yashsingh1/xdaforums huggingface dataset:
[Google Pixel 2 Questions & Answers] mattie_49:
New issue:

Ok real quick someone. I traded my old device in for another pixel2 software version Jan 5th . Opm2 .171019.016 . My device was within the 14 day store return policy . Anyhow knew the manager and she gave me the larger storage one. I think the 116 gig. Had issues after Sept 5th security updatefor 9.0. Anyhow I know there is a way with this software . Downloaded 8.1 system image from Google's site. Can I sideload to downgrade and be able to use command? Or is this one past the point. Took sim card out originally. Ran through to devoloper options. Greyed out. Any help would be awesome. In op it says if I'm on this firmware I can do sideload.

---------- Post added at 03:23 AM ---------- Previous post was at 02:25 AM ----------

Traded my old one in after Sept 5th update patchhad a few issues. They gave me a brand new one firmware I'm now on is Opm2.171019.016 I know I can sideload can't I ? Or ?
[Google Pixel 2 Questions & Answers] crixley:
Answered on the other thread but I will here too, you can't unfortunately

"If you have received the OTA patch for your pixel2, and now

are on OPM2.171019.016, you will no longer be able to run

the command. And downgrade is not available at this time. "
[Google Pixel 2 Questions & Answers] mattie_49:
Glad I didn't try and sideload firmware.
[Google Pixel 2 Questions & Answers] crixley:
You could try an OTA flash but it will just fail before it flashes it. Recovery won't let you roll back bootloader. It sucks that you got one with the update that stopped the command ☹️
[Google Pixel 2 Questions & Answers] mattie_49:
Yes but it's 3-4 versions earlier than last 1. I really did have some kind of software bug going on. Was outside all day the other afternoon. The device shook as it identified fp. But screen wouldn't wake. Had to hard reset to be able to see anything on screen. And to reboot. Oh well. Gonna update to pie then, exploit will come on current software I'd bet. Thanks for the info.
[Google Pixel 2 Questions & Answers] FirstAccount:
If I have a Verizon pixel 2 XL that has the last security patch, is there a way I can downgrade it to the version that will allow me to unlock the bootloader so that I can root this phone?

Any guides would be great
[Google Pixel 2 Questions & Answers] westhaking:
No. Not possible.
[Google Pixel 2 Questions & Answers] EstiR86:
Unlocking the bootloader wipes device so that is known
[Google Pixel 2 Questions & Answers] enzyne:
It's strange because on first boot it was in the off posisiont and greyed out but said bootloader already unlocked but now after a reboot and magisk install it says this.

https://ibb.co/dvyNRb
[Google Pixel 2 Questions & Answers] mamarcac:
I will test it as well tonight, I have the Verizon Pixel 2 non-XL. Just to confirm, the people here are installing fastboot & adb from the SDK Platform-Tools then doing "adb reboot bootloader" and "fastboot flashing lock_critical" correct?
[Google Pixel 2 Questions & Answers] EstiR86:
Yup that's what it seems
[Google Pixel 2 Questions & Answers] mamarcac:
Any chance you can post the screenshot of the Developer Options "OEM Unlocking" now that you're unlocked and rooted? I'm going to test this on my Walleye P2 tonight as well. Thank you so much for sharing man, very exciting stuff!
[Google Pixel 2 Questions & Answers] EstiR86:
Has anyone tried this with OG Pixels, just curious to know if this works.
[Google Pixel 2 Questions & Answers] abs0lute:
Can confirm that it is working. Still need to either root or install a kernel that bypasses SafetyNet, but just bought a Verizon P2 Walleye about an hour and a half ago, ran the adb command and was prompted with this:

https://photos.app.goo.gl/fGiwzVZ5HvgTaAp42

Phone was wiped, set up phone as new, checked developer settings and OEM unlocking was disabled/greyed out.

However, attempting to set up Android Pay shows a SafetyNet failure message. Fairly positive that Verizon made a pretty neat mistake here.
[Google Pixel 2 Questions & Answers] Lightn1ng:
Verizon Pixel 2 Walleye (not XL). Can confirm it works here.
[Google Pixel 2 Questions & Answers] TonikJDK:
Google made the mistake. Seen them make many on the OG too. Congrats! If you is Magisk for root it will get all set on safety net without a kernel.
[Google Pixel 2 Questions & Answers] Lightn1ng:
I'm gonna do some digging into whether this is permanent.

