• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

I just bootloader unlocked a Verizon branded Pixel 3 - how is this possible??

Search This thread

dcarvil

Senior Member
Apr 20, 2016
467
247
So we don't need to download the blueline images that say Verizon and can just use the latest 11.0.0 (RQ3A.210705.001, Jul 2021) image instead?

I haven't done this forever, is there still a need for TWRP if we are sticking with the stock rom, unlocking the bootloader and installing Magisk?

Use the latest blueline 11.0 image - you don't need one that specifically says Verizon. The Verizon only images are merged into the later general blueline images.

TWRP does not work on Android 11. Use adb/fastboot (make sure you have the latest version) per the flashing instructions at https://developers.google.com/android/images
 

4PDAXDA

New member
Dec 3, 2020
2
0
Google Pixel 3
Thank you for sharing!
I have a Pixel 3 (not pink, 64gb) from Woot (bought in spring 2021), that had a Verizon SIM in the slot with a red checkmark on it. I only realized that when I unwrapped the box, unboxed, and powered it on, as I was unaware of any of these nuances. Only after I played with it for a bit, did I take out the SIM card. I don't remember whether I connected to WiFi or how much of the phone I set up before taking out the card.
What I do remember, is reading up on how to flash another ROM (did that a lot a few years ago with various phones, espcially Xiaomi) or unlock the bootloader and coming across the fact that I got the Verizon version with a 35xxxx IMEI, and that its bootloader is "permalocked." Glad to see there is some info out there, since the idea popped back into my head after hearing about CalyxOS and how it's used mostly on Pixel devices.

I'm going to try this out shortly after saving my data from it, and will be back with some info. As of right now, the OEM unlocking toggle in Developer Options is white, NOT greyed-out...
 

Ioseb2899

New member
Dec 22, 2018
3
1
Thank you! It worked for me too for two Pixel 3 phones, one from B&H (software version PD1A.180720.031) and one from Woot (software version PQ1A.181105.017.A1). Here are the steps I followed (with android platform tools including adb and fastboot already installed):

1. Removed verizon sim card (just in case) before powering on
2. Powered on and skipped through Google setup
3. Connected to my T-Mobile tethered wifi instead of Verizon Fios home wifi (just in case)
4. Enable developer options, wait for "OEM Unlocking" to become not-greyed-out (requires wifi)
5. Enable USB debugging in developer options
6. Issue `adb reboot bootloader` from PC (or shutdown and use hardware keys)
7. Issue `fastboot flashing unlock` from PC
8. execute `flash-all.sh` from the official stock pixel 3 factory image zip from here: <https://developers.google.com/android/images#blueline>
a. This gets rid of Verizon's firmware completely
9. Wait for it to complete, reboot into bootloader
10. Issue `fastboot flashing lock` (erases user data) to re-lock bootloader
11. Booted normally and setup. OEM Unlocking is still available in developer options if I want it in the future.
I have hard reseted my phone and then skipped google setup but after that even I've connected to wifi its still greyed out. what can I do ? I've tried it so many times but I think am doing something wrong please help me
 

AsItLies

Senior Member
Nov 4, 2009
1,191
474
tucson
Google Pixel 3
Is this only works for new pixels that is not booted up even once ?

I don't think it's simply 'booted up once'. It *seems* it's more if the vzw sim is used, then that triggers whatever vzw does to lock the bootloader (I've read some believe that vzw is encrypting the bootloader).

I wouldn't bang my head against the wall, it's not that complicated. It's just basically, take the sim out before booting, do as minimal startup as you can but connect to wi-fi. Turn on Dev ops and hope you can select OEM Unlock.

that's it. either u can or can't. If you can't, don't think there's anything you can do about it, sorry.

cheers
 

Ioseb2899

New member
Dec 22, 2018
3
1
I don't think it's simply 'booted up once'. It *seems* it's more if the vzw sim is used, then that triggers whatever vzw does to lock the bootloader (I've read some believe that vzw is encrypting the bootloader).

I wouldn't bang my head against the wall, it's not that complicated. It's just basically, take the sim out before booting, do as minimal startup as you can but connect to wi-fi. Turn on Dev ops and hope you can select OEM Unlock.

that's it. either u can or can't. If you can't, don't think there's anything you can do about it, sorry.

cheers
thanks for reply, and am really sorry about it too. I hope someone will find the way to unlock bootloader on already booted and activated verizon pixel 3/3xl 🥺
 
  • Like
Reactions: 4PDAXDA

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
I bought several of these on the Woot deal. Out of 4, only one allowed the bootloader to be unlocked and they are all Verizon phones with a IMEI starting with 35. I have noticed one main difference, on the one that is able to be unlocked. The rest all have an eSIM and if I try to erase the eSIM it will fail. I suspect, considering everything else is the same that this is the reason they cannot be unlocked. The devices that permanently have a Verizon SIM in the eSIM slot cannot be unlocked. If anyone knows of a way to remove the eSIM then I would love to test the theory, but I have not found a way yet and believe me I have tried.
 

AsItLies

Senior Member
Nov 4, 2009
1,191
474
tucson
Google Pixel 3
I bought several of these on the Woot deal. Out of 4, only one allowed the bootloader to be unlocked and they are all Verizon phones with a IMEI starting with 35. I have noticed one main difference, on the one that is able to be unlocked. The rest all have an eSIM and if I try to erase the eSIM it will fail. I suspect, considering everything else is the same that this is the reason they cannot be unlocked. The devices that permanently have a Verizon SIM in the eSIM slot cannot be unlocked. If anyone knows of a way to remove the eSIM then I would love to test the theory, but I have not found a way yet and believe me I have tried.

Confusing. What is a 'device that permanently has a Verizon SIM in the eSIM slot'? And how are you determining that to be the case?

From what I've read, if the box doesn't have an identifier called EID xxx on it, then it doesn't have an esim. My vzw p3 doesn't have that.

Mine, also woot deal, was able to boot loader unlock, but attempting to add esim just gives 'something went wrong', etc.

cheers
 

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
Confusing. What is a 'device that permanently has a Verizon SIM in the eSIM slot'? And how are you determining that to be the case?

From what I've read, if the box doesn't have an identifier called EID xxx on it, then it doesn't have an esim. My vzw p3 doesn't have that.

Mine, also woot deal, was able to boot loader unlock, but attempting to add esim just gives 'something went wrong', etc.

cheers
They don't have a permanent Verizon SIM specifically. All but one, the one that can be unlocked indicates that it has an eSIM installed when I attempt to factory reset. I am assuming it to be a Verizon eSIM since they were originally Verizon phones as evidenced by the IMEI's. What are the chances that 3 phones used on Verizon from 3 random people would have had some other eSIM? And, from what I know, you can't install any other eSIM on the Verizon phones. So, by deductive reasoning I assume the eSIM to be Verizon's.

More details though: I didn't get the original Pixel box. I purchased the Scratch and Dent used models. It sounds like you received a new device or at least one with the original pixel packaging. Mine didn't have any EID or IMEI on the boxes. So, it's likely that if you had a new device, it had never been activated on Verizon network and therefore didn't have the "eSIM lock". If so, my theory is that it seems that Verizon may restrict the eSIM for their use on the device (but doesn't assign one) and only activates it when the device is used on Verizon network for the first time by a post-paid contract.

Either way, it seems that there are people who have activated their device on the Verizon network and could still unlock them. So, I'm not 100% confident on this.

All I know for sure is this: 3 of the devices all had gave an error saying that an eSIM that could not be erased during factory rest and they can not be bootloader unlocked. One did not ask to erase an eSIM with factory reset and could be unlocked. So, you can confirm my theory by checking if the eSIM box is checked if you go to factory reset (Obviously, don't complete the reset). I assume it is not and that you are able to boot loader unlock the device.
 

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
Screenshot_20210814-101438.png
 

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
The first image is from the device that can be unlocked. The last two are from one of the devices that cannot. Please ignore the fact that the first image is running android 12 beta (It had the eSIM unchecked on Android 11 as well).

