[Android Q&A, Help & Troubleshooting] Ryu Kenshin:
Okay, today i got a break-through with nandunlock. I'm soo... happy to share it with you guys.

First, download nandunlock.zip and extract all the contents to the same folder as adb.exe

Push nandunlock to data/local:

adb push nandunlock /data/local/

adb shell chmod 755 /data/local/nandunlock

Run temp root as my other previous guide.

Make sure your boot_daemon_drv like this:

adb shell

$ ls -l /dev/boot_daemon_drv

ls -l /dev/boot_daemon_drv

crw-rw-rw- 1 system cache 247, 0 Apr 20 09:14 [1;35m/dev/boot_daemon_drv[0m

Next get root permission and run nandunlock:

$ su

su

# /data/local/nandunlock

/data/local/nandunlock

[+]iomem address get

mmap base =80000000 length=1c000000

text offset=00048000 length=0071a000

data offset=00762000 length=0011e3ec

[+]mmap

mem=40021000 offset=7ffdf000

[+]kallsyms_addresses=c0613230

count=0000a8b8

[+]kallsyms_num_syms=0000a8b8

[+]kallsyms_names=c063d520

[+]kallsyms_markers=c06b8230

[+]kallsyms_token_table=c06b84e0

[+]kallsyms_token_index=c06b8870

[+]kallsyms_lookup_name

[+]kallsyms_lookup_name

shboot_daemon_read =c0249f64 shboot_daemon_write=c0249e9c

shboot_daemon_mmap =c0249e44 shboot_daemon_open =c0249e00

shboot_daemon_release=c0249e24

commit_creds =c00acb60 prepare_kernel_cred=c00ac828

[+]shboot_daemon_ioctl entry pointer search

addr=c079ad14

c079acf0 :

c079acf0 : 00 00 00 00 00 00 00 00 64 9f 24 c0 9c 9e 24 c0 ........d.$...$.

c079ad00 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad10 : 00 00 00 00 00 00 00 00 00 00 00 00 44 9e 24 c0 ............D.$.

c079ad20 : 00 9e 24 c0 00 00 00 00 24 9e 24 c0 00 00 00 00 ..$.....$.$.....

c079ad30 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad40 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad50 : 00 00 00 00 00 00 00 00 51 34 6e c0 ff ff ff ff ........Q4n.....

[+]entry point write

c079acf0 :

c079acf0 : 00 00 00 00 00 00 00 00 64 9f 24 c0 9c 9e 24 c0 ........d.$...$.

c079ad00 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad10 : 00 00 00 00 39 8b 00 00 00 00 00 00 44 9e 24 c0 ....9.......D.$.

c079ad20 : 00 9e 24 c0 00 00 00 00 24 9e 24 c0 00 00 00 00 ..$.....$.$.....

c079ad30 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad40 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

c079ad50 : 00 00 00 00 00 00 00 00 51 34 6e c0 ff ff ff ff ........Q4n.....

[+]ioctl system call

[+]get root

[+]entry point erase

mmc_protect_part=c05d458c size=88

0000ac98 :

0000ac98 : 00 00 00 00 02 00 00 00 01 00 00 00 03 00 00 00 ................

0000aca8 : 02 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 ................

0000acb8 : 04 00 00 00 02 00 00 00 06 00 00 00 03 00 00 00 ................

0000acc8 : 07 00 00 00 03 00 00 00 08 00 00 00 03 00 00 00 ................

0000acd8 : 09 00 00 00 02 00 00 00 0a 00 00 00 02 00 00 00 ................

0000ace8 : 0b 00 00 00 02 00 00 00 00 00 a0 e3 1e ff 2f e1 ............../.

0000acf8 : 2f 73 79 73 74 65 6d 2f 62 69 6e 2f 73 68 00 00 /system/bin/sh..

c05d458c :

c05d458c : 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................

c05d459c : 02 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ................

c05d45ac : 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 ................

c05d45bc : 07 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................

c05d45cc : 09 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 ................

c05d45dc : 0b 00 00 00 00 00 00 00 4c 26 38 c0 30 26 38 c0 ........L&8.0&8.

c05d45ec : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

kallsyms_addresses search failed

c01f918c :

c01f918c : 00 00 a0 e3 1e ff 2f e1 04 b0 4c e2 00 70 52 e2 ....../...L..pR.

c01f918c :

c01f918c : 00 00 a0 e3 1e ff 2f e1 04 b0 4c e2 00 70 52 e2 ....../...L..pR.

NAND unlock failed.

Ignore the NAND failed message, mount the /system folder to get read-write permission:

# mount -o rw,remount /dev/block/platform/mmci-omap-hs.0/by-name/system /system

mount -o rw,remount /dev/block/platform/mmci-omap-hs.0/by-name/system /system

Then you can edit your build.prop as you like, or to make root permanent everytime you reboot with this:

# cp /data/local/su /system/bin

cp /data/local/su /system/bin

Voila, every time you reboot, open terminal console (find one on market) and type:

$ su

#

Bricked Warning: Don't follow this guide anymore!!!