[GUIDE] How to unlock the bootloader for Nokia 8.3 5G

[hikari_calyx]

TO CONTENT FARMS ESPECIALLY GETDROIDTIPS: DO NOT REPOST THIS TOPIC ON YOUR WEBSITE!
点击这里查看中文版(Click here for Chinese Version Guide)

If you're looking for how to unbrick the phone that received May 2023 Security Update, you've come to the right place.
You have two options to unbrick your Nokia 8.3

If you prefer not to unlock the bootloader, visit here:

https://xdaforums.com/t/guide-how-to-unbrick-nokia-8-3-affected-by-may-2023-security-patch.4592205/

Or if you don't mind unlocking the bootloader, do these steps before you proceed to bootloader unlock:

1. Use volume key to select "Recovery mode", power key to enter.
2. When you see android robot lying on the ground, hold power key and press volume up key once. Then you'll get recovery screen.
3. Download this package: https://android.googleapis.com/packages/ota-api/package/627142c637bf373410e6b8911aeb9b2e65bd5969.zip
4. Select Apply Update from ADB, then sideload it with adb command.
5. Once the sideload procedure finishes, select "reboot to bootloader", then follow this guide to unlock the bootloader.

Existing Android 10 builds has a critical problem, that allowed us to flash or erase any bootloader partition even if the bootloader is not unlocked. However, Android 11 builds blocked this method, but there's a known workaround for this.

Therefore, I think it's time to disclose the unlock method now. It's known working on both TA-1243 and TA-1251.

The critical part for unlocking the bootloader is - the prototype bootloader of this phone. By opportunity, I got the early bootloader from a prototype unit that allows us to unlock the bootloader, thanks to the help of a Canadian people who claimed to have a Nokia 8.3 prototype himself.

Click this for Android 11 or Android 12 users

Your warranty will be void as bootloader unlock is not reverseable - you cannot relock it. Prototype ABL for normal Nokia 8.3 and 8V 5G UW are not interchangeable, flashing wrong ABL image will cause your phone hard brick.

To use this method, you need to ensure your phone has Android 10 installed - the latest build that we can use this method is 00WW_1_150-B01, you can confirm this by dialing *#*#7837#*#*.

If your phone has Android 11 installed (00WW_2_180-B01 or newer), then this bootloader unlock method has been blocked, but there's known workaround for this. Check 2nd reply for details.

UPDATE: Russian version Nokia 8.3 5G cannot be downgraded yet. If you're using Russian version Nokia 8.3 5G (Software version has RU tag), use EDL method for bootloader unlock.

Please download the prototype bootloader from here:
Click here for Nokia 8.3 5G (BGT TA-1243/1251)
Click here for Nokia 8V 5G UW (RAV TA-1257)
If you see Error code 00000101 during download - please use industrial standard web browser to download it, like Google Chrome.

SHA256

Nokia 8.3 5G: e253b67fa028b1ea9ca714bee6d95902e2b340ae201e0c88adc12781279b8fd5
Nokia 8V 5G UW: 70391abce694c95d7bb9d2c3fa1bcbfd66f26f42a766bc8d8c4d222caf8a62d4

Root Key Hashes

Nokia 8.3 5G: E3B22179CCBFB91730E233C4162E2D9DD33D02C97289EC1E9F787AC52CBDE3E0
Nokia 8V 5G UW: C3CEDC3A4612C85DD70EEDFA8ABA75621D579CEA62BB9A8D805DD4E9C542A6F0

(For Nokia 8.3 5G only), flash it under fastboot mode, and unlock the bootloader - pretty simple:

fastboot flash abl BGT-abl.elf
fastboot reboot-bootloader
fastboot oem unlock-go

Confirm unlock on your phone and it's all done. You can safely update the phone to Android 11 right after unlocked. Since we cannot perform critical unlock properly, we can only do regular unlock, but this should be enough.

Video demonstration:

For Nokia 8V 5G UW only:

1. Ask someone who has access of HDK to grant service permission for you.
2. Execute these commands (please download frp_oemunlock.img from https://xdaforums.com/t/prototype-abl-binary-from-nokia-xr20-for-bootloader-unlock.4455845/ ):

fastboot flash abl_a RAV-abl.elf
fastboot flash abl_b RAV-abl.elf
fastboot reboot-bootloader
fastboot flash frp frp_oemunlock.img
fastboot reboot-bootloader
fastboot flashing unlock_critical
(confirm unlock)
fastboot flashing unlock
(confirm unlock)

Have fun for modding this device!

 

[hikari_calyx]

If you don't mind take apart your phone, you can use EDL method - but you know doing so will definitely void the warranty, and the stubborn triple-color company could remove these pads in later batches.

Firehose programmer for this phone is attached here.

Since we didn't grab downgrade OTA package for Russian variant, they cannot pass full OTA package verification and has to use EDL method for downgrading ABL. Thanks to Russian users for providing info.

In case Android 12 update from future cannot be downgraded, you'll have to use EDL method as well.

Example of using edl.py from bkerler (https://github.com/bkerler/edl):

edl.py w abl_a abl_proto_e253b67f.elf --memory=ufs --loader=prog_firehose_ddr.elf
edl.py w abl_b abl_proto_e253b67f.elf --memory=ufs --loader=prog_firehose_ddr.elf
edl.py reset

Keep in mind doing so will 100% void your warranty, and you cannot relock the bootloader.

 

[hikari_calyx]

For archiving purposes:
00WW_1_150-B01 full OTA zip: https://android.googleapis.com/packages/ota-api/package/627142c637bf373410e6b8911aeb9b2e65bd5969.zip
00WW_2_180-B01 full OTA zip: https://android.googleapis.com/packages/ota-api/package/12a35835cf4034f539ae7d03ffecd0682bef1b66.zip

You can use them for OS rooting.

