How To Guide [GUIDE] How to unlock the bootloader for Nokia 2.2

[areallydumbperson]

quick search finds a private method for ta-1211

 

[nswed]

It requires software that costs $30, yet it needs a key that costs $100. It's like $15 cheaper than the same phone. Not worth it.
Tried finding a cracked version. It doesn't run, as it needs the hardware.

If I reflash original firmware after I'm done with unlocking bootloader, will it work? I'm doing it for the sake of restoring IMEI.

 

[areallydumbperson]

It requires software that costs $30, yet it needs a key that costs $100. It's like $15 cheaper than the same phone. Not worth it.
Tried finding a cracked version. It doesn't run, as it needs the hardware.

If I reflash original firmware after I'm done with unlocking bootloader, will it work? I'm doing it for the sake of restoring IMEI.

Ignore my post before the edit my bad can you elaborate more

 

[nswed]

Ignore my post before the edit my bad can you elaborate more

IMEI is corrupted.
I tried reflashing firmware, using tools to write IMEI, flashing nvram from other phone. Neither worked, maybe excluding nvram, as it fixed the MAC address problem. But serial number and IMEI are still empty.
I'm not sure where is IMEI written, I tried using grep to find this partition, I haven't found it.
IMEI tools need authentication, as secure boot is enabled.

I analyzed ABOOT partition, and I found OEM commands for entering META mode and flashing IMEI. Both need verification. There are exploits for secure boot, but not the verification.

And it's completely not worth to buy the box, as Nokia 2.4 would cost around that price, if including shipping.


-----

Nokia 2.2 and Nokia 2.3 are similar when it comes to hardware. Even if screen wouldn't work, it's not needed to unlock bootloader, so it isn't a problem. Problem is that I don't want to brick it permanently.

 

[0DDA0]

try doing it on a windows machine maybe drivers are screwing up

*Sigh* I don't know anyone with a windows system I can borrow. I'll have to delete files to free up space to install windows as dual boot. *Heavy sigh*

 

[areallydumbperson]

IMEI is corrupted.
I tried reflashing firmware, using tools to write IMEI, flashing nvram from other phone. Neither worked, maybe excluding nvram, as it fixed the MAC address problem. But serial number and IMEI are still empty.
I'm not sure where is IMEI written, I tried using grep to find this partition, I haven't found it.
IMEI tools need authentication, as secure boot is enabled.

I analyzed ABOOT partition, and I found OEM commands for entering META mode and flashing IMEI. Both need verification. There are exploits for secure boot, but not the verification.

And it's completely not worth to buy the box, as Nokia 2.4 would cost around that price, if including shipping.


-----

Nokia 2.2 and Nokia 2.3 are similar when it comes to hardware. Even if screen wouldn't work, it's not needed to unlock bootloader, so it isn't a problem. Problem is that I don't want to brick it permanently.

i have an idea

if you have a scatter file use it but if not make one

try remove verification

flash an empty vbmeta

flash boot image without verification

 

[areallydumbperson]

*Sigh* I don't know anyone with a windows system I can borrow. I'll have to delete files to free up space to install windows as dual boot. *Heavy sigh*

sorry for a late reply but if u have a usb stick u can do a windows to go install on the usb

 

[nswed]

i have an idea

if you have a scatter file use it but if not make one

try remove verification

flash an empty vbmeta

flash boot image without verification

Just tried it. It stopped booting, "no valid os found". Currently trying to flash the backup I've made before the attempt.

 

[areallydumbperson]

Just tried it. It stopped booting, "no valid os found". Currently trying to flash the backup I've made before the attempt.

sorry!!

 

[areallydumbperson]

Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img

Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:

fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:

sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img

We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:

adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU

found out nokia has realeased 2.2 source code i think it might be kernel http://nokiaphones-opensource.azureedge.net/download/phones/Nokia2.2_V1.630.tar.gz

 

[RidyaGD]

how'd it go

sorry for late respond, i've unninstalled all adb driver and now i'm using non-minimal adb and it worked! Conclusion: don't ever use minimal adb.

 

[RidyaGD]

managed to patch my boot image using magisk and i didnt need a custom recovery yay

this might be useless but u wont have to use mtk easy su everytime u reboot

i put my boot_a image on my phone and let magisk patch it using the magisk manager

i got the output file and used the MT6761 scatter put it on download only mode on sp flash tool and unticked all the boxes except boot_a and double clicked the file location to change it to the patched one i transferred onto my computer and flashed i and now i have magisk

if anyone isnt bothered to patch their boot image with magisk ill send mine below

thanks, i really need it.

 

[0DDA0]

sorry for a late reply but if u have a usb stick u can do a windows to go install on the usb

It's no problem.
Of course! Thanks for the idea. KInd of gave up on/put on hold the rooting because of the windows thing. This is an alternative I can do.

