[GUIDE] [HOW TO] Safely re-lock bootloader on Android 5.1

Do you like the new security features of Android 5.1?

  • Yes

    Votes: 26 37.7%
  • No

    Votes: 43 62.3%

  • Total voters
    69
Search This thread
Jan 1, 2019
5
0
So what exactly was the issue with Android 5.1? If I understand correctly, the issue was that the "OEM unlocking" option in Developer Options would get disabled automatically in 5.1 without users choosing to do so? Was this only a problem when they already had their bootloader locked?

In STEP 4, it says:

Once you have developer options enabled, enable USB Debugging and tick the box to allow OEM unlock.

Is this basically allowing ADB to lock and unlock your bootloader if it is enabled? What does it mean if it is disabled while the phone has an unlocked bootloader? Why would it not always be ticked? Also, mine is currently greyed out. Is that okay? Can I proceed with it like this?

Screenshot: OEM Unlocking
yeit2Yt.png


In STEP 5, it says:

If setting has stuck, you are ready to unlock your bootloader and install the factory image using one of the ways outlined elsewhere in this forum.

Is this a typo? Should it say "ready to lock your bootloader"? I feel like it must be a typo, but I just wanna be sure I'm not lost, since I'm a newb.

I used "flash-all.bat" from "7.1.1 (N6F27M, Oct 2017)" from Google. Is that an appropriate way to flash the stock ROM before relocking the bootloader? My Android Version is now 7.1.1. Can I proceed with relocking the bootloader? I am doing this to return the phone from an eBay purchase, and the bootloader was locked when I received it, so I would like to relock it.

Screenshot: Android Version 7.1.1
kxrbTq7.png


I have already done the following:

• Flashed a stock ROM from Google (Android Version 7.1.1) using the "flash-all.bat" file.
• Factory reset the device after flashing the stock ROM, making sure not to enable any screen locks or add any accounts to the phone.
• In STEP 4, it says to make sure OEM unlock sticks. "OEM unlocking" is both enabled, and greyed out. I couldn't untick it if I wanted to.
• I don't understand STEP 5. My bootloader is unlocked, and I wish to lock it. Also, the "factory image" is the same thing as the "stock ROM" right?

What I plan to do next:

• Restart phone using the power button + volume down to boot into the bootloader. Connect it to my PC, open a command prompt in the ADB folder, and run the command:

Code:
fastboot oem lock

So this command both locks the bootloader and also factory resets the phone again?

I want to see if I correctly understand why locking the bootloader has been the cause of hard bricking the Nexus 6. The original issue is that in Android 5.1, the "OEM unlocking" option would disable on its own. And this was only a problem if you locked your bootloader when there was no OS on the phone?
 
Last edited:
Jan 1, 2019
5
0
This is the process I used to lock the bootloader on my Nexus 6.

Currently my Nexus 6 has LineageOS "lineage-15.1-20191212-nightly-shamu-signed.zip" installed. Magisk "Magisk-v20.1.zip" is also installed. I also have TWRP "twrp-3.3.1-0-shamu.img" installed.

These are the procedures I am taking to relock my bootloader.

I will write out these steps as I do them and put them in My Detailed Procedure. I'll also write the quick instructions for people who know what they're doing. I'm pretty sure I almost hard bricked my device doing this. Make sure your phone isn't bootlooping before locking the bootloader.

My Detailed Procedure
• Google "nexus 6 factory image" and the first link has the stock ROM with the version "7.1.1 (N6F27M, Oct 2017)" under "shamu" for Nexus 6. Download from the link.
• Unzip the folder "shamu-n6f27m-factory-bf5cce08.zip", and then move the contents from the folder "shamu-n6f27m" into the same folder you have adb.exe and fastboot.exe. This means "flash-all.bat" is in the same folder as "adb.exe".
• Make sure your Nexus 6 has the drivers to connect to Windows. Connect the Nexus 6 to a computer with the charging cable, then turn the phone on using the key combination power + volume down to boot into the bootloader. Open a command prompt and type "cd "C:/folder/location/of/adb.exe"". Double click the "flash-all.bat" file. This will flash the stock ROM to the Nexus 6 device. This also removes TWRP, all of your data, and internal storage files. Wait until it says "Press any key to exit...". Then press the key and you are not on stock android. Note: the previous line said "fastboot: error: Command failed". Looks a little ominous to me, but I don't think it's an issue. I am proceeding.
• Now use the arrow keys to select "START". Wait a few minutes while it loads, then set up the phone without setting up any screen locks, without adding any accounts, and without connecting to WiFi. I'm not sure if the WiFi part matters, but I also don't have a SIM card in it either, so I'm just leaving the phone offline.
• Verify "OEM unlocking" is enabled. Go to Settings > About phone > Build number and tap "Build number" 7 times. Hit back, and go into Developer options. For me "OEM unlocking" is grayed out, the switch is ticked to the right, and it says "Bootloader is already unlocked". I am going to restart my phone to make sure it "OEM unlocking" stays enabled. I believe this is the problem that was in Android 5.1, so it shouldn't be a problem here in Android 7.1.1? Correct me if I'm wrong. My reboot is taking a lot of time hanging on the "Google" splash screen with an unlock symbol underneath. I got impatient and held the power button until the splash screen blinked. Umm... is it bootlooping? I've held power button a few times and it seems to just restart it; the screen flashes and then it hangs. I'll just be a little more patient... I'm gonna hold power button one last time and time it with a stopwatch. I'm 6 minutes in and no luck. It must be bootlooping. New plan! That's scary... IF I HAD LOCKED THE BOOTLOADER HERE WITHOUT REBOOTING ONE MORE TIME TO CHECK THINGS, I WOULD HAVE BEEN SCREWED. IT WOULD BE BOOTLOOPING WITH A LOCKED BOOTLOADER AND NO CUSTOM RECOVERY. I WOULDN'T BE ABLE TO USE FASTBOOT OR TWRP TO FIX THINGS. FASTBOOT IS REQUIRED TO FLASH THE FACTORY IMAGE. NO UNLOCKED BOOTLOADER MEANS NO FASTBOOT.
• I'm gonna reflash the stock image and repeat the steps. It says from naldotech, in step 9 of "How To Flash Factory Image on Nexus 6 & Go Back To Stock" (I can't submit links), after you flash the factory image, "In Recovery, wipe data and cache so the phone doesn’t get stuck in a bootloop." Since I won't have any recovery to do that, what I'm going to do is do a factory reset from within stock Android one time, then see if any bootlooping occurs after I do that. I'll strikethrough these bullet points that are unnecessary errors on my part.
• Factory reset the phone from within Android 7.1.1 before rebooting the phone to prevent a bootloop. This is to delete data and cache (I believe it will do that). Go to Settings > Backup & reset > Factory data reset. Then select "RESET PHONE" and then "ERASE EVERYTHING". Set up the phone the same way with no accounts, screen locks, or WiFi.
• Verify "OEM unlocking" is enabled. Go to Settings > About phone > Build number and tap "Build number" 7 times. Hit back, and go into Developer options. For me "OEM unlocking" is grayed out, the switch is ticked to the right, and it says "Bootloader is already unlocked". Restart the phone to make sure it "OEM unlocking" stays enabled. Yay, no bootloop. I'm gonna restart 3 more times, but I imagine I'm good to go now. And verified. No bootloop after 3 reboots.
• And now is the important part. This is the first time I will be locking a bootloader. I'm beginning to think the "OEM unlocking" was not greyed out in previous versions and that it is actually a safeguard they added after 5.1. Mine is still ticked right and grayed out after the reboots. Let's continue.
• Enable USB debugging in "Developer options" so that you can run the fastboot command to lock the bootloader.
• Shut down the phone and boot into the bootloader (power button + volume down) in order to run fastboot commands.
• Make sure the device is connected to your PC and open a command prompt and type "cd C:/correct/folder/with/fastboot".
• Run "fastboot oem lock". Press the power button to confirm. Let's see if I'm in the clear...
• Selecting "START" from the bootloader...
• Device is starting with the "Google" logo but without the unlock symbol. Let's hope there is no bootloop... Whew, got past the Google screen and it's starting android with the colorful animation!
• I set up the phone one last time and the option "OEM unlocking" is no longer grayed out. I went ahead and unchecked it and factory reset the phone one last time. The factory reset took quite a while, but it worked.


