Updating Verizon Pixel unlocked bootloader with depixel8

[LoliSmith]

If you are on 7.1 you can lock and unlock again. I've been on these forums since the beginning and lots of people have done it.

Ok, gtk, thanks.

One thing that is 100% positive and pasted all over the forums is that if you are on 7.1 you can u lock. Doesn't matter if you unlocked previously. All that matter is if you are on 7.1. If you are then you can unlock

Thanks.

 

[bobby janow]

1. Believe what? That once you relock regardless of whether or not you stay on 7.1, you can't re-unlock?

2. So you think I can unlock using depixel8, relock on 7.1, stay on 7.1 never upgrade and use depixel8 again to re-unlock?

3. He is being cryptic for whatever reason, he doesn't want to reveal how depixel8 works. This isn't a matter of spoon feeding me, I have no way of knowing how depixel8 works without reverse engineering it.


4. What firmware are you talking about? The Pixel bootloader?

1. No. You can unlock if you stay on 7.1
2. Yes
3. I wasn't talking about how depixel8 works really. Just what determines whether the option is grayed out or not. So I meant the firmware of the device specifically.
4. The firmware of the device. The bootloader has nothing to do with anything. Google and Verizon bootloaders are the same yet one can be unlocked and one cannot.

 

[LoliSmith]

3. I wasn't talking about how depixel8 works really. Just what determines whether the option is grayed out or not. So I meant the firmware of the device specifically.

I think the Verizon bootloaders flashed at the factory are different from the Google bootloaders flashed at the factory. The former won't respond to the fastboot OEM unlock command and the latter will.

Google and Verizon bootloaders are the same yet one can be unlocked and one cannot.

I don't think they are. The only way to know that is to reverse engineer them and neither of us have done that.

 

[bobby janow]

I think the Verizon bootloaders flashed at the factory are different from the Google bootloaders flashed at the factory. The former won't respond to the fastboot OEM unlock command and the latter will.

I don't think they are. The only way to know that is to reverse engineer them and neither of us have done that.

They won't respond to the oem unlock command because you can't enable that in dev options. If you turn off the switch on a Google device you can't unlock either until you reenable it. That is irrespective of the bootloader version.

The reason I say they are the same is because Google devices and Verizon devices only have one factory image for the both of them. They have to be the same. But back in 7.1 at some point there were 2 separate I believe. Users with a VZW phone tried to flash the Google image in order to get the switch to toggle and it still wouldn't. That image included the bootloader too.

 

[LoliSmith]

The reason I say they are the same is because Google devices and Verizon devices only have one factory image for the both of them. They have to be the same.

If there is only 1 aboot.img version for both Verizon and Google Pixels, then it has to be implemented at a lower level than aboot.

http://newandroidbook.com/Articles/aboot.html
http://newandroidbook.com/TOC.html#boot
https://source.android.com/security/verifiedboot/index.html
https://source.android.com/security/verifiedboot/verified-boot.html

 

[bobby janow]

If there is only 1 aboot.img version for both Verizon and Google Pixels, then it has to be implemented at a lower level than aboot.

http://newandroidbook.com/Articles/aboot.html
http://newandroidbook.com/TOC.html#boot
https://source.android.com/security/verifiedboot/index.html
https://source.android.com/security/verifiedboot/verified-boot.html

Exactly! Now let's figure out where. That's what I was trying to pull out of JCase, thus the spoon feeding chastisement.

 

[LoliSmith]

Exactly! Now let's figure out where. That's what I was trying to pull out of JCase, thus the spoon feeding chastisement.

http://newandroidbook.com/AIvI-M-RL1.pdf

 

[aholeinthewor1d]

http://newandroidbook.com/AIvI-M-RL1.pdf

There are a total of 5 bootloaders technically. There is the PBL which is stored in ROM. I'm guessing there is something unique in this which when connected with Google's serves to decide if the device can be unlocked or not.

Then each "slot" also has 2 bootloaders. Each has aboot and each has xbl.