 

[areallydumbperson]

thanks, i really need it.

happy to help and im happy to see that you got a gsi working on your phone

 

[areallydumbperson]

Yep

 

[areallydumbperson]

seems like my reply didnt attach to your reply but yes you can in fact unlock your nokia 2.2

 

[areallydumbperson]

Android 11 Magisk Patched Boot Image (Yes after unlock you can in fact update to android 11 without the device getting bricked)

Flashing Method:

fastboot flash magisk_patched-23000_QNm3D
fastboot reboot

android 10 image coming soon if you managed to update to android 10

 

[areallydumbperson]

Android 11 Magisk Patched Boot Image (Yes after unlock you can in fact update to android 11 without the device getting bricked)

Flashing Method:

fastboot flash magisk_patched-23000_QNm3D
fastboot reboot

android 10 image coming soon if you managed to update to android 10

I couldn’t get magisk to work but to make it up I made an android 10 spflash tool file which I want to send out

(build 2300)

 

[areallydumbperson]

Reserved #1

Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img

Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:

fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:

sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img

We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:

adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU

i have got what seems to be every oem command from the lk file

oemkeystore
oem p2u
oem off-mode-charge
oem key
oem lks
oem scp_status
oem scp_log_thru_ap_uart
oem usb2jtag
oem ultraflash:
oem ultraflash_en
oem secureBoot getfusestatus
oem battery getcapacity
oem getversions
oem alive
oem getprojectcode
oem getUID
oem auth_timecount clr
oem auth_timecount set count
oem auth_timecount get
oem auth_start
oem permission
oem getpermissions
oem getsecurityversion
oem md5
oem repair
oem simunlock
oem simlock
oem simlock_status
oem getdllname
oem unlock

 

[areallydumbperson]

Now the last piece of puzzle of Nokia x.2 series bootloader unlock line has been completed, thanks to the help of a member called Woke_World.
After I read his procedure, I decided to optimize the entire procedure and use my own firmware file to achieve it.

Step 1: Do full backup
(For this case please use SP Flash Tool 5.1924 or newer that can be found on spflashtool.com )

The firmware for this procedure can be downloaded here: https://www.androidfilehost.com/?fid=2188818919693749336
SHA256: D056631A8A795A06795B3A4E5F334DBF9B55C3C71269831F8E7926FA3ABA5637

Please follow the procedure in this topic to do readback: https://forum.xda-developers.com/t/...-global-nokia-5-1-plus-unbrick-guide.3858253/
For this case, you need to keep Download Agent file as the same came with SP Flash Tool, and altunlock-MT6761_Android_scatter.txt

Once readback done, please extract these images inside your backup for later use:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img

Step 2: Format all + Download to flash the firmware with altunlock scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with this scatter file: "altunlock-MT6761_Android_scatter.txt"
Once flash complete, disconnect the phone.

Step 3: Bootloader unlock
Press and hold volume down key and connect to PC - keep that condition for around 12 seconds then the phone will boot to Fastboot mode.
Execute these 2 commands to perform bootloader unlock:

fastboot flashing lock_critical
fastboot oem unlock

Look at your phone and press volume up to confirm unlock. Once done, disconnect the phone and remove the battery, wait 5 seconds and place the battery back.

Step 4: Do readback again
Once readback done, please extract these images inside your backup for later use:

sec1.img
seccfg.img

Step 5: Format all + Download to flash the firmware with original scatter file
Switch to Download tab, and choose format all + download to flash the entire phone with the original scatter file named as "MT6761_Android_scatter.txt" - note there's no altunlock at the beginning of filename.
Once flash complete, disconnect the phone.

Step 6: Power on the phone and enable USB debugging, root the phone with MTK Easy SU
[NOTE: DO NOT INSERT ANY SIM CARDS AND YOU MUST SKIP INTERNET CONNECTION]

You can download the MTK Easy SU apk from here : https://github.com/JunioJsv/mtk-easy-su/releases/latest
And Magisk APK from here : https://github.com/topjohnwu/magisk/releases/latest

When you have both MTK Easy Su and Magisk APK installed, please enable the "Run as 64 Bits" option, and tap the hash (#) button to enable root.
Once root complete, we can now re-enable bootloader unlock and restore IMEI.

Step 7: Re-enable bootloader unlock and restore IMEI
Please copy the 7 img files to your phone's internal storage:

nvcfg.img
nvram.img
proinfo.img
protect1.img
protect2.img
sec1.img
seccfg.img

We assume you copied them to root directory of internal storage (a.k.a. /storage/emulated/0/ )

Then execute these commands on your PC:

adb shell
su
dd if=/storage/emulated/0/nvcfg.img of=/dev/block/bootdevice/by-name/nvcfg
dd if=/storage/emulated/0/nvram.img of=/dev/block/bootdevice/by-name/nvram
dd if=/storage/emulated/0/proinfo.img of=/dev/block/bootdevice/by-name/proinfo
dd if=/storage/emulated/0/protect1.img of=/dev/block/bootdevice/by-name/protect1
dd if=/storage/emulated/0/protect2.img of=/dev/block/bootdevice/by-name/protect2
dd if=/storage/emulated/0/sec1.img of=/dev/block/bootdevice/by-name/sec1
dd if=/storage/emulated/0/seccfg.img of=/dev/block/bootdevice/by-name/seccfg

When it's done, please perform factory reset to apply the NVRAM restoration.

Please watch this video for entire procedure demonstration:

That wraps up the entire procedure of bootloader unlock, and have fun for modding this device!

Credits:
Woke_World from triple-color company product community
diplomatic for his MTK-SU Exploit and simplified utility called JunioJsv
topjohnwu for MagiskSU

if you dont like the wait 5 seconds message after bootloader unlock i made a modded lk image that has removed the orange state message

(android 9 build 1680)