[Nexus 6 Q&A, Help & Troubleshooting] playahate:
INTRO​

This thread and the method described is dedicated to bricked Nexus 6 and Nexus 9 that has TWRP installed but locked bootloader. No wipes are helpfull, ROMs flashes (or not) but gives permanent bootloop.

If no other methods work, then here is your chance:

IMPORTANT!!! The unlockN6.img file is only for NEXUS 6! The unlockN9.img file is only for NEXUS 9!

The script will work on both N6 and N9.​

1. Boot to TWRP. If you didn't wipe the userdata trying to ressurect the device, you can get all your files with

adb pull sdcard d:\sdcard\

You can use any folder instead of d:\sdcard\ but you must create the folder first.

[IMG="adb pull sdcard"]http://i.imgur.com/OR19Xgfh.jpg[/IMG]

1.1 If the TWRP logo blinks but doesnt boot you are still good to go as users report that adb still work even in that case.

1.2 With the blinking TWRP logo you can boot to bootloader and perform

fastboot -w

This will wipe the cache and USERDATA. all your data will dissapear but TWRP will boot normally

NEXUS 6

2.1 Download the unlockN6.img file from the attachments at the bottom of the post and place it to adb folder on PC.

In case the folder is c:\android perform the following:

adb push c:\android\unlockN6.img /sdcard/unlockN6.img
adb shell dd if=/sdcard/unlockN6.img of=/dev/block/mmcblk0p18

Reboot to bootloader and make:

fastboot oem unlock

After that you are able to to flash the stock firmware with flash-all.bat or manually file-by-file.

As we don't know how some hash in the beginning of the unlockN6.img file influence the device. We didn't notice any difference though, but Prefferred way is use the script.

Instead of making dd, push and flash the script made by [MENTION=4544860]osm0sis[/MENTION], in the end of the post. For both N6 and N9.

then unlock bootloader and flash ROM.

NEXUS 9

2.2 Download the unlockN9.img file from the attachments (all the credits go to [MENTION=5049483]GedBlake[/MENTION] for providing us the file) at the bottom of the post and place it to adb folder on PC.

In case the folder is c:\android perform the following:

adb push c:\android\unlockN9.img /sdcard/unlockN9.img
adb shell dd if=/sdcard/unlockN9.img of=/dev/block/mmcblk0p27

Reboot to bootloader and make:

fastboot oem unlock

After that you are able to to flash the stock firmware with flash-all.bat or manually file-by-file.

If you are interested in additional information, all the prosses of gaining the information is given below... Othervise - skip to the dowload.

Problem​

As many of you already know, last Nexus devices (and all that will come after N6&N9) have new option in developers settings - Enable OEM Unlock.

New security feature from Google gives regular users new level of keeping their data in private space. And in case of lost (stolen) stock device with keyguard/pin enabled the villian can't even make the device work. The "old" Nexus devices can be easily unlocked/wiped and used as normal. But now, with the new feature, if someone will try to run fastboot oem unlock, will get the following:

with the Device is LOCKED Status Code: 2

Is it good or bad?​

Definetly good for regular users. But sometimes it turnes against some "want to be advanced" users. As many of the "unlock/flash custom rom" manuals has the line "You can lock the bootloader with the command fastboot oem lock" many users do this thing. Some of the users make it, as it guarantees the security (as many people think).

But sometimes something goes wrong and system doesn't boot. Many of the manuals say that if one perform fastboot oem lock and fastboot oem unlock again - everything wipes and there is normally booted stock device again... And it is a good method, that ended with the Nexus 5/7. Because now if you lock the device and the system doesnt boot, you will not be able to unlock it as you need to check the 'Allow OEM Unlock' in Developer Options.

INFO. How does it work?​

I'll start with the changes, commited in development_prefs.xml, DevelopmentSettings.java and Utils.java from the android.googlesource.com:

So the new devices have that spesial partition that influens wether the device can be unlocked.

If we go deeper in the docs, we can see how all that thing is working.

PersistentDataBlockService.java:

