OEM Unlock Official Verizon Google Pixel 2 XL (WORKING!) Warranty Replacement

Did it work for you? Need fresh Pixel (i think)(NO SIM) July patch which is 8.1

  • Yes

    Votes: 17 27.4%
  • No

    Votes: 45 72.6%

  • Total voters
    62

slogar25

Senior Member
May 19, 2012
387
121
73
Well if there are any devs or anyone with programming language knowledge out here still willing to give a helping hand there are some cve's out there right now for anything prior to October's security update. Namely, CVE-2018-9513,14,15. There is even a working POC here:

https://www.exploit-db.com/exploits/45558/

Been trying to teach myself some programming in C but coming along slowly. I believe this is do-able. Just need a program with the correct arguments to elevate privileges
 

Airpil

Senior Member
Feb 12, 2007
258
73
0
Hello, i know it is sounds stupid but i have sold my VZ Pixel 2 XL and bought Google version. That is it. =) This is the easiest method.
Because all the threads for this matter are currently inactive i would like to share couple of thoughts here.
1) removing com.android.phone app for admin user do the job OEM Unlock became available on any SW version ( flashing unlock doest work) and the option is still there even after Factory Reset from Recovery. But if you do a Factory Reset via Erase All - everything will be locked again. You have to be careful when buying used Pixels. One guy tried to sell me a VZ phone saying this is a Google version.
2) Flashing modified ZIP doest work. Because the ZIP file itself have to be signed correctly. However Google use the same signatures for OTA updates and it is quite simple to modify signature bits via HEX editor. The main issue i wasn't able to solve - whole file SHA256 sum. there are several control bits which should have a correct offsets (ECDSA)
3) Just before i bough a normal Pixel2 xl i was playing with LG Download mode. Here you can find the more or less working tool for LAF github.com/rc420head/lglaf
From my point of view this tool is really promising. At least we can get an access to the device when recovery\os is "sleeping" and play with extremely limited CLI.

4) OEM Lock - is a server side feature. Google lock the bootloader based on IMEI check. IMEI allows uniquely identify the user. And based on the latest GDRP this approach - ILLEGAL. Somebody (Google) process personal information (IMEI) without agreement ( OEM lock works even when we disagree with all Terms of Agreement )
5) VZ - almost impossible to reach support team.
6) Everybody who wants to have their bootloader unlocked but doesnt have a skils Can chat with Google support (Every evening for example)
7) This is ridiculous - Pixel phones the only phones with pure Google view on Android future. And i think we have to be ready and build a strong comunity ( as a Jailbreak community) . sooner or later all the manufactures will lock the bootloader and we will be in a jail. People fighting for transsexuals, vegans, etc. but doesnt care about a jailed devices. And this is a Liberty..
8) I found a way to get an access to the QXDM port on Pixel 2 XL. I will share my findings later and will continue to poke a LG Download mode.
apologies for my En . )
 
Last edited:

MColbath

Senior Member
Oct 28, 2013
127
48
0
Hello, i know it is sounds stupid but i have sold my VZ Pixel 2 XL and bought Google version. That is it. =) This is the easiest method.
Because all the threads for this matter are currently inactive i would like to share couple of thoughts here.
1) removing com.android.phone app for admin user do the job OEM Unlock became available on any SW version ( flashing unlock doest work) and the option is still there even after Factory Reset from Recovery. But if you do a Factory Reset via Erase All - everything will be locked again. You have to be careful when buying used Pixels. One guy tried to sell me a VZ phone saying this is a Google version.
2) Flashing modified ZIP doest work. Because the ZIP file itself have to be signed correctly. However Google use the same signatures for OTA updates and it is quite simple to modify signature bits via HEX editor. The main issue i wasn't able to solve - whole file SHA256 sum. there are several control bits which should have a correct offsets (ECDSA)
3) Just before i bough a normal Pixel2 xl i was playing with LG Download mode. Here you can find the more or less working tool for LAF github.com/rc420head/lglaf
From my point of view this tool is really promising. At least we can get an access to the device when recovery\os is "sleeping" and play with extremely limited CLI.

4) OEM Lock - is a server side feature. Google lock the bootloader based on IMEI check. IMEI allows uniquely identify the user. And based on the latest GDRP this approach - ILLEGAL. Somebody (Google) process personal information (IMEI) without agreement ( OEM lock works even when we disagree with all Terms of Agreement )
5) VZ - almost impossible to reach support team.
6) Everybody who wants to have their bootloader unlocked but doesnt have a skils Can chat with Google support (Every evening for example)
7) This is ridiculous - Pixel phones the only phones with pure Google view on Android future. And i think we have to be ready and build a strong comunity ( as a Jailbreak community) . sooner or later all the manufactures will lock the bootloader and we will be in a jail. People fighting for transsexuals, vegans, etc. but doesnt care about a jailed devices. And this is a Liberty..
8) I found a way to get an access to the QXDM port on Pixel 2 XL. I will share my findings later and will continue to poke a LG Download mode.
apologies for my En . )
Do you mean Emergency Download Mode (EDL) when you are talking about accessing the QXDM port? If you actually are able to get into diagnostics mode though, that might change things. I've poked around EDL with OpenPST, can't really do much other than connect to the device because we don't have the programmers.

In regards to the LAF partition. There actually isn't anything that can be done, the signature/hash for the Pixel is different from LG devices according to the creator of LGLAF. The most that can be done is dumping partition. When you try to write, it will say it succeeds but nothing will change.
 