 

[jjayzx]

There's a possibility you can't unlock again after a relock even if on 7.1, some people were permanently locked.

 

[LoliSmith]

There's a possibility you can't unlock again after a relock even if on 7.1, some people were permanently locked.

I thought that was what jcase was implying. Do you know if the people on 7.1 who were permanently locked had done any flashing or received any updates at all before or after relocking?

 

[LoliSmith]

There are a total of 5 bootloaders technically. There is the PBL which is stored in ROM. I'm guessing there is something unique in this which when connected with Google's serves to decide if the device can be unlocked or not.

Then each "slot" also has 2 bootloaders. Each has aboot and each has xbl.

Thanks for that concise explanation, I tried to hit the thanks button but I did too many today I guess. Will do tomorrow.

What does PBL stand for?

What does xbl stand for?

 

[aholeinthewor1d]

Thanks for that concise explanation, I tried to hit the thanks button but I did too many today I guess. Will do tomorrow.

What does PBL stand for?

What does xbl stand for?

PBL = primary boot loader

XBL = eXtensible boot loader. This replaces SBL (secondary boot loader) on newer processors

Edit: https://www.inforcecomputing.com/inforce-qualcomm-secure-boot-prevents-malicious-software

 

[LoliSmith]

PBL = primary boot loader

XBL = eXtensible boot loader. This replaces SBL (secondary boot loader) on newer processors

Edit: https://www.inforcecomputing.com/inforce-qualcomm-secure-boot-prevents-malicious-software

Thanks again. So PBL is in the boot ROM and XBL executes prior to aboot loading?

 

[aholeinthewor1d]

Thanks again. So PBL is in the boot ROM and XBL executes prior to aboot loading?

Yea pbl>xbl>aboot

 

[LoliSmith]

Yea pbl>xbl>aboot

In the firmware, there are the following images:

tz.img (trust zone?)

aboot.img (android bootloader)

xbl.img (extensible bootloader)

If both the Verizon and Google Pixels have the same tz.img, aboot.img and xbl.img, then the difference between the devices must be in PBL in the Boot ROM. And the factory must flash a different PBL to the Verizon devices than to the Google devices.

 

[aholeinthewor1d]

In the firmware, there are the following images:

tz.img (trust zone?)

aboot.img (android bootloader)

xbl.img (extensible bootloader)

If both the Verizon and Google Pixels have the same tz.img, aboot.img and xbl.img, then the difference must be in PBL in the Boot ROM. And the factory must flash a different PBL for the Verizon devices than the Google devices.

That was my thinking also. Just realized jcase said it connects to Google's servers to determine if it can be unlocked or not. Well how does it do that with no internet access? I've already taken a pixel out of the box and removed the SIM before powering on. Then during setup skipped connecting to wifi and then unlocked with dePixel8. So there obviously has to be something in the hardware which determines if it can be unlocked or not.

 

[LoliSmith]

Then during setup skipped connecting to wifi and then unlocked with dePixel8.

I am on 7.1 Android security patch 10/5/16. Build NDE63N.

That is the original firmware, yes? I have a regular Pixel, not a Pixel XL.

If so, I should be able to relock and then unlock again. I can't remember if I had WiFi off when I first set up the device. I know I did not have an active SIM in the phone.

 

[LoliSmith]

This is pretty fantastic if true:

https://forum.xda-developers.com/showpost.php?p=71561177&postcount=38

 

[aholeinthewor1d]

This is pretty fantastic if true:

https://forum.xda-developers.com/showpost.php?p=71561177&postcount=38

Yea I was going to mention the CID but figured you already found that info. At first it appeared that you could identity a Verizon vs Google pixel by the CID but then I've seen multiple people prove that theory wrong. A bunch of people got pixels from Google directly and their CID was the same has the Verizon one.

 

[bobby janow]

This is pretty fantastic if true:

https://forum.xda-developers.com/showpost.php?p=71561177&postcount=38

It's not. I have Project Fi and it's grayed out.