• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
  • Fill out your device list and let everyone know which phones you have!    Edit Your Device Inventory

[GUIDE] How to unlock the bootloader for Nokia 2.2

Search This thread

areallydumbperson

Senior Member
Jun 1, 2021
64
5
It requires software that costs $30, yet it needs a key that costs $100. It's like $15 cheaper than the same phone. Not worth it.
Tried finding a cracked version. It doesn't run, as it needs the hardware.

If I reflash original firmware after I'm done with unlocking bootloader, will it work? I'm doing it for the sake of restoring IMEI.
Ignore my post before the edit my bad can you elaborate more
 

nswed

Member
May 22, 2021
8
1
Ignore my post before the edit my bad can you elaborate more
IMEI is corrupted.
I tried reflashing firmware, using tools to write IMEI, flashing nvram from other phone. Neither worked, maybe excluding nvram, as it fixed the MAC address problem. But serial number and IMEI are still empty.
I'm not sure where is IMEI written, I tried using grep to find this partition, I haven't found it.
IMEI tools need authentication, as secure boot is enabled.

I analyzed ABOOT partition, and I found OEM commands for entering META mode and flashing IMEI. Both need verification. There are exploits for secure boot, but not the verification.

And it's completely not worth to buy the box, as Nokia 2.4 would cost around that price, if including shipping.


-----

Nokia 2.2 and Nokia 2.3 are similar when it comes to hardware. Even if screen wouldn't work, it's not needed to unlock bootloader, so it isn't a problem. Problem is that I don't want to brick it permanently.
 

areallydumbperson

Senior Member
Jun 1, 2021
64
5
IMEI is corrupted.
I tried reflashing firmware, using tools to write IMEI, flashing nvram from other phone. Neither worked, maybe excluding nvram, as it fixed the MAC address problem. But serial number and IMEI are still empty.
I'm not sure where is IMEI written, I tried using grep to find this partition, I haven't found it.
IMEI tools need authentication, as secure boot is enabled.

I analyzed ABOOT partition, and I found OEM commands for entering META mode and flashing IMEI. Both need verification. There are exploits for secure boot, but not the verification.

And it's completely not worth to buy the box, as Nokia 2.4 would cost around that price, if including shipping.


-----

Nokia 2.2 and Nokia 2.3 are similar when it comes to hardware. Even if screen wouldn't work, it's not needed to unlock bootloader, so it isn't a problem. Problem is that I don't want to brick it permanently.
i have an idea

if you have a scatter file use it but if not make one

try remove verification

flash an empty vbmeta

flash boot image without verification
 

areallydumbperson

Senior Member
Jun 1, 2021
64
5
Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img



Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:
Code:
fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:
Code:
sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img
We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:
Code:
adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU
found out nokia has realeased 2.2 source code i think it might be kernel http://nokiaphones-opensource.azureedge.net/download/phones/Nokia2.2_V1.630.tar.gz
 

RidyaGD

Member
Jun 2, 2021
25
0
managed to patch my boot image using magisk and i didnt need a custom recovery yay

this might be useless but u wont have to use mtk easy su everytime u reboot

i put my boot_a image on my phone and let magisk patch it using the magisk manager

i got the output file and used the MT6761 scatter put it on download only mode on sp flash tool and unticked all the boxes except boot_a and double clicked the file location to change it to the patched one i transferred onto my computer and flashed i and now i have magisk

if anyone isnt bothered to patch their boot image with magisk ill send mine below
thanks, i really need it.
 

areallydumbperson

Senior Member
Jun 1, 2021
64
5
Android 11 Magisk Patched Boot Image (Yes after unlock you can in fact update to android 11 without the device getting bricked)

Flashing Method:

fastboot flash magisk_patched-23000_QNm3D
fastboot reboot

android 10 image coming soon if you managed to update to android 10
 

Attachments

  • magisk_patched-23000_QNm3D.img
    32 MB · Views: 2
  • Like
Reactions: RidyaGD

areallydumbperson

Senior Member
Jun 1, 2021
64
5
Android 11 Magisk Patched Boot Image (Yes after unlock you can in fact update to android 11 without the device getting bricked)

