Bootloader Code Generator for Huawei P20 EML-L29

Search This thread

sorinbotirla

Member
Mar 20, 2019
19
29
Hello,
I am currently building a python script to generate codes for Huawei P20 (EML-L29) bootloader.

So far, I have to deal with these things in order to make it work:
- the code is a 16 digit number
- the last tried code is stored in a txt file to resume if anything crashes and it goes up incrementally.
- the code usually starts with 15XXXXXXXXXXXXXX
- at 5 failed attempts, the phone will reboot to normal mode. To prevent this, at every 4th failed attempt, It runs "fastboot reboot-bootloader" command to reset the counter.
- each attempt takes 4.5 seconds to complete. No other command will be taken while waiting for response from the phone.
- It tries about 10000 codes per day (which is too slow).

Is there any method to prevent the wait time for every attempt in order to make it run faster?

Here is the code I have used:

Code:
import os, sys, time

start = 1500000000000000
bootloaderGeneratedCode = "bootloaderGeneratedCode.txt"
bootloaderFoundCode = "bootloaderFoundCode.txt"
currentCode = start
lastCode = currentCode
tries = 1

def checkTxtFiles():
    if not os.path.isfile(bootloaderGeneratedCode):
        with open(bootloaderGeneratedCode, "w+") as bgc:
            bgc.seek(0)
            bgc.write(str(start))
    if not os.path.isfile(bootloaderFoundCode):
        with open(bootloaderFoundCode, "w+") as bgc:
            bgc.seek(0)
            bgc.write(str(""))

def checkFastbootDevices():
    res = str(os.popen("fastboot devices").read()).replace("List of devices attached", "").replace("fastboot", "").replace("device", "").replace(" ", "").replace("\n", "").replace("\r", "").replace("\t", "")
#     print(res)
    if "" == res:
        return False
    else:
        if "not found" in str(res) or "error" in str(res):
            return False
        else:
            return True
def checkAdbDevices():
    res = str(os.popen("adb devices").read()).replace("List of devices attached", "").replace("fastboot", "").replace("device", "").replace(" ", "").replace("\n", "").replace("\r", "").replace("\t", "")#     print(str(res))
    if "" == res:
        return False
    else:
        if "not found" in str(res) or "error" in str(res):
            return False
        else:
            return True

def rebootBootloader():
    if checkFastbootDevices():
        res = os.popen("fastboot reboot-bootloader").read()
    else:
        res = os.popen("adb reboot-bootloader").read()
    print(str(res))

def tryCode(code):
    global bootloaderFoundCode
    global tries
    res = os.popen("fastboot oem unlock "+str(code)).read()
    if "too many links" in str(res):
        tries = 1
    if "FAILED" in str(res):
        #code failed
        pass
    elif "OKAY" in str(res) or "SUCCESS" in str(res):
        #code succeeded
        with open(bootloaderFoundCode, "w+") as bgc:
            bgc.seek(0)
            bgc.write(str(code))
        print("FOUND BOOTLOADER CODE: "+str(code))
        sys.exit(0)
    #print(str(res))

def getLastCode():
    with open(bootloaderGeneratedCode, "r") as f:
        f.seek(0)
        return f.read()

checkTxtFiles()

with open(bootloaderFoundCode, "r") as bgc:
    bgc.seek(0)
    code = bgc.read()
    if 0 < len(code):
        print("FOUND BOOTLOADER CODE: "+str(code))
        sys.exit(0)
    else:
        while True:
            while checkFastbootDevices():
                #has fastboot devices
                print("Found fastboot device")
                if tries <= 4:
                    #can try oem unlock
                    currentCode = int(getLastCode())
                    print("Trying "+str(tries)+" of 4 with code "+str(currentCode))
                    tryCode(currentCode)
                    currentCode += 1
                    with open(bootloaderGeneratedCode, "w") as f:
                        f.seek(0)
                        f.write(str(currentCode))
                    tries += 1
                else:
                    #need to reboot-bootloader
                    tries = 1
                    rebootBootloader()

            if not checkFastbootDevices():
                #no fastboot device detected
                print("Waiting for device..")
                while not checkFastbootDevices():
                    if checkAdbDevices():
                        print("ADB Device found. Will reboot to bootloader");
                        rebootBootloader()
                        tries = 1
                    else:
                        time.sleep(1)
                        tries = 1
 
Last edited:
  • Like
Reactions: Ryandos

TonyCubed

Senior Member
Mar 5, 2010
234
23
I have no experience with anything like this but it might be possible to use machine learning to try and guess the unlock with enough bootloader unlock codes that have already been generated and IMEI.
 

sorinbotirla

Member
Mar 20, 2019
19
29
I have no experience with anything like this but it might be possible to use machine learning to try and guess the unlock with enough bootloader unlock codes that have already been generated and IMEI.

Hi, I have experience with machine learning and I can handle this. But getting pairs of IMEI/unlock codes from others might not be an easy task due to privacy issues involved. AFAIK IMEI posting on this board is forbidden.
 

panjaksli

Senior Member
Aug 6, 2018
51
7
Try no more! Apparently someone has found a way to unlock bootloader without a code(on honor play), but it requires phone disassembly and doing some stuff...
 

sorinbotirla

Member
Mar 20, 2019
19
29
Just look at the honor play thread: https://forum.xda-developers.com/honor-play/how-to/unlock-bootloader-unofficial-free-t3914658
I would definitely try to contact the author, since it has configuration for honor play so far only, maybe the P20 might be very similar.

Hi,
I have managed to put the P20 in tespoint mode
PBHUP20-2-grande.jpg


and tried to flash the twrp using the method described in that post and I got the successful PASS message. The testpoint mode allows temporary bootloader unlock.
unlocked.png


however, even if I immediately pressed the volume up button and unplugged the usb to prevent the phone to overwrite the recovery with the default eRecovery at reboot, it still brings me to the default eRecovery (no twrp shown).

I tried to set again the tespoint mode and flashed the twrp img with fastboot using this command
flash recovery_ramdisk twrp.img

twrp.png


tbe flash returned OK on both sending and writing but I couldn't get the twrp shown as it pointed me again to the eRecovery (I rebooted the phone directly in recovery mode)

I tried to flash several images but without success (messages returned are OKAY but I don't think they were really written)
Does the testpoint mode actually allows to write files or just emulates the status messages returned? I think I miss something.
 
Last edited:

panjaksli

Senior Member
Aug 6, 2018
51
7
Hi,
I have managed to put the P20 in tespoint mode
PBHUP20-2-grande.jpg


and tried to flash the twrp using the method described in that post and I got the successful PASS message. The tespoint mode allows temporary bootloader unlock.
unlocked.png


however, even if I immediately pressed the volume up button and unplugged the usb to prevent the phone to overwrite the recovery with the default eRecovery at reboot, it still brings me to the default eRecovery (no twrp shown).

I tried to set again the tespoint mode and flashed the twrp img with fastboot using this command
flash recovery_ramdisk twrp.img

twrp.png


tbe flash returned OK on both sending and writing but I couldn't get the twrp shown as it pointed me again to the eRecovery (I rebooted the phone directly in recovery mode)

I tried to flash several images but without success (messages returned are OKAY but I don't think they were really written)
Does the tespoint mode actually allows to write files or just emulates the status messages returned? I think I miss something.
Did you edit the XML file in the program's folder ? It has the device code name in it(but for honor play) and also paths to the files to be flashed. Also maybe you need specific bootloader and fastboot(recovery) image for the P20 ? I would try it with patched imgs for p20 which should be somewhere here on this xda forum. And btw. you've got some balls to disassemble your phone just for experimenting with bootloader unlock :D

---------- Post added at 01:46 PM ---------- Previous post was at 01:42 PM ----------

Did you edit the XML file in the program's folder ? It has the device code name in it(but for honor play) and also paths to the files to be flashed. Also maybe you need specific bootloader and fastboot(recovery) image for the P20 ? I would try it with patched imgs for p20 which should be somewhere here on this xda forum. And btw. you've got some balls to disassemble your phone just for experimenting with bootloader unlock :D
Wait, that screen says your phone is unlocked ??? Then I would try this https://forum.xda-developers.com/huawei-p20/development/root-huawei-p20-pie-emui-9-t3892601 or https://forum.xda-developers.com/huawei-p20/how-to/guide-how-to-finally-root-emui9-t3883295
 
  • Like
Reactions: sorinbotirla

sorinbotirla

Member
Mar 20, 2019
19
29
Did you edit the XML file in the program's folder ? It has the device code name in it(but for honor play) and also paths to the files to be flashed. Also maybe you need specific bootloader and fastboot(recovery) image for the P20 ? I would try it with patched imgs for p20 which should be somewhere here on this xda forum. And btw. you've got some balls to disassemble your phone just for experimenting with bootloader unlock :D

no I haven't changed the xml file. Just kept the files in place (with the right paths to ramdisk image). I will give a try to other images. To dissasemble the phone I have bought an ifixit pro set and heated the cover with a heatgun to melt the glue.
Here is a tutorial to disassemble the P20
https://www.youtube.com/watch?v=D4udqBEK0wQ



After I put my phone in testpoint mode, the fastboot menu shows the Unlocked status for the bootloader (Phone: unlocked). This is just a temporary unlock and it requires putting the phone in testpoint mode again when you need to unlock it.
 

panjaksli

Senior Member
Aug 6, 2018
51
7
no I haven't changed the xml file. Just kept the files in place (with the right paths to ramdisk image). I will give a try to other images. To dissasemble the phone I have bought an ifixit pro set and heated the cover with a heatgun to melt the glue.
Here is a tutorial to disassemble the P20
https://www.youtube.com/watch?v=D4udqBEK0wQ




After I put my phone in testpoint mode, the fastboot menu shows the Unlocked status for the bootloader (Phone: unlocked). This is just a temporary unlock and it requires putting the phone in testpoint mode again when you need to unlock it.
Waiiit, if it unlocks phone temporary, if you bridge it, what about soldering those leads together ? Does it still boot normally into system, or just straight up into the bootloader ?
 

sorinbotirla

Member
Mar 20, 2019
19
29
Waiiit, if it unlocks phone temporary, if you bridge it, what about soldering those leads together ? Does it still boot normally into system, or just straight up into the bootloader ?
LoL that's why I like this board. It comes along with amazing people like you. I haven't yet tried to solder them but the testpoint doesn't automatically boot the phone into fastboot You can boot normally. It is possible that you might just solved one of the biggest issues on the Huawei community.
Yet. I still have to test it to confirm that a temporary bootloader unlock can be simply converted into permanent by just soldering testpoints.
I will keep you updated
 

sorinbotirla

Member
Mar 20, 2019
19
29
Hi all ,how to use this code ? Please write me Step by Step :)

1. install Python on your pc
2. install fastboot and adb on your pc
3. enable developer options on your phone
4. enable "allow oem unlock" in developer options
5. connect the phone to your pc with usb and allow usb debugging confirmation (also check the "trust this computer" checkbox)
6. create a file called "unlockBootloader.py" and copy paste the code inside it.
7. open cmd/terminal/powershell and navigate to the file.
8. run python unlockBootloader.py and then leave the room and buy other phone. Also don't forget to live your life. You'll need it later in the next steps.
9. ???????
10. return when you are 120 years old and hope your phone is unlocked (which I doubt)
11. enjoy your unlocked Huawei and die happy few seconds later.
12. profit
 

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    Just look at the honor play thread: https://forum.xda-developers.com/honor-play/how-to/unlock-bootloader-unofficial-free-t3914658
    I would definitely try to contact the author, since it has configuration for honor play so far only, maybe the P20 might be very similar.

    Hi,
    I have managed to put the P20 in tespoint mode
    PBHUP20-2-grande.jpg


    and tried to flash the twrp using the method described in that post and I got the successful PASS message. The testpoint mode allows temporary bootloader unlock.
    unlocked.png


    however, even if I immediately pressed the volume up button and unplugged the usb to prevent the phone to overwrite the recovery with the default eRecovery at reboot, it still brings me to the default eRecovery (no twrp shown).

    I tried to set again the tespoint mode and flashed the twrp img with fastboot using this command
    flash recovery_ramdisk twrp.img

    twrp.png


    tbe flash returned OK on both sending and writing but I couldn't get the twrp shown as it pointed me again to the eRecovery (I rebooted the phone directly in recovery mode)

    I tried to flash several images but without success (messages returned are OKAY but I don't think they were really written)
    Does the testpoint mode actually allows to write files or just emulates the status messages returned? I think I miss something.
    6
    Hi all ,how to use this code ? Please write me Step by Step :)

    1. install Python on your pc
    2. install fastboot and adb on your pc
    3. enable developer options on your phone
    4. enable "allow oem unlock" in developer options
    5. connect the phone to your pc with usb and allow usb debugging confirmation (also check the "trust this computer" checkbox)
    6. create a file called "unlockBootloader.py" and copy paste the code inside it.
    7. open cmd/terminal/powershell and navigate to the file.
    8. run python unlockBootloader.py and then leave the room and buy other phone. Also don't forget to live your life. You'll need it later in the next steps.
    9. ???????
    10. return when you are 120 years old and hope your phone is unlocked (which I doubt)
    11. enjoy your unlocked Huawei and die happy few seconds later.
    12. profit
    4
    no I haven't changed the xml file. Just kept the files in place (with the right paths to ramdisk image). I will give a try to other images. To dissasemble the phone I have bought an ifixit pro set and heated the cover with a heatgun to melt the glue.
    Here is a tutorial to disassemble the P20
    https://www.youtube.com/watch?v=D4udqBEK0wQ




    After I put my phone in testpoint mode, the fastboot menu shows the Unlocked status for the bootloader (Phone: unlocked). This is just a temporary unlock and it requires putting the phone in testpoint mode again when you need to unlock it.
    Waiiit, if it unlocks phone temporary, if you bridge it, what about soldering those leads together ? Does it still boot normally into system, or just straight up into the bootloader ?
    4
    Hi all ,how to use this code ? Please write me Step by Step :)
    hahahahaha
    4
    Waiiit, if it unlocks phone temporary, if you bridge it, what about soldering those leads together ? Does it still boot normally into system, or just straight up into the bootloader ?
    LoL that's why I like this board. It comes along with amazing people like you. I haven't yet tried to solder them but the testpoint doesn't automatically boot the phone into fastboot You can boot normally. It is possible that you might just solved one of the biggest issues on the Huawei community.
    Yet. I still have to test it to confirm that a temporary bootloader unlock can be simply converted into permanent by just soldering testpoints.
    I will keep you updated