Also, the first post from this thread: https://forum.xda-developers.com/t/esim-on-verizon-branded-pixel-3.4266477/

Anyway, I get this error if I try to factory reset a device with eSIM checked:

Screenshot_20210814-102357.png
 

AsItLies

Senior Member
Nov 4, 2009
1,191
474
tucson
Google Pixel 3
@neatojones thnx that's a lot of info, good stuff. But, first thing I'd say is there may be some misinterpretation.

when it says 'erase donwnloaded sim' I'd bet that is simply a generic part of the 'reset' pixel3 (as some variants do have an esim). I don't think it's an inication of the device being able activate / use an esim or not, it's just there in case your device is one of the ones that has the capability.

haven't read the link you mentioned, will do that now and get back. I could be wrong about this, which would be great, I'd like mine to have esim capability. But what I've read says no, not able to do it.

yeah just read that and if u look towards the bottom, my comments along with others saying much the same, vzw did something to those devices and no one seems to have figured out what it is, but there seems to be no way to get an esim on it. It also seems possible they requested the devices be made WITHOUT the esim chip, and there's really no way the software will know that other than to tell us what it's been telling us any time we try to add / delete / reset etc: 'failed, try again'.

I keep going back, to understand this better, to the results of 'how to know if your device has an esim?' search. And they always say on the box will be EIDxxx, just the way u have IMEIxxx. And that makes sense even if it was VZW and it was a locked esim, they would STILL have that on there, but they don't.

That doesn't mean there's no way to hack it, but doesn't look like anyone has done that, assuming there is a real possibility of it.

cheers
 
Last edited:

AsItLies

Senior Member
Nov 4, 2009
1,191
474
tucson
Google Pixel 3
That's possible, but there is a 100% correlation with the error and not being able to unlock the bootloader. I have a device which does not give this error or have the box checked and the bootloader can be unlocked
okay, that is interesting, and it certainly would lead one to believe that an esim has been erased...

but when you try to flash a new esim in this case it fails right? Assuming that's the case, I'd guess the only way to go forward is to try debugging the process and see if u can determine why it fails?

cheers
 
  • Like
Reactions: neatojones

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
okay, that is interesting, and it certainly would lead one to believe that an esim has been erased...

but when you try to flash a new esim in this case it fails right? Assuming that's the case, I'd guess the only way to go forward is to try debugging the process and see if u can determine why it fails?

cheers
Correct, it seems to fail to erase whatever is in the eSIM on the ones that won't unlock. It only checks the box on the devices that don't have the ability to unlock. In those cases it is preselected, I didn't select it. On the one that can be unlocked, I can select the box, but it isn't preselected (see the first photo).

Yes, I would want to debug that process but I could use a hand from someone more knowledgeable about that. My guess is that it is marked read only and we would need root to remove whatever is written to that SIM.

Beyond that, my best guess is because of that eSIM, the phone continues to identify as Verizon when it connects to the internet and that's why the bootloader can't unlock on those devices.
 

neatojones

Senior Member
Dec 28, 2010
156
47
Springfield, IL
So, after further research, you are right that the devices might not have been Verizon. The IMEI that start with 35 are retail units, but could theoretically be from another country and so Verizon isn't a given. But, the issue still remains that the device are recognizing the presence of some eSIM data that cannot be removed and also unable to be bootloader unlocked. It is know that the devices must "call home" for approval to bootloader unlock and so I think this is more than co-incidence... I could be wrong. :)
 

AsItLies

Senior Member
Nov 4, 2009
1,191
474
tucson
Google Pixel 3
@neatojones My understanding, from some searching, is that there's a few ways carriers try to lock a sim, and thus various ways to unlock them. That's partly why they always say to stay on original firmware until it's carrier unlocked, because within that stock firmware is an app that needs the 'unlock code' put in for it to happen. Side note; just bought a sam tab a wifi - lte tablet, had to reasearch which was easiest to sim unlock. turns out the Sprint version uses a 'firmware' sim lock, the others do not. Which made me wonder; flashing a diff firmware with odin would unlock sim?

Now, with more devices having eSims, not sure how that affects things. Of course it too would need to be locked. But exactly 'how' this is happening, no idea for sure.

I've only used adb debugging a few times. But a google seach turns up all the needed info. Basically turn on adb, connect to lap / desk top, start debug logging just prior to when u know the error will occur, then stop it just after it occurs. Within the debug log will be the error. Note, it would be wise to use debug switches that indicate which output level you want, I"d suggest something like just Warnings and Fatal Errors, as the output can be enormous, there will be thousands of lines of output within just a few seconds, so you don't want all debug output.

