[How-to] Unlock bootloader on Verizon Pixel/XL

Search This thread

djared704

Senior Member
Jul 12, 2018
116
83
Los Pringles, California
I had given up all hope of unlocking the bootloader. It's a Verizon device with Q Build QP1A.191005.007.A3. and up until an hour ago, whenever I looked, enable OEM unlocking was always greyed out. But I just happen to see it not greyed out, hit the toggle switch, did the fastboot unlock, and lo and behold, my Pixel XL now has an unlocked bootloader. I wish I could explain it, but there's no logical explanation. It could happen to you too.

You have to do the quick tests to actually ensure if it's a VZW device or unlocked (Unlocked should be _p on google site, vzw will be _vz)
Mate if this was the case this whole entire thread wouldn't exist.
 

Vandan.Patel

New member
Feb 20, 2018
4
0
At this point is there any hope for people running the last update for the pixel XL Verizon to be able to unlock the bootloader?
 

beeewell

Senior Member
Apr 25, 2012
260
90
Nexus 6
Google Pixel 3a
You have to do the quick tests to actually ensure if it's a VZW device or unlocked (Unlocked should be _p on google site, vzw will be _vz)
Mate if this was the case this whole entire thread wouldn't exist.

I'm very skeptical too, and maybe I screwed up. It took me awhile to figure out the google test thing, but I think this is the data that's in question below. I see the name has a _vz at the end of it. Does this look like the data you would get from the Google repair site to see if it's a Verizon model? I put xxx's and yyy's in for my imei & serial.

)]}'

[[["grd",["device","G-2PW2100-022-B","_pixel_xl_phone_silver_128gb_vz","Pixel XL","128 GB, Very Silver","https://lh3.googleusercontent.com/OsPTZ0Uonr59bD3E-hV_WDt_W8JgN_F5iGtFHGSrNC5bvLTrYh-SDuwgmytsrH0UaA","xxx","yyy",1,null,1,null,0,null,null,"Pixel XL (128 GB, Very Silver)",1595314800000,"Jul 21, 2020",null,null,0]
,1]
,["e",2,null,null,376]
]]
 

djared704

Senior Member
Jul 12, 2018
116
83
Los Pringles, California
I'm very skeptical too, and maybe I screwed up. It took me awhile to figure out the google test thing, but I think this is the data that's in question below. I see the name has a _vz at the end of it. Does this look like the data you would get from the Google repair site to see if it's a Verizon model? I put xxx's and yyy's in for my imei & serial.

)]}'

[[["grd",["device","G-2PW2100-022-B","_pixel_xl_phone_silver_128gb_vz","Pixel XL","128 GB, Very Silver","https://lh3.googleusercontent.com/OsPTZ0Uonr59bD3E-hV_WDt_W8JgN_F5iGtFHGSrNC5bvLTrYh-SDuwgmytsrH0UaA","xxx","yyy",1,null,1,null,0,null,null,"Pixel XL (128 GB, Very Silver)",1595314800000,"Jul 21, 2020",null,null,0]
,1]
,["e",2,null,null,376]
]]

I have a theory for your case then. It has also been proven on the Pixel 4. If you bought the device brand stinkin new with no VZW sim in it, that means NO one ever turned on the device before you did, and it especially booted without a VZW sim in it, potentially it would unlock as a regular pixel.
This still doesn't support our previous theories that VZW pixels require the Google server to unlock. I have also seen documentation of Pixel 1 not being permitted to be unlocked even proven unlocked, and not refurbished.
The questions will keep adding up.

Anyways, if any one of you remember this video, it features "hTC-download", including a "Token AUTHENTICATION PASS/FAIL" It honestly looks really neat and I believe if we can get a TOKEN PASS we can actually unlock the bootloaders for ourselves. If I'm correct, these tokens are distributed along the factories in China, Taiwan, where pixels are built, and my only theory is someone stole a token and also knows how to work on pixels (It makes sense because it's a chinese service) I also had one of my friends do a taobao service a few days ago, and they also successfully unlocked his bootloader! However it's completely different. I do not want to post it here for privacy reasons but to explain it, the camera is basically staring at the phone for a solid 35 minutes, then ting, you see the phone light up into a "Unlock bootloader?" display
Which is interesting, and completely different to what we know as of right now. There is absolutely 0 documentation of anyone just completely exploiting the pixel bootloader, and frankly, I have 0 doubts it can be done.
We're so close!
Thanks everybody.
 