Also after @jnappert 's testing, the workaround works great.
1. Sideload 00WW_1_150-B01 OTA package under recovery. You may see downgrade not allowed prompt but it will install anyway.
2. Reboot to bootloader under recovery mode. Although Anti-Rollback protection is triggered, the abl is not protected and is now downgraded to vulnerable build.
3. You can now follow the guide to unlock the bootloader.

I hope this will help everybody to bring up custom rom development for this phone.

 

[Volski_]

Existing Android 10 builds has a critical problem, that allowed us to flash or erase any bootloader partition even if the bootloader is not unlocked.

Does that mean that they forgot to blow eFUSE of secure boot in this model? On a different device, once I flashed tampered ABL image after unlocking (and unlock_critical) the blootloader, XBL refuses to load ABL because of tampering. It hard bricked the device, but EDL mode was working.

It could be that ABL_proto image that you extracted might be signed by the OEM.

 

[hikari_calyx]

Does that mean that they forgot to blow eFUSE of secure boot in this model? On a different device, once I flashed tampered ABL image after unlocking (and unlock_critical) the blootloader but XBL refuses to load ABL because of tampering. It hard bricked the device, but EDL mode was working.

It could be that ABL_proto image that you extracted might be signed by the OEM.

It's signed by OEM - you can compare it yourself.
In demonstration video, the secure boot is already enabled as you can see.

 

[mingkee]

Can anybody tell does it pass CTS with Magisk hide?

 

[hikari_calyx]

Can anybody tell does it pass CTS with Magisk hide?

It will pass - at least that's the situation on 00WW_1_150-B01.

 

[mingkee]

Now I have mine turn off to avoid further update.
I was unaware and it went up to 11, so I have to use different bootloader to root.

 

[hikari_calyx]

Now I have mine turn off to avoid further update.
I was unaware and it went up to 11, so I have to use different bootloader to root.

If bootloader unlocked, it will be safe to update to Android 11.

 

[TheDuke94]

Hello everybody. I was minding: because i've upgraded my nokia 8.3, is it possibile to roll back to android 10, unlock bootloader and install superSU?

 

[jnappert]

I tried downgrading to Android 10 yesterday und sucessfully unlocked bootloader (which deletes user-data). Then the OTA Update to 00WW_2_200 installed without problem.

 

[TheDuke94]

I tried downgrading to Android 10 yesterday und sucessfully unlocked bootloader (which deletes user-data). Then the OTA Update to 00WW_2_200 installed without problem.

can you please type here the steps you've made to downgrade your phone?

 

[hikari_calyx]

For Nokia 8 V 5G UW users:
I suspect devices with 00VPO_1_260-B01 or older should be vulnerable, but I think many users should have the phone updated to 00VPO_1_280-B01 already.

Need further investigation whenever I got firmware.

 

[TheDuke94]

I tried to downgrade mine from Android 11 to 10. Anyways, when i sideload the "update", the recovery text "downgrade not allowed". When it finishes the install, my phone just boot in fastboot mode and the only way to get it back is to install the Android 11 update. Still waiting any tips to downgrade

 

[jnappert]

can you please type here the steps you've made to downgrade your phone?

I downgraded from 00WW_2_180 to 00WW_1_150-B01:
- installed adb and drivers
- enabled USB Debug
- bootet to stock recovery: "adb reboot recovery"
- in recovery "apply update from adb"
- adb sideload 00WW_1_150-B01 from post #3
- rebootet to fastboot and continued with steps from post #1 to unlock bootloader
- after reboot device updated directly to 00WW-2_200

Now i am looking for working custom recovery...

 

[hikari_calyx]

I downgraded from 00WW_2_180 to 00WW_1_150-B01:
- installed adb and drivers
- enabled USB Debug
- bootet to stock recovery: "adb reboot recovery"
- in recovery "apply update from adb"
- adb sideload 00WW_1_150-B01 from post #3
- rebootet to fastboot and continued with steps from post #1 to unlock bootloader
- after reboot device updated directly to 00WW-2_200

Now i am looking for working custom recovery...

Thanks for sharing the tip. But apparently the triple-color company will block this

 

[TheDuke94]

Thanks for sharing the tip. But apparently the triple-color company will block this

Looks like it already happened, 'cause mine says "downgrade not allowed" gonna try again friday. I'll update you

 

[Dani897]

I was lucky enough to get this phone from bh photos as shelf stock and it shipped with android 10. They are currently on sale there for $320. I installed and unlocked bootloader. I may get a pixel as a backup so id be willing to test recovery,roms etc...when someone comes up with something. Ive been out of the Android scene for a while and im curious if root is possible at this time or if that would require 3rd party recovery and/or a kernel

 

[mingkee]

A little update
Bootloader unlocked
This time is a bit tricky
I tried to enter recovery and got "no command". Press volume up + power together every 2 seconds and I got actual recovery
Tried update from SD...no go
Tried update from adb... downgrade is not allowed
Somehow I went to fastbootd and nothing worked
I chose bootloader and this time elf file from post 1 worked (it didn't work when I enter bootloader normal way)
Now I have to find out where I can get boot to patch

 

[hikari_calyx]

A little update
Bootloader unlocked
This time is a bit tricky
I tried to enter recovery and got "no command". Press volume up + power together every 2 seconds and I got actual recovery
Tried update from SD...no go
Tried update from adb... downgrade is not allowed
Somehow I went to fastbootd and nothing worked
I chose bootloader and this time elf file from post 1 worked (it didn't work when I enter bootloader normal way)
Now I have to find out where I can get boot to patch

You can extract boot image from OTA package via payload dumper.