yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Guides, News, & Discussion] treIII:
Is it possible that you upload your boot.img with all the changes you've made so someone else can flash it and see if the toggle for OEM unlocking becomes live? Just a thought. Nice work.
[Google Pixel XL Guides, News, & Discussion] jjayzx:
Sadly no, only things I didn't get to do was decrypt and get selinux to stay on permissive. I don't know if decrypt is required for permissive to stick and being permissive is really the last chance of it working or not.
[Google Pixel XL Guides, News, & Discussion] blueyes:
When you get a chance, run the fastboot command to get_unlock_ability. If your switch changed to "already unlocked" you may get a "1" now instead of a"0". My Angler says that exact same thing
[Google Pixel XL Guides, News, & Discussion] blueyes:
https://www.dropbox.com/s/ow0kcjckh67kv3c/prop.zip?dl=0

https://www.dropbox.com/s/jp42iebwjy0wg2g/boot_a&_ b.zip?dl=0

One is my actual build.prop second contains boots. Pulled from device. Don't believe I still have the original boot.img
[Google Pixel XL Guides, News, & Discussion] treIII:
I want the boot image in which gives you the ability that you edited the ramdisk on the gave you the ability to toggle the OEM unlock switch
[Google Pixel XL Guides, News, & Discussion] blueyes:
All I did to the ramdisk was remove forecencryption. And Added permissive and a cid line to cmdline. cid line does nothing so it's pointless. You can use those images I zipped using dd if=boot_a of=/dev/block/.....

Im fairly certain that the boot only allows me to stay decrypted and permissive.
[Google Pixel XL Guides, News, & Discussion] treIII:
I've done the other things in the thread that you have listed and I've not gotten the ability to toggle the switch. I see why others are still digging to find out what gave you the ability. I done something like this in the past the gave the ability to over clock the HTC evo 4 g LTE and if my directions weren't followed in order to the tee then it wouldn't permit over clocking. I listed the steps in order and they had to be done in the exact order I posted or it wouldn't take effect. Doing everything I listed didn't matter if it wasn't done in the exact order. So I had tricked the phone somehow and I'd remembered my steps in order. Hopefully someone will figure out what triggered it for you.

---------- Post added at 02:15 AM ---------- Previous post was at 02:11 AM ----------

I thought the default.prop edits were contained in the boot.img? That's why I wanted the boot.img. i thought I had read that in the other thread where you originally posted about this. And thanks

---------- Post added at 02:17 AM ---------- Previous post was at 02:15 AM ----------

I wonder if anyone who has purchased the phone from Verizon has paid off the phone and asked Google if they could have the ability for their phone to be carrier unlocked per say so they could unlock the bootloader on their device
[Google Pixel XL Guides, News, & Discussion] death2all110:
Blakes-MBP:~ blakeleeper$ fastboot flashing get_unlock_ability
...
(bootloader)	get_unlock_ability: 0
OKAY [ 0.042s]
finished. total time: 0.042s
[Google Pixel XL Guides, News, & Discussion] blueyes:
I can get the default prop that was in my edited boot.img. I'm trying to recollect everything I did.

Ran getprop. Every single reference to unlocking that was a "0" I ran setprop "the line that showed zero" 1

Manually edited build.prop. (to reflect a"1" on all unlocking lines.

I also (initially, before dPixel8 was released) used dirty cow to edit the props but can't imagine those did Amy good as I didn't notice any difference afterwards. I knew something changed when a file appeared in /data/property that I did not place referencing oem unlock allowed with a value of 1.

I did most if not all the edits w a Fi sim card installed, not sure that makes a difference. Currently have my Verizon sim back in and can still toggle the switch and get a "1" running flashing get_unlock_ability.

I got a little obsessed about it and went at it from all directions. Figured I'd get it done or brick the phone trying. So if there's anything I can get from my system I'll gladly do so.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Verizon phones are not sim locked. If that's what you mean by carrier locked
[Google Pixel XL Guides, News, & Discussion] death2all110:
So did you use depixel8 to unlock at all?
[Google Pixel XL Guides, News, & Discussion] treIII:
Thais why I asked for your boot. IMG earlier because I thought it may make my default. Prop the same as yours if I flashed your boot. IMG. The possibly I could control the toggle. I have T-Mobile sim in my phone and it's irrelevant to being able to toggle OEM unlock. So I ask you would my default. Prop be the same as yours if I flash your boot. IMG? And if I flash your boot. IMG what would be the command that I should use in order to do so? And thanks. Your very helpful and a truly dedicated member of XDA. I'm wondering if someone figures out how you created the ability to toggle the OEM switch being that you've explained everything that you've done which would carefully help someone by narrowing the possibilities down if there would be required payment for providing this ability ? Congratulations whether you figure it out or not
[Google Pixel XL Guides, News, & Discussion] jasoraso:
Did you ever use dePixel8? At what stage did you do that?

