# Bootloader unlocking

Bootloader unlocking is the process of disabling the bootloader security that enforces secure boot during the boot procedure. It can allow advanced customizations possible, such as installing custom firmware. On smartphones, this can be a custom Android distribution or another mobile operating system. Some bootloaders are not locked at all and some are locked, but can be unlocked with a command, a setting or with assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through a software exploit.
Bootloader unlocking is also done for mobile forensics purposes, to extract digital evidence from mobile devices, using tools such as Cellebrite UFED.

## Background

Unlocking the bootloader allows installing and running unsigned code on a device, including user customized software. Operating outside the manufacturer specification might usually result in voiding any warranties and may make the device susceptible to data theft, as the integrity of the operating system (as intended by the manufacturer) can no longer be guaranteed. On Chromebooks, enabling developer mode makes the system less secure than a standard laptop running Linux. Unlocking the bootloader may require reinitialization, formatting to factory settings, or otherwise lead to data loss on Android and ChromeOS devices. This is due to the fact that some user data is impossible to back up without root permission. This will also lead to certain security apps not working, such as Samsung Knox for which the counter would be stuck at "0x1."
Sascha Segan from PCMag considered a locked bootloader a mistake on the Qualcomm Snapdragon Insiders phone, which is targeted at advanced users.

## Platforms
### Android

Unlocking the bootloader is typically a prerequisite of obtaining root access and/or installing a custom ROM.
Android bootloader unlocking as of 2024 :
| Manufacturer | Difficulty level | Method |
| Google | Easy (non-Verizon) Impossible Workaround Reported **(Verizon) | Command-line (unlocked variant, not restricted to carrier, and non-Verizon carrier variants when paid off fully) |
| Samsung | Easy (EU and others) Impossible (US) | Development settings (except North American cellular variants), however, if modified or custom firmware is flashed, Samsung Knox will be permanently tripped, so Samsung Wallet, Secure Folder and applications made use of the Knox framework will be permanently unusable even if the bootloader is re-locked. (Not all Samsungs device have Knox, for example: J7 Prime do not have Knox eFuse.) |
| OnePlus | Easy (non-T-Mobile) Medium (T-Mobile) | Command-line, except on T-Mobile US variants where an unlock code is needed |
| Xiaomi | Hard (outside China Mainland) Very Hard (China Mainland) | Add Mi account, request code via Windows-only software, wait for 3 days on HyperOS or 1 week for MIUI (limited to one device per month and three devices per year). On devices with Xiaomi HyperOS outside mainland China, you need to request for bootloader unlock permission for your Xiaomi account in the Xiaomi Community app before you can proceed with bootloader unlocking. Your Xiaomi account needs to be at least 1 month old to be eligible. For Mainland China devices with HyperOS, you need to reach Xiaomi Community Level 5 and take an exam and pass the manual grading before you can add your account. On some devices with Mediatek system on a chip it might be possible to unlock using MTKClient, a third-party tool. |
| Asus | Impossible | Unlocking was performed via a first-party unlocking tool, but servers and app were removed. |
| Sony | Medium | Command-line, request code at Sony website |
| Fairphone | Medium | Command-line, request code at Fairphone website or forum |
| Motorola | Medium (non Verizon, AT&T, Tracfone) Impossible (Verizon, AT&T, Tracfone) | Command-line, request code at Motorola website |
| Realme | Medium-Hard (China Mainland and India) Impossible (global) | Command-line, after installation of the in-depth test app and submitting an application for in-depth testing. |
| Nothing | Easy | Command-line |
| Huawei | Medium-Hard (Kirin SoCs, select Huawei phones) Impossible, due to unlocking services being shut down (Other devices) | Select Huawei phones using the Kirin SoC can have their bootloader unlocked via potatonv: https://www.xda-developers.com/huawei-honor-bootloader-unlock-potatonv/ Other devices: N/A |
| OPPO | Easy (MediaTek) or phones that bought in mainland China Medium (Snapdragon). Only any phones in support list are possible to unlock Snapdragon-powered OPPO phone. Any phones that's not in support lists is still possible if using paid tool also known as UnlockTool. Without paid tool, It would be impossible to unlock. Unlocking is possible on some mediatek SoCs via MTKClient. Note that about fastboot binaries were removed, or locked by RSA key | Snapdragon: https://us.docs.wps.com/l/sIIS95rToAcW2x7AG?v=v2 MediaTek: MTKClient, sometimes MTK bypass utility are required beforehand Any phones that's bought from mainland China and in device support lists of depth-test: Unlock by depth test regardless of SoC, depth test app can be downloaded from https://www.oppo.cn/thread-397164526-1 then unlock via adb with simple command line while in fastboot state If you are getting "Handshake failed" on MTKCilent, then it is necessary to test point to force boot into boot ROM |
| HMD-Nokia | Impossible | N/A |
| vivo | Impossible Unless there are XDA forums that have methods to unlock, but some method cannot be used after updated phone patched exploit. The user can access fastboot, but the manufacturer has modified the bootloader so that it does not respond to any commands to unlock bootloader. | Vivo X70 Pro+ https://xdaforums.com/t/vivo-x70-pro-bootloader-unlock-how-to-guide.4444989/ Vivo Y31 2021 https://xdaforums.com/t/unlocking-bootloader-rebooting-in-edl-without-testpoint-vivo-y31-2021.4440801/ |
| LG | Hard | Possible, with the help of leaked engineering bootloaders available to be flashed via QFIL utility |
| Tecno | Medium | Command-line, (requires Tecno ID account on the phone, registered in two weeks or more, to activate OEM unlocking.) |
| Infinix | Medium | Command-line, (requires Infinix ID account on the phone, registered in two weeks or more, to activate OEM unlocking.) |
| Itel | Medium | Command-line, (requires Itel ID account on the phone, registered in two weeks or more, to activate OEM unlocking.) |
| TCL | Medium (Ion V only) Unknown (other phones) | For the Ion V mobile phone, you can use a Python tool to reboot to a normally hidden fastboot, then use the fastboot command 'fastboot flashing unlock' to unlock it. |
| Amazon (fire hd) | Medium | Brick while fastbooting via adb command line (only Linux) |
** Unlocking Verizon Pixel bootloader