I have a suspicion that the device locks itself if you set it up with a Verizon SIM card - am I wrong about that?
[Google Pixel 2 Questions & Answers] nomisunrider:
Same result as previously posted on a pixel 2 XL

FAILED (remote: Device already : locked!)
[Google Pixel 2 Questions & Answers] bobby janow:
I'd like to see a screen shot of the toggle after you do this unlock method. Also I'd like to see if it's now possible to relock it and then perhaps unlock it again via the same method or by the simple bootloader oem unlock command.
[Google Pixel 2 Questions & Answers] Lightn1ng:
Just tried. Relocking works, and it goes back to the state it was before. Unlocking via the same method works. oem unlock does not.

You can try yourself if you want
[Google Pixel 2 Questions & Answers] D3RP_:
I do have a Verizon sim, and it hasn't locked up yet, so idk.
[Google Pixel 2 Questions & Answers] bobby janow:
Wow that's nuts. How did you relock? Each time is a wipe?
[Google Pixel 2 Questions & Answers] Lightn1ng:
Relocked with fastboot. It wiped each time.
[Google Pixel 2 Questions & Answers] bobby janow:
You mean fastboot oem lock? And the toggle never changed right? This is gonna be fixed you know that right? Reminds me of depixel8 [MENTION=2376614]jcase[/MENTION] method way back when. I'd love to get some input from the big guys about this if you know what I mean.
[Google Pixel 2 Questions & Answers] Lightn1ng:
It's gonna be fixed. If you unlock it now though, i doubt they'll relock it with an update.
[Google Pixel 2 Questions & Answers] lps1014:
Can confirm it works - now rooted on my verizon pixel 2 (non-XL).
[Google Pixel 2 Questions & Answers] SWATre:
FAILED (remote: Device already : locked!)

Based on mine and other experiences, I'm going to guess this doesn't work for 8.1 XL version.
[Google Pixel 2 Questions & Answers] EstiR86:
Get TWRP then just flash Magisk instead
[Google Pixel 2 Questions & Answers] bobby janow:
That is probably correct. Once unlocked I've not seen a relock forced update. Even depixel8. This is quite interesting.. we just need some more testing and confirms. Like updates, patches, etc. Eyeballs on this thread for sure.
[Google Pixel 2 Questions & Answers] TonikJDK:
I will give you credit, you for guts to try relocking but great info.

I really doubt it too. A relock will wipe it, can you imagine the outcry, fines and class actions if the wipe phones remotely. Not gonna happen.

But I bet if you try and relock again after they fix it, it stays locked.

Use Magisk. It works great and passes safteynet.
[Google Pixel 2 Questions & Answers] compneo:
Another no go here on Pixel 2 XL running 8.1.0.
[Google Pixel 2 Questions & Answers] aholeinthewor1d:
Am I wrong in thinking this is no different than the Pixel 1? Lots if people randomly got phones from Verizon that were able to be unlocked. Some people thought it was related to the SIM which was disproven. Basically some just slipped through the cracks. Is this different?
[Google Pixel 2 Questions & Answers] mamarcac:
For the life of me I cannot get adb or fastboot to recognize my Pixel 2. What am I missing? I installed Android SDK fresh tonight, added the Google USB Driver. Windows 7 Pro recognizes Pixel 2. Even turned off and manually entered Fastboot mode. Nothing. I don't get it, any suggestions?

Nevermind, I'm an idiot - had to manually point to the directory for Windows to use the right driver
[Google Pixel 2 Questions & Answers] Spaniard85:
I'll toss my name in the hat as well as having a VZW Pixel with an unlockable bootloader. I'm on my 3rd VZW Pixel 2 XL. The first device was purchased from a corporate brick-and-mortar location, and I was able to get a brand-new device as a warranty exchange from that same store. This device, however, is a warranty replacement ordered by an employee in that store. It came as a standard warranty replacement affair, on its own in a box without the original packaging.

I discovered this topic this evening, and lo and behold, my "OEM unlocking" option was NOT greyed out. I now have an unlocked bootloader. I'll be looking to flash TWRP and magisk here in a bit.

UPDATE: I was able to successfully flash TWRP and magisk. Good stuff guys!
[Google Pixel 2 Questions & Answers] mamarcac:
Me too!