Quick Instructions
• Get factory image (the stock ROM) "7.1.1 (N6F27M, Oct 2017)" from Google and flash it using "flash-all.bat".
• Set up phone without accounts or screenlocks. I also didn't allow it to connect to the internet.
• Factory reset from within Android 7.1.1 (this supposedly clears data and cache that could cause a bootloop).
• Restart the phone a few times to make sure it runs without bootlooping.
• Verify "OEM unlocking" is enabled. Mine is enabled and grayed out. I don't think this is an issue on this version.
• Enable USB debugging.
• Lock bootloader with "fastboot oem lock".
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Am I to understand that I can not ever go back to unrooted stock and locked booloader, now?

    I'm really sorry for what is probably a stupid noob question, but I'm really paranoid now. TIA!!

    You can go back to stock. And then, subsequently relock the bootloader.

    And the question is not "stupid". Noob questions are encouraged here. That's how you learn.
    2
    Thanks for clarifying that. There were a number of articles on several Android website that indicated this had to be checked to unlock bootloader. Shows that just because you read it on the internet, it ain't necessarily so.

    Here's one example > http://www.droid-life.com/2014/11/0...nable-oem-unlock-option-in-developer-options/
    I think we must have gotten our wires crossed somehow lol. Yes, "Allow OEM unlock" does have to be checked to unlock the bootloader. What I was trying to say is that it stays checked if you don't have a Google account on the phone and no lockscreen password.
    2
    [snip]
    Now, can I have TWRP/CustomROM installed, then relock bootloader to prevent anyone from replacing my system and still having recovery locked by Device Manager, with an overall more secure system? They can't unlock bootloader without getting into the system, I can still flash ROMs through recovery, and flash recovery using something like ROM Manager or GooManager.

    Locked bootloader only stops flashing partitions from fastboot. I can still do everything else, no? Besides a bad flash on both recovery AND system, I should be ok?

    First, no you can't flash a recovery with a locked bootloader.

    Are you sure you can't relock without being stock? I read users that did and were still able to flash using custom recovery and do recovery updates using an app in the system.

    You can not relock your bootloader, unless 100%/stock. You will brick your device if you try. Read the OP.

    I finally caught up with reading this thread.

    Here's my view on this: the issue with re-locking the bootloader on a Nexus 6 is that, unlike previous Nexus devices, it forces a wipe on re-lock. Moreover, the wipe is done by the stock recovery. So, if you have TWRP flashed, and you lock, you will end up in a bootloop (because it seems like TWRP doesn't deal with the force wipe the same way as the stock recovery does.

    Now, that being said, I believe there is a way to have a locked bootloader and TWRP. You would have to unlock your bootloader, flash TWRP, root, then flash back the stock recovery. Now you should be able to re-lock. Then, once you boot back into Android, use a terminal emulator or Flashify (or something similar) from the Play Store to flash TWRP. You should end up with a locked bootloader with TWRP installed. Keep in mind that if you plan to unlock again, you would need to flash the stock recovery (using what I mentioned before) before unlocking.

    I personally don't recommend a locked bootloader if you like to mess around with your phone, but hey, the choice is yours.
    2
    If you have an unlocked bootloader it would be extremely hard to brick this device, the only way AFAIK with an unlocked bootloader would be to "fastboot format boot" and not replace it.

    This sounds like: if you don't own a car, extremley hard to crash it
    1
    Okay, so I'm new to the whole unlocking/flashing thing.... I bought a nexus 6 from Verizon which obviously came with 5.1 out of the box. I was using stock with my google account attached and a pin lock. I successfully unlocked by bootloader and rooted with twrp and the nexus toolkit. I have also since flashed chroma. Am I to understand that I can not ever go back to unrooted stock and locked booloader, now?

    I'm really sorry for what is probably a stupid noob question, but I'm really paranoid now. TIA!!
    The first post explains how to lock the bootloader safely. If you're going g back to stock, simply follow the steps