• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Bootloader Unlock Guide

Search This thread

wag3slav3

Senior Member
Sep 3, 2009
233
35
You're right, I finally found it. It's on the back of the board. I was able to use it to downgrade, still fighting with the software to get it into a state where I can use dc-unlocker client.

https://imgur.com/a/KxIYAZQ

I was able to downgrade to Android 6 since that's all that comes with the board software (Schubert-W09A-BD 1.0.0.18_Board Software_general_8.0.0_r1_EMUI8.0_05022GAE) using the testpoint then used Read booloader code from dc-unlocker I wasn't able to unlock the phone directly with dc-unlocker.

After that I went into upgrade mode (both vol buttons and power) and used dc-phoenix to load Schubert-W09A 8.0.0.190(C567)_Firmware_8.0.0_r1_EMUI8.0_05014YFX and Schubert-W09A 8.0.0.190(C567)_Firmware_8.0.0_r1_EMUI8.0_05014YFX - SHT-W09_hw_usa as an addon package.

Once I was back up to 8.0.0.190 I got into fastboot and ran fastboot oem unlock (code from read bootloader code) and I now have an unlocked M5 8.4.
 

ferraript

Member
Jun 29, 2018
16
1
I was able to downgrade to Android 6 since that's all that comes with the board software (Schubert-W09A-BD 1.0.0.18_Board Software_general_8.0.0_r1_EMUI8.0_05022GAE) using the testpoint then used Read booloader code from dc-unlocker I wasn't able to unlock the phone directly with dc-unlocker.

After that I went into upgrade mode (both vol buttons and power) and used dc-phoenix to load Schubert-W09A 8.0.0.190(C567)_Firmware_8.0.0_r1_EMUI8.0_05014YFX and Schubert-W09A 8.0.0.190(C567)_Firmware_8.0.0_r1_EMUI8.0_05014YFX - SHT-W09_hw_usa as an addon package.

Once I was back up to 8.0.0.190 I got into fastboot and ran fastboot oem unlock (code from read bootloader code) and I now have an unlocked M5 8.4.
that's very good news!
thanks a lot for identifying the test point and congratulations to you for unlocking the BL as well ;)
now it's my turn :D
 

papars

Senior Member
Dec 12, 2008
166
7
I just received one 10.8 CMR-W09 with .192 and 5 Nov 2018 security patch.

In developer options there is the selection to allow OEM unlock.
Is there a method to unlock this device (e.g. fastboot oem unlock) , or I should let it update and hope for a future solution?
 

Volumetrik

Senior Member
Nov 27, 2013
62
19
I just received one 10.8 CMR-W09 with .192 and 5 Nov 2018 security patch.

In developer options there is the selection to allow OEM unlock.
Is there a method to unlock this device (e.g. fastboot oem unlock) , or I should let it update and hope for a future solution?
Just got EMUI 9/PIE update for CMR-AL19.
I am also interested by the answer....
What the purpose of this setting ?
 

wag3slav3

Senior Member
Sep 3, 2009
233
35
Just got EMUI 9/PIE update for CMR-AL19.
I am also interested by the answer....
What the purpose of this setting ?

OEM Unlock Allowed is a user setting that blocks fastboot from doing an OEM unlock when you don't want it. It was in your previous version's developer options too, you just didn't notice it.

You need that AND the OEM code from Huawei to unlock the bootloader. You can't get the code from them anymore because, reasons.

This is why we have to force a downgrade with testpoint to something that's exploitable and extract that code.
 

Volumetrik

Senior Member
Nov 27, 2013
62
19
OEM Unlock Allowed is a user setting that blocks fastboot from doing an OEM unlock when you don't want it. It was in your previous version's developer options too, you just didn't notice it.



You need that AND the OEM code from Huawei to unlock the bootloader. You can't get the code from them anymore because, reasons.



This is why we have to force a downgrade with testpoint to something that's exploitable and extract that code.
Great explaination, thank you ! [emoji2]
 

gravitycode

New member
Jun 10, 2019
3
0
Hello guys, I was stupid enough to upgrade my M5 10" (wifi only model) to v. 9.0.1.182 without having an unlocked bootloader, because I thought I'd stick to the stock firmware.

Nevertheless, I've now decided I'd rather root. I did some research and it looks like it's virtually impossible to unlock the bootloader unless I manage to downgrade to some version before July 2018, but some people saying this is impossible without interefering with the hardware as well.

Do you think it would be possible to downgrade in a painless way so that I can use DCUnlocker, or am I doomed to a life of bloatware with my tablet? -_-

Thanks in advance.
 

dahawthorne

Senior Member
Nov 15, 2014
1,993
1,838
Brighton
This is exactly why I abandoned any idea of buying a Huawei product even before the US embargo fiasco. Huawei's decision to actively prevent owners doing what they want with their own property (i.e. rooting) is a deal-breaker. It was bad enough even before that, having to jump through hoops to get codes from Huawei, but now they've broken even third-party unlockers. Quite why anyone in XDA would buy a Huawei product in these circumstances is beyond my comprehension. "Ordinary" consumers with no interest in software, maybe, but XDA members...?
Rant mode off... :)
 

gravitycode

New member
Jun 10, 2019
3
0
This is exactly why I abandoned any idea of buying a Huawei product even before the US embargo fiasco. Huawei's decision to actively prevent owners doing what they want with their own property (i.e. rooting) is a deal-breaker. It was bad enough even before that, having to jump through hoops to get codes from Huawei, but now they've broken even third-party unlockers. Quite why anyone in XDA would buy a Huawei product in these circumstances is beyond my comprehension. "Ordinary" consumers with no interest in software, maybe, but XDA members...?
Rant mode off... :)

based on your reply I assume I am doomed then. Why I bought it tbh is that it's actually the first time I invest in a tablet, I wanted an alternative mobile coding workstation and I'm pretty happy with the setup I already achieved (TermuxArch + LXDE running on a VNC client), the hardware is just fine for some light coding on the go, but the bloatware is getting on my nerves now.

I didn't do proper research, unfortunately, into all of this before I bought the thing. Up until now I always had android phones but never bothered to root because I spend most of my time at a laptop, now that this tablet turned into a laptop alternative however, I saw the benefits of rooting.

I guess I'll just have to live with it and know better for the future :good:
 

dahawthorne

Senior Member
Nov 15, 2014
1,993
1,838
Brighton
I'm in pretty much the same situation with my Lenovo TB-8704F 8" tablet. It's a beautiful little device with a full HD display, and was upgraded by Lenovo's OTA to Oreo 8.1 a full year after Oreo was introduced. I expect no further upgrades from Lenovo, and the tablet isn't popular enough to have enthused developers to create any custom ROMs, so like you I'm just living with the results of a poor decision. The best I can say is that at least I was able to unlock it via Lenovo's website and then root it.
From a consumer perspective the tablet is a pleasure to use, but from an enthusiastic propellorhead's point of view it's a write-off. No more Lenovo for me.
 

Fredheg

Senior Member
Jan 6, 2015
58
11
48
Sundgau
I have opening m'y tablette, it's not so dificult. Taken Care you must only go 5mm inside wuth tour plastic cut IMG_20190419_114904.jpg

Envoyé de mon ONEPLUS A3003 en utilisant Tapatalk
 

brando56894

Senior Member
Dec 16, 2010
1,881
257
Jersey City
I have the SHT-W09 and whenever I set MFG mode and connect it to my Windows 10 laptop it immediately crashes Windows. I've installed HiSuite and all the drivers I can find, but apparently I'm still missing the ones for MFG mode because device manager shows that they're not installed when it's enabled, shortly before crashing.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 25
    DISCLAIMER: I'm not responsible for anything that happens to your device. Use the steps below at your own risk . Be mindful of the facts unlocking bootloader voids your warranty and also hard resets your device - ALL YOUR DATA, SETTINGS, FILES AND APPS WILL BE DELETED. These steps worked for me - I own Chinese version of 8.4" LTE model. I do not know if they will work for any other models of M5, including European versions, WiFi only version and 10" models.

    To execute the steps below you will need to obtain unlock code, specific to bootloader of your device. There is a slow, painful and free way to get it, and there is a quick and easy way to get the code instantly, which will cost you 4 euros. The slow way is to create Huawei ID, register on Huawei website and request the unlock code directly from Huawei, through dedicated link they provide. I do not use this method, so I don't have the link - do not ask. You will have to provide justification why you need it, such as being a developer and you bought the device to develop and make a living off of it - something Huawei support would find reasonable. In most cases they will not agree to unlock bootloader if you just tell them you want to install some roms. In this guide I will be describing the other method to get it done, which costs 4 euros.

    Follow these steps.

    1. Go to DC Unlocker website, register for an account (or login, if you already have one)
    2. Buy 4 credits (cost is 4 euro) using the Buy link
    3. Download the latest DC Unlocker client (pictures 1,2 below)
    4. Open the DC Unlocker client, click "server" tab on the right (picture 1) , enter your website login you created in step 1 and click "Check Login"
    5. Select "Huawei phones" from "Select manufacturer" dropdown
    6. On your M5, go to Dialer app, and type in *#*#2846579#*#* to open Project Menu
    7. Click Background Settings->USB Port Settings->Manufacture Mode
    8. Connect your M5 to PC via USB cable and return to DC Unlocker client
    9. Click the Search button to detect your device. It should be detected as "Huawei HiSilicon Kirin Android" (picture 1)
    10. Click "Unlocking" tab
    11. Click "Read Bootloader Code"(picture 2). It may not work on the first try, but don't worry - unsuccessful bootloader code reads do not spend your credits. Give it a few seconds, disconnect/reconnect USB cable and try again
    12. Copy and save generated bootloader code
    13. Download Huawei Multi Tool from the bottom of this page and install it
    14. Boot into download mode by powering off your M5, then holding Vol Down + Power keys simultaneously for a few seconds and then plugging in USB cable while still holding these 2 keys
    15. Open Multi Tool v8 and paste the code you got from DC Unlocker into "Get Unlock Key" input field
    16 Click "Use your key" button next to it (picture 3)
    17. On the bottom right click the green "Unlock bootloader" button
    18. You will get a bunch of warnings on your M5 screen about unlocking bootloader - press Vol Up key and then Power key
    19. At this point your bootloader will be unlocked and M5 will factory reset itself