  • Like
Reactions: beeewell

beeewell

Senior Member
Apr 25, 2012
260
90
Nexus 6
Google Pixel 3a
I have a theory for your case then. It has also been proven on the Pixel 4. If you bought the device brand stinkin new with no VZW sim in it, that means NO one ever turned on the device before you did, and it especially booted without a VZW sim in it, potentially it would unlock as a regular pixel.
This still doesn't support our previous theories that VZW pixels require the Google server to unlock. I have also seen documentation of Pixel 1 not being permitted to be unlocked even proven unlocked, and not refurbished.
The questions will keep adding up.

Anyways, if any one of you remember this video, it features "hTC-download", including a "Token AUTHENTICATION PASS/FAIL" It honestly looks really neat and I believe if we can get a TOKEN PASS we can actually unlock the bootloaders for ourselves. If I'm correct, these tokens are distributed along the factories in China, Taiwan, where pixels are built, and my only theory is someone stole a token and also knows how to work on pixels (It makes sense because it's a chinese service) I also had one of my friends do a taobao service a few days ago, and they also successfully unlocked his bootloader! However it's completely different. I do not want to post it here for privacy reasons but to explain it, the camera is basically staring at the phone for a solid 35 minutes, then ting, you see the phone light up into a "Unlock bootloader?" display
Which is interesting, and completely different to what we know as of right now. There is absolutely 0 documentation of anyone just completely exploiting the pixel bootloader, and frankly, I have 0 doubts it can be done.
We're so close!
Thanks everybody.

The only thing I can add, and I'm not sure it's at all helpful, but another hypothesis - My wife bought this phone REFURBISHED. She took it out of the box, charged it, put in her Verizon sim card, and fired it up. Maybe there was something in the refurbishing process that ultimately allowed it to be unlocked. It really defies explanation. As I mentioned before, based on what I read here and trying numerous times, I had given up on unlocking this phone to the point of ordering another unlocked phone. Since I lucked out if you will in unlocking it, I've cancelled the other order. As of now, I have a rooted stock in one slot, and PixelDust in the other slot.
 

bpatterson007

Member
Dec 4, 2010
5
0
So just to be clear, if you have a Verizon Pixel XL with the last update installed, you cannot currently unlock the bootloader? So no Lineage 17.1 install for me?
 

djared704

Senior Member
Jul 12, 2018
116
83
Los Pringles, California
So just to be clear, if you have a Verizon Pixel XL with the last update installed, you cannot currently unlock the bootloader? So no Lineage 17.1 install for me?

Rather than a solid "no" like it has before, there are sudden reports of this chinese service unlocking it. At the moment I'm still gather information regarding it, but you may always look at my previous posts about it. Cheers.
 
  • Like
Reactions: Rojasarevaloz

bpatterson007

Member
Dec 4, 2010
5
0
Rather than a solid "no" like it has before, there are sudden reports of this chinese service unlocking it. At the moment I'm still gather information regarding it, but you may always look at my previous posts about it. Cheers.

Good luck and godspeed. It pisses me off owning something and being restricted like this. I know I'm not the only one!
 

hairycheez

Senior Member
Aug 2, 2011
103
39
Google Pixel 5
If following the steps and going to Google.com (not any website) doesn't work, maybe try using the check in command from Google.
 

Attachments

  • Screenshot_20200611-222534_Chrome.jpg
    Screenshot_20200611-222534_Chrome.jpg
    178.1 KB · Views: 602

YandexStudio

Member
Nov 27, 2017
31
16
Beijing
OnePlus One
Nexus 6
Rather than a solid "no" like it has before, there are sudden reports of this chinese service unlocking it. At the moment I'm still gather information regarding it, but you may always look at my previous posts about it. Cheers.

I've also noticed the unlocking service on Taobao, currently I still didn't buy it, but usually, they use teamviewer to contorl your computer and then transfer their unlocking scripts, and they oprate it fast, then delete the script file, ( I've bought a fiber modem unlocking service before, I don't know if it's similar for unlocking mobile phones)

Is there anyway to grab their script file without let them notice? If so, maybe I can buy it and have a try.
 
  • Like
Reactions: CLPose

CLPose

Senior Member
Jan 7, 2015
726
381
Buenos Aires
I've also noticed the unlocking service on Taobao, currently I still didn't buy it, but usually, they use teamviewer to contorl your computer and then transfer their unlocking scripts, and they oprate it fast, then delete the script file, ( I've bought a fiber modem unlocking service before, I don't know if it's similar for unlocking mobile phones)

Is there anyway to grab their script file without let them notice? If so, maybe I can buy it and have a try.

I've PM you with some relevant info. Looking forward to seeing you! ;)
 
  • Like
Reactions: FFF_in_WY
I've also noticed the unlocking service on Taobao, currently I still didn't buy it, but usually, they use teamviewer to contorl your computer and then transfer their unlocking scripts, and they oprate it fast, then delete the script file, ( I've bought a fiber modem unlocking service before, I don't know if it's similar for unlocking mobile phones)

Is there anyway to grab their script file without let them notice? If so, maybe I can buy it and have a try.

Maybe you can close the TeamViewer connection after the script has been transferred to your system.
 
  • Like
Reactions: FFF_in_WY

kha1rul

Senior Member
Sep 28, 2010
57
5
London
Great to see there's a lot of progress, keep it up guys! I really appreciate your efforts.
Out of curiosity, Does anyone have a link to the Taobao unlocking service?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 163
    Hi guys. So I finally found a way to unlock a bootloader on a Verizon Pixel. Without further ado, let's get started. This method works on Pixel and Pixel XL.

    1. Remove Google account and any kind of screen lock (fingerprint, PIN, pattern, etc.) from your device.
    2. Eject sim card from your device.
    3. Reset your device. In setup wizard, skip everything, don't connect to WiFi, don't add fingerprint or any kind of screen lock.
    4. Go to Developer Options and enable USB debugging.
    5. Connect your phone to PC.
    6. Open CMD in adb directory and type
    Code:
    adb shell pm uninstall --user 0 com.android.phone
    7. Restart your device.
    8. Connect to WiFi, open Chrome and go to google.com (or any website really).
    9. Go to Developer Options and enable OEM unlocking.
    10. Reboot into bootloader and via CMD run
    Code:
    fastboot oem unlock
    or
    Code:
    fastboot flashing unlock
    11. Profit

    Be aware that unlocking bootloader removes everything from your device.

    Credit to members LeoTheRomRasta and Qu3ntin0 for making this method available to the community on the Bounty thread yesterday. https://xdaforums.com/pixel-xl/how-to/bounty-verizon-pixel-bootloader-unlock-t3740911/page14 There is an ongoing discussion there about variations on this method.

    UPDATE: Confirmed that this method works on Android Oreo as well as Android P Developer Preview.
    15
    Please can someone go through the trouble with making some step-by-step instructions that are a bit more noob-friendly, like in the OP? Thanks.

    Here is what worked for me:

    Prerequisites:

    No SIM card in the phone
    ADB and Platform Tools installed on a computer (https://www.xda-developers.com/install-adb-windows-macos-linux/)
    The latest OTA image downloaded to the computer (https://developers.google.com/android/ota#sailfish for the Pixel or https://developers.google.com/android/ota#marlin for the Pixel XL)
    The phone connected to the computer with USB
    Learn how to use ADB and Fastboot on your computer as it can differ.

    Steps:

    1. On the phone, open Settings>System>Reset Options and factory reset the phone. It should say "Restarting" or something similar.
    2. When the screen goes black, press and hold the Volume Down key until you get into the Bootloader mode. Use the volume keys to navigate to "Recovery Mode" and select it with the power button.
    3. Hold the Volume Down key for about a minute (while it resets) until you make it back to the bootloader.
    4. Again use the volume keys to select Recovery Mode, then you should see a graphic of an android lying down.
    5. Hold the Power button then press the Volume Up button once. It should give you a menu. If that doesn't work, try pressing them at the same time.
    6. Use the volume and power buttons to select "Wipe Data/Factory Reset"
    7. Once it finishes, select the "Apply update via ADB" option.
    8. Go to your computer and type in 'adb sideload sailfish-ota-qp1a.191005.007.a3-394b5899.zip' (without quotes) for the Pixel or 'adb sideload marlin-ota-qp1a.191005.007.a3-23002a57.zip' for the Pixel XL.
    9. Factory reset again from recovery mode
    10. Reboot to system
    11. While it just shows the G, press the power button until the phone restarts
    12. Once it boots up, skip all of the steps but disable the options for sending information to Google.
    13. Enable Developer Options by tapping "Build Number" seven times
    14. In Developer Options, enable USB Debugging
    15. On your computer, run 'adb shell pm uninstall --user 0 com.android.phone'
    16. Reboot twice
    17. Connect to WiFi
    18. Open google.com in Chrome
    19. check Developer Options to see if you can enable OEM unlocking
    20. If you can't, swipe away Settings from the Recents menu and go back to Chrome
    21. In Chrome, open a bunch of websites. After opening each one, check the OEM Unlocking option again and close Settings afterward.
    22. Once you can enable it, do so! Now you can unlock the bootloader.

    Unlocking the bootloader:

    1. Reboot and press the Volume Down key when the screen goes black
    2. On the computer, type 'fastboot flashing unlock'

    You just unlocked the bootloader!