Spider210

Senior Member
Sep 13, 2010
250
24
18
I just received my FRU replacement from Verizon and can VERIFY THIS WORKS, accroding to the IMEI checker webpage it does show GOOGLE_VRZ_FRU_64G
It was on 8.1,
Booted phone with no sim, skipped all the settings Also set send usage and diag to off in
Turned off automatic system updates in dev options., turned on USB Debugging, kept screen awake while charging. the Ran ADB "adb shell pm uninstall --user 0 com.android.phone". Turned on wifi and waited a couple minutes. Returned to Developer options and OEM Unlock was no longer grayed out so I turned it on

Upgrade to Pie. Did the OTA. OEM Unlock stuck through the update.
Skipped the security update, then Shut down phone from system. Once phone was off I held down power button and the volume down button to take me to Fastboot mode.
Ran "fastboot flashing unlock".
Got the the screen to say yes or no to bootloader unlock.
Phone erased
Now I have fresh setup and OEM Unlocking is greyed out but says Bootloader is already unlocked!

edit

I was able to successfully download taimen-pq1a.181105.017.a1-factory-e79a94ed

and using the flash-all to flash it

so now my next question is, can I relock it now that its factory flashed and be able to reunlock it in the future if needed?
 
Last edited:

Spider210

Senior Member
Sep 13, 2010
250
24
18
Can anyone answer this I do have the Verizon model that I got as a replacement I was able to unlock the bootloader and flash the latest Android 9 from Google if I relock it will I be able to unlock it again in the future?

Sent from my Pixel 2 XL using Tapatalk
 

Badger50

Forum Moderator
Staff member
Feb 27, 2011
11,218
9,394
253
60
Kansas City
I'm about to buy this phone today from Best Buy: https://www.bestbuy.com/site/google-pixel-2-xl-64gb-just-black-verizon/6099989.p?skuId=6099989

Does anyone know if I'll be able to unlock the bootloader and root it? It says (Verizon) but I'm not sure if that's the variant or if the google variant can be locked to a carrier.
It's likely the Verizon variant. Therefore, you won't be able to unlock the bootloader. That's the way it is with most retailers. About the only way to get a true google variant is to buy it directly from google.
 
  • Like
Reactions: eulogy1337

eulogy1337

Member
Apr 25, 2014
15
1
0
It's likely the Verizon variant. Therefore, you won't be able to unlock the bootloader. That's the way it is with most retailers. About the only way to get a true google variant is to buy it directly from google.
That's so frustrating. Just let me do what I want with the device that I own. Ugh.

I'll try OP's method anyway since this is the only good phone that I can afford thanks to the $400 off. I guess I'll just have to go a generation without root unless someone comes up with a new method.
 

Badger50

Forum Moderator
Staff member
Feb 27, 2011
11,218
9,394
253
60
Kansas City
That's so frustrating. Just let me do what I want with the device that I own. Ugh.

I'll try OP's method anyway since this is the only good phone that I can afford thanks to the $400 off. I guess I'll just have to go a generation without root unless someone comes up with a new method.
I hear ya my friend. I wouldn't hold your breath about an unlocking method anytime soon. Heck, the original verizon pixel just got an unlocking method about 5 months ago :eek:
 

wolfu11

Senior Member
Jan 26, 2013
621
409
93
Minneapolis
That's so frustrating. Just let me do what I want with the device that I own. Ugh.

I'll try OP's method anyway since this is the only good phone that I can afford thanks to the $400 off. I guess I'll just have to go a generation without root unless someone comes up with a new method.
Google verison is pretty cheap on swappa right now. I got one for under 400 with 16 months left on the warranty transfer. I gave up and sold my Vwz one but it sold for 450 and I bought it in April for 400 off so it's a win win.
The sad part is the v30 has an unlock method for all varients but we may not see one for this phone the way it looks. ...
 

adamszostek

Member
Jun 1, 2014
19
2
0
I've just bought Pixel 2XL, I was in a hurry because the phone was in mint condition and the price for 128GB variant was super nice - I live in Europe and here, Pixels are quite expensive - and I forgot that it may be Verizon's device. And indeed it's Verizon model.
Hopefully, someone will figure out how to unlock it, but my previous Pixel 1 was stock and I never needed to unlocked it, so think I can live with it.
 

muppetmaster916

Senior Member
Jul 31, 2013
1,059
397
0
Boston
I've just bought Pixel 2XL, I was in a hurry because the phone was in mint condition and the price for 128GB variant was super nice - I live in Europe and here, Pixels are quite expensive - and I forgot that it may be Verizon's device. And indeed it's Verizon model.
Hopefully, someone will figure out how to unlock it, but my previous Pixel 1 was stock and I never needed to unlocked it, so think I can live with it.
Honestly I'd love root, but this phone is great stock. And you know you'll get updates before anything other than pixel.
 

illestclinton

New member
Aug 1, 2017
2
0
0
Took a few tries and a factory restore, but it worked for me. Just flashed TWRP and Magisk. Thanks!

I should note this is a warranty replacement on the September update.
 

cludlow

New member
May 6, 2017
2
0
0
Unlocked Google Pixel 2 Verizon?

Hello,

I just reset my already Pie Pixel 2 Verizon and confirmed that following the steps does result in the toggle switch becoming available. However when I ran through part two I got stuck. Since I am already running the latest version I can't OTA and so I end up with the dreaded "FAILED (remote: 'Flashing Unlock is not allowed')"
 

ducats

Senior Member
Dec 6, 2010
196
69
0
SoCal
Just got my warranty replacement today and this worked like a charm. I used both unlock and unlock critical commands. Next Pixel will be from Google!