    Note: using Multi Tool is optional. Instead, if you have ADB tools with fastboot installed on your PC, then after step 14 you can just use fastboot to unlock your bootloader, by typing "fastboot oem unlock <code>"
    Note 2: I don't do tech support via PM, so don't PM me for help or with questions. Use the thread instead, and some other XDA members or myself will probably help you. Good luck!

    Now I'm hoping some dev takes a shine to our phablet, and compiles TWRP build for it. It can certainly be installed now that we managed to unlock the bootloader :cool:
    17
    To enter Project Mode on Wifi only tablets, open calculator and enter () () 2,846,579 () (). On 10.8" tablet, it will need to be in landscape mode to get all the calculator symbols to show.
    7
    * * *Thread Cleaned, again * * *

    Look guys, everyone here was new, asked dumb questions, made stupid remarks, and frustrated those who are contributing to Xda. Each of us has done it when we were new, someone of us are still doing it as senior members.

    My point; now that you're the one being frustrated by new users, don't threaten to pick up your toys and go home, if every dev here did that this place would be another social site. Report abusive users, don't "punish" the many users who show respect and appreciation for your time and efforts by walking away because a few new guys get irritating (remember when you were the one doing the irritating).

    Maybe it would do us all good to remember the days when we were the ones making people mad, asking stupid questions or arguing because we thought we knew when we really didn't.

    Those who are here to share your hard work, and be recognized, thanked, and grow your experience, please remember that the rules are for you as well as everyone else.

    If you are relatively new, and don't know how things work in Xda, or think you know more than someone else, or feel like arguing because your opinion is different than the one providing mods, Roms, etc. figure out a way to communicate the difference with respect and realizing that people who develop word here do it for free, they do it when they could be hanging out with friends or family, and they share it with us because they want to see if it works, what's broke, and get feedback on how to fix it. Not be disrespected by users who haven't put in that time yet. And the rules apply to you as well as everyone else.

    This thread has talented and experienced people in it, don't let all that get wasted and lost in arguing, bickering, and violation Forum Rules. Nothing productive come of that.

    No one is permitted to insult, be rude, or disrespect another user, regardless of your title, your skill level, or your time in Xda. Those who give up their personal time to develop mods for our devices deserve respect from those of us who use their work for free.

    tl;dr

    Be respectful to those who dedicate their free time to provide free stuff for us, every users should show respect to every user, report those causing heartache and frustration, remember you are here for the greater good, not the lesser evil. Be kind, and be an example of what you think Xda should be.
    4
    • Once you're on the unlock page, fill everything out for a Wifi tablet with "Before EMUI5.0 selected".
    • Before hitting Submit, go into the chrome developer tools and under the sources tab, open up the file 'emui.huawei.com -> en -> publish static -> plugin -> unlock/template -> js -> detail.js?v.4.15'.
    • Click the '{ }' icon at the bottom left of the source pane to pretty-print the file
    • Scroll down to line 150 that should say "if(param.before5)". Right click the line number for that line and select 'add breakpoint'.
    • Now hit submit.
    • The submission should break on that line number, when it does (it'll be highlight), go into the console and enter "param.before5 = 0" (without quotes, followed by enter) to change it's value
    • Hit the '>' symbol at the top right of the source tab to resume submission.
    Got mine today for the CMR-W09 in a simliar way which may be easier for some:
    • Go to unlock page but select "Since EMUI5.0"
    • Fill in everything but IMEI
    • Open Konsole (F12) and paste
      Code:
      $('#model').val('Tablet-Wi-Fi')
      second box should change from "Smartphone" to "Tablet-Wi-Fi"
    • Click Commit and receive unlock code
    4
    The B181 update includes a security patch, which closes the backdoor used by DC-unocker to obtain the booloader unlock code.
    DC-unlocker comments this with: "Your device now runs new security system and no service will work even if it is detected as it appears [​IMG] Only possibly downgrade may help it."

    So, if you want to get the bootloader code, you must use B168 or versions below that.
    If you have already updated to B181 , you must try to downgrade.

    You can find versions with working common dload method via project menu and SD Card
    find it here: http://androidhost.ru/search.html
    Just search "AL09" or "W09" , "Mediapad M5" or "Madiapad M5" (Seems they have a typo maybe because of diffenent russian characters)
    I checked B181 and B168 (for W09) both have XLOADER 02 (checked via ante09 tool) , so this should work.