[YU Yuphoria] SkandaH:
[GUIDE] Unlock the bootloader of YU Yuphoria without using fastboot & wiping userdata

Introduction

As we know, the official way to unlock the bootloader of YU Yuphoria (YU5010A) is through fastboot.

For a untouched device, the status of the bootloader should be:

fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false

To unlock the bootloader, you need to enable 'OEM unlocking' under Developer options first, then via bootloader/fastboot interface:

fastboot oem unlock

It'll eventually erase the userdata.

Then the status of the bootloader should be:

fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: true

Inspired by the findings on similar devices, we can actually unlock the bootloader of YU Yuphoria (YU5010A) without using fastboot, while keeping the userdata intact.

How-to

Warning!

It is dangerous! This whole thing is basically one giant hack - which is not intended to be done by normal users. It is messing with the bootloader partition, so it is possible that something goes wrong and you will have a nice & costly brick in your pocket. Be prepared to revive the device from a hard-brick.

1.

Enable 'OEM unlocking' under Developer options. You may need to tap the Build number 7 times under About phone to get the Developer options under Settings.

2.

We need root access (kinda expected!). To root the device without unlocking bootloader, use KingRoot. Use the Android version.

Now there is a catch! KingRoot can root the device, cause the latest build of OS (YU5010A_SW_V026_HW_M21 ATM) contains such vulnerabilities which can be exploited by the root exploits used by KingRoot. But we can't ensure about future.

The Cyanogen OS variant (YU5010) is currently unaffected by the root exploits. But the same logic is applicable on it too.

3.

After being rooted, use adb shell or any terminal emulator to dump the 'aboot' i.e bootloader partition in internal sdcard:

su
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/aboot.img

4.

Now we need to modify the dumped image using hex-editor. For YU Yuphoria:

Unlock Bit Position - 0x000FFE10 Hex
Tamper Bit Position - 0x000FFE14 Hex

'00' means false, '01' means true. So to set the bootloader as unlocked, we just need to change the following:

Save the modified image as 'abootmod.img' inside your sdcard.

5.

Now its time to flash back the modded bootloader. Execute the following from adb shell or any terminal emulator:

su
dd if=/sdcard/abootmod.img of=/dev/block/bootdevice/by-name/aboot

Do a reboot & voila! You have unlocked the bootloader! Don't just believe me - check the status of the bootloader to ensure.

Note

1. We can also reset the tamper bit using this procedure.

2. If you prefer GUI, then you can use this fantastic app by [MENTION=3562083]wanam[/MENTION].

3. This is tested on a stock Android (YU5010A) variant of YU Yuphoria running OS version YU5010A_SW_V026_HW_M21. Please test & post feedback to ensure compatibility.

4. I'm not providing pre-modified images as it increases the risk of bricking the devices having older/newer bootloaders - please do it yourself. The offsets should be unchanged in future, though.

Credits

1. [MENTION=4544860]osm0sis[/MENTION]

2. [MENTION=4551856]segv11[/MENTION]

3. [MENTION=5381511]Mnt-XDA[/MENTION]

4. luvyu - for providing initial partition dumps.

5. [MENTION=5939513]abees[/MENTION] - for risking his device for this experiment.

6. Users of XDA & YU forums.

Happy tinkering! :highfive: :good: