yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Guides, News, & Discussion] Rootuser3.0:
Did you happen to have a black pixel xl or white. I just got one from Asurion too I promise had a white one bit they said 2 to 3 weeks wait time but I could get the black one instead so I chose black and it's locked down. I took out my sim and connected it to WiFi and still greyed out
[Google Pixel XL Guides, News, & Discussion] Uncle Lizard:
I have a black one, but I didn't put the SIM card in until after I unlocked the bootloader.
[Google Pixel XL Guides, News, & Discussion] DirtydAmbrose:
Was yours the 128 GB model or the 32 ? I have a black pixel xl 128 on back order with asurion. I think someone posted that if they do not replace your phone in like a week that you can get Verizon to replace it and you pay them the deductible and then asurion settles up with them.
[Google Pixel XL Guides, News, & Discussion] pritchfest:
This worked for me! So easy, much thanks.

I'm stock kernel with this modification:

https://xdaforums.com/pixel/development/kernel-stock-kernel-safetynet-patch-t3515692
[Google Pixel XL Guides, News, & Discussion] xdadevnube:
I just got my Pixel XL today: purchased from Play Store and came with Android 7.1.1.

This thread seems like the place to ask whether it is possible to unlock the bootloader on a Google variant of the Pixel without connecting to the internet.

An internet connection is required to toggle the OEM Unlock in dev settings.

I'm curious if any of the methods in this thread would work for this.

Obviously, Google is getting device information for each device that toggles this and it is likely they could share this information with the carrier. The carrier would in theory know that the device is bootloader unlocked.

There is an XDA thread that doesn't yield any information regarding unlocking the bootloader without an internet connection. I figured this thread is the most pertinent.
[Google Pixel XL Guides, News, & Discussion] jjayzx:
This thread is about the Verizon variant cause it's stock locked. Google variant is not locked, just do the unlock procedure.
[Google Pixel XL Guides, News, & Discussion] DA6030:
I appreciate the point, which is just that there isn't a "brand new, before first connection" sort of vulnerability that might be portable from Google Play devices to Verizon devices, because the default state, for all Pixels, is to disallow unlocking. [MENTION=4151838]xdadevnube[/MENTION] demonstrated that all Pixels assume they should be locked, even Google Play editions, until they connect to the mothership (at which point they're informed that they are actually Google Play editions, so it's okay to be unlocked). That would be more secure, from Google's perspective, than if any devices shipped unlockable, and upon connection, learn they're actually Verizon editions and should not be unlockable. Really a nuanced difference, but potentially helpful to those trying to find vulnerabilities.
[Google Pixel XL Guides, News, & Discussion] DirtydAmbrose:
People have talked about it not being cid, and possibly not imei related to be able to unlock bootloader or not, but what about the actual device id ? Let's say someone has a Verizon pixel XL and a Google store pixel XL and they paid cash for both and 100% legally own them lock stock and barrel, could they actually put the Google play store device id on the Verizon pixel XL and see if putting that Google play store device id allows the Verizon pixel XL to unlock the bootloader ? Then change the Verizon pixel XL device id back to its stock device id after bootloader unlocking it.

My question is, is it possible to change the device id of a Verizon pixel XL to the one of a Google store model or is changing the device id going to require being bootloader unlocked to do ?

I am more familiar with HTC phones and how they can be s-off unlocked but I do not really know this type of animal so I am just throwing things at the wall to see if anything sticks.

Any thoughts on this or am I way off base and it's not possible to do ?
[Google Pixel XL Guides, News, & Discussion] blueyes:
The VZW meid is the hard coded device ID. Meid's are embedded into CDMA. Phones, just as imei's are embedded into GSM phones.

The VZW pixels​ meid is vzwmeid btw. Fastback getvar all command will print the information.
[Google Pixel XL Guides, News, & Discussion] DirtydAmbrose:
I thought Verizon switched to using imei just as gsm has ? Verizon uses your imei to register your device and gives them the make and model of phone. Unless they use the imei to get the meid but they did use to use the meid to register their phones at least until phones like the HTC m7 came out.