Flashing Method:

fastboot flash magisk_patched-23000_QNm3D
fastboot reboot

android 10 image coming soon if you managed to update to android 10
I couldn’t get magisk to work but to make it up I made an android 10 spflash tool file which I want to send out

(build 2300)
 

areallydumbperson

Senior Member
Jun 1, 2021
64
5
Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img



Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:
Code:
fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:
Code:
sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img
We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:
Code:
adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU
i have got what seems to be every oem command from the lk file

Code:
oemkeystore
oem p2u
oem off-mode-charge
oem key
oem lks
oem scp_status
oem scp_log_thru_ap_uart
oem usb2jtag
oem ultraflash:
oem ultraflash_en
oem secureBoot getfusestatus
oem battery getcapacity
oem getversions
oem alive
oem getprojectcode
oem getUID
oem auth_timecount clr
oem auth_timecount set count
oem auth_timecount get
oem auth_start
oem permission
oem getpermissions
oem getsecurityversion
oem md5
oem repair
oem simunlock
oem simlock
oem simlock_status
oem getdllname
oem unlock
 

areallydumbperson

Senior Member
Jun 1, 2021
64
5
Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img



Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:
Code:
fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:
Code:
sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:
Code:
nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img
We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:
Code:
adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU
if you dont like the wait 5 seconds message after bootloader unlock i made a modded lk image that has removed the orange state message

(android 9 build 1680)
 

Attachments

  • lk.img
    831.5 KB · Views: 5

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    If I follow the procedure, can I eventually return back to a stock unrooted/locked OS that can receive OTA updates and passes safetynet?
    You can but there will be no way to write a serial num and this unlock procedure still preserves ota functionality
    1
    Something's going wrong with me. Please tell me how did you flashed it? (The command I mean).
    fastboot flash boot TWRP.img
  • 8
    To moderators: There's no Nokia 2.2 forum in XDA-Developers, please move this topic when available.
    To content farms: DO NOT COPY AND PASTE THE ENTIRE GUIDE!

    Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
    After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

    Step 1: Do full backup
    (For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

    The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
    SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

    Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
    For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

    Once readback done, please extract these images inside your backup for later use:
    Code:
    nvcfg.img
    nvram.img
    proinfo.img
    protect1.img
    protect2.img

    DO NOT SKIP STEP 1, OR YOUR PHONE WILL NOT HAVE IMEI AND SN!

    Step 2: Format all + Download to flash the firmware with altunlock scatter file
    Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
    Once flash complete, disconnect the phone.

    Step 3: Bootloader unlock
    Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
    Execute these 2 commands to perform bootloader unlock:
    Code:
    fastboot flashing lock_critical
    fastboot oem unlock

    Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

    Step 4: Do readback again
    Once readback done, please extract these images inside your backup for later use:
    Code:
    sec1.img
    seccfg.img

    Step 5: Format all + Download to flash the firmware with original scatter file
    Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
    Once flash complete, disconnect the phone.

    Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
    [NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

    You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
    And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

    When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
    Once root complete, we can now re-enable bootloader unlock and restore IMEI.

    Step 7: Re-enable bootloader unlock and restore IMEI
    Please copy the 7 img files to your phone's internal storage:
    Code:
    nvcfg.img
    nvram.img
    proinfo.img
    protect1.img
    protect2.img
    sec1.img
    seccfg.img
    We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

    Then execute these commands on your PC:
    Code:
    adb shell
    su
    dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
    dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
    dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
    dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
    dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
    dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
    dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

    When it's done, please perform factory reset to apply the NVRAM restoration.

    Please watch this video for entire procedure demonstration:

    That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

    Credits:
    Woke_World from triple-color company product community
    diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
    topjohnwu for MagiskSU
    1
    How to extract *.img files from ROM_0 backup?
    1
    Please make a tutorial on how to unlock the bootloader of Nokia 2.1 with Android 10 update.