+1. My Verizon Pixel 2 non-XL is now running TWRP 3.2.1, currently setting 'er back up as a brand new phone. Took more work than I planned for (haven't used adb/fastboot since the Galaxy S3) but in the end made it. Thanks for much for everyone's input and sharing in this thread. Been a fun day!
[Google Pixel 2 Questions & Answers] dodendemise:
I cannot believe how easy that was. Currently have TWRP and Magisk 15.1 installed. Purchased in a Verizon corporate store and took 8.1 OTA prior to unlocking.
[Google Pixel 2 Questions & Answers] andyroidna:
Has anyone gotten this to work on the 2 XL?
[Google Pixel 2 Questions & Answers] enzyne:
Delete post.
[Google Pixel 2 Questions & Answers] MishaalRahman:
Posted on the XDA Portal! https://www.xda-developers.com/verizon-google-pixel-2-bootloader-unlock/ GET IT WHILE IT LASTS

Just to be sure (there's 9 of you guys claiming success), but you all bought it from Verizon right? You guys didn't all get a refurbished model after sending one in for repair? They didn't just send you a regular model?
[Google Pixel 2 Questions & Answers] enzyne:
I purchased my phone from a corporate store here in Montana. Not a RMA replacement.
[Google Pixel 2 Questions & Answers] MishaalRahman:
Thanks! Anyone else want to chime in?
[Google Pixel 2 Questions & Answers] bhow11:
Unlock Success

I can also confirm this method works on my Verizon Pixel 2 running 8.1 (12/05/2017 security patch).
[Google Pixel 2 Questions & Answers] abs0lute:
Purchased it from Best Buy today in store, unlock worked flawlessly.
[Google Pixel 2 Questions & Answers] mamarcac:
I bought online thru Verizon website on Black Friday and also confirmed tonight this method works. I'm on 8.1 December 5 security patch and have TWRP installed with an unlocked bootloader now!
[Google Pixel 2 Questions & Answers] bhow11:
Bought direct from Verizon
[Google Pixel 2 Questions & Answers] dodendemise:
Mine was brand new from the store. I ordered online but picked up in store, so it was from the stores stock.
[Google Pixel 2 Questions & Answers] CyanideHD:
This is quite exciting. Sad to hear it's only for the regular Pixel 2, I have the XL :(
[Google Pixel 2 Questions & Answers] cnote74:
I thought both pixel 2's we're the same hardware specs so only difference is the battery and screen sizes.
[Google Pixel 2 Questions & Answers] CyanideHD:
People are reporting it not working on the XL for whatever reason :(
[Google Pixel 2 Questions & Answers] cnote74:
Should be same bootloader, processor, ram and camera, I will try it on my pixel 2 xl panda Verizon and report back.
[Google Pixel 2 Questions & Answers] D3RP_:
It seems like they're slightly different for whatever reason, as the command that started this whole thing is an XL specific command.
[Google Pixel 2 Questions & Answers] tonyeltriton:
what a shame i have xl version
[Google Pixel 2 Questions & Answers] bobby janow:
You might want to head over and claim the bounty.

What is the relock command? Same as before?
[Google Pixel 2 Questions & Answers] ryanbg:
Someone wanna try something a little goofy for me? (Need a VZW device)

Once you've unlocked a Verizon Pixel 2, run the following command:

fastboot oem writecid 00000000

Then lock your bootloader. Then try unlocking the normal way:

fastboot flashing unlock
[Google Pixel 2 Questions & Answers] D3RP_:
What bounty? And yes, the 'fastboot flashing lock' command will prompt you to lock or not lock the bootloader.
[Google Pixel 2 Questions & Answers] bobby janow:
Wow, things got really interesting these last 24 hours. I really don't want to unlock the bl but I would like to be able to at some point, perhaps after I buy next year's model and I have this as a secondary device. With these methods does the oem unlock switch in dev options become active or is it just that this is an exploit? And if what you propose works, even if the switch is still gray, will they be able to close that exploit? I'll say one thing, I'm not taking the January patch until this is sorted out.

---------- Post added at 07:51 AM ---------- Previous post was at 07:48 AM ----------

Read through this: https://xdaforums.com/pixel-2-xl/how-to/temp-root-bounty-verizon-users-t3710652

And then, so far anyway, the only way to unlock it again is via your method?
[Google Pixel 2 Questions & Answers] Lightn1ng:
I got my phone directly from a Verizon store. It came with Verizon paperwork in the box. No RMA at all.

I bought it like 4 days ago.

---------- Post added at 10:27 AM ---------- Previous post was at 10:23 AM ----------

I don't even think Verizon can relock it; the bootloader is probably hard coded to only allow relocking from fastboot.