Not sure where u believe I indicated these might not be vzw phones. I don't believe that. And, I don't know, but again, I'd say that just because the sftware is doing something with an 'esim' (or seems to be), doesn't mean there is esim data there. It could well be that there is no data there but the sftware is just 'going through the routine' it would go through normally, not aware of the fact vzw may have done something that keeps that sftware from doing what it would do with a 'normal' unlocked pix 3.

cheers
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Hey, I'm confused about the factory image version. Say I want to keep the phone on Android 9, which factory image do I flash? If I want the bootloader to remain unlocked do I flash any image that doesn't say "Verizon" - will flashing non-Verizon factory ROMs cause any issues? I don't really care about verizon network compatability

    If you want to stay on Android 9, flash the last Android 9 version, 9.0.0 (PQ3A.190801.002, Aug 2019).

    Flashing non-Verizon images is not an issue. The images that say Verizon have some Verizon specific information (probably radio frequencies) that have not yet been incorporated into the mainline image. Once those changes are incorporated into mainline, there is no Verizon specific image for that update cycle. The Aug 2019 image will have the Verizon specific info from June 2019.
    1
    Hey guys. This thread seems pretty recent, so I just wanted to ask if anyone has a decent way of identifying if a phone is a Verizon or not? Looking to get one off eBay for eSim usage and want to avoid VZ. The phone starts with IEMI 35. SN starts wtih 89.

    * Never mind. The imei.info site is really good and actually gives you the exact model from imei. The ones I were looking at are all VZ :(
    AFAIK, an IEMI beginning with 35 means it is a Verizon phone.
  • 4
    I mean, I'm not complaining. But I was incredibly surprised! I bought the phone BRAND NEW AND SEALED, from the current sale on woot ($170), and yet was still intending on returning it after I realized I had bought a Verizon variant, albeit carrier unlocked. Yeah, it's only the 64gb version, but I literally just bought this for testing, and as a backup. Actually bought a P3 from a friend that was in decent condition. A really close, trusted friend too, but unfortunately it just happened that about a month later the battery started exhibiting the dreaded behavior indicating it was starting to fail, so I decided to pull the trigger on the sale, not realizing it was a Verizon model. I went into much more detail about it in my post on Slickdeals: https://slickdeals.net/forums/showpost.php?p=146850461&postcount=127

    It's also pink, but I'm putting on the Mint colored Spigen Neo Hybrid case on it anyway ;)

    So anyway, from all my collective knowledge about Pixels, and plenty of knowledge about (and hate towards) certain US carriers locking down devices, I wasn't expecting to be able to bootloader unlock this phone. Luckily I decided to open the box anyway and see if the OEM unlocking toggle was greyed out (which is what I fully expected!)... And it wasn't!? I still expected something, anything, to go wrong, but no, it actually successfully unlocked the bootloader (proceeded to factory reset as usual, etc)!! Unfortunately, it seems that the eSIM is still locked up and disabled, but like I said, for my usages as a simple dev'ing, testing, and/or backup phone, the eSIM isn't really important to me.

    Don't think it matters, but I did this immediately upon opening the brand new phone, and it was on firmware PQ3A.190505.002 (May 2019, Pie). I mentioned it in my SD post, but the IMEI does start with 35, and checking it through Verizon's prepaid check system also indicated it as Verizon branded. I know that historically (on older Pixels, not even the 3, iirc), there was a [anecdotal] workaround where some owners would pop out the VZW SIM card before ever turning on the phone and they could then unlock the bootloader. Crazier for me is that I didn't even bother pulling out the VZW SIM card the phone came with before turning it on.

    The only thing I can think, is that (and my memory here is foggy about the anecdotal posts) maybe when people were buying the phones from Verizon, those phones were actually turned on with then-active SIM cards, thus allowing them to "phone home" and permanently lock up the bootloader, at some point before ultimately shipping to the buyers. However, as these brand new Pixel 3's being sold are just leftover old, albeit brand new and factory sealed, stock, they were never turned on, whether at all or with active VZW SIM cards, at any point. When I initially turned on this new phone earlier today, since I left in the VZW SIM card included with the phone, I got a message pop up saying something along the lines of "we couldn't activate the device" or whatever.

