NB1-Collision

NB1-Collision is a bootloader unlock spoofing hack found by Hikari Calyx Tech.

### Why that name?

Nokia 8 is the one and only device that the bootloader unlock can be requested officially.

The unlock key itself is actually a signature of your IMEI to tell your bootloader that your phone can be unlocked properly.

### Applicable devices

* Nokia 2
* Nokia 2.1
* Nokia 3.1 A & C
* Nokia 3.1 Plus C
* Nokia 5
* Nokia 6
* Nokia 6.1
* Nokia 6.1 Plus
* Nokia 7
* Nokia 7 Plus
* Nokia 7.1
* Nokia X71
* Nokia 8 Sirocco
* Nokia 8.1
* Nokia 9 PureView

And the phone's bootloader service level 0x0008 or the service project code is \*\*\*1 (e.g. B2N1, A1N1).

To acknowledge that, you need to use the fastboot.exe came with OST LA and execute:

```
fastboot oem getProjectCode
```

If it returns \*\*\*1, then it's applicable. Devices met this condition needn't to meet the condition below.

```
fastboot oem getSecurityVersion
```

If it returns 0x0008, then it's applicable. Devices met this condition needn't to meet the condition above.

### How it works

To ensure NB1-Collision hack will work, we need to change the IMEI written in a specific partition to the IMEI of Nokia 8 you requested. The most possible method of hacking this partition is by using EDL mode, or FTM signature bypass hack. **It's strongly recommended to backup this partition before you hack the phone.** In this case, the IMEI we used is 004400152020002.

For Nokia 2, Nokia 2.1, Nokia 3.1 A & C, Nokia 3.1 Plus C, Nokia 5 and Nokia 6, it's located at **deviceinfo** partition, offset 0x2010, like this:

```
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00002010  30 30 34 34 30 30 31 35 32 30 32 30 30 30 32 00  004400152020002.
00002020  xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00  xxxxxxxxxxxxxxx.
```

For Nokia 6.1, Nokia 6.1 Plus, Nokia 7, Nokia 7 Plus, Nokia 7.1, Nokia X71, Nokia 8 Sirocco, it's located at **deviceinfo** partition, offset 0x158.

On Nokia 8 Sirocco, IMEI isn't written here, so you need to add yourself.

On Nokia 6.1 Plus sold in India with 6GB RAM (DGI TA-1083), IMEI here is not your actual IMEI, but 00440015202002, so you have to change it to the actual IMEI of Nokia 8.

Like this:

```
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000150  00 00 00 00 00 00 00 00 30 30 34 34 30 30 31 35  ........00440015
00000160  32 30 32 30 30 30 32 00 00 00 00 00 00 00 00 00  2020002.........
00000170  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
```

For Nokia 8.1 and Nokia 9 PureView, it's located at **mfd** partition, offset 0x16C. On Nokia 8.1, imei\_1 here is empty, which is expected and you need to write proper IMEI yourself here, like this:

```
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  44 66 4D 5F 00 00 00 00 09 00 00 00 73 77 69 64  DfM_........swid
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000060  70 72 6F 64 75 63 74 69 64 00 00 00 00 00 00 00  productid.......
00000070  50 4E 58 47 41 4D 30 31 32 33 34 35 36 37 38 39  PNXGAM0123456789
00000080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000B0  10 00 00 00 62 74 5F 6D 61 63 00 00 00 00 00 00  ....bt_mac......
000000C0  00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx  ....xxxxxxxxxxxx
000000D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000100  00 00 00 00 0C 00 00 00 77 69 66 69 5F 6D 61 63  ........wifi_mac
00000110  00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx  ........xxxxxxxx
00000120  xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00  xxxx............
00000130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000150  00 00 00 00 00 00 00 00 0C 00 00 00 69 6D 65 69  ............imei
00000160  5F 31 00 00 00 00 00 00 00 00 00 00 30 30 34 34  _1..........0044
00000170  30 30 31 35 32 30 32 30 30 30 32 00 00 00 00 00  00152020002.....
```

After IMEI of this partition got hacked, you can now flash the bootloader unlock key to the phone and perform bootloader unlock, and restore the original partition back.