---------- Post added at 10:32 AM ---------- Previous post was at 10:27 AM ----------

fastboot oem writecid 00000000
...
FAILED (remote: unknown command)
finished. total time: 0.002s

Also, I ran fastboot getvar, my CID is 00000001
[Google Pixel 2 Questions & Answers] robocuff:
There's an article linked to earlier in this thread that shows a screenshot shot of that setting after unlocking. It remains grayed out and unavailable. Just as it was with depixel8.
[Google Pixel 2 Questions & Answers] ryanbg:
Verizon devices are 00000001 and Google/unlocked devices are 00000000. The writecid command was present in an earlier bootloader... hmm...
[Google Pixel 2 Questions & Answers] Lightn1ng:
So should I downgrade the bootloader?
[Google Pixel 2 Questions & Answers] Spaniard85:
Mine was a replacement. Not 100% sure if it was refurbished, but seeing as it didn't come in OEM packaging, I'd assume it was. Or at very least, not an original brand new VZW Pixel.
[Google Pixel 2 Questions & Answers] Lightn1ng:
[MENTION=766721]ryanbg[/MENTION]

I just downgraded to the earliest factory bootloader available - writecid still doesn't work.

I do remember what we had to do on the S5, sending vendor commands to the eMMC. I assume that's not possible here.
[Google Pixel 2 Questions & Answers] ryanbg:
This is a different type of CID. This one is just an HTC SKU specifier. Let me dig a little deeper with the writecid command.

UPDATE: Try

fastboot oem setcid 00000000

(they renamed the command for some reason)
[Google Pixel 2 Questions & Answers] Lightn1ng:
[MENTION=766721]ryanbg[/MENTION]

fastboot oem setcid 00000000 worked. Trying relocking/unlocking now.
[Google Pixel 2 Questions & Answers] ryanbg:
Thanks. After reboot, try checking the CID again to see if it stuck.
[Google Pixel 2 Questions & Answers] EstiR86:
Tell us what kind of results you get
[Google Pixel 2 Questions & Answers] Lightn1ng:
The CID stuck, but OEM Unlocking in developer options is still greyed out. "Connect to the Internet or contact your carrier."
[Google Pixel 2 Questions & Answers] ryanbg:
Was this after a wipe? Can you try going through initial setup and seeing if it'll let you enable OEM unlocking?
[Google Pixel 2 Questions & Answers] Lightn1ng:
It wiped after re-locking the bootloader.
[Google Pixel 2 Questions & Answers] ryanbg:
If you login and activate, does OEM unlocking button change?
[Google Pixel 2 Questions & Answers] Lightn1ng:
I did login and activate - my Verizon SIM has been in this whole time.

---------- Post added at 11:18 AM ---------- Previous post was at 11:16 AM ----------

@ryanbg

Somebody said this on Reddit:

This is because of Verizon and the locked bootloader. Since there is no hardware or software differences it has to verify the IMEI against a database to confirm it can be unlocked.
[Google Pixel 2 Questions & Answers] ryanbg:
Could you try unlocking (fastboot flashing lock_critical) and then toggle the OEM unlock option, then lock, then try unlocking again? Sorry for the rat race, just want to see if we can persistently lock/unlock bootloader with CID change.
[Google Pixel 2 Questions & Answers] Lightn1ng:
When it's unlocked, the OEM unlocking option is still grayed out, saying that the bootloader is already unlocked.

---------- Post added at 11:23 AM ---------- Previous post was at 11:20 AM ----------

@ryanbg

Isn't the IMEI stored in an EFS partition? Can't we back it up, clear the partition, boot it up, and unlock?
[Google Pixel 2 Questions & Answers] ryanbg:
PLEASE don't do that. Just leave EFS alone. I'm going to look into a couple things for now, you can set your CID back to 00000001 if you want and flash back to normal.
[Google Pixel 2 Questions & Answers] Lightn1ng:
Alright, I'm going to leave it unlocked with the 00000000 CID for now. If you want me to try anything else, just ping me.
[Google Pixel 2 Questions & Answers] Do0zman:
Confirmed.