@Override
public void onStart() {
enforceChecksumValidity();
formatIfOemUnlockEnabled();
publishBinderService(Context.PERSISTENT_DATA_BLOCK_SERVICE, mService);
}
private void formatIfOemUnlockEnabled() {
if (doGetOemUnlockEnabled()) {
synchronized (mLock) {
formatPartitionLocked();
doSetOemUnlockEnabledLocked(true);
}
}
}
private void formatPartitionLocked() {
DataOutputStream outputStream;
try {
outputStream = new DataOutputStream(new FileOutputStream(new File(mDataBlockFile)));
} catch (FileNotFoundException e) {
Slog.e(TAG, "partition not available?", e);
return;
}
byte[] data = new byte[DIGEST_SIZE_BYTES];
try {
outputStream.write(data, 0, DIGEST_SIZE_BYTES);
outputStream.writeInt(PARTITION_TYPE_MARKER);
outputStream.writeInt(0); // data size
outputStream.flush();
} catch (IOException e) {
Slog.e(TAG, "failed to format block", e);
return;
} finally {
IoUtils.closeQuietly(outputStream);
}
doSetOemUnlockEnabledLocked(false);
computeAndWriteDigestLocked();
}
private void doSetOemUnlockEnabledLocked(boolean enabled) {
FileOutputStream outputStream;
try {
outputStream = new FileOutputStream(new File(mDataBlockFile));
} catch (FileNotFoundException e) {
Slog.e(TAG, "partition not available", e);
return;
}
try {
FileChannel channel = outputStream.getChannel();
channel.position(getBlockDeviceSize() - 1);
ByteBuffer data = ByteBuffer.allocate(1);
data.put(enabled ? (byte) 1 : (byte) 0);
data.flip();
channel.write(data);
outputStream.flush();
} catch (IOException e) {
Slog.e(TAG, "unable to access persistent partition", e);
return;
} finally {
IoUtils.closeQuietly(outputStream);
}
}
@Override
public void setOemUnlockEnabled(boolean enabled) {
// do not allow monkey to flip the flag
if (ActivityManager.isUserAMonkey()) {
return;
}
enforceOemUnlockPermission();
enforceIsOwner();
synchronized (mLock) {
doSetOemUnlockEnabledLocked(enabled);
computeAndWriteDigestLocked();
}
}
@Override
public boolean getOemUnlockEnabled() {
enforceOemUnlockPermission();
return doGetOemUnlockEnabled();
}

Many lines are skipped, you can find them by the link above. As we can see, there is one byte with 1 - allow oem unlock and 0 -do not allow.

DevelopmentSettings.java:

private static final String ENABLE_OEM_UNLOCK = "oem_unlock_enable";
private CheckBoxPreference mEnableOemUnlock;
@Override
public void onCreate(Bundle icicle) {
super.onCreate(icicle);
mEnableOemUnlock = findAndInitCheckboxPref(ENABLE_OEM_UNLOCK);
if (!showEnableOemUnlockPreference()) {
removePreference(mEnableOemUnlock);
}
private void updateAllOptions() {
final Context context = getActivity();
updateCheckBox(mEnableOemUnlock, Utils.isOemUnlockEnabled(getActivity()));
private static boolean showEnableOemUnlockPreference() {
return !SystemProperties.get(PERSISTENT_DATA_BLOCK_PROP).equals("");

So those lines give us the information, that users try to find out in other threads... So here it is:

The checkbox goes to "off" after every reboot.

So you can't just allow oem unlock and use it sometimes in the future. It will work only with the first reboot to bootloader. And if you reboot the phone without changes - it will reset the option in settings.

UPD: With the 5.1.1 update, it remains enabled after reboot.

Getting things done​

If you look into the PersistentDataBlockService.java, you can find the line:

private static final String PERSISTENT_DATA_BLOCK_PROP = "ro.frp.pst";

And if we go to the /system/build.prop on the device, we will get the following:

ro.frp.pst=/dev/block/platform/sdhci-tegra.3/by-name/PST for the Nexus 9

ro.frp.pst=/dev/block/platform/msm_sdcc.1/by-name/frp for the Nexus 6

The next step is running

adb shell busybox fdisk /dev/block/mmcblk0

So we can see for the Nexus 6:

The PST partition of the Nexus 9 is 27.

What can we do about it?

Well. Thats simple. All we need is TWRP/working adb.

Actually some users with blinking TWRP logo still can use adb. Some can perform fastboot -w or fastboot format cache and fastboot format userdata to make TWRP work, wipe and boot.

But sometimes there is no system and nothing can be flashed (as it was with one device on russian forum).

So with all the information written above we made the following:

Asked the guy with the live device to check the allow oem unlock and reboot to recovery.

adb shell dd if=/dev/block/mmcblk0p18 of=/sdcard/unlock.img

to copy the partition on sdcard and send us the file.

on the "bricked" device run:

adb push c:\android\unlock.img /sdcard/unlock.img

Where c:\android - is the folder with the adb and file itself.

adb shell dd if=/sdcard/unlock.img of=/dev/block/mmcblk0p18

and after reboot to bootloader we succesfully performed the fastboot oem unlock.

Hope the information is usefull and will help someone.

IMPORTANT!!! The unlockN6.img file is only for NEXUS 6! The unlockN9.img file is only for NEXUS 9!

The script will work on both N6 and N9.

If you dd the wrong file your device will not boot, you will not be able to use TWRP after that​

And ones again: the BEST way is to use [MENTION=4544860]osm0sis[/MENTION] UPDATE-Nexus.BootUnlocker.zip from THIS post (or newer is exists).