    So anyway, I wanted to say all of this because I'm always fascinated by flukes like this, where someone (me in this case!) is able to bootloader unlock a phone that should otherwise be completely unable to do so... Also attaching screenshots to show that it is indeed a Verizon branded Pixel 3 with the bootloader now unlocked. Note that it now shows current April 2021 firmware installed, but like I mentioned before it shipped with May 2019 installed from the factory, and I updated the firmware after unlocking the bootloader immediately after opening. Is there any explanation to this? Did I just get incredibly lucky? Does my theory in the previous paragraph possibly make sense? Or is there already a known explanation somehow and I just was completely unaware (and if so please let me know)?

    final note: pics look like phone's screen is fuzzy because I haven't even removed the factory plastic wrap yet, lol. amazon glass screen protectors come tomorrow!

    EDIT: LMAO! The listing on Woot now says in big bold letters, "The bootloader is LOCKED on these phones". Pretty sure it didn't say that when I bought it, so must be a lot of people complaining about it and trying to return! Not sure how I was able to do it though still... even if I couldn't, I would have just cited the lack of eSIM as my reason for return. Fully Unlocked != eSIM Neutered, lol.
    3
    Thank you! It worked for me too for two Pixel 3 phones, one from B&H (software version PD1A.180720.031) and one from Woot (software version PQ1A.181105.017.A1). Here are the steps I followed (with android platform tools including adb and fastboot already installed):

    1. Removed verizon sim card (just in case) before powering on
    2. Powered on and skipped through Google setup
    3. Connected to my T-Mobile tethered wifi instead of Verizon Fios home wifi (just in case)
    4. Enable developer options, wait for "OEM Unlocking" to become not-greyed-out (requires wifi)
    5. Enable USB debugging in developer options
    6. Issue `adb reboot bootloader` from PC (or shutdown and use hardware keys)
    7. Issue `fastboot flashing unlock` from PC
    8. execute `flash-all.sh` from the official stock pixel 3 factory image zip from here: <https://developers.google.com/android/images#blueline>
    a. This gets rid of Verizon's firmware completely
    9. Wait for it to complete, reboot into bootloader
    10. Issue `fastboot flashing lock` (erases user data) to re-lock bootloader
    11. Booted normally and setup. OEM Unlocking is still available in developer options if I want it in the future.
    2
    Hey, I'm confused about the factory image version. Say I want to keep the phone on Android 9, which factory image do I flash? If I want the bootloader to remain unlocked do I flash any image that doesn't say "Verizon" - will flashing non-Verizon factory ROMs cause any issues? I don't really care about verizon network compatability

    If you want to stay on Android 9, flash the last Android 9 version, 9.0.0 (PQ3A.190801.002, Aug 2019).

    Flashing non-Verizon images is not an issue. The images that say Verizon have some Verizon specific information (probably radio frequencies) that have not yet been incorporated into the mainline image. Once those changes are incorporated into mainline, there is no Verizon specific image for that update cycle. The Aug 2019 image will have the Verizon specific info from June 2019.
    1
    Thanks for the direction. Haven't done a root on a phone in a long time.

    Indeed, I am a Slicker ha. Over there I am @Skullk. The name was taken here so I used an alternate. Been a long time lurker on these forums.

    This was the Slickdeal https://slickdeals.net/f/14972183-google-pixel-3-128gb-not-pink-199-99-with-free-shipping-on-woot

    I received the phone yesterday. Made sure no SIM installed. Battery was completely dead, that makes sense though as these are some older stock.

    Hope to have some time this weekend to give it a try. I'll report back with my findings.

    Cheers!
    1
    Hey guys. This thread seems pretty recent, so I just wanted to ask if anyone has a decent way of identifying if a phone is a Verizon or not? Looking to get one off eBay for eSim usage and want to avoid VZ. The phone starts with IEMI 35. SN starts wtih 89.

    * Never mind. The imei.info site is really good and actually gives you the exact model from imei. The ones I were looking at are all VZ :(
    AFAIK, an IEMI beginning with 35 means it is a Verizon phone.