    Credit goes to djared704 for finding this method.

    Let me know if I need to change anything about this guide.
    11
    Hey guys. After 5 months of my purchase I finally achieved bootloader unlocking. Basically I am a user that has never updated to latest, I don't know if it makes it a variable if you're already on latest and try this. (I was coming from Sept 2019). So what I did was factory reset from the system menus. Then as soon as the screen went black, I did bootloader combos and straight to recovery. I factory resetted as prep, flashed DECEMBER patch, then after that finished, factory resetted again. Essentially, I followed the classic ADB exploit that has "never worked since Sept-Oct 2019" And yes I do have the VZW_001 CID and "_VZ" in GL website. Know when yours is bootlooping as soon as you reboot it, just hard reboot so it boots up quicker, I don't know what it does for it to take so long. Anyways when you get in, just setup like we'd always do, NO google account, turn off all setting requests (Data location, wallpapers, etc). Then as soon as I got in, I turned on debugging, ran the classic adb pm command, rebooted TWO times. This means as soon as I booted, i swiped to go to home, then rebooted a second time. As soon as I did that, I loaded up my wifi connection, I don't know if it matters but Im using the 5G wifi, then I load up google.com. Immediately, I already notice something strange. Google.com doesn't have a "valid SSL certificate" I thought it was weird, so I went to google.com on my PC and look certified SSL. As I knew that was weird, I was clicking around and I thought that was enough. so I went to the dev menu. OEM lock still grayed out. I went back to chrome and simply typed in "youtube" Let it load up. Then I clicked on the site. I went back to the dev menu. Still grayed out. I exited settings app and relaunched it to the dev menu. OEM unlock lit up in flying colors. I could not believe it. I instantly ticked it with 0 hesitation and rebooted immediately to the bootloader. The unlock command worked! I am now unlocked sailfish! I thank the community so much for all the hard work. I, only motivated the community to their potential. Thank you again!

    Generally there are some kinds of factors.
    Users have stated before if you OTA'd from menus to Latest patch, it would say "October", even though it's really december. This may make the unlocking procedure impossible. I have also not seen any marlin users report back to me yet about this method. You can still try flashing from googles site if you're already on "October = Dec".

    Enjoy guys. We proved WE own these phones, and not VZW.
    7
    D
    Deleted member 5638945
    Uhm, how do you skip Wi-Fi setup? :confused:

    EDIT: Guys, can confirm. It works!!! Just tested this as of now. The trick is to factory reset twice because the first reset leaves an indicator to the phone that you did a factory reset just now. Therefore, not allowing you to skip Wi-Fi connection in Setup Wizard. As for the steps, once you opened Google Chrome and visit a website, Go to Developer Options and wait until 3-5 minutes if the option to unlock is still grayed out. You might want to go back and forth one more time to see if the option to unlock is now enabled.
    7
    Apparently there may a very very small case of possibly unlocking bootloader on VZW pixel 1 again. There is a Chinese service known by the name of "Taobao", performing premium paid bootloader unlocks for Pixel 1. Now at XDA, we do not agree with charging people in any way. The first way the old adb uninstall exploit was even discovered was because some user leaked, also a premium service in China. This is a bit different. The interface they are using is in Chinese (I know this because I connected with a user in our TG channel that has used this service). When I talked with this user they spoken about how they used the getvar command to determine if it was a actual VZW model or not. He went on to tell me that he used a VPN service to connect to their (data centre?) or his own phone, built for going long distances, I guess. He tells me he hasn't paid attention to the PC that much, and in a bit his bootloader was successfully unlocked. I actually took a look at the fastboot toolkit when I was on his PC and it was actually a toolkit from 2016, and it was obviously a bit modified, having a chinese file shortcut that directs to system32 cmd. The shortcut was obviously "命令提示符", translating Command Prompt. I can't understand why you would need admin access for adb, but to spin off, the commands in the help directory of both fastboot and ADB are different. Some I noticed were "flashing get_unlock_bootloader_nonce" "flashing unlock_bootloader <request>" "flashing lock_bootloader". However the ADB directory looks a bit similar to what we see today. I looked at a couple of the proprietary apps he used and the interfaces of those kinda reminded me of IP grabbing applications. Some great people at TG attempted to translate for me, and it looked about right.
    In theory, they use these apps to grab a VZW IP and maybe bully it with your own router? Or maybe they infiltrate it with their own IP which explains turning on the VPN. We have to work together, and figure out exactly how it was done. We have some info, but no steps on reproducing it. Lets try and work this out together! WE ARE so close! Thanks so much.