Now on htc phones I had an unlocked 10 and they went by imei on it and I had to use a Verizon one to get it to work on Verizon well that and flash the Verizon radio. I just thought maybe it might be a thought. Just would be nice if someone could crack this. My money would be on you figuring it out.
[Google Pixel XL Guides, News, & Discussion] blueyes:
https://www.verizonwireless.com/support/knowledge-base-32159/

Verizon is somewhat unique. Afaik it's the only carrier who's devices (every single one) is sold sim unlocked and will work on any carrier out of line box with no modification's. They have an imei , but are embedded and link to their servers with the vzwmeid and VZW_cid. Hook up to a PC and using fastboot run " fastboot getvar all". You'll see the info. HTC devices can change the code to the suoercid without issue. The vzwmeid is tied into the ESN. Mess it up and end up with a bad ESN. That's something you don't want.
[Google Pixel XL Guides, News, & Discussion] DirtydAmbrose:
Oh I was not doubting you only trying to understand as verizon still uses imei number to activate a device on line. I think they have to have their phones carrier unlocked due to a FCC agreement they made, but they still do what they can to lock out other USA carriers as they lock out the apn settings so you can't add the apn for at&t or T-Mobile but they did add apns for foreign countries so people traveling abroad could use their phone out of the country. They did this with android m or maybe it was L and not sure with nougat but most likely Verizon still locked out adding apns for at&t and T-Mobile. Leave it to Verizon. With s-off on HTC phones you could add apns, not sure about pixels.

So if you had to guess what would you think tells the Google servers if the BL can be unlocked or not ? Jcase does not want to speculate but he probably has an idea on it.
[Google Pixel XL Guides, News, & Discussion] Jmaher7098:
0.xml blank wwhen i open it

Sorry wrong thread

---------- Post added at 07:49 PM ---------- Previous post was at 07:46 PM ----------

Plz help don't know what to used
[Google Pixel XL Guides, News, & Discussion] EstiR86:
So if someone was able to change the cid to say the string of ones rather than the vzw cid would this make the device bootloader unlockable? This thread has been all over the place and is pretty hard to follow.
[Google Pixel XL Guides, News, & Discussion] bobby janow:
No.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
Alright so has anyone determined what is causing the bootloader from being unlocked so we can try to start exploiting it.
[Google Pixel XL Guides, News, & Discussion] fizbanrapper:
Verizon is. They're Assh0les
[Google Pixel XL Guides, News, & Discussion] EstiR86:
Agreed but does anyone else think that maybe the one of the apps that the sim card installs can be the cause of this, also does the people with the Verizon pixel have the same system apps like Verizon oma trigger as those that get installed through the sim.
[Google Pixel XL Guides, News, & Discussion] toknitup420:
No. All these pipe dreams have already been dreamed and crushed.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
Thanks for the response do you happen to have a Verizon pixel, and if so can you go to installed apps and tell me which system apps are installed related to verizon
[Google Pixel XL Guides, News, & Discussion] toknitup420:
All those vzw system apps come with even the Google factory image. They're on every pixel device.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
This doesn't make much sense I doubt pixels from the play store have system apps related to verizon if they are on a carrier such as fi. Then again this could be a term Verizon insisted on knowing them.
[Google Pixel XL Guides, News, & Discussion] toknitup420:
Doubt it all you want. If you take apart the system image from a Google factory image there are vzw apps in system.
[Google Pixel XL Guides, News, & Discussion] cb474:
I'm confused, is it still possible to unlock the bootloader on a current uptodate Verizon Pixel with Oreo? Does dpixel8 still work or something else?
[Google Pixel XL Guides, News, & Discussion] mrmidnight:
The switch does nothing for the Verizon Pixels as was stated above and in the other post you commented in bud.
[Google Pixel XL Guides, News, & Discussion] stinger4321:
Have a locked google verizon replacement.. up for sale but in the meantime willing to cancel the listing and try anything on it...I dont care if it bricks.. using my old trusty nexus 6 in the meantime..
[Google Pixel XL Guides, News, & Discussion] AncientDeveloper:
You're my guy! I'm attempting to explore other possibilities without exploiting the bootloader code, but I don't have a Verizon Pixel to test the theory.

Here's the logic: Since the G-2PW2100s all seem to share identical hardwares, there should be no reason why a non-Verizon factory image can't be flashed onto a Verizon G-2PW2100. The factory images contain all the bootloader/radio partition images; so in theory, flashing a non-Verizon factory image should make the device non-Verizon. (Aside from the imei/meid/esn/etc)

Therefore as long as there's a way to write to the partitions, this should be achievable. Feel free to PM me to try a few things.
[Google Pixel XL Guides, News, & Discussion] mattwheat:
Theoretically? ....... Theoretically, there are a lot of things that could take place to solve our bootloader problem. The fact of the matter is we can't flash anything with out first gaining temp root. Or finding an exploit. I've seen you trolling almost every thread in here offering up the same idea as above. Trust me there are some very talented devs around here, and I'd be willing to bet that between them and every other frustrated VZW Pixel owner, every other option, trick, old school method, or improvised solution has been thought of and talked about on here.

Not trying to be rude dude, just saying don't get your hopes up, and get all gung ho that this is just another simple Moto RZR HD we are messing with. But I do appreciate your enthusiasm.

---------- Post added at 01:04 PM ---------- Previous post was at 12:58 PM ----------

No sir. If you are on 7.1.2 or higher and or your "OEM unlocking" is greyed out so you can't switch it in your Dev options then your bootloader is locked FORRRRRREEEVVVVEERRRRR <---- said in a echoing deep sci fi accent.
[Google Pixel XL Guides, News, & Discussion] stinger4321:
Fyi.. i dumped my locked pixel xl.. first tried to get google to replace with playstore version... But they wouldnt do anything... With bootloader locked you can only flash ota zips.. need unlocked to flash images... Guess maybe a playstore pixel 2 xl is in my future
[Google Pixel XL Guides, News, & Discussion] AncientDeveloper:
Call me a troll or whatever; I like tackling difficult problems . I'm in no way claiming to be a smart person, and I understand it's not easy. Frankly, I don't even have a Verizon Pixel, so there's absolutely no need for me to do this. Just trying to give back to the community.

Personally, I believe theories are the foundation of breakthroughs; while most theories stay as theories (as I have been working on quantum theories for many years now), I don't believe they should be dismissed unless proven wrong. That said, technically, one would just need to gain access to write to the eMMC; root and/or exploit are just different ways to do so, and there are possibly other ways.
[Google Pixel XL Guides, News, & Discussion] cb474:
Thanks for the explanation. Does this mean it is also not possible to root the Verizon version with OEM unlocking greyed out?
[Google Pixel XL Guides, News, & Discussion] TonikJDK:
Correct, you need the bootloader unlocked to root this ohone.
[Google Pixel XL Guides, News, & Discussion] bobby janow:
Can you root any phone with a locked bootloader?
[Google Pixel XL Guides, News, & Discussion] sd_shadow:
Yes, many devices have been rooted with a locked bootloader, just not the Pixel
[Google Pixel XL Guides, News, & Discussion] bobby janow:
Very interesting. I've been out of the root game since the Pixel (how quickly they forget) but I seem to recall I needed to unlock the bl for my 5x in order to root. Forgot how I did it on the Nexus 5 but I also think I unlocked. This was all before Android Pay put an end to that, however. So which phone can you root without bl unlock? Just curious.
[Google Pixel XL Guides, News, & Discussion] lucky_strike33:
Samsung phones have root with bootloader locked
[Google Pixel XL Guides, News, & Discussion] hooks024:
You can root a number of devices with kingroot. Their super user software sucks, but it can be removed and SuperSU installed with minimum effort using adb. The problem I ran into with my gs4 was the locked bootloader, so I could only install TouchWiz based ROMs using flashfire. I'd love to be able to get root on my pixel though, even if I can't flag any ROMs.
[Google Pixel XL Guides, News, & Discussion] mattwheat:
Granted. ND I have been hearing about some software security company testing Android bootloader's and we're amazed at all the security exploits they were able to find. Maybe there's a way in there.

---------- Post added at 07:51 PM ---------- Previous post was at 07:51 PM ----------

Yes.
[Google Pixel XL Guides, News, & Discussion] B0RD34UX:
I remember being able to root my G4 and L9 without unlocked bootloader.
[Google Pixel XL Guides, News, & Discussion] HACK3DANDR0ID:
I just purchased a Verizon Pixel XL, using with TMO SIM, i didnt see any Verizon apps on my device... Trying to unlock bootloader as well...
[Google Pixel XL Guides, News, & Discussion] TonikJDK:
You won't get VZ apps without a VZ SIM. The SIM has nothing to do with the bootloader. A VZ phone is bootloader locked no matter what unless it is on 7.1.0. Anything higher and you are done.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Just to clarify, you will get a couple carrier apps relative to the initial radio configuration (radio is the first thing to start after the bootloader). Google gets project for, Sprint has sprintdm and another one or two, , etc. Its like 2-3 apps,. Really, that's not bloatware. Plus their uninstallable.
[Google Pixel XL Guides, News, & Discussion] H0wdy:
I'm using 8.1 and Sprint. My OEM lock is greyed out. What can I do?
[Google Pixel XL Guides, News, & Discussion] ironmaskusa:
Not a damn thing, my man. There are quite a few of us waiting for a payload from some generous developer to look into and maybe stumble into an exploit we can grease that switch up with and flick right out of the gray... but who knows... maybe never.. which is really puzzling me as to why no one else has tried and done it just for boasting rights! :D
[Google Pixel XL Guides, News, & Discussion] EstiR86:
To all those needing your bootloaders unlocked, go look at this thread where someone has found a way to unlock the bootloader of a Verizon Pixel 2.

https://xdaforums.com/pixel-2/help/maybe-stupid-question-verizon-pixel-2s-t3726294/page2

Command:

Fastboot flashing lock_critical

Please go check and see if this works I also made a thread for the Original Pixel's that can be found here, refer to this threads for unlocking the bootloaders for the OG Pixels.

