[Q] ANY way to toggle Allow OEM Unlock via Fastboot?

Search This thread

AardvarkAdventure

Senior Member
Mar 25, 2011
72
32
I sold my N9 on eBay and the buyer requested a refund claiming it wouldn't boot. I got it back and found this person had somehow relocked the bootloader [improperly] and now I can only get into Fastboot mode...but I can't flash anything because the bootloader is locked...and I can't unlock the bootloader because I can't toggle the stupid "Allow OEM Unlock" setting.

Even TWRP won't load. It just flashes the logo screen over and over again.

Any and all help is greatly appreciated. I've never actually come across an unfixable Android device, but it's looking like there may be no way back from this.
 

cam30era

Inactive Recognized Contributor
Nov 20, 2010
5,092
1,792
Columbus, Indiana
I sold my N9 on eBay and the buyer requested a refund claiming it wouldn't boot. I got it back and found this person had somehow relocked the bootloader [improperly] and now I can only get into Fastboot mode...but I can't flash anything because the bootloader is locked...and I can't unlock the bootloader because I can't toggle the stupid "Allow OEM Unlock" setting.

Even TWRP won't load. It just flashes the logo screen over and over again.

Any and all help is greatly appreciated. I've never actually come across an unfixable Android device, but it's looking like there may be no way back from this.

Try:
Fastboot format cache
Fastboot format userdata

This will wipe your device, including everything on the SDcard, but you then should be able to boot TWRP. If so, then you can ADB push a ROM while in TWRP, and get it to boot.

No guarantees here, though.

If you are going to do this, make sure you know what you are doing. Make sure you know, or can search and find the directions for ADB pushing a ROM, before you enter those commands in fastboot.

It's also possible that after you boot to TWRP, that your PC won't initially recognize your N9. You need to be prepared to identify in Windows device manager what you N9 is being identified as, and be prepared to find and load new drivers.
 
Last edited:
  • Like
Reactions: borxnx

AardvarkAdventure

Senior Member
Mar 25, 2011
72
32
Try:
Fastboot format cache
Fastboot format userdata

This will wipe your device, including everything on the SDcard, but you then should be able to boot TWRP. If so, then you can ADB push a ROM while in TWRP, and get it to boot.

No guarantees here, though.

If you are going to do this, make sure you know what you are doing. Make sure you know, or can search and find the directions for ADB pushing a ROM, before you enter those commands in fastboot.

It's also possible that after you boot to TWRP, that your PC won't initially recognize your N9. You need to be prepared to identify in Windows device manager what you N9 is being identified as, and be prepared to find and load new drivers.
Thanks for the reply! But sadly..."can not format any partition while device state is locked!"
 
  • Like
Reactions: tryingtolearn

cam30era

Inactive Recognized Contributor
Nov 20, 2010
5,092
1,792
Columbus, Indiana
I can into recovery mode, but just a flashing TWRP logo. While that's on the screen, I can get ADB to recognize the device, but I don't have a whole ton of experience with ADB. Thoughts?

So TWRP starts, but doesn't get past the initial screen. And you can issue ADB commands?
I've never heard of anything like this.
Hopefully someone else has dealt with this and can offer a suggestion.
 

AardvarkAdventure

Senior Member
Mar 25, 2011
72
32
So TWRP starts, but doesn't get past the initial screen. And you can issue ADB commands?
I've never heard of anything like this.
Hopefully someone else has dealt with this and can offer a suggestion.

First off, I just wanna thank you for your continued replies. I really appreciate it.

Basically, from what I've read from others on various forums who've encountered this problem on various devices, ANYONE who unlocks the bootloader before the first boot is susceptible to this. If you don't go in and hit the "allow OEM unlock" toggle and you try to flash factory images...you're screwed. Question is, why the hell would anyone look for that toggle (or give it a second thought if they stumbled across it) if the device allowed them to unlock it before the first boot (just like every previous Nexus device)? The official download page for factory images makes no mention of this problem.

So, yep, that's where I'm at. Power button-> Google logo-> red text stating "this is a development device not intended for public use" (or something like that)-> blinking TWRP logo. Any Fastboot commands aside from things like "reboot" result in an error stating that the device is locked.

In the N6 forum there is a thread about how to get around this, but it involved using Qualcomm's drivers and some .bat that works with them. It was provided by someone at Motorola, apparently.
 

cam30era

Inactive Recognized Contributor
Nov 20, 2010
5,092
1,792
Columbus, Indiana
First off, I just wanna thank you for your continued replies. I really appreciate it.

Basically, from what I've read from others on various forums who've encountered this problem on various devices, ANYONE who unlocks the bootloader before the first boot is susceptible to this. If you don't go in and hit the "allow OEM unlock" toggle and you try to flash factory images...you're screwed. Question is, why the hell would anyone look for that toggle (or give it a second thought if they stumbled across it) if the device allowed them to unlock it before the first boot (just like every previous Nexus device)? The official download page for factory images makes no mention of this problem.

So, yep, that's where I'm at. Power button-> Google logo-> red text stating "this is a development device not intended for public use" (or something like that)-> blinking TWRP logo. Any Fastboot commands aside from things like "reboot" result in an error stating that the device is locked.

In the N6 forum there is a thread about how to get around this, but it involved using Qualcomm's drivers and some .bat that works with them. It was provided by someone at Motorola, apparently.

First off, you're most welcome (and BTW, there's a button for that). ;)

Secondly, I have a Nexus 6 and spend a lot of time on that forum. While it's crazy to try to relock the bootloader, on the N6 about 2/3 of THOSE WITH TWRP recovery HAVE BEEN ABLE TO SUCCESSFULLY fastboot flash the two commands I posted above. I'm sorry it didn't work for you.

Third, the thread you mentioned does not work on this type of "fastboot lock" brick. It's only for qhsub_bulk brick.

FWIW: it seems you've nothing to loose by trying to RMA your device?
 
  • Like
Reactions: borxnx

doitright

Senior Member
Oct 31, 2014
1,512
861
I can into recovery mode, but just a flashing TWRP logo. While that's on the screen, I can get ADB to recognize the device, but I don't have a whole ton of experience with ADB. Thoughts?

adb shell
# mkfs.ext4 /dev/whatever/the/heck/is/the/data/partition
# reboot bootloader
fastboot oem unlock

Seems to me that there is a bug in the recovery image that you have installed, its probably failing while trying to figure out how to prompt you for your passcode in order to enable mounting the encrypted /data partition.
 
Last edited:
  • Like
Reactions: cam30era

playahate

Senior Member
Oct 7, 2010
142
90
40
Moscow
My thoughts:
Enable OEM unlock checkbox in Developer Settings

For Volantis+ devices, we will give users
the ability to enable OEM unlock through
Developer Settings. To do so, we must write
the value to the last byte of a special partition

that does not get erased even after factory reset.

This feature will only be available on devices
with the persistent data partition, thus the checkbox
is only visible for devices that meet this requirement.
The quote is taken from android.googlesource.com:
So this line:
Code:
adb shell busybox fdisk /dev/block/mmcblk0
Gives us:
Code:
Number Start (sector) End (sector) Size Code Name
1 256 229631 224K 0700 modem
2 229632 262399 32768 0700 metadata
3 262400 263167 768 0700 sbl1
4 263424 263535 112 0700 sdi
5 263936 263967 32 0700 sec
6 263968 264031 64 0700 ddr
7 264192 266239 2048 0700 aboot
8 267192 267703 512 0700 rpm
9 268192 269215 1024 0700 utags
10 269216 270215 1000 0700 tz
11 270216 278527 8312 0700 padA
12 278528 279295 768 0700 sbl1bak
13 279552 281599 2048 0700 abootBackup
14 282552 283063 512 0700 rpmBackup
15 283552 284575 1024 0700 utagsBackup
16 284576 285575 1000 0700 tzBackup
17 285576 285583 8 0700 versions
18 285696 286719 1024 0700 frp
19 286720 288767 2048 0700 mdm1m9kefs1
20 288768 290815 2048 0700 mdm1m9kefs2
21 290816 292863 2048 0700 mdm1m9kefs3
22 292864 294911 2048 0700 padB
23 294912 327679 32768 0700 sp
24 327680 360447 32768 0700 keystore
25 360448 364543 4096 0700 logs
26 364544 430079 65536 0700 persist
27 430080 430591 512 0700 mdm1hob
28 430592 430655 64 0700 mdm1dhob
29 430656 430911 256 0700 cid
30 430912 447295 16384 0700 logo
31 447296 449343 2048 0700 misc
32 449344 454399 5056 0700 padD
33 454400 454401 2 0700 mdm1m9kefsc
34 454402 454417 16 0700 ssd
35 454656 487455 32800 0700 recovery
36 487680 505855 18176 0700 kpan
37 505856 538623 32768 0700 boot
38 538624 1062911 512K 0700 cache
39 1062912 1193983 128K 0700 oem
40 1193984 1196031 2048 0700 padC
41 1196032 5390335 4096K 0700 system
42 5390336 61005567 53.0M 0700 userdata

It could be (or could not be) mmcblk0p5 partition as its only 32 bytes and must contain only 1 or 0 for "enable oem unlock"... (the name is sec=secure?)
Dunno if its possible to flash the img from the device with enabled feature. As it states in another thread - users on 5.1 get this slider/checkbox get "off" after every reboot (though the bootloader stays unlocked if it was performed already). So it must be set to "enable" then the device must be rebooted to bootloader to make fastboot oem unlock. And if after enabling it, you reboot into recovery to get adb working, or boot the fastboot and then without unlocking boot to system - the trigger gets back to "off". So the fastboot definetly checks the value in that partition.
Actually theres 3 ways:
1. The trigger is set to "on" in system and writes to the partition immediatly. GOOD. We can make backup on some device, then push the .img to our device and restore backup while in recovery with smth like (in case its p5, i dunno whether its true): UPD: the Nexus 6 build.prop has ro.frp.pst=/dev/block/platform/msm_sdcc.1/by-name/frp, so the needed partition is 18
adb shell
su
dd if=/dev/block/mmcblk0p18 of=/sdcard/name_of_backup.img
Then reboot into fastboot and make unlock.
Of course it will work only if you made unlock before, flashed the TWRP and relocked the bootloader.
2. The trigger is set to "on" in system and writes to the partition only after reboot. Reboot to recovery still get the same value is "on". GOOD. We can make backup on some device while in recovery, then push the .img to our device and restore backup while in recovery
3. The trigger is set to "on" in system and writes to the partition only after reboot into bootloader. Reboot to recovery rewrites the partition and it becomes "off". BAD. We can't do anything.

UPDATE:
Another option is to try to get into second bootloader (aboot). On the Nexus 5 its VolUP+VolDown+Power from the "Switched Off" Device. And if you plug the device to PC (with the proper installed drivers) - the adb must work and all the commands including the mentioned one (dd if=/dev/block/mmcblk0p18 of=/sdcard/name_of_backup.img).
The main problem is - it seem to be available ONLY if the main bootloader is corrupted and the phone doesn't boot into bootloader. But its worth trying...
 
Last edited:
  • Like
Reactions: sziraqui

techiedj

Senior Member
May 1, 2011
55
26
From Jonathan Levin's article it looks like PST persist is p27.

My other thought is could you use the Nexus Root Toolkit to temporary boot TWRP or the Modifided boot.img using fastboot boot instead of fastboot flash? And work from there, sideload a new recovery or something hell idk. :confused:

or try the fastboot oem verify command mentioned in the article and here http://forum.xda-developers.com/showpost.php?p=60587819&postcount=56
Warning, the article states that oem verify wipes the data partion and relocks the device
 

playahate

Senior Member
Oct 7, 2010
142
90
40
Moscow
From Jonathan Levin's article it looks like PST persist is p27.
:laugh: found this topic in search with "unlock" keywords and didn't notice that its from the N9 thread :silly:
All the commands and partitions was for N6, but the idea and the information stays the same.

My other thought is could you use the Nexus Root Toolkit to temporary boot TWRP or the Modifided boot.img using fastboot boot instead of fastboot flash? And work from there, sideload a new recovery or something hell idk. :confused:
As far as i know, fastboot boot recovery.img will not work on the locked bootloader. And the Toolkit boot the recovery and modified boot.img AFTER it makes fastboot oem unlock.
 

playahate

Senior Member
Oct 7, 2010
142
90
40
Moscow
Correct. If bootloader is locked, the only fastboot command that can be used is "fastboot oem unlock", and the "allow bootloader unlock" box has to be checked in Settings (of course).
Well. You are not quite right...
fastboot device-info
fastboot format userdata
fastboot format cache
fastboot oem verified
1st will always work.
2 and 3 - it all depends.
4 will work definetly on Nexus 9, not sure about Nexus 6...
 

Loglud

Senior Member
Jul 29, 2011
235
449
Had this problem with another device cool thing to remeber is that on locked devices the only thing that is different is that there is a signature before the MAGIC header so the solution is to pull the android stock images from https://developers.google.com/android/nexus/images. Once done extract the images in both the zip and the tar that is inside the zip. You will see recovery.img inside the tar. One thing about the boot process of TWRP is that it enables adb in preboot meaning while in the boot loop you should have access to adb. With access to adb all you need to do is dd the images over the corresponding partitions: i.e.
PLEASE NOTE NOT FOR THE FEINT OF HEART. I AM NOT RESPONSIBLE FOR YOU BRICKING YOUR DEVICE.
adb push recovery.img recovery.img
adb shell dd if=recovery.img of=/dev/block/<recoverymmcblock>
I dont know if the default recovery has adb push update so id probably recommend doing this on every partition thats inside the tar, i.e. system, boot.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Had this problem with another device cool thing to remeber is that on locked devices the only thing that is different is that there is a signature before the MAGIC header so the solution is to pull the android stock images from https://developers.google.com/android/nexus/images. Once done extract the images in both the zip and the tar that is inside the zip. You will see recovery.img inside the tar. One thing about the boot process of TWRP is that it enables adb in preboot meaning while in the boot loop you should have access to adb. With access to adb all you need to do is dd the images over the corresponding partitions: i.e.
    PLEASE NOTE NOT FOR THE FEINT OF HEART. I AM NOT RESPONSIBLE FOR YOU BRICKING YOUR DEVICE.
    adb push recovery.img recovery.img
    adb shell dd if=recovery.img of=/dev/block/<recoverymmcblock>
    I dont know if the default recovery has adb push update so id probably recommend doing this on every partition thats inside the tar, i.e. system, boot.
    2
    Getting frustrated with this issue as well.

    Today I wake up, I notice my Nexus 9 has a system update to 6.0.

    Fine accept it.

    During the update process, the message "Error" showed up.

    Waited for a while, couldn't get anything to work, so rebooted the device.

    Stuck on a permanent bootloop with the 4 swirly icons (yay, 6.0) on the screen.

    Go into recovery mode (I don't have Clockwork or the like, this tablet is completely stock) to do a factory reset.

    Once done, back to the bootloop of the 4 swirly icons (did I mention, yay?).

    Okay, it's softbricked, I can recover from this. I'll just install the update manually. I know I enabled USB debugging, it should be okay...right?

    Unfortunately, I did not enable "Allow OEM unlock".

    I'm not a clueless tech user, but neither am I an expert. Followed all the instructions plodgingly, and wonderful, can't do anything since I did not enable that option.

    And of course because the tablet is soft-bricked, I cannot boot it up, go into settings and enable it.

    Chicken and egg much, Google?

    Over the past couple of hours, I've felt like putting my fist through the tablet.

    I love the Android interface, I love how customisable it can be (even though I have never bothered to change it from stock). I love the fact that I can copy files from my PCs without having everything go through iTunes (if Apple had their way, you couldn't fart without it passing through iTunes).

    What I hate though is how horrible an update like this can be. Yeah, hindsight is a 20-20 situation, I should have installed a recovery app or the like to prevent this.

    Google in their infinite wisdom did not include any stock options for default rollbacks when push updates screw up.

    To me, the one solution that'll give less heartburn to users like me who experience this, whenever an update is pushed out, when I click accept, I'd love to have seen a pop up message scream out at me:

    WARNING! WARNING!
    MAKE SURE YOU ENABLE USB DEBUGGING
    MAKE SURE YOU ENABLE ALLOW OEM UNLOCK

    If the update fails, at least you might be able to fix it on your own. Failure to do this will result you have to go to a tech support centre to get your device unbricked.

    xoxo
    Google


    That sure would have made life easier.
    2
    Thanks for the reply! But sadly..."can not format any partition while device state is locked!"

    Try fastboot reboot-recovery?
    2
    I can into recovery mode, but just a flashing TWRP logo. While that's on the screen, I can get ADB to recognize the device, but I don't have a whole ton of experience with ADB. Thoughts?

    So TWRP starts, but doesn't get past the initial screen. And you can issue ADB commands?
    I've never heard of anything like this.
    Hopefully someone else has dealt with this and can offer a suggestion.
    1
    ATTENTION: READ THIS!!!

    Ok guys, I had the same issue...
    It is impossible for us to recover our system. We are currently locked out of it. This is a mistake from Google, they will probably sort it out for the newer devices.

    But for now whether you are stock or not they will allow unlock your bootloader for you.
    I rooted my device, and through a series of unfortunate events I managed to lock oem while in a bootloop.
    Don't worry about it, just send it to HTC and ask them to sort it out.

    For me not only did they unlock it, but they also completely re-flashed into stock.

    SEND IT TO HTC, THEY HAVE THE TOOLS TO FIX YOUR DEVICE. WE DO NOT.

    If anyone finds a way to do it themselves good...for anyone else, this is a warning that your warranty is not voided by this issue and the official engineers can unlock it for you.