At what stage did you do the decrypt/wipe?

I'm wondering if the reference in /data/property regarding oem unlock allowed got erased with the decrypt, and then the build.prop or the boot.img revisions were able to write oem_unlock_allowed to 1; and maybe if that value already exists, it won't rewrite to a 1 - so the decrypt/wipe allowed that set prop to work?
[Google Pixel XL Guides, News, & Discussion] blueyes:
C:\Users\brian\Download>fastboot oem getcid

...

(bootloader) cid: VZW__001

OKAY [ 0.047s]

finished. total time: 0.047s

C:\Users\brian\Download>fastboot flashing get_unlock_ability

...

(bootloader) get_unlock_ability: 1

OKAY [ 0.036s]

finished. total time: 0.052s

When i bought the device from VZW the oem toggle was greyed out.
[Google Pixel XL Guides, News, & Discussion] treIII:
My phone just did an update from the P build from Verizon. Verizon bought phone and it updated to the V build. Not the X that Verizon users are getting. My phone never installed any Verizon apps nor has it yet. How do I change the Cid? And also what is the command to flash the boot.img that blue eyes posted? The last question is for blue eyes. I'm using the phone with T-Mobile and as soon as it booted at the Verizon store I immediately put it on airplane mode and put in my T-Mobile sim. Other than the Cid I don't think my phone knows it brings to Verizon or it would have downloaded the X update. So now how do I change the Cid?
[Google Pixel XL Guides, News, & Discussion] blueyes:
https://www.dropbox.com/s/tony5wg5p8i5fum/elementalx.img?dl=0

Found the edited ElementalX kernel I'm using. Flash normally. Fastboot flash boot elementalx.img
[Google Pixel XL Guides, News, & Discussion] blueyes:
I did use dPixel8 to unlock the bootloader. Right after that I flashed the factory image. (P). Then formatted userdata and flashed the edited kernel. Booted up permissive and decrypted.
[Google Pixel XL Guides, News, & Discussion] treIII:
I just flashed your edited elemental x boot.img. how do I format userdata
[Google Pixel XL Guides, News, & Discussion] blueyes:
Fastboot format userdata. It WILL erase your internal storage. So backup anything you don't want erased on sdcard
[Google Pixel XL Guides, News, & Discussion] treIII:
What should be my next step? I'm trying to emulate what you have done

---------- Post added at 10:47 PM ---------- Previous post was at 10:44 PM ----------

OK I formatted then I reflashed your edited boot.img. now phone is booting. Should it say decrypted in security now

---------- Post added at 10:49 PM ---------- Previous post was at 10:47 PM ----------

After flashing the your edited kernel is that what makes it permissive?
[Google Pixel XL Guides, News, & Discussion] blueyes:
Yes. Run getenforce in a terminal and should get permissive. In security settings it'll show "encrypt phone" instead of encrypted. Are you rooted?
[Google Pixel XL Guides, News, & Discussion] treIII:
I followed your instructions and yet my phone still says encrypted. I formatted then I flashed the kernel.
[Google Pixel XL Guides, News, & Discussion] treIII:
My phone is still encrypted and getenforce returned enforcing

---------- Post added at 11:27 PM ---------- Previous post was at 11:23 PM ----------

OK. I just formatted userdata again. I'll check when phone boots
[Google Pixel XL Guides, News, & Discussion] blueyes:
https://www.dropbox.com/s/fnrz5em315dqmw9/ex_noforce_permissive.img?dl=0

The recovery database needed to be edited. Sorry. Flash this after formatting
[Google Pixel XL Guides, News, & Discussion] treIII:
I was rooted will I still be rooted after formatting?
[Google Pixel XL Guides, News, & Discussion] blueyes:
Think you'll lose it flashing a kernel. Plus boot-to-root needs editing to remove forecencryption.
[Google Pixel XL Guides, News, & Discussion] treIII:
No need to step aside two heads are better than one where I'm from. Thanks for your help.

---------- Post added at 11:37 PM ---------- Previous post was at 11:34 PM ----------

OK. I formatted user data again and I'm still encrypted. Somethings not working

---------- Post added at 11:46 PM ---------- Previous post was at 11:37 PM ----------

Elemental x kernel is showing in settings. And I've formatted twice
[Google Pixel XL Guides, News, & Discussion] blueyes:
Did you get the second ElementalX boot I posted. ? And userdata formatting won't remove root but I'm uncertain if flashing a kernel will or not with the boot-to-root method.
[Google Pixel XL Guides, News, & Discussion] treIII:
I flashed the one you posted that was in dropbox. OK I still need to flash the file you posted about data base
[Google Pixel XL Guides, News, & Discussion] blueyes:
Posted 2.

https://www.dropbox.com/s/fnrz5em315dqmw9/ex_noforce_permissive.img?dl=0

Use this one.
[Google Pixel XL Guides, News, & Discussion] treIII:
OK so format again and while still in bootloader flash this?
[Google Pixel XL Guides, News, & Discussion] blueyes:
Yes sir
[Google Pixel XL Guides, News, & Discussion] treIII:
Formatting userdata does remove root. So once I'm booted back up should I reflash boot to root?
[Google Pixel XL Guides, News, & Discussion] blueyes:
Flashing the kernel probably removed root. Boot-to-root needs editing because it's fstabs don't remove forecencryption
[Google Pixel XL Guides, News, & Discussion] blueyes:
You could flash twrp. Then the new SuperSU zip (R4). Twrp does remove forecencryption as well as verity.
[Google Pixel XL Guides, News, & Discussion] treIII:
I just did everything again and I'm still encrypted

---------- Post added at 12:21 AM ---------- Previous post was at 12:16 AM ----------

I formatted then I flashed this. Here's the command I used. Fastboot flash boot ex_noforce_permissive.img and it did not fail.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Something is forcing encryption but can't be that boot image.

What do you mean it did not fail?
[Google Pixel XL Guides, News, & Discussion] blueyes:
Print the contents of your fstab.marlin
[Google Pixel XL Guides, News, & Discussion] treIII:
This is above my head if u explain I'll do it. I'm like you I don't care if this becomes a brick. They made more than one. I'd rather it not be but I do own it.
[Google Pixel XL Guides, News, & Discussion] blueyes:
If your not rooted you won't be able to read it but should be able to adb pull fstab.marlin
[Google Pixel XL Guides, News, & Discussion] blueyes:
This app can edit boot images easily on the device.

https://play.google.com/store/apps/details?id=com.redlee90.imagekitchenforandroid
[Google Pixel XL Guides, News, & Discussion] blueyes:
I just extracted that boot image and checked. Both fstabs do not forecencryption. So I can't see why your still encrypted. I'd suggest you flash the factory image. Fastboot flash system system.img , fastboot flash system _b system _other.img , fastboot flash bootloader bootloader.img, same for radio and userdata then fastboot format userdata, fastboot -w, fastboot flash boot ex_noforce_permissive.img.

I used the "P" build if you want to use the same one I had.
[Google Pixel XL Guides, News, & Discussion] treIII:
I'm on the V build. Could that be the problem
[Google Pixel XL Guides, News, & Discussion] blueyes:
Can't say. I do believe when you update it switches slots. I'd flash the P factory images. As I posted. Run fastboot reboot-bootloader in between flashes.
[Google Pixel XL Guides, News, & Discussion] treIII:
Run fastboot reboot bootloader between formatting then again after flashing the kernel? And between the image?
[Google Pixel XL Guides, News, & Discussion] lucky_strike33:
Why do you keep deleting your posts? You're weird.
[Google Pixel XL Guides, News, & Discussion] blueyes:
Run reboot-bootloader between flashing a system system_b radio etc..
[Google Pixel XL Guides, News, & Discussion] treIII:
Okay since I have ElementalX installed what's the best way to get myself back to a stock situation while having that custom kernel without creating a brick because I've seen somewhere that people are having trouble with custom kernels and going back stock or something to that effect

---------- Post added at 03:57 AM ---------- Previous post was at 03:53 AM ----------

I'm going to pull my FS tab in about 20 minutes I've just been busy and I'd like to know what it says also since my phone hasn't decrypted. I'm not new to root and so forth I found the last five nexus's and several HTC phones before that but I'm also not a developer of any sort by any means and don't know any coding and so forth

---------- Post added at 04:28 AM ---------- Previous post was at 03:57 AM ----------

Does anyone know how to write Cid on pixel yet
[Google Pixel XL Guides, News, & Discussion] treIII:
My fstab you asked for
[Google Pixel XL Guides, News, & Discussion] psychatog64:
So what do I have to do exactly to be running on permissive?
[Google Pixel XL Guides, News, & Discussion] death2all110:
No way to write CID on pixel, that I am aware of.
[Google Pixel XL Guides, News, & Discussion] treIII:
It has to be somewhere. Possibly in bootloader embedded?
[Google Pixel XL Guides, News, & Discussion] larsdennert:
Here's a little story to occupy your time while you try to recreate the unlock ability.

