OEM Unlock Official Verizon Google Pixel 2 XL (WORKING!) Warranty Replacement

Did it work for you? Need fresh Pixel (i think)(NO SIM) July patch which is 8.1

  • Yes

    Votes: 17 27.4%

  • No

    Votes: 45 72.6%
  • Total voters
    62
X

Xihexa.io

Member
Jul 25, 2018
18
10
0
Feb 15, 2019 at 7:50 AM
So, I haven't found many viable exploits for the Verizon variant myself. I have however been able to copy and install a . pem certificate and a RSA key thanks to using a Linux terminal.
Been poking around and editing a bunch of stuff in the root folder of this thing.
As of now, I've been able to grant myself su and sudo access only if I login via HTTP and keep the app in a wake lock, as well as keeping it in my recent apps list. (Granted myself this by editing the passwd, sudoers, profiles, debconf, and a few other files.)
The odd thing I've noticed is, mostly every mount point is unmounted, and apparently never has been mounted minus the necessary mounts i.e boot, system, etc.
I'm currently toying around with editing the fstab, mounts, and testing certain things.
There's a lot of stuff either in the wrong file format or place, and a lot of system folders/files blocked off to the point chmod, chown, chroot etc, will not yield.
It seems possible that you could programmatically give yourself root, however until I can get into the /dev/root folder itself, I haven't found anything related to unlocking the bootloader.
I'll keep y'all posted, just don't expect much cuz I'm a noob at this sort of stuff still and it'll definitely take some time.
I AM able to run ADB/Fastboot while running Debian in an isolated shell, I just have to figure out how to simultaneously emulate a Windows environment in order to make it think that it's actually connected so I can test commands while in a root shell. (I don't have access to a PC, so keep in mind I'm doing all this on the Pixel 2 XL itself.)
Who knows, maybe with the actual release of Android Q this year, we may be able to unlock it before upgrading to the stable, official update like many were able to do upgrading from 8.1 to 9.0.
 
Last edited:
  • Like
Reactions: STraver, westhaking, siggey and 2 others
S

STraver

Senior Member
Jul 18, 2007
470
65
48
Feb 20, 2019 at 8:36 PM
Xihexa.io said:
So, I haven't found many viable exploits for the Verizon variant myself. I have however been able to copy and install a . pem certificate and a RSA key thanks to using a Linux terminal.
Been poking around and editing a bunch of stuff in the root folder of this thing.
As of now, I've been able to grant myself su and sudo access only if I login via HTTP and keep the app in a wake lock, as well as keeping it in my recent apps list. (Granted myself this by editing the passwd, sudoers, profiles, debconf, and a few other files.)
The odd thing I've noticed is, mostly every mount point is unmounted, and apparently never has been mounted minus the necessary mounts i.e boot, system, etc.
I'm currently toying around with editing the fstab, mounts, and testing certain things.
There's a lot of stuff either in the wrong file format or place, and a lot of system folders/files blocked off to the point chmod, chown, chroot etc, will not yield.
It seems possible that you could programmatically give yourself root, however until I can get into the /dev/root folder itself, I haven't found anything related to unlocking the bootloader.
I'll keep y'all posted, just don't expect much cuz I'm a noob at this sort of stuff still and it'll definitely take some time.
I AM able to run ADB/Fastboot while running Debian in an isolated shell, I just have to figure out how to simultaneously emulate a Windows environment in order to make it think that it's actually connected so I can test commands while in a root shell. (I don't have access to a PC, so keep in mind I'm doing all this on the Pixel 2 XL itself.)
Who knows, maybe with the actual release of Android Q this year, we may be able to unlock it before upgrading to the stable, official update like many were able to do upgrading from 8.1 to 9.0.
Click to expand...
That is way over my head, but it sounds like you are making progress. Thanks for your efforts and rest assured you will be quite the hero should you find a bootloader unlock!
 
  • Like
Reactions: Xihexa.io
S

ScottyRay76

Member
Apr 20, 2018
11
8
0
Kennett
Feb 21, 2019 at 3:04 AM
Ok...factory reset....

Skip everything after reboot to homepage....

Turn dev options on...toggle stay awake...toggle off auto updates...turn on debug mode.. gi back one page leaving the dev selection list up from settings fo make it easy...then press home...

Cable up with adb and run the the same command I use on Verizon pixel xl.. adb shell then
$ pm uninstall --user 0 com.android.phone..will say success!

Then immediately on the phone go to wifi and select your router and supply password. Now...be ready after you press enter and jump to the menu we left in background if you did that is the settings list that has dev options close to bottom and click dev options. .look at OEM then back one page wait just one second the click dev options again and check again....then press back again ....continue ti jump back wait a second the click to jump back into dev options...usually by the 10 or more times there it is...flipable on any Verizon phone...be ready each time for the OEM to be in a moveable status before going back...but or stay in dev options a second at a time or so...for me any any security patch I can flip it...confirm it...then presto that's done...now what...lol..can anyone run from here??.. I need to know the results when trying to run fastboot unlock comnands...??...if needed just factory reset and repeat...it will allow to toggle the OEM unlock...it has something to do with going in and out over and over without waiting very long until you catch it then flip it...I had no luck the normal enable inter and wait few and then check at tour leisure and toggle it...it was always gray ...until this glitch I guess you call it...but it still says not allowed on mine when unlock commands from fastboot are ran.when you go back its toggle off and gray again until factory reset and the same sing and dance...but when I toggle it on and reboot normally it go out and come back or look at it tomorrow it stays on I the ok to unlock bootloader position...only after running an attempted booster unlock it toggle back off...so just wondering while this is in the correct position if anyone can look under the hood and figure out anything further while while the toggles is good before running unlock commands....maybe security is half down or the door could be jostled open that seems to be jumping in the way during the command to unlock while its I. The correct status to normally allow the command...I felt I was close...seeing the toggle on cant ge nothing could it...when you toggle it back off yourself after catching it the first time you can turn off and on all day even after rebooting...it says it needs to reboot to turn back o. Security even when flipped back off...and a. Confirmation when toggled in.....so once toggled on...it works like it should until I try to unlock...oy then it trips it back off....anyone have same results?,
 
Last edited:
  • Like
Reactions: Xihexa.io, shooterlgk, siggey and 1 other person
X

Xihexa.io

Member
Jul 25, 2018
18
10
0
Feb 23, 2019 at 7:26 PM
STraver said:
That is way over my head, but it sounds like you are making progress. Thanks for your efforts and rest assured you will be quite the hero should you find a bootloader unlock!
Click to expand...
So far I've managed to find a boot ID and several other tidbits, currently trying to figure out a way to create a new user with superuser privileges that I can add to the phone using the multi user feature, all the bootloader stuff is in the init and boot files however I have not found a way to edit them successfully. Ain't giving up tho cuz if nobody else is gonna find it I figure I might as well see what I can do lol
 
  • Like
Reactions: siggey, xdamember143, underoath403 and 1 other person
P

pantallica420

Member
Aug 13, 2018
13
7
0
Feb 24, 2019 at 4:46 PM
Xihexa.io said:
So far I've managed to find a boot ID and several other tidbits, currently trying to figure out a way to create a new user with superuser privileges that I can add to the phone using the multi user feature, all the bootloader stuff is in the init and boot files however I have not found a way to edit them successfully. Ain't giving up tho cuz if nobody else is gonna find it I figure I might as well see what I can do lol
Click to expand...


I will say it is very much appreciated. I am on the same mission myself... If there is a specific way to change the phone from a production model to a userdebug you can at least run commands as root in adb and fastboot... I am definitely not a pro at all this but a touch more than a noob and I'm new to the whole a/b dual boot partitions but I am recovering from a surgery that prevents me from getting back to my old jobs so while I'm recovering I'm trying to learn enough to at least be entry level in all this stuff as it's easier on my body...lol This is where I am at on this myself. If anybody knows how to change this nightmare/extreme learning experience I call my phone from a production model to a userdebug model and is willing to share the info, please let me know. Thank you.
 
  • Like
Reactions: Xihexa.io, sgtslaughter64, underoath403 and 2 others
S

Skorpyun812

Senior Member
Jul 29, 2012
79
29
0
Mar 8, 2019 at 12:04 AM
hallr88 said:
Started with device on July 5th security patch Android Oreo 8.1. 100% Verizon device. Got replacement phone in the mail. No SIM inside. Turned it on. Plugged it in to a computer. Skipped past everything on setup. Turned on Developer options. OEM Unlock was grayed out.

Turned off automatic system updates in dev options. Turned on USB Debugging. Keep screen awake while charging. Ran ADB "adb shell pm uninstall --user 0 com.android.phone". Turned on wifi and waited a couple minutes in the chrome browser. Returned to Developer options and OEM Unlock was no longer grayed out. Ticked it.

Kept phone running for a few minutes. Turned device off and booted to fastboot. Still locked. Returned to system from bootloader. OEM Unlock still blue. Let apps update and also logged into Google account. Noticed OEM Unlock was staying unlocked through a couple reboots.

Decided to upgrade to Pie. Did it OTA. OEM Unlock stuck through the update. Shut down phone from system. Once phone was off I held down power button and the volume down button to take me to Fastboot mode. Ran "fastboot flashing unlock". BOOM! Got the the screen to say yes or no to bootloader unlock.
Click to expand...
Warranty swap, Verizon, came with Pie, December 5,2018. Followed your instructions: Ran adb shell pm uninstall --user 0 com.android.phone. Received "Success" response and OEM Unlock was still grey. Continued by enabling WIFI and opening Chrome. I let it sit for a few minutes as well and when I came back Dev Options, OEM unlock was blue and allowed me to toggle it to unlock. Restarted into fastboot, to find the bootloader was still reporting locked status. Restarted to system and OEM unlock was once again greyed out and locked. Now when I run command - adb shell pm uninstall --user 0 com.android.phone - I receive the following failure message

PS C:\android-studio\tools> PS C:\android-studio\tools> adb shell pm uninstall --user 0 com.android.phone
Get-Process : A positional parameter cannot be found that accepts argument 'adb'.
At line:1 char:1
+ PS C:\android-studio\tools> adb shell pm uninstall --user 0 com.andro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: :)) [Get-Process], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.GetProcessCommand

PS C:\android-studio\tools> Failure [not installed for 0]
Failure : The term 'Failure' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ Failure [not installed for 0]
+ ~~~~~~~
+ CategoryInfo : ObjectNotFound: (Failure:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

PS C:\android-studio\tools> PS C:\android-studio\tools>

Methinks I missed my opportunity. :(

Note: an update did download while wifi was enabled but, it has not been installed. I'm going to try a factory reset and see if I can't get it blue again. Update to follow.

UPDATE 1: performed factory reset without installing anything and ran "adb shell pm uninstall --user 0 com.android.phone" and was able to acheive "success" again:

PS C:\android-studio\tools> adb shell pm uninstall --user 0 com.android.phone
Success
PS C:\android-studio\tools>

Ran Chrome WITHOUT connecting to Wifi which did nothing but, the minute I connected to wifi and news updates came up (in chrome), I was able to toggle it again. I played with the toggle and everytime I lock it, a message pops up that tells me to restart to enable this protection feature. I wonder if this is happening Automatically, even if you restart the phone with OEM unlocked. For now, dinner is ready but, I will continue to play with this awhile tonight. More updates to come.

As you stated "Returned to system from bootloader. OEM Unlock still blue."
This is where things are different for me. I returned to system from bootloader and it was grey again. I almost wonder if the Pie update addressed your exploit at this very junction. It stays blue if I just do a simple restart (note that system date reverted back to Jan. 1) but, I'm a bit afraid of rebooting to fastboot.

UPDATE 2: tried running some commands in system, powershell just sat there waiting, never did a thing with either fastboot oem unlock or fastboot flashing unlock_critical. Turned off Wifi and tried running the commands again in fastboot (which Idk anything about deving so feel free to laugh at me) and again, nothing. Restarted phone . . . it's grey again. :mad:

UPDATE 3: I've allowed all the apps to update. Based on what I've read, it seems the firmware can accept updates without affecting the OEM unlock toggle. I'm crossing my fingers, as I'm going to let the phone install the security update, which I realize could be a game ending move but, there's still no IMEI registered to the device (or rather, it's not reporting inside the system software at this time) so I'm either going to screw myself or, determine that the problem exists within IMEI. The question I have yet to find an answer to is, do the security updates keep us locked out or is it IMEI? fingers crossed I don't screw myself here. Either way I have a Sprint SIM. But, at this time fastboot unlock commands are not responding in my powershell.

UPDATE 4:
So after considering how irreversible IMEI registration and Security updates are, I decided to NOT allow the security update and instead, get my SIM card going (I figured, if it has something to do with Verizon SIMs, I should be ok with a Sprint SIM). For some reason or another, my IMEI/MEID info would not show up. I performed another factory reset and the SIM began to talk. I ran the command "adb shell pm uninstall --user 0 com.android.phone" and once again acheived "success" however, after repeating the steps - disabling auto updates, enable USB debug, etc. (which I did every time I reset) - the OEM unlock is still greyed out, despite the success message. I still haven't installed the security update and will try another factory reset without SIM to see if any problems or successes replicate, though I have a feeling, the IMEI now being registered, is permanent AND possibly the culprit AND my gut tells me there's no going back. I know very little about these things compared to most here however, I hope at the very least I was able to confirm suspicions and/or provide info not previously provided. To confirm this is a refurbished Google Pixel 2XL originally purchased from Verizon, warrant replacement that came with Android 9 (Pie) on the December 5, 2018. I hope the information I've provided here is of some use and I will play with it a bit more tomorrow. if I discover anything new or useful, I will run back here and share my findings ASAP.

I should have never gone against my gut, purchasing direct from Verizon; instead of the unlocked variant, online. feeling like an ass.
 
Last edited:
  • Like
Reactions: siggey and xdamember143
S

Skorpyun812

Senior Member
Jul 29, 2012
79
29
0
Mar 8, 2019 at 6:33 PM
I was able to find a relation between IMEI and the OEM toggle. After firing up the device and allowing the SIM to register, I once again ran the code, "adb shell pm uninstall --user 0 com.android.phone" which surprisingly have me a "success" reply. This time though, the switch stayed greyed out and at that moment my mobile connection disappeared like a ghost. I tried toggling my mobile data but, after shutting it off I could not turn it back on. It was then that I noticed my IMEI/MEID info had all mysteriously disappeared. I replicated this a couple times.

What I've concluded is, even though I'm on Sprint, I can't use my mobile network after running "adb shell pm uninstall --user 0 com.android.phone". I can go back and reset everything, take the SIM card out and get the switch to toggle but, then the phone won't read the SIM card or register IMEI. And if I do the process backwards, by installing the SIM first, I can't truly toggle the lock despite success messages AND once I do run the command, I ALSO lose IMEI info anyway. In summary, for my phone, the command "adb shell pm uninstall --user 0 com.android.phone" neutralizes my phone's ability to read my SIM and register the IMEI, no matter what.

I am still on the December 5, 2018 security patch however, I don't see a point in holding it back, since I'm confident the OEM unlock toggle has something to do with SIM. It seems Google addressed the 'No SIM exploit', as I call it.
Hope this info helps.
 
Last edited:
  • Like
Reactions: siggey, underoath403 and xdamember143
A

andrew_yousry

Member
Jan 31, 2012
26
3
0
Mar 10, 2019 at 7:29 PM
hallr88 said:
Started with device on July 5th security patch Android Oreo 8.1. 100% Verizon device. Got replacement phone in the mail. No SIM inside. Turned it on. Plugged it in to a computer. Skipped past everything on setup. Turned on Developer options. OEM Unlock was grayed out.

Turned off automatic system updates in dev options. Turned on USB Debugging. Keep screen awake while charging. Ran ADB "adb shell pm uninstall --user 0 com.android.phone". Turned on wifi and waited a couple minutes in the chrome browser. Returned to Developer options and OEM Unlock was no longer grayed out. Ticked it.

Kept phone running for a few minutes. Turned device off and booted to fastboot. Still locked. Returned to system from bootloader. OEM Unlock still blue. Let apps update and also logged into Google account. Noticed OEM Unlock was staying unlocked through a couple reboots.

Decided to upgrade to Pie. Did it OTA. OEM Unlock stuck through the update. Shut down phone from system. Once phone was off I held down power button and the volume down button to take me to Fastboot mode. Ran "fastboot flashing unlock". BOOM! Got the the screen to say yes or no to bootloader unlock.

Device was erased because I chose yes. OEM Unlock grayed out again but in unlocked position? Hmm...ok with me. The strangest thing happened when I checked my IMEI when I was done. I had checked before I started also and I could have sworn there was different information than what I ended up with at the last check. Im tired..maybe just trippin out. The OEM Unlock toggle is available to toggle again.
Click to expand...
didn't work for me :(
 
cammykool

cammykool

Senior Member
Sep 6, 2011
1,442
360
113
24
Colorado
Mar 18, 2019 at 5:28 AM
THEVAN3D said:
Yeah, of course it worked. I just did not want to reset my phone. I have never resetted it ever since I got it so I thought it wouldv'e been a headache to do so. It was. But not as much as I thought.
Click to expand...
Did it let you unlock? Or just toggle the switch.

Sent from my Pixel 2 XL using Tapatalk
 
S

SeanAndre03

Member
Nov 2, 2017
22
4
0
Apr 2, 2019 at 12:36 PM
IDK what I'm doing but yeah I got an idea.
I'm new to xda, and first of all I'm not an expert at talking English so please bear with me. By reading all your ideas I came up with a trick haven't tried it but it's worth trying ? I red something in this thread that they put there device in edl mode which is good and I came up with this idea, once you boot into edl use miracle box to backup the whole emmc of a pixel 2 xl unlocked bootloader excluding system and userdata partitions which is big( it's a separate image .img file of each partition ) then use that backup to our pixel 2 xl Verizon model . After that you should boot to an unlock bootloader then flash factory images from Google or just backup whole emmc then restore which is big and may differ in other variants.

PS. If you want to do this hardbricking is 50-50 possible if you screw up.
 
Last edited:
muppetmaster916

muppetmaster916

Senior Member
Jul 31, 2013
1,059
397
0
Boston
Apr 2, 2019 at 2:31 PM
SeanAndre03 said:
IDK what I'm doing but yeah I got an idea.
I'm new to xda, and first of all I'm not an expert at talking English so please bear with me. By reading all your ideas I came up with a trick haven't tried it but it's worth trying ? I red something in this thread that they put there device in edl mode which is good and I came up with this idea, once you boot into edl use miracle box to backup the whole emmc of a pixel 2 xl unlocked bootloader excluding system and userdata partitions which is big( it's a separate image .img file of each partition ) then use that backup to our pixel 2 xl Verizon model . After that you should boot to an unlock bootloader then flash factory images from Google or just backup whole emmc then restore which is big and may differ in other variants.

PS. If you want to do this hardbricking is 50-50 possible if you screw up.
Click to expand...
Let's run it by a Dev that was directly involved, see what they think. @Badger50 ?
 
Last edited:
You must log in or register to reply here.

New posts

Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone