[GUIDE]Unlocking Bootloader + Magisk Root for Huawei Mate 20 Pro

Aug 11, 2010
43
24
0
tell me, i spoke with one of the unlock guys today on whatsapp and he said he doubts that they will ever be available again, looks like huawei have cracked down on the support staff who were giving out the keys, i wish someone would manage to crack the hashing algorithm, as i assume that's all the unlock key is, a hash of the iemi.

looks like i'll be returning my mate 20 pro to my provider and going pixel 3xl, note 9, or s 10 instead!
 

ataraxist

Senior Member
Jan 25, 2012
299
30
0
I read through quite a few post here to get everything sorted out and in order to save every one some time here is a summary of all the info I have gathered so far, and my way to thank the forum for offering me so many helpful tips. I'll try to keep this thread updated as information comes in.

All credit goes to their respective owners, I am only aggregating all the information here.

Current status on BL Unlock:

China version: OEM unlock not greyed out, direct BL unlock possible
EU/NA version (L09/L29/L0C): OEM unlock greyed out in developer options, BL unlock possible via FunkyHuawei method by upgrading to .170.
UPDATE 2019/01/02: Some users reported they have already received the .171 update from carrier (https://forum.xda-developers.com/showpost.php?p=78571337&postcount=6), if that is the case you can skip the FH Method part and go directly to unlock BL.

Note: Currently .170 is not GooglePay certified, so Google Pay won't work on this, if you must have Google pay please wait for your carrier to update to some version that support OEM unlock (tap build number 7x to get Developer Options in Settings -> System -> About Phone and then go to Settings -> System -> Developer Options and see if Enable OEM Unlock option is enabled).

Also current recovery install requires you to boot into recovery (Power and volume up with phone disconnected from USB) every single time if you want root, which is not perfect.

The only time you'd be required to wipe your phone is right after your BL is unlocked with fastboot OEM unlock, please make sure you have a backup before doing that step.

Where to get unlock code?
In order to get BL unlocked, you need both allow OEM unlock option NOT greyed out (i.e., you can enable it) AND a BL unlock code. BL unlock code can only be purchased either from FunkyHuawei (55 USD one time for BL unlock code only or if you buy an unlimited pass 132USD for unlimited flashing + BL unlock code (note that it is locked to your phone and can not be transferred)), or MinistryOfSolutions (30 Euro, https://ministryofsolutions.com/huawei-bootloader-unlock-service-all-new-models-new-firmwares, BL unlock code only).

FunkyHuawei Method (for non-China version)
1. Create an account in https://funkyhuawei.club/membersarea, buy 1 credit (if you just want to download .170 firmware, each credit cost 18USD).
2. Go to Select Firmware tab, use LYA-Global if you don't see the exact model. Then select .171 version.
3. Follow instructions here: https://pastebin.com/raw/Db5ZSyqu, you must download the specific HiSuite version (9.0.2.301)and the specific installer executable. Run the executable FHHiSuiteInstaller.exe as administrator (right-click and choose Run As Administrator) <- must run as admin since it will need to modify your host file. Make sure the script runs without error.
3.1 (Additional step for L0C): Edit the c:\users\YOURHOMEFOLDER\appdata\local\hisuite\userdata\updatedogdev\hisuiteconfig.xml file and change LYA-L29 to LYA-L0C everywhere it occurs and save the file. (Thanks to FunkyHuawei Support for pointing this one out).
4. Put the phone into fastboot mode (adb reboot-bootloader or with the phone off connect the usb cable while holding volume down, or boot the phone holding volume down with USB cable connected to PC).
5. Go to HiSuite on your PC and click on System Recovery (furthest to the right towards the bottom of the main screen), and let it do the magic. You will see some cmd windows pop up however it should get to the download progress with a percentage pretty fast, if you don't see that pop up then please check to make sure you have at least one credit in the FH Select Firmware tab and you have installed the specific versions of HiSuite and ran the installer as admin in Step 3.
6. Once everything is completed please verify to see if your firmware version is .171.

Unlock Bootloader
Again, get the BL code and go to Settings -> System -> Developer Options and make sure Enable OEM Unlock option is enabled. Also check to make sure you have everything backed up. Also enable USB Debugging in the same screen as well.
Rest is pretty standard:


at this point there will be a format operation performed on the phone, if it didn't complete successfully don't worry, your phone is wiped. During the boot you should see a black window with yellow text of warnings to tell you your phone is unlocked and not secured.

Go through all the steps to initialize the phone, turn on Developer options again, and enable USB Debugging again.

Root

1. Download and install Magisk Manager from this XDA post: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
2. Switch channel, go to Magisk Manager -> Settings -> Update Channel , set it to Custom, and the URL is https://bit.ly/2N8UVlq (at the moment, per https://forum.xda-developers.com/apps/magisk/dev-magisk-canary-channel-bleeding-edge-t3839337). Go back to main screen and down swipe to refresh, it should say Latest Version > v18.0.
3. You will need to find the stock RECOVERY_RAMDIS.img file, I used HW Firmware Finder (https://forum.xda-developers.com/tools/general/huawei-firmware-finder-team-mt-t3469146) to help me with the task, however I couldn't find the L0C update file and ended up using L09 update file instead, which appear to work. I also couldn't find the update.zip for .171 so I ended up using the latest full update version that was available to me (http://update.hicloud.com:8180/TDS/.../g1750/v181585/f1/full/update_full_base.zip).
4. Unzip the file, drag out UPDATE.APP file in the zip package, and opened it with Huawei Firmware Extractor (I used 0.9.9.5 in this thread: https://forum.xda-developers.com/showthread.php?t=2433454). Extract and open the UPDATE.APP in update file. If you get a checksum error make sure to uncheck both of the verify checksum in Settings -> Extract.
5. Now you should see a RECOVERY_RAMDIS.img file, right click and extract it.
6. Send the RECOVERY_RAMDIS.img file back to your phone (anywhere is fine), go back to Magisk Manager -> Install -> Patch boot, get the patched_boot.img file from the phone back to the PC.
UPDATE 2019/01/02:mad:pvillasuso was kind enough to post the ramdisk image (both original and Magisk modified) for Mate 20 Pro LYA-L09 (Firmware version .171):https://forum.xda-developers.com/showpost.php?p=78575496&postcount=13, obviously use it at your own risk.
7. Go to fastboot mode again:


Now your phone should be back to normal with no root yet, turn off your phone and turn it back on by booting into recovery (Power and volume up with phone disconnected from USB)

Boot up and if you go to Magisk now you should be able to see Magisk installed with Installed Version same as Latest Version.

Congrats you are now rooted!

In future you will need to boot into recovery each time to maintain root (which requires you to turn phone off and power + vol up), if you prefer not to do so @ThatsJustLogic suggested you can use the app https://forum.xda-developers.com/showpost.php?p=78569733&postcount=2 to add a one-click reboot from your dropdown menu.

Credits:
@ThatsJustLogic - Figured out the installation steps to patch ramdisk: https://forum.xda-developers.com/showpost.php?p=78554707&postcount=125
@duraaraa - Guy behind FunkyHuawei for figuring out the .171 upgrade and make everything works smoothly https://forum.xda-developers.com/mate-20-pro/how-to/unlock-rebrand-unbrick-update-t3855065
@mutahharbashir - Guy behind MinistryOfSolutions for the unlock BL code.
And creators of Magisk, HWFirmwareFinder, HWUpdateExtractor.

Does this pass safetynet test?
 
Last edited by a moderator:

Xalies

Senior Member
Nov 16, 2010
285
73
0
Noticed this from FH ... at least it can be done

FunkyHuawei - Root Kirin 980 With Locked Bootloader

For DEVELOPERS/TINKERERS ONLY!!

Supported Devices:
ALL VARIANTS OF:
Mate 20, Mate 20 X, Mate 20 Pro, Honor Magic 2, Honor V20, possibly future Kirin 980 devices.

--------------
What works ---
--------------
Root shell in recovery.
Booting unsigned code (TWRP only tested) via the erecovery_ramdisk partition (use dd to flash twrp.img to erecovery_ramdisk)

---------------
What doesn't work
---------------
Booting the actual device
Factory reset will fail
Possibly other issues.

--------------------
What we hope to achieve
--------------------
Since there is an entry point into loading unsigned code via eRecovery, we hope someone can use this entry point to boot a rooted system. We're not sure how possible it is. Unfortunately we don't have enough time to develop this solution.

--------------------
REQUIREMENTS
--------------------
1. A FunkyHuawei unlimited pass. (Full unlimited pass, not 30 day pass, 3 day pass, etc.)
2. A windows PC
3. USB Redirector Server ( https://www.incentivespro.com/downloads.html for free trial )
4. TeamViewer (http://teamviewer.com)


-------------------
SCHEDULING
-------------------
Email us at [email protected] to schedule an appointment. We will perform the procedure remotely via shared USB and TeamViewer. Please tell us what you hope to work on/achieve with the root shell, and we will consider your request.

--------------
DISCLAIMERS
--------------
1. Approval for appointment is not guaranteed and is based on our availability and schedule. We may deny requests at our discretion.
2. This is not a part of what you pay for with the FunkyHuawei service -- it is an extra which we are supplying at our own discretion.
3. If you brick your phone, we are not responsible. If you have an unstable internet connection your phone may brick in the process. Of course we will help you try to recover, but there is risk involved. Be aware.
 
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone