OnePlus8 VZW Bootloader is Not Unlockable

Search This thread

tutorialbs

Member
Jun 7, 2012
32
25
Figuring out how to unlock the bootloader for my OnePlus 8 UW 5G (IN2019)

1
For those looking at unlocking the BL on the VZW branded OP8/8Pro, check into the source code. On other devices there is a service called OEMUnlock. ... the OEMUNLOCKALLOWED is set to 0. This data is also stored in Persistent storage and survives a factory reset.
2
I have also flashed the abl from the international and TMobile models, with the international abl and the OEM bit changed, it throws an error "THW" along with saying not allowed, and with the TMobile abl it expects an unlock_code.bin but won't generate the code to submit to OP.
3
screenshot: IN2019 bootloader unlocked on EU Build number 10.5.12.IN21BA
4
The Verizon ops files use slightly different crypto than the other variants like T-Mobile

Oppo CryptTools V1.2 (c) B. Kerler 2019-2020

With a bit of editing it's possible to reflash the phone to instantnoodlet_15_O.16_201001.ops (the T-Mobile variant) -- edit settings.xml and change the <BasicInfo> and <Target ID> tags.
Code:
fastboot oem unlock
FAILED (remote: 'Please flash unlock token first.')
Code:
fastboot.exe oem get_unlock_code
...
FAILED (remote: Unknow command)
I may take another stab at it later using an EU or international firmware and see if that behaves any different.

The above method is similar to a working method for T-Mobile OnePlus 8T: [GUIDE] Convert TMO to EU via MSM Tool, no SIM Unlock or Bootloader Unlock needed! (62 pages)

I'm still reading, but sounds like MSM flashing VZW with TMO and/or EU .ops abl files might work, but that it also might involve editing the .ops files using bkerler/oppo_decrypt and CryptTools, or similar. And TMO files may require obtaining your phone's unlock token or unlock code.
 
Last edited:

vitogga

Member
Apr 19, 2014
30
3
Figuring out how to unlock the bootloader for my OnePlus 8 UW 5G (IN2019)

1

2

3

4


The above method is similar to the working method for T-Mobile OnePlus 8T: [GUIDE] Convert TMO to EU via MSM Tool, no SIM Unlock or Bootloader Unlock needed! (62 pages)

I'm still reading through, but it sounds like I'll be MSM flashing my VZW with the TMO and/or EU .ops abl files, and that also might involve editing the .ops files using bkerler/oppo_decrypt and CryptTools, or similar. Although with the TMO file it sounds like it involves obtaining your phone's unlock token or unlock code.
Modifying settings.xml of tmo ops you can flash the vzw trough msm tool. However, it doesn't allow to unlock the bootloader. In case of EU ops, just modifying the settings.xml wouldn't works, with A10 ops the msmtool can't flash it, on A11 ops the msm complete the flashing but device doesn't boot.
 

tutorialbs

Member
Jun 7, 2012
32
25
In that OnePlus 8T thread they managed to flash EU ops over TMO, so maybe there is some way to make MSM flash EU A10 ops over VZW?

I'll try messing with EU ops once I get my MSM tool working. My Windows is currently having a driver or COM port conflict that started after I installed Mi5_Qualcomm_Drivers drivers to use QPST and engineeringmode. It's all still working fine on my 2nd computer, tho.
 
Last edited:

GloomyHat14

Member
Sep 10, 2021
6
1
Well, Android 11 is now out so you guys with rooted OP8 UWs should be able to flash away to your heart's content :). I myself am waiting on whoareyou, but it seems he's a busy man with all these requests so I don't mind being patient. Happy flashing, and good luck!!! Thanks for all of the info so far guys
 

L0ND0NB0Y

Senior Member
Mar 7, 2020
86
11
22
Yemen
Samsung Galaxy S22 Ultra
Figuring out how to unlock the bootloader for my OnePlus 8 UW 5G (IN2019)

1

2

3

4


The above method is similar to a working method for T-Mobile OnePlus 8T: [GUIDE] Convert TMO to EU via MSM Tool, no SIM Unlock or Bootloader Unlock needed! (62 pages)

I'm still reading, but sounds like MSM flashing VZW with TMO and/or EU .ops abl files might work, but that it also might involve editing the .ops files using bkerler/oppo_decrypt and CryptTools, or similar. And TMO files may require obtaining your phone's unlock token or unlock code.
Yeah if you flash vzw to tmo it works, but not eu as I have a tmo device and tried flashing eu but either the device gets stuck at EDL or fastboot.
I think us who tried the process should make a telegram group and discuss over there. I believe we would be able to do it, it just needs teamwork.
 

L0ND0NB0Y

Senior Member
Mar 7, 2020
86
11
22
Yemen
Samsung Galaxy S22 Ultra
Modifying settings.xml of tmo ops you can flash the vzw trough msm tool. However, it doesn't allow to unlock the bootloader. In case of EU ops, just modifying the settings.xml wouldn't works, with A10 ops the msmtool can't flash it, on A11 ops the msm complete the flashing but device doesn't boot.
I think I have an idea, what if we flashed it to vzw and then grabbed the config partition of a tmo device with enabled OEM in developer mode and flashed it over our vzw device. It would enable the OEM toggle cuz I tried it with ZTE devices and it works every single time. If anyone has experience with bkerler edl tool from github PM me I'll dump the config partition from my friend's phone later when I get time and we can try it.

And for anyone thinking why I said keep the vzw fw it's cuz tmo needs an unlock token but idk about vzw, I mean if we bypassed the toggle maybe vzw devices are flashed with global BL and the only thing keeps us from unlocking is OEM toggle.
 

L0ND0NB0Y

Senior Member
Mar 7, 2020
86
11
22
Yemen
Samsung Galaxy S22 Ultra
For those looking at unlocking the BL on the VZW branded OP8/8Pro, check into the source code. On other devices there is a service called OEMUnlock. If it's there two conditions need to be true to set the data bit that enables it.

First, does the OEM allow it. OP says yes.

Second, does the carrier allow it. Big Red says No.

Since that is the case the OEMUNLOCKALLOWED is set to 0. This data is also stored in Persistent storage and survives a factory reset. The call for it comes from Vendor and because of that swapping to a different carrier's SIM means nothing.

Figure out how to hijack, alter, or spoof that process and you can get it. Just so you know, it's more than a build.prop edit.

I've been working on this on a P3XL for some time now. I have temp root but the files system uses "deduped blocks" and can't be mounted RW so I'm at a roadblock. If the file system on the OP8/8Pro can be mounted RW it's possible it could be done.....

My next device will NOT be a Google device nor will it be bought from Big Red. Haven't made up my mind if it's gonna be the 8 or 8Pro......

Pixel 3 XL, Yep, Crashed It.....

.....Again, and Again, and Again......
OP devices are a little easier to enable OEM cuz it they have EDL, I was able to toggle the OEM with flashing the config partition from a tmo phone with OEM enabled so toggling OEM wouldn't be a problem, but the problem comes with the BL itself, it wouldn't allow unlocks. I tried flashing global bl and it gives THW same as what user @Whoareyou is encountering, I wonder what does that THW means.
 

-TsT-

Member
Jan 20, 2014
8
0
Tbilisi
hii, i have OP8 Verizon version, can i bootloader unlock? i am from Georgia Tbilisi City, sim card not working, work 1 minutes, after lost signal, any fix and solution?
 

crankless

Senior Member
Aug 24, 2010
53
6
I don't understand at this point. Release the unlock method. It's a dead phone. Help other out that want to do more.
 
  • Like
Reactions: rodken

Top Liked Posts

  • There are no posts matching your filters.
  • 13
    I can confirm a working method is available, PM me if you are interested, it will not be posted publicly.
    4
    I never got a reply to any of my private messages asking about the bootloader unlock, so here's the progress I've gotten on my own -

    The Verizon ops files use slightly different crypto than the other variants like T-Mobile
    Code:
    mbox=        [0xAA,0x69,0x82,0x9E,0x5D,0xDE,0xB1,0x3D,0x30,0xBB,
                  0x81,0xA3,0x46,0x65,0xA3,0xE1,0x00,0x00,0x00,0x00,
                  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
                  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
                  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
                  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
                  0x0a,0x00]

    Code:
    Oppo CryptTools V1.2 (c) B. Kerler 2019-2020
    MIT License
    ----------------------------
    
    Extracting instantnoodlev_15_O.07_201103.ops
    xml: 153330e00
    Extracting prog_firehose_ddr.elf
    Extracting prog_firehose_lite.elf

    With a bit of editing it's possible to reflash the phone to instantnoodlet_15_O.16_201001.ops (the T-Mobile variant) -- edit settings.xml and change the <BasicInfo> and <Target ID> tags.

    With this comes the "OEM unlock" toggle in Developer settings, unfortunately ....

    Code:
    fastboot oem unlock
    FAILED (remote: 'Please flash unlock token first.')

    Code:
    fastboot.exe oem get_unlock_code
    ...
    FAILED (remote: Unknow command)

    So, no bootloader unlock yet, but it is happily running the T-Mobile firmware.
    (wifi, LTE and fingerprint appear working fine)

    I may take another stab at it later using an EU or international firmware and see if that behaves any different.
    3
    Whatever... I'll bite the bullet. Just ordered one 5 minutes ago and I'll get it on the 6th. Let's see where we end up.
    2
    Here is some proof. And yes he will answer on his time. Sorry that's all I can tell you. Verizon op8 unlocked running pixel experience spoofed as a pixel 4 for all the nifty features. Call screen -assistant 2.0. magisk rooted passing all safety nets,clean slate kernel

    Good to hear, guess i'll keep waiting. Do like the feel and speed of the phone, definitely out performs my Moto z4