e

New member
Nov 12, 2015
4
4
Thank you @johnny886!

This guide helped me install latest WW updates on Tencent (CN) phone, unlock bootloader and then root my device!

I ran into some kinks along the way so I'll share my experience here in case it helps anyone else.

I had a Tencent phone that had WW firmware installed when I bought it but running an old Android 11 build and Bootloader unlock not working.

If you don't have the phone's box with the 2 IMEI numbers listed I would copy them from the "about phone" settings screen before following this guide.

To start, I wouldn't recommend using the batch files - if they fail there's no descriptive error message, so it's best to open them in notepad, see what they do and then copy-paste the commands into a fresh terminal (change current working directory of the terminal to the ROG5 folder extracted from OP zip).

Make sure to have ADB drivers installed and check that it's detecting your device (which needs to have developer options and USB debugging turned on) by running "adb devices".

From here you can run "adb reboot bootloader" where you can use the fastboot commands. I was stupid and I was running "adb reboot fastboot" to run the fastboot commands but I realized my mistake when I read one reply from @twistedumbrella pointing this out in another thread (Thanks!). That's probably why I couldn't run "fastboot oem enter-dload" to enter EDL mode but I got around it by running "adb reboot edl" with the device turned on and connected in adb mode.

Then I could see QSHUBS_BULK_xxx appear in the device manager which meant I was missing the Qualcomm EDL drivers so I installed them following this guide: https://fixfirmware.com/qhsusb-bulk-driver/

The drivers weren't signed so they appeared with a yellow exclamation mark in device manager. This meant I had to disable driver signature verification by following the Shift+Restart method from this guide: https://www.droidwin.com/disable-driver-signature-verification-windows-10/

After this, going into ADL mode and running the "0-update_image_EDL.bat" script it ran successfully and I wasn't getting the sahara protocol error anymore. After getting the finished message without an error the phone rebooted into some factory firmware based on an old android version, probably used for testing the device. And on the home screen there was a widget with my ISN and SSN listed so I wrote them down.

I proceeded to backup the 7 files, making sure that "adb shell" followed by "su" didn't throw an error (Looks like bootloader is unlocked in this factory image because it didn't work previously). Then I checked the persist.img, which is an archive so you need to open it with 7-zip, no need for WinHex Pro, then opened the Country file inside and saw it was already WW, not CN. If you need to change it to WW then you will either need to repackage the archive after extracting it and editing the country file or use WinHex Pro.
Then I checked my asuskey4 file and it was missing a lot of data including IMEI so I used HxD hex editor to place the fingerprinting information at the correct addresses as shown in the screenshot attached to johnny's opening post in this thread and finally I used the restore script to push just this file to the phone.
After that I was able to enter bootloader mode and run 'fastboot flash all WW_xxx.raw" from inside the WW folder and it flashed without a hitch. Note that I used another WW raw that had a later version than the one johnny provided but it shouldn't matter in the end.
After booting to a fresh install of the WW ROM I did get the hardwarestub notification but then after I applied the OTA updates it was gone.
For installing the OTA updates you don't need to flash them one by one like someone in one of these threads claimed, I installed the last one for Android 11 first and then the latest one for Android 12 just by downloading them to the sdcard root directory on the phone and tapping the "update package detected" notification. You should be able to go directly to latest update but I haven't tested that.
After all that was done I successfully unlocked the bootloader using the ASUS unlock tool (You will get a warning screen every time you reboot the phone when your bootloader is unlocked, no need to check using dial codes or oem commands, you'll know). So my IMEI wasn't blocked because seller already unlocked it once but it was missing completely from the asuskey4 file I guess.
After unlocking bootloader I just extracted the boot img from the OTA update using python payload dumper (win64 payload dumper should work too), I loaded it onto the phone storage and patched it with Magisk app and finally I flashed it using 'fastboot flash boot ./magisk-patched-boot.img' command and viola! I had root.

And one more hint for those that think their phone is stuck in EDL mode:
Open device manager and hold power and vol down until the ADL device dissappears, hold it for too long and it'll just enter EDL mode again but if you release it at the right moment it'll boot normally.

Hope this writeup helps someone.
Cheers!
 

3rehaan

Senior Member
Nov 16, 2019
59
3
ASUS ROG Phone 5
If your ROG3/ROG5/ROG5S is a CN version, but it is WW firmware when you buy it, then the Bootloader cannot be unlocked, or it prompts that the unlocking is successful, but the Bootloader is still not unlocked after restarting.