Pixel 2 bought from VZW store on black Friday. All OTA updates had been installed running 8.1

Used fastboot commands to unlock bootloader

Installed TWRP 3.2.1 for walleye

Installed Magisk via zip

Root confirmed

Passes Safety Net
[Google Pixel 2 Questions & Answers] andyroidna:
Nothing happens on my 2 XL. So just to add to others results, it unfortunately doesn't seem to work for the XL
[Google Pixel 2 Questions & Answers] baknblack:
Same with my OG pixel. Just returns already locked
[Google Pixel 2 Questions & Answers] bobby janow:
But can you issue the regular unlock command with fastboot now? That was the question although it is good to know it is still not available via the switch. One thing though, remember that some Google devices had it grayed out too until they factory reset. Then it became active.

edit: flashboot flashing unlock is what I meant. Does that work after you changed the sid? Got ninja'd slightly about the factory reset and the switch becoming active. But after you ran the cid command to set it to 0 did you then factory reset? I know it did once you unlocked but I mean afterwards.
[Google Pixel 2 Questions & Answers] andyroidna:
I don't even get that message. I type in the command, and it just gives me a list of other fastboot commands. Doesn't say locked or anything
[Google Pixel 2 Questions & Answers] baknblack:
If your just getting the help you have an older version of ADB and fastboot. I had to get the lastest directly from google.
[Google Pixel 2 Questions & Answers] Lightn1ng:
oem unlock still says that it's locked. The phone checks with remote servers to verify that the IMEI isn't Verizon - if it is, the switch is permanently blocked.

Maybe we can spoof the check?
[Google Pixel 2 Questions & Answers] bobby janow:
If I recall, [MENTION=2376614]jcase[/MENTION] said if he could gain temp root then he could unlock the bootloader. With an unlocked bootloader (even though it's not really showing unlocked in OEM options) you can gain root. I wonder if this will help him out to find an exploit that might even work on the 2 XL.
[Google Pixel 2 Questions & Answers] Lightn1ng:
Yeah I have no plans to root just yet.

Finding an exploit for temp root shouldn't be that bad now that we have a device we can easily test it on.

EDIT: What I mean is that it should be doable now - finding a root priviledge escalation exploit in the Linux kernel isn't easy at all.
[Google Pixel 2 Questions & Answers] andyroidna:
Ah, you're right. Just updated and got the "device already locked" message
[Google Pixel 2 Questions & Answers] DA6030:
This sounds like a critical security bug (on HTC/Google's part), and from their perspective has nothing to do with circumventing the carrier unlock block. Certainly this will be patched with the next OTA.

Much bigger deals to Google/HTC are:

(*) oem_lock_critical is a LOCK command, not an UNLOCK command, so the fact that you're getting an UNLOCK prompt is unexpected behavior

(*) This bypasses Factory Reset Protection, a mandatory Android Platform feature, opening this device up to being wiped by thieves
[Google Pixel 2 Questions & Answers] Lightn1ng:
Yeah, this has a 100% chance of being patched in a few weeks
[Google Pixel 2 Questions & Answers] collinjames:
It would be interesting to monitor wireshark after a factory reset and see where exactly it's doing this server side check and find a way to spoof it
[Google Pixel 2 Questions & Answers] Lightn1ng:
I'm not good with Wireshark at all but I'll look if I find the time.
[Google Pixel 2 Questions & Answers] mr573162:
when i did this process my google account was still attached and i had to reenter my previous password i set to get into the device. But i was able to achieve the unlocked boot loader on my pixel 2.
[Google Pixel 2 Questions & Answers] bobby janow:
The bypass of FRP is extremely disturbing. I know there is a band of thieves somewhere (close by?) that constantly try to bypass FRP and they have succeeded somewhat with bl unlock and installing some older version of firmware. But this exposes even those of us with a locked bootloader since the device is now vulnerable to anyone with adb. So playing the blame game, where does it lay? HTC? Verizon? Google? All 3? With this security bug Verizon and all its focus on security by not allowing a bootloader unlock is mere noise. At this point they should fix the bug and make the oem unlock switch active for those that don't care about security. I don't see any other option at this point. They dropped the ball and its been recovered by the other team. Yes, I am totally annoyed by this development even though some of you have benefited. Congrats to the OP for finding this and to those that wanted it. (I'm not that heartless) But this is way way worse than simply allowing bl unlock. It's downright disgraceful. So now it's time to make amends and release the IMEI database so that a factory reset will allow bl unlock.

BTW, if you have a device like the Pixel 2 from Google and the OEM switch is toggle-able but it's in the off position, you can't get a stolen device and wipe it and get it unlocked right? The FRP will prevent that correct? And by the same token, if the switch is in the on position even though the bl is locked, that will allow the bl to be unlocked even on a factory reset correct? That's assuming the user is the same or the Google account was removed before the legitimate sale.