Best of luck to all!

https://xdaforums.com/pixel-xl/how-to/verizon-pixel-bootloader-unlocked-t3726672
[Google Pixel XL Guides, News, & Discussion] george241312:
Guys i just remembered HTC has their own fastboot build that has more commands compared to the regular google fastboot which enable write cid commands.
[Google Pixel XL Guides, News, & Discussion] jjayzx:
There's currently no way to write Cid properly.
[Google Pixel XL Guides, News, & Discussion] thewebsiteisdown:
Just for the hell of it I tried that version and it won't detect my device. Well it states it's offline anyway.

Is there a way to write 11111111 to the ro.boot.cid while in the os using root explorer?
[Google Pixel XL Guides, News, & Discussion] blueyes:
It's found in /sys/firmware/devicetree/radio/chosen/hts_smem_cid

But you can not write to it. Pa

Possibly copy it and write to it then push back. But I'm not using the supercid. It's there in getprop but if I run fastboot readcid I get vzw
[Google Pixel XL Guides, News, & Discussion] blueyes:
Yes.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Permissive
[Google Pixel XL Guides, News, & Discussion] blueyes:
Notice my ro.boot.cid has not changed
[Google Pixel XL Guides, News, & Discussion] blueyes:
If you want to only see the oem args on getprop

Run getprop | grep oem
[Google Pixel XL Guides, News, & Discussion] blueyes:
Using grep
[Google Pixel XL Guides, News, & Discussion] jjayzx:
Cid also pops up in board info file.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Yup. Why I'm thinking that the Cid is not the target
[Google Pixel XL Guides, News, & Discussion] death2all110:
Great! Thanks!
[Google Pixel XL Guides, News, & Discussion] blueyes:
Once you modify (ElementalX or any other kernel) the command is fastboot flash boot ElementalX.img , you only run fastboot boot ****.img for the boot-to-root.img
[Google Pixel XL Guides, News, & Discussion] death2all110:
Unfortunately, even thought setcid exists as a command in the bootloader, it appears its blocked.

For reference, here's the OEM commands that the bootloader has some may/may not work. I do not recommend testing a command unless you know what it does.

oem reboot-download
oem reboot-ftm
oem rebootRUU
oem listpartition
oem listram
oem dmesg
oem last_dmesg
oem update_emmc_partition
oem read_mmc
oem write_mmc
oem test_emmc
oem ufs_get_lun
oem ufs_set_lun
oem erase_phone_storage
oem unlock
oem lock
oem device-info
oem show-barcodes
oem ramdump
oem getcolorid
oem setcolorid
oem getcid
oem setcid
oem enable-charger-screen
oem disable-charger-screen
oem off-mode-charge
oem select-display-panel
oem readconfig
oem writeconfig
oem easydump
oem readunlock
oem dumpDataCode
oem dsiw
oem dsir
oem ddrtest
oem dump_ram_full
oem get_ks_token
oem get_anti_theft_status
oem sha1sum
oem readmeid
oem refurbish
oem batt_enable_bms_charger_log
oem batt_disable_tbatt_protect
oem batt_enable_fast_charge
oem batt_test_pwr_supply
oem batt_for_pa_test
oem batt_disable_safty_timer
oem batt_keep_charge_on
oem uart
oem htc_radio_debug_func
oem htcramdump
oem autordump2storage
[Google Pixel XL Guides, News, & Discussion] blueyes:
You ran strings | grep OEM against the aboot?

Quite a few don't work. Possibly due to not being a debug build or not being adb=insecure
[Google Pixel XL Guides, News, & Discussion] blueyes:
If you run the ks token command you'll get your unlock bootloader code
[Google Pixel XL Guides, News, & Discussion] death2all110:
Correct.

---------- Post added at 04:16 PM ---------- Previous post was at 04:11 PM ----------

I see that. That's interesting.
[Google Pixel XL Guides, News, & Discussion] Zeroflucks:
Hows progress going? getting close to figuring this out? Thanks.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Im in a few chats with some great HTC guys. I'm going to bring some in on this...
[Google Pixel XL Guides, News, & Discussion] blueyes:
Fastboot getvar all
[Google Pixel XL Guides, News, & Discussion] M9guy:
With some good Htc devs working on it, I can almost guarantee they will figure it out. Glad to see Htc devs involved, I have always thought the Htc guys were the top devs and they can crack about anything, and on ocassion they work with beaups and jcase.
[Google Pixel XL Guides, News, & Discussion] social-design-concepts:
can't you use fastboot boot foo.img to test before flashing?
[Google Pixel XL Guides, News, & Discussion] thewebsiteisdown:
I wasn't able to give anymore thanks yesterday so now I am giving them to you. I was pretty busy yesterday after participating. So what's the verdict then? I would think that just like in the past that changing the cid would be another way of accomplishing what you did. I see that your way worked just as good but would be curious to see if changing the cid does the same thing as well. It makes sense it would based on past hacks with htc phones.
[Google Pixel XL Guides, News, & Discussion] death2all110:
We're still looking into it. The CID makes sense to me. However, [MENTION=2376614]jcase[/MENTION] says the CID doesn't do sh!t.

https://twitter.com/jcase/status/795379769776869376
[Google Pixel XL Guides, News, & Discussion] psychatog64:
Has anyone else gotten this to work or just blue eyes ATM?
[Google Pixel XL Guides, News, & Discussion] blueyes:
I'd have to agree with [MENTION=2376614]jcase[/MENTION]. As I haven't changed my cid. And have full control over the unlocking switch in developers options. The cid(supercid) would more than likely only make a flip on a HTC phone with an unlocked bootloader and S-off. As far as I can tell this phone has no signs of being "S" anything
[Google Pixel XL Guides, News, & Discussion] blueyes:
I'll see what I can do bud. I'm on the BlissRom dev team and we have some HTC guys but was invited to a slack with quite a few sharp devs who collaborate and mash ideas. I didn't start it so don't have invite rights there. That would be [MENTION=5676253]fizbanrapper[/MENTION]
[Google Pixel XL Guides, News, & Discussion] death2all110:
BlissRom guys know me! I was on the team back when I had my m8. Small world!
[Google Pixel XL Guides, News, & Discussion] psychatog64:
Has this been isolated to a certain thing that caused this to work?
[Google Pixel XL Guides, News, & Discussion] jjayzx:
[MENTION=6207927]blueyes[/MENTION] are you still on p version?
[Google Pixel XL Guides, News, & Discussion] treIII:
Blue eyes look in the system image thread. There are strings for unlocking the bootloader in the Google settings app. I'm just wondering if the code is written different b upon booting a Verizon pixel xl through this apk. It's under the rom recovery kernel section posted on page 2
[Google Pixel XL Guides, News, & Discussion] blueyes:
Yes
[Google Pixel XL Guides, News, & Discussion] blueyes:
Here is my Settings and SystemUI apks

https://www.dropbox.com/s/dccgdvh9fwb8ekf/settings_ui.zip?dl=0
[Google Pixel XL Guides, News, & Discussion] death2all110:
Yeah I pulled the APKs the other day. Working on getting them de-odexed and decompiled.
[Google Pixel XL Guides, News, & Discussion] death2all110:
Ok. So I was able to get the smali code of SettingsGoogle and Services.jar there was nothing really of use in systemui. I'm not the best at smali and I'm at work, but what I did read of the code led me to PeristentDataBlockService, hence why I decompiled services.jar as well.

https://drive.google.com/file/d/0B1HxFGzV7xG8OUh3UjRvb09oaVk/view

Let me know if anything else is needed.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Look in /data/property

Do you have a file persist.sys.oem_unlock_allowed?
[Google Pixel XL Guides, News, & Discussion] death2all110:
I do not.

I just created it and gave it a value of '1'. Rebooting now....
[Google Pixel XL Guides, News, & Discussion] blueyes:
Correct
[Google Pixel XL Guides, News, & Discussion] death2all110:
No go. Still grayed out. Granted it says bootloader is already unlocked.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Then wipe data from your settings app and reboot, make sure that line is also in build.prop
[Google Pixel XL Guides, News, & Discussion] death2all110:
Same thing.
[Google Pixel XL Guides, News, & Discussion] social-design-concepts:
Has anyone reproduced the result yet? does it need to be the same kernel as [MENTION=6207927]blueyes[/MENTION]?
[Google Pixel XL Guides, News, & Discussion] jjayzx:
I don't know what others are using but I was on x.
[Google Pixel XL Guides, News, & Discussion] psychatog64:
You got this to work?