On the LG g4 i spent a bunch of time trying out how to disable the camera OIS which was horrible under the wrong video circumstances but fabulous when taking a still. Anyway one day I had magically disabled it for a short while, and caused the camera app to FC. when I got OIS back on, I couldn't figure out what I did to switch it off. I had changed many many settings in both the build.prop and default.prop with many combinations, rebooting over and over. Nothing worked to get it again.

In the end, the solution was simple but not obvious. None of the settings in the build or default prop stuck after boot as far as the camera was concerned. Either something else modified them or the camera choose it's own settings at initialization after boot. However, issuing a simple setprop from a root command line while the phone was running would turn OIS on and off. The same command had no effect in the boot scripts.

Best of luck.
[Google Pixel XL Guides, News, & Discussion] M9guy:
Didnt jcase say that the cid basically does nothing on the pixel xl and pixel for that matter ? I could be wrong but I thought I had seen comments about it on multiple threads including this one ? If so on that basis wouldnt it be safe to say messing with the cid would be basically wasting your time ? Once again I"am not saying this, but I think jcase did ?

---------- Post added at 01:55 AM ---------- Previous post was at 01:52 AM ----------

Dexter ( ie blueyes ) we are counting on you to crack this puppy lol. A lot of us are behind you on cracking this and appreciate your efforts !!!!
[Google Pixel XL Guides, News, & Discussion] treIII:
Yeah I seen that also and had forgotten that.
[Google Pixel XL Guides, News, & Discussion] jasoraso:
Dexter blueeyes has his toggle unlocked, and he achieved it without changing cid, so I think we can leave that alone.

At this point, one person had tried to unencrypt, to follow some of the steps blueeyes took, but has been unsuccessful.

If someone wants to attempt to unencrypt, I think that could be useful.

Although I have unencrypted on my 6p, I was only able to do so following steps that were outlined for me. Some of the steps blueeyes has outlined have been over my head, but this weekend, I have time to try and figure it out.

It anyone else wants to help, I think pursuing unencrypting might be a good step to following blueeyes.
[Google Pixel XL Guides, News, & Discussion] social-design-concepts:
[MENTION=6207927]blueyes[/MENTION]

can you post the output of : cat /proc/cmdline
[Google Pixel XL Guides, News, & Discussion] blueyes:
I mentioned something similar earlier. Everywhere (when I ran getprop) that showed a zero. I ran setprop "that line" and one.
[Google Pixel XL Guides, News, & Discussion] blueyes:
sched_enable_hmp=1 sched_enable_power_aware=1 console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=marlin androidboot.selinux=permissive android.boot.cid=11111111 androidboot.oem_unlock_support=1 user_debug=31 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff buildvariant=user veritykeyid=id:34e81e2c57675086f628c1b2e4b4ade8e0a1941d androidboot.bootdevice=624000.ufshc androidboot.veritymode=enforcing androidboot.keymaster=1 androidboot.serialno=HT68S0201858 androidboot.baseband=msm mdss_mdp.panel=1:dsi:0:qcom,mdss_dsi_samsung_s6e3ha3_wqhd_cmd:1:qcom,mdss_dsi_samsung_s6e3ha3_wqhd_cmd:cfg:split_dsi androidboot.slot_suffix=_a fpsimd.fpsimd_settings=0 app_setting.use_app_setting=0 kernelflag=0x00000000 debugflag=0x00000000 androidboot.hardware.revision=PVT radioflag=0x00000000 radioflagex1=0x00000000 radioflagex2=0x00000000 cpumask=0x00000000 androidboot.hardware.ddr=4096MB,Samsung,LPDDR4 androidboot.ddrinfo=00000001 androidboot.ddrsize=4GB androidboot.hardware.color=SLV00 androidboot.hardware.ufs=32GB,Samsung androidboot.msm.hw_ver_id=268824801 androidboot.qf.st=2 androidboot.cid=VZW__001 androidboot.mid=G-2PW2100 androidboot.bootloader=8996-012001-1608281716 androidboot.oem_unlock_support=0 androidboot.fp_src=1 androidboot.htc.hrdump=detected androidboot.ramdump.opt=mem@2g:2g,mem@4g:2g androidboot.bootreason=power_on_key androidboot.ramdump_enable=0 ro root=/dev/dm-0 dm="system none ro,0 1 android-verity /dev/sda33" rootwait skip_initramfs init=/init androidboot.wificountrycode=US
[Google Pixel XL Guides, News, & Discussion] blueyes:
Showing phone is not encrypted...
[Google Pixel XL Guides, News, & Discussion] blueyes:
https://www.dropbox.com/s/4h8z31849g3iqsg/cmdline?dl=0

My actual cmdline file pulled from device
[Google Pixel XL Guides, News, & Discussion] blueyes:
If anyone needs me to I will write step by step instructions to decrypt. Headed back from a meeting in New Orleans but can do one later. This "achievement" is bitter sweet. Really no fun if I can't share it. So that said , I want someone else to get it done!
[Google Pixel XL Guides, News, & Discussion] social-design-concepts:
haven't downloaded your boot.img yet but you added your cmdline changes to the beginning of the cmdline correct?

I'm still wondering if it's a pushed / downloaded policy the device receives during initial setup? I'm currently doing Android 6 upgrades on enterprise class devices that work this way, we have to push a license to the device that enables the device to upgrade to Android 6, that policy is then stored somewhere persistent so it survives a full device wipe. So it's definitely possible that these devices could work in a similar fashion.
[Google Pixel XL Guides, News, & Discussion] jasoraso:
I'm thinking you're on the right track. And I wonder if that persistent key is stored in /data - so un-encrypting/formatting would wipe that key out. Then I guess the next step would be make sure that key doesn't get downloaded/pushed by VZW again (cid couldn't certainly be important here).
[Google Pixel XL Guides, News, & Discussion] social-design-concepts:
My thought is it's multiple policy, one policy might get loaded that sets the device EE, VZW, GS, another policy would get loaded that would then set the allow OEM unlocking, these policies would only have to be written once, and possible appended to the end of the persistent partition or to some fake NVM location.
[Google Pixel XL Guides, News, & Discussion] blueyes:
I am certain of a few things. I , having been building Android for quite some time. (Bliss officially for several devices, from the N7 2013 , 6,5x,6p, as well as maintaining our gerrit. )

I only mention this to sort of explain how my thinking process goes. I'm a bit ADHD , and afraid some of my explanations may be all over the place. Lol

OK. I agree with you regarding the persist and it's values. They are essentially like product overrides you'll see in the device.mk files or BoardConfig.mk or ROM specific make files. For example in the build.prop you'll see ro.sf.lcd_density=560, to build with a diff value the proper way wouldn't be to change that value in device.mk but add a second line persist.sys.lcd_density=534 or whatever you density you wanted.

This is why I added persist.sys.oem_unlock_allowed=1 to the bottom, dead last line of build.prop. Hoping it would act as a product override like done in the build process. If anything helps this must. Because it also self created a file in /data/property/persist.sys.oem_unlock_allowed (with a value of 1).

I honestly can't say if decryption helped. Just something I've been doing since Shamu. A little trickier on this device due to the ridiculous double partitioning. And having the recovery.fstab in the boot.img's ramdisks etc folder. Permissive selinux was an easy change I made to increase chances of getting it done.
[Google Pixel XL Guides, News, & Discussion] death2all110:
I speculated on this earlier and in the beginning of this thread.

There are a few OMA-DM related files in system apps.

com.android.omadm.service

com.android.sdm.plugins.dcmo

com.android.sdm.plugins.diagmon

com.android.sdm.plugins.connmo - theres actually a hidden activity inside this that you can launch to select the VZW OMA server.

com.htc.omadmtrigger

com.android.sdm.plugins.sprintdm

com.android.vzwomatrigger
[Google Pixel XL Guides, News, & Discussion] blueyes:
I'm booting from slot a, apparently.. I decompiled both boot_a&b. Boot_a doesn't forecencryption, yet boot_ b looks like a stock fstabs that if were active would encrypt me. So I pulled boot_a and decompiled it so you guys can see first hand the changes made. Extract the 7zip and you'll have your ramdisk (holding the fstabs, sepolicy..) and split_img folder holds your kernel command line arguments

https://www.dropbox.com/s/he7h7aho2upgrll/decompiled_bootimg.7z?dl=0