Unlock ANY Pixel from Carrier

[#mcl]

____________________________________________________

UPDATE AS OF 9 OF DECEMBER OF 2022:
The security patch of December of 2022 fixed the patch, so it doesn't work on this version and newer ones.
A am working to get the exploit to work on newer version, but for now haven't found any. If anyone has any ideas or suggestions please let me know!
____________________________________________________

Hey everybody!
So recently I bought a Google Pixel 4 XL. The thing is that in Europe they are too expensive compared to the US, so I bought one that was from AT&T(used of course). However is that I need to use my SIM on the phone, but of course, the phone refused to allow me to use my SIM from Spain. ⛔️

So after hours of research, I found a way to unlock it. Here are the steps:
1. Remove your SIM card if it is on the phone
2. Do a factory reset
3. Do OFFLINE SETUP. Also, DON'T PUT ANY PASSWORD OR ANY TYPE OF SCREEN LOCK
4. Once you are on the main screen, enable USB Debugging.
5. Connect the phone to the computer (I assume you already have the USB drivers, platform-tools downloaded and knowledge on how to use ADB commands. If you don't have the SDK downloaded, head to this link and follow the instructions)
6. Inside the platform-tools folder, open a terminal window and run "adb shell"(on mac, once you are on the directory you have to run "./adb shell") and then "pm uninstall -k --user 0 com.google.android.apps.work.oobconfig" (run them without quotes)

After this, you can already connect the phone to the internet and put your SIM in.
This didn't unlock the phone though . What we have just done is this:

When we connect the phone to the internet, it verifies if it should lock the SIM or not. So we did a setup without internet, so the phone can't do that. After that, we uninstall the package responsible for doing this.
So when we connect it to the internet, it won't check the SIM lock
However, the bootloader is still locked and grey out. This is because this app is responsible to grey or not the bootloader switch. If it is from a carrier, the package will disable the switch, and if not you will have the ability to unlock it. As we kill the app before it could do its job, the bootloader will be waiting until the package gives its answer.

Special thanks to this Jorge Cortés to make this post possible.

If you find the post useful, consider buying me a cup of coffee please with Revolut.

 

[#mcl]

If anyone has problems/doubts please let me know!

 

[Danny17va]

Esim is unlocked as well?

 

[#mcl]

Didn't try but should work, as the phone never check if it is from a carrier or not.

 

[Danny17va]

Didn't try but should work, as the phone never check if it is from a carrier or not.

On another post someaone said esim is working on pixel 4 verizon unlocked trought this steps. So as you say, it works.
Thanks

 

[#mcl]

On another post someaone said esim is working on pixel 4 verizon unlocked trought this steps. So as you say, it works.
Thanks

No problem. Just for curiosity, who did the test on unlocked Verizon Pixel?

 

[Daniyal48]

Is there any work around to unlock to bootloader too??

 

[#mcl]

Is there any work around to unlock to bootloader too??

Hey,
I am working on that. As it turns out there is a way to flash firmware to any device with a Qualcomm chip, even if the bootloader os locked. It's called EDL mode. This mode was designed to force flash firmware in bricked devices that can't use fastboot or adb.
I already find the app I need to flash, actually there a a lot of different ones( I chose QPST) but it needs some strange files that I didn't find yet, and it won't allow em to use the google firmware neither .
So when I find those files I will write a detailed guide on how to unlock the bootloader , but for now I only know how to use any SIM on a locked Pixel device.

 

[Daniyal48]

Hey,
I am working on that. As it turns out there is a way to flash firmware to any device with a Qualcomm chip, even if the bootloader os locked. It's called EDL mode. This mode was designed to force flash firmware in bricked devices that can't use fastboot or adb.
I already find the app I need to flash, actually there a a lot of different ones( I chose QPST) but it needs some strange files that I didn't find yet, and it won't allow em to use the google firmware neither .
So when I find those files I will write a detailed guide on how to unlock the bootloader , but for now I only know how to use any SIM on a locked Pixel device.

I have tried the same on a OnePlus device but they have MSM Tool to thet let you work in edl mode but I haven't found any tool for Pixel devices yet

 

[#mcl]

I have tried the same on a OnePlus device but they have MSM Tool to thet let you work in edl mode but I haven't found any tool for Pixel devices yet

yeah unlike Oneplus Google didn't release any software designed specifically to the Pixel lineup, so you have to use the generic Qualcomm tools.

 

[Daniyal48]

yeah unlike Oneplus Google didn't release any software designed specifically to the Pixel lineup, so you have to use the generic Qualcomm tools.

Can you name other generic Qualcomm tools so I can experiment with them??

 

[#mcl]

Yeah of course, there is QFIL also and some others that aren't official. I downloaded them from Androidmtk website.
With this link you go to the qpst download and use instructions section of their webpage. At the bottom you will find similar programs, but I didn't get to try them. You can try them, but make sure they are for Qualcomm Chipset, because some of them are for mediatek phones.

 

[Daniyal48]

Yeah of course, there is QFIL also and some others that aren't official. I downloaded them from Androidmtk website.
With this link you go to the qpst download and use instructions section of their webpage. At the bottom you will find similar programs, but I didn't get to try them. You can try them, but make sure they are for Qualcomm Chipset, because some of them are for mediatek phones.

Okay thank you I hope i find a solution with this

 

[#mcl]

Okay thank you I hope i find a solution with this

No problem, good luck researching .
I will keep searching as well to see if I can find those files

 

[Daniyal48]

No problem, good luck researching .
I will keep searching as well to see if I can find those files

If you find any files please also send them to me. Can we use a working Device to get these files from. Like we extract these files for a normal pixel 4 xl and then flash it to ours?

 

[#mcl]

If you find any files please also send them to me. Can we use a working Device to get these files from. Like we extract these files for a normal pixel 4 xl and then flash it to ours?

Of course, if I find them I will make them available for anyone .
Yes in theory you can extract this files from your phon, however as mine is locked I need them from an unlocked pixel I suppose, but I didn't try to extract the files from my home and the flash them again, it could work. In the QPST you even have a section to that, it's a backup I Believe but not sure about the name.
If you try and it works let me know!

 

[Daniyal48]

Of course, if I find them I will make them available for anyone .
Yes in theory you can extract this files from your phon, however as mine is locked I need them from an unlocked pixel I suppose, but I didn't try to extract the files from my home and the flash them again, it could work. In the QPST you even have a section to that, it's a backup I Believe but not sure about the name.
If you try and it works let me know!

Yes I am also looking for an unlock Pixel 4 XL if I find one I will try extracting these files and post it somewhere on the internet so anyone can access it

 

[#mcl]

Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...

 

[Daniyal48]

Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...

I have Pixel 2 XL but it doesn't boot into EDL i tried fastboot commands and also abd commands but it doesn't even go there...I have Pixel 3 XL on the way I will try on that but that is already unlocked

 

[Daniyal48]

Yeah that is a way, but I was thinking that maybe these files are inside of the IMG files of the firmware from Google, and that firmware isn't lock , so if anyone manage to find those files there you wouldn't need to buy another pixel to extract the firmware.
I also think that in reality you don't need the firmware but rather some files for your Qualcomm Chipset to get the Sahara protocol working and I believe later on you flash the firmware, however I am not sure about that as I didn't try it.
I think this because you can find some Qualcomm snapdragon 855 programmer files (which had the extension we need), so they may be basic files that activates the Sahara protocol (which is the one used when the phone is in this mode) and only after I believe you can flash the firmware using some commands.
I would like to try out this but I can't as it could brick my phone and I don't have other to use, and I don't have any other pixel, this is my first and only Pixel ever.
So if you have an older pixel and you want you could try this theory...

Mbn Files from Pixel 4 Request

As title states, I am looking for the mbn files from the pixel 4. I downloaded the modem partition and could not seem to extract it and thought someone that owns a pixel 4 might have better luck than me. Thanks! The directory might be...

forum.xda-developers.com

Are these files related to our issue