#### History

The bootloaders of Nexus and Pixel devices can be unlocked by using the fastboot command fastboot oem unlock or if it doesn't recognize the command fastboot flashing unlock.
When Motorola released a bootloader unlocking tool for the Droid Razr, Verizon removed the tool from their models.
In 2011, Sony Ericsson released an online bootloader unlocking tool. Sony requires the IMEI number to be filled in on their website. For the Asus Transformer Prime TF201, Asus has released a special bootloader unlock tool.
In 2012, Motorola released a limited tool for unlocking bootloaders. They require accepting terms and conditions and creating an account before the bootloader can be unlocked for your Motorola device.
A 2012 article by The Verge called the unlockable bootloaders a 'broken promise' and called for a fix.
HTC phones have an additional layer of lock called "S-OFF/S-ON".
Bootloaders can be unlocked using an exploit or using a way that the vendor supplied. The latter method usually requires wiping all data on the device. In addition, some manufacturers prohibit unlocking on carrier locked phones. Although Samsung phones and cellular tablets sold in the US and Canada do not allow bootloader unlocks regardless of carrier status, a service has allowed users on an earlier version to unlock their US/Canadian Samsung phone(s) and/or tablet(s)
In 2018, a developer from XDA Developers launched a service which allowed users to unlock the bootloader of some Nokia smartphone models. Similarly, another developer from XDA Developers launched a service to allow users to unlock the bootloaders of Samsung Galaxy S20 and Samsung Galaxy S21 Phones.
Huawei announced plans to allow users to unlock the bootloader of the Mate 30 series, but later retracted that. Huawei has stopped providing bootloader unlock codes since 2018. A bootloader exploit named checkm30 has been developed for HiSilicon based Huawei phones.
When the bootloader of the Samsung Galaxy Z Fold 3 was unlocked, the camera became less functional. This could be restored by re-locking the bootloader. This issue was later fixed by Samsung. For the Samsung Galaxy S22 series, unlocking the bootloader has no effect on the camera.

### Others
#### Microsoft

The WPInternals tool is able to unlock bootloaders of all Nokia Lumia phones running Windows Phone, but not phones like the Alcatel Idol 4 or HP Elite x3. Version 1.0 was released in November 2015. In October 2018, the tool was released as open source software when the main developer René Lergner (also known as HeathCliff74) stepped down.
The slab bootloader used by Windows RT could be unlocked using a vulnerability, but was silently patched by Microsoft in 2016. UEFI Secure Boot on x86 systems can generally be unlocked.

#### Apple

The boot ROM protection on iOS devices with an A11 processor or older can be bypassed with a hardware exploit known as checkm8, which makes it possible to run other operating systems including Linux.
The bootloader on Apple Silicon-based Macs can be unlocked. However, other Apple devices like the iPhone and iPad cannot be bootloader unlocked even when using the same chip used in a Mac.

#### Google

The equivalent of bootloader unlocking is called developer mode in Chromebooks. Chromebooks use custom bootloaders that can be modified or overwritten by removing a Write-protect screw. Some models lack a screw and instead may or may not require disabling the onboard Cr50 chip.
In 2013, the bootloader of the Chromecast was hacked using an exploit. In 2021, it was hacked again for newer versions. In 2023, it was reported that the Chromecast HD could be unlocked without exploit.

#### Asus

Asus used to provide an Unlocking tool for both of their smartphone lines, the Zenfone and ROG Phone. This worked as an installable .apk file that the user could install on their phone, then unlock the bootloader. The app worked by contacting Asus unlocking servers, then prompting the user to perform a factory reset.
In 2023 Asus removed the tool from their website and closed the unlocking servers, so even phones with the .apk file installed couldn't unlock their bootloaders. Representatives on the Asus forums claimed the tool would be available again, but as of March 2024 no additional information has been provided, even after the release of their latest device the ROG Phone 8 and the upcoming release of the Zenfone 11 Ultra.
A user on the popular forum XDA (website) filed a court claim application against Asus due to the unlock tool never being released and alleged that Asus censored comments about the unlock tool on their forum.

#### SpaceX

In August 2022, security researcher Lennert Wouters applied a voltage injection attack to bypass firmware verification of a Starlink satellite dish from SpaceX.

## Relocking

On Android, it is possible to relock the bootloader.

## VNeID app changes

According to information from technology groups in Vietnam, after updating version 2.1.6 of the VNeID application released on May 30, 2024, some Android phone users have received warnings : "Your device is not safe, there is a risk of containing malicious code...". As a result, users are thrown to the main screen and cannot use the VNeID application, even though before the update they could still log in and use it normally.
This is because VNeID 2.1.6 update has added new security measures to stop working on Android devices with root access, unlocked bootloader and developer mode enabled. To use, users must disable root access to the device, relock bootloader and turn off developer options.

## Shutdown of online services

In 2018, Huawei stopped providing bootloader unlock codes. On 31 December 2021, LG shut down their website which provided bootloader unlock codes. In August 2023, ASUS removed the unlocking tool from their website and shut down the servers used to unlock the bootloader.