Why is it like this? Because Chinese merchants do not master the correct method of converting WW firmware, your mobile phone ISN is lost, so it cannot be unlocked. You only need to restore the correct SSN and ISN to unlock the Bootloader.

Because many people privately wrote me to ask for help, I have no way and no time to help solve them one by one, so I will share the method and let you do it yourself.

1. You must flash the ENG firmware that I released. If you flash the ENG firmware found elsewhere, your fingerprints and IMEI may be lost, and the phone cannot be used normally.
ROG5:https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353865/

ROG5s:https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353339/

2. Use the dd command to back up asuskey4 to the computer

adb shell

su

dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/asuskey4

adb pull /sdcard/asuskey4 (Here is the directory name of your computer, for example adb pull /sdcard/asuskey4 C:\Users\johnny886\Desktop\rog5)

3. Read the correct SSN and ISN of the mobile phone, and then write the SSN and ISN into asuskey4

adb shell getprop >device.txt

Then use notepad++ or other editing tools to open device.txt
Search SSN, copy SSN to the new text, search SSN, copy ISN to the text. Then use winhex or UltraEdit to open asuskey4, write the SSN and ISN to the correct address, SSN address: 00000000h ISN address:00000180h,
then save the file, and use the command to restore asuskey4 to the phone partition.

4. Use the dd command to restore asuskey4 to the phone

adb push ...\asuskey4 /sdcard/ ( for example adb push C:\Users\johnny886\Desktop\rog5\asuskey4 /sdcard/ )

adb shell

su

dd if=/sdcard/asuskey4 of=/dev/block/bootdevice/by-name/asuskey4

5.Enter fastboot mode, flash the official raw WW firmware, and install the official website unlock tool after entering the system to unlock the phone.
Hello Jhonny Sir I Did All In Step By Step But In My asuskey not show IMEI & isn how can I Edit this And I Also didn't Get the Device.txt in command
( Sorry My English Is Bad )
 

LinhBT

Senior Member
Apr 21, 2020
238
60
VietNam
Xiaomi Mi 5X
Redmi K20 Pro
If your ROG3/ROG5/ROG5S is a CN version, but it is WW firmware when you buy it, then the Bootloader cannot be unlocked, or it prompts that the unlocking is successful, but the Bootloader is still not unlocked after restarting.

Why is it like this? Because Chinese merchants do not master the correct method of converting WW firmware, your mobile phone ISN is lost, so it cannot be unlocked. You only need to restore the correct SSN and ISN to unlock the Bootloader.

Because many people privately wrote me to ask for help, I have no way and no time to help solve them one by one, so I will share the method and let you do it yourself.

1. You must flash the ENG firmware that I released. If you flash the ENG firmware found elsewhere, your fingerprints and IMEI may be lost, and the phone cannot be used normally.
ROG5:https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353865/

ROG5s:https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353339/

2. Use the dd command to back up asuskey4 to the computer

adb shell

su

dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/asuskey4

adb pull /sdcard/asuskey4 (Here is the directory name of your computer, for example adb pull /sdcard/asuskey4 C:\Users\johnny886\Desktop\rog5)

3. Read the correct SSN and ISN of the mobile phone, and then write the SSN and ISN into asuskey4

adb shell getprop >device.txt

Then use notepad++ or other editing tools to open device.txt
Search SSN, copy SSN to the new text, search SSN, copy ISN to the text. Then use winhex or UltraEdit to open asuskey4, write the SSN and ISN to the correct address, SSN address: 00000000h ISN address:00000180h,
then save the file, and use the command to restore asuskey4 to the phone partition.

4. Use the dd command to restore asuskey4 to the phone

adb push ...\asuskey4 /sdcard/ ( for example adb push C:\Users\johnny886\Desktop\rog5\asuskey4 /sdcard/ )

adb shell

su

dd if=/sdcard/asuskey4 of=/dev/block/bootdevice/by-name/asuskey4

5.Enter fastboot mode, flash the official raw WW firmware, and install the official website unlock tool after entering the system to unlock the phone.
I followed exactly your instructions, but still my 5S has null IMEI and baseband, therefore, unable to unlock the bootloader. But the Device-info ( when device's at fastboot mode ) is like attached. Pls suggest, tks!
 

Attachments

  • asus.png
    asus.png
    69.8 KB · Views: 48

Dilutedmemories

New member
Jul 30, 2022
1
0
ASUS ROG Phone 5
Success is disgusted by some people, and will not share any files for free in the future.
This thread was the answer I was looking for and it looks like i'm too late. Just a few days short by the looks of it :cry:
What happened to this sub-forum? Why are the people that are trying to help feeling like they shouldn't?
Hopefully someone can share and help the ones capable to do this. Just need a point in the right direction. Kicking myself for waiting that week to research now...

@johnny886 It really sucks that people drove you to this.
 

azoth428

New member
May 21, 2022
4
0
Success is disgusted by some people, and will not share any files for free in the future.
Bro don't let the haters win. You solved this issue for me when no one else could. Everyone I asked said it was impossible and that the Asus unlock app only worked once and because the phone had already been unlocked and then relocked by tencent I would never have root. Keep you post up just to spite whoever hated on your success. I wish I hadn't deleted the files or I would mirror them. Anybody have those files?
 

Pawer8

Senior Member
Oct 21, 2014
74
21
This thread was the answer I was looking for and it looks like i'm too late. Just a few days short by the looks of it :cry:
What happened to this sub-forum? Why are the people that are trying to help feeling like they shouldn't?
Hopefully someone can share and help the ones capable to do this. Just need a point in the right direction. Kicking myself for waiting that week to research now...

@johnny886 It really sucks that people drove you to this.
Same. I was about to buy the phone. It is the only one that has all the features I need.



Haters gonna hate.

If no one hates you you're nobody.
-some rapper in the 2000
 

Madbullben

Senior Member
Feb 23, 2013
100
13
Anything new about this? I'd be intrested in this if I ever lock the bootloader by accident. Shame that the OP found something brilliant but won't share it anymore.
 

3rehaan

Senior Member
Nov 16, 2019
59
3
ASUS ROG Phone 5
Thank you @johnny886!

This guide helped me install latest WW updates on Tencent (CN) phone, unlock bootloader and then root my device!

I ran into some kinks along the way so I'll share my experience here in case it helps anyone else.

I had a Tencent phone that had WW firmware installed when I bought it but running an old Android 11 build and Bootloader unlock not working.

If you don't have the phone's box with the 2 IMEI numbers listed I would copy them from the "about phone" settings screen before following this guide.

To start, I wouldn't recommend using the batch files - if they fail there's no descriptive error message, so it's best to open them in notepad, see what they do and then copy-paste the commands into a fresh terminal (change current working directory of the terminal to the ROG5 folder extracted from OP zip).

Make sure to have ADB drivers installed and check that it's detecting your device (which needs to have developer options and USB debugging turned on) by running "adb devices".

From here you can run "adb reboot bootloader" where you can use the fastboot commands. I was stupid and I was running "adb reboot fastboot" to run the fastboot commands but I realized my mistake when I read one reply from @twistedumbrella pointing this out in another thread (Thanks!). That's probably why I couldn't run "fastboot oem enter-dload" to enter EDL mode but I got around it by running "adb reboot edl" with the device turned on and connected in adb mode.

Then I could see QSHUBS_BULK_xxx appear in the device manager which meant I was missing the Qualcomm EDL drivers so I installed them following this guide: https://fixfirmware.com/qhsusb-bulk-driver/

The drivers weren't signed so they appeared with a yellow exclamation mark in device manager. This meant I had to disable driver signature verification by following the Shift+Restart method from this guide: https://www.droidwin.com/disable-driver-signature-verification-windows-10/

After this, going into ADL mode and running the "0-update_image_EDL.bat" script it ran successfully and I wasn't getting the sahara protocol error anymore. After getting the finished message without an error the phone rebooted into some factory firmware based on an old android version, probably used for testing the device. And on the home screen there was a widget with my ISN and SSN listed so I wrote them down.

I proceeded to backup the 7 files, making sure that "adb shell" followed by "su" didn't throw an error (Looks like bootloader is unlocked in this factory image because it didn't work previously). Then I checked the persist.img, which is an archive so you need to open it with 7-zip, no need for WinHex Pro, then opened the Country file inside and saw it was already WW, not CN. If you need to change it to WW then you will either need to repackage the archive after extracting it and editing the country file or use WinHex Pro.
Then I checked my asuskey4 file and it was missing a lot of data including IMEI so I used HxD hex editor to place the fingerprinting information at the correct addresses as shown in the screenshot attached to johnny's opening post in this thread and finally I used the restore script to push just this file to the phone.
After that I was able to enter bootloader mode and run 'fastboot flash all WW_xxx.raw" from inside the WW folder and it flashed without a hitch. Note that I used another WW raw that had a later version than the one johnny provided but it shouldn't matter in the end.
After booting to a fresh install of the WW ROM I did get the hardwarestub notification but then after I applied the OTA updates it was gone.
For installing the OTA updates you don't need to flash them one by one like someone in one of these threads claimed, I installed the last one for Android 11 first and then the latest one for Android 12 just by downloading them to the sdcard root directory on the phone and tapping the "update package detected" notification. You should be able to go directly to latest update but I haven't tested that.
After all that was done I successfully unlocked the bootloader using the ASUS unlock tool (You will get a warning screen every time you reboot the phone when your bootloader is unlocked, no need to check using dial codes or oem commands, you'll know). So my IMEI wasn't blocked because seller already unlocked it once but it was missing completely from the asuskey4 file I guess.
After unlocking bootloader I just extracted the boot img from the OTA update using python payload dumper (win64 payload dumper should work too), I loaded it onto the phone storage and patched it with Magisk app and finally I flashed it using 'fastboot flash boot ./magisk-patched-boot.img' command and viola! I had root.

And one more hint for those that think their phone is stuck in EDL mode:
Open device manager and hold power and vol down until the ADL device dissappears, hold it for too long and it'll just enter EDL mode again but if you release it at the right moment it'll boot normally.

Hope this writeup helps someone.
Cheers!
Can You Please Help Me Fill Assukey4 Details I Have Same Missing Details ..!
Please Help Me !!
 
For anyone who may have followed the instructions yet didn't finish them or something, and needs them, I compiled the original post via the Wayback Machine. The links to download the file are broken, but even if they weren't I wouldn't distribute it because the firmware isn't mine to distribute.

Original Post:​

If your ROG3/ROG5/ROG5S is a CN version, but it is WW firmware when you buy it, then the Bootloader cannot be unlocked,
or it prompts that the unlocking is successful, but the Bootloader is still not unlocked after restarting.


Why is it like this? Because Chinese merchants do not master the correct method of converting WW firmware, your mobile
phone ISN is lost, so it cannot be unlocked. You only need to restore the correct SSN and ISN to unlock the Bootloader.


Because many people privately wrote me to ask for help, I have no way and no time to help solve them one by one, so I
will share the method and let you do it yourself.


1. You must flash the ENG firmware that I released. If you flash the ENG firmware found elsewhere, your fingerprints and
IMEI may be lost, and the phone cannot be used normally.

ROG5: https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353865/ (non-functioning link)

ROG5s: https://forum.xda-developers.com/t/...ootloader-to-modify-country-cn-to-ww.4353339/ (non-functioning link)


2. Use the dd command to back up asuskey4 to the computer
- adb shell
- su
- dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/asuskey4
- adb pull /sdcard/asuskey4 (Here is the directory name of your computer, for example adb pull /sdcard/asuskey4 C:\Users\johnny886\Desktop\rog5)

3. Read the correct SSN and ISN of the mobile phone, and then write the SSN and ISN into asuskey4
- adb shell getprop >device.txt

Then use notepad++ or other editing tools to open device.txt

Search SSN, copy SSN to the new text, search SSN, copy ISN to the text. Then use winhex or UltraEdit to open asuskey4,
write the SSN and ISN to the correct address, SSN address: 00000000h ISN address:00000180h, then save the file, and
use the command to restore asuskey4 to the phone partition.

4. Use the dd command to restore asuskey4 to the phone
- adb push ...\asuskey4 /sdcard/ (for example adb push C:\Users\johnny886\Desktop\rog5\asuskey4 /sdcard/)
- adb shell
- su
- dd if=/sdcard/asuskey4 of=/dev/block/bootdevice/by-name/asuskey4

5. Enter fastboot mode, flash the official raw WW firmware, and install the official website unlock tool after entering the system to unlock the phone.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 15
    Success is disgusted by some people, and will not share any files for free in the future.
    3
    Working perfectly tested and rooted. Steps are easy to follow.

    1) Download the ENG firmware and flash it following the steps.

    2) Then follow this post and the commands to extract asuskey4 and add ISN to the asuskey4.

    3) Flash WW ROM back to the phone.

    4) Use Unlock tool and then done.
    2
    Thank you @johnny886!

    This guide helped me install latest WW updates on Tencent (CN) phone, unlock bootloader and then root my device!

    I ran into some kinks along the way so I'll share my experience here in case it helps anyone else.

    I had a Tencent phone that had WW firmware installed when I bought it but running an old Android 11 build and Bootloader unlock not working.

    If you don't have the phone's box with the 2 IMEI numbers listed I would copy them from the "about phone" settings screen before following this guide.

    To start, I wouldn't recommend using the batch files - if they fail there's no descriptive error message, so it's best to open them in notepad, see what they do and then copy-paste the commands into a fresh terminal (change current working directory of the terminal to the ROG5 folder extracted from OP zip).

    Make sure to have ADB drivers installed and check that it's detecting your device (which needs to have developer options and USB debugging turned on) by running "adb devices".

    From here you can run "adb reboot bootloader" where you can use the fastboot commands. I was stupid and I was running "adb reboot fastboot" to run the fastboot commands but I realized my mistake when I read one reply from @twistedumbrella pointing this out in another thread (Thanks!). That's probably why I couldn't run "fastboot oem enter-dload" to enter EDL mode but I got around it by running "adb reboot edl" with the device turned on and connected in adb mode.

    Then I could see QSHUBS_BULK_xxx appear in the device manager which meant I was missing the Qualcomm EDL drivers so I installed them following this guide: https://fixfirmware.com/qhsusb-bulk-driver/

    The drivers weren't signed so they appeared with a yellow exclamation mark in device manager. This meant I had to disable driver signature verification by following the Shift+Restart method from this guide: https://www.droidwin.com/disable-driver-signature-verification-windows-10/

    After this, going into ADL mode and running the "0-update_image_EDL.bat" script it ran successfully and I wasn't getting the sahara protocol error anymore. After getting the finished message without an error the phone rebooted into some factory firmware based on an old android version, probably used for testing the device. And on the home screen there was a widget with my ISN and SSN listed so I wrote them down.

    I proceeded to backup the 7 files, making sure that "adb shell" followed by "su" didn't throw an error (Looks like bootloader is unlocked in this factory image because it didn't work previously). Then I checked the persist.img, which is an archive so you need to open it with 7-zip, no need for WinHex Pro, then opened the Country file inside and saw it was already WW, not CN. If you need to change it to WW then you will either need to repackage the archive after extracting it and editing the country file or use WinHex Pro.
    Then I checked my asuskey4 file and it was missing a lot of data including IMEI so I used HxD hex editor to place the fingerprinting information at the correct addresses as shown in the screenshot attached to johnny's opening post in this thread and finally I used the restore script to push just this file to the phone.
    After that I was able to enter bootloader mode and run 'fastboot flash all WW_xxx.raw" from inside the WW folder and it flashed without a hitch. Note that I used another WW raw that had a later version than the one johnny provided but it shouldn't matter in the end.
    After booting to a fresh install of the WW ROM I did get the hardwarestub notification but then after I applied the OTA updates it was gone.
    For installing the OTA updates you don't need to flash them one by one like someone in one of these threads claimed, I installed the last one for Android 11 first and then the latest one for Android 12 just by downloading them to the sdcard root directory on the phone and tapping the "update package detected" notification. You should be able to go directly to latest update but I haven't tested that.
    After all that was done I successfully unlocked the bootloader using the ASUS unlock tool (You will get a warning screen every time you reboot the phone when your bootloader is unlocked, no need to check using dial codes or oem commands, you'll know). So my IMEI wasn't blocked because seller already unlocked it once but it was missing completely from the asuskey4 file I guess.
    After unlocking bootloader I just extracted the boot img from the OTA update using python payload dumper (win64 payload dumper should work too), I loaded it onto the phone storage and patched it with Magisk app and finally I flashed it using 'fastboot flash boot ./magisk-patched-boot.img' command and viola! I had root.

    And one more hint for those that think their phone is stuck in EDL mode:
    Open device manager and hold power and vol down until the ADL device dissappears, hold it for too long and it'll just enter EDL mode again but if you release it at the right moment it'll boot normally.

    Hope this writeup helps someone.
    Cheers!
    1
    by far one of the best contributions of the forum, I don't usually comment, but I had to thank you
    1
    So uhh, what happened? There's no content in this post.
    In few words 2 out 10 ppl tell some BS to dev and 8 congrats/thank him but he decided to pay attention only to haters and rage quit (delete files). Classic Narcissistic personality disorder.