yashsingh1/xdaforums huggingface dataset:
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Someone needs to compare stock .013 and Verizon's .016 which patched the exploit, and figure out what the latter did and try to reverse engineer a solution. No other updates have been specific to Verizon, so whatever it is, it's permanent. I still believe it has something to do with the e-sim, as that's the only constant. Changing sim cards from different carriers changes nothing. And, flashing factory images wipes the device, yet you still can't unlock the BL. Just a rant, but I hope you see where I'm going here
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
It's just really almost depressing. This device tweeked up would surely be amazing/stock is almost perfect . Would love to be flashing something currently.
[Google Pixel 2 Guides, News, & Discussion] crixley:
For that single exploit? Yes perhaps.

One thing you learn in computer sciences and engineering is that every system has an exploit, whether or not it gets found is another thing. If you could create a completely closed off unhackable system you'd be an awfully rich person, as banks, governments and the like would be lining up at your door.
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
It is! But, I made it under the wire and have an unlocked BL. Problem is, everyone went for the 2xl, so the ROM devs followed that route.. I've always loved CarbonROM, but nothing official for te P2. And, the fact that LineageOS doesn't seem to want to release an official build for the Pixel 2 pretty much sucks! That's all I have yo say
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
Seems about right. All of us that are past the known method to unlock. Definitely want on the other end . But here you are unlocked and there aren't any builds. Kinda torn. Stock is pretty dang good. I'm not gonna stress because for a Vanilla Android experience. This pixel2 is where it's at. Up to 2.5 days off charger and 7+ hours on screen. I'm gonna enjoy it. Try to
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Honestly, adblockers, TiBu, root explorer for managing my NAS, and Viper are the only reasons I root. The stock experience is great!
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
I really want to be able to use "DriveDroid" as I feel like I constantly needing new Live USB drives for my PCs! :P

I also want to be able to compile AOSP for some test drives.

I checked the system logs and I didn't see anything about the esim locking the phone at system startup. Of course, I don't have the bootloader logs, so I can't say for certain that it's not changing something during the bootloader phase.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Agreed, I have no desire to flash ROMs or anything really but damn I miss root.

I miss substratum and magisk so much. The worst part is that such a small thing makes me consider changing phones. I love every other aspect of this phone, but not having root makes me feel like my phone isn't really mine.
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
I can assure you . There will be a route in due time. Just when. And it would be worth it ? To trade in one of the best devices (I've ever owned.) To be able to access bootloader. Who knows ,and I'm sure Android 9.1 will be better. Google's on it with the ota's. I really think the sunshine people with make a route for the pixel2 & Xl models .
[Google Pixel 2 Guides, News, & Discussion] crixley:
The worst part of all this is that my phone is actually purchased directly through Google. Just happens to be one I needed an RMA on.
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
I feel you so much on this. I'm so frustrated with my RMAed phone.
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
Seems like with you having root access. And running stock .We locked devices could maybe get a better bead,on what's really going in your system start up. I know that's where it is. And after sim card registration with Verizon . During boot something says no access to this area. We just have to find the bypass.
[Google Pixel 2 Guides, News, & Discussion] crixley:
There is a lot of info under "com.android.omadm.service.apk", this is where I'm going to focus my energy. I'm positive this has the answer we're looking for. Decompiled it and am going through everything with a fine toothed comb.
[Google Pixel 2 Guides, News, & Discussion] crixley:
This for example
[Google Pixel 2 Guides, News, & Discussion] crixley:
One thing I see that's interesting is that it uses the imsi and not the IMEI, that may be what the issue is with RMA devices.
[Google Pixel 2 Guides, News, & Discussion] b00ster23:
"the sunshine people" Are not working on a route for the pixel2 & XL. The Pixel8 method was found by happenstance working on a different platform.

Just for clarification around the Pixel(2) and PixelXL(2)....they are built around 2 different hardware platforms. The Pixel(2) on HTC and the PixelXL(2) on LG. So it was the working on an exploit for the HTC decices that revealed the "exploit" :)
[Google Pixel 2 Guides, News, & Discussion] crixley:
Wasn't that also like two years ago? lol
[Google Pixel 2 Guides, News, & Discussion] crixley:
You Verizon guys might want to try out these dialer codes. Looks like they might be Verizon debugging codes. They don't work for me since I'm Canadian. 899726 and 89987

I'm assuming *#*#code#*#*
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
I'm going out on a limb here, but I think the critical partition was exclusive to the 2xl, thus the need to unlock it using the unlock_critical command. I don't know how to find all the partitions on the P2, but, if the Dec and Jan (non VZW) updates created it, that would explain why locking it, via the OP, would make it possible to unlock the bootloader and keep it unlocked. Updates can't wipe a partition that shouldn't exist. Just brainstorming, so don't bag on me too much :)
[Google Pixel 2 Guides, News, & Discussion] crixley:
Mine showed critical unlocked but bootloader locked. I wonder if that is the refurb issue? What do yours show?
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Where did you see that? If it was in the bootloader, I have secure boot: yes (PRODUCTION) and status: unlocked

If I need to look elsewhere, lmk
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
Built on Htc. Htc 10 charger fits into it perfectly . My cord fits nobodies phone . It surely does the Verizon Pixel2; like a glove. Literally the same plug. Verizon had the no USB plug on either end feature. My old Htc 10 charger plugs perfectly and allows fastboot on my desktop. Goes to show ,how it's an Htc device after they sold out to Google.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Fastboot OEM device-info

Thank you
[Google Pixel 2 Guides, News, & Discussion] b00ster23:
Actually the Samsung 9 uses the same charger....so all these phones must be made by Sammy, right...? SMH :eek:
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
all variables = true

It was just a shot in the dark. Just trying to help

---------- Post added at 01:56 AM ---------- Previous post was at 01:38 AM ----------

If there's anything else I can provide that would help, just ask and I will do it. Just give instructions, as so much has changed since the old days of Android that I haven't kept on.
[Google Pixel 2 Guides, News, & Discussion] poena:
will 9.0 break the bootloader unlock?
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
Locked down way before that.
[Google Pixel 2 Guides, News, & Discussion] nolanjb:
In case anyone was curious, these are the files that were changed in the bootloader between the .013 and the .016 update in January.

Not sure if we could do anything with it if we found out exactly what was changed or not:

file_contexts.bin

vendor_service.rc

libs/libftm_lib_emmc_utility.so

sbin/adbd

sbin/downloadzip

sbin/htc_dlmode

sbin/htc_fastbootd
[Google Pixel 2 Guides, News, & Discussion] crixley:
Can someone extract htc_dlmode and htc_fastbootd
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
The files from December update are in "oldfiles.zip" and the one from the latest update are in "newfiles.zip"

I can get the ones from the update nolanjb mentioned in his post. I didn't realize he actually said the version numbers until after I extracted them. Just let me know.
[Google Pixel 2 Guides, News, & Discussion] nolanjb:
I originally downloaded the December update too, but I downloaded the January 013 update today (the one before Verizon patched the exploit) and the md5sums are the same in the bootloader files.
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Is the bootloader the issue? Think about this:

If you have the original device you purchased, or purchase a new one, you can unlock the BL

If you purchased a VZW variant and were able to take advantage of the exploit, you can unlock the BL

If you purchased a VZW variant that was patched out, you can't

If you received an RMA (RMAD at Google or Verizon) you also can't

With the exception of .016 being Verizon exclusive, most all of the updates have been universal. My thought is that there is a "switch" that gets tripped, sort of like Knox on Samsung devices. The updates always trigger that switch, unless it's been disabled when you first registered the original device. RMAs get triggered, because the device has already been activated and lost the ability to be unlocked, because it's been loaded with the most recent update, that won't permit unlocking. Again, just thoughts
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
I was just thinking the same thing. It could be a simple boolean that needs to be changed. The question is how do we change it.
[Google Pixel 2 Guides, News, & Discussion] poena:
let me rephrase.

I have the vzw pixel 2.

i unlocked the bootloader last year when I got the phone.

will updating it to android 9 break it or once it's unlocked it stays that way?
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Nope, it's all good!
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
Hey DuckRuckus, can you do me a favor with your unlocked Pixel? Can you run the following adb command while root, and upload the resulting TXT? It would give us a general idea of the Pixel's boot process.

adb shell bootstat -p >> bootlog.txt
[Google Pixel 2 Guides, News, & Discussion] nolanjb:
I see what you're saying. I just thought it was weird that the bootloader files are the same in the December update and January 013 update but in the out of cycle 016 update they changed those files. Maybe if we found out what changed in those files it could point us in the direction of what we need to change when the phone is booted up.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Can you get me vendor_service.rc too please?
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
Gladly. Here's the files. :D
[Google Pixel 2 Guides, News, & Discussion] crixley:
Thank you very much!
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
So, I've noticed something odd, when I ran "getprop" in the adb shell, I noticed a odd property.

[sys.oem_unlock_allowed]: [1]

It looks like Flashing unlock should be allowed, at least the system thinks so. But the bootloader is not reading that. I'd assume there's another variable overriding that one.
[Google Pixel 2 Guides, News, & Discussion] nolanjb:
Mine looks like that too after I do the "pm uninstall --user 0 com.android.phone" trick. It will even stay that way after resetting the phone. It goes back to 0 after trying "fastboot oem unlock" or "fastboot flashing unlock" from the bootloader.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Fastboot flashing get_unlock_ability gives back a 1 too, there is something seriously messed up with refurbs
[Google Pixel 2 Guides, News, & Discussion] crixley:
Odd you have prop "[ro.oem_unlock.pst]: [/dev/block/platform/soc/1da4000.ufshc/by-name/misc] and [ro.oem_unlock.pst_offset]: [6144], I have neither of these.

I'm really curious what is blocking a refurb, I can't seem to figure it out. It is like the system is getting conflicting info about unlock ability.

I also don't have

"(bootloader) vzwisLTE:

(bootloader) vzwmid:"

which again demonstrates that refurbs are not verizon devices, an argument I've had with support. They don't believe this is an issue, and I'm not willing to keep sending the phone back over and over to get more refurbs with the same issue.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
Im following

I can reproduce the same values. maybe if an unlock tool was developed like in the root process for asus zentab 3s 10 we would be able to have success. I do not know how the "tool" achieves adb commands we enter
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
I'll just real quick confirm that my refurb Pixel also doesn't have these variables with "getprop" or the bootloader variables.

These are so odd. And it's frustrating that Google won't do anything. I can confirm they havne't fixed this issue with newly received refurbs, as I recently had to send mine back due to a cracked corner.
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
So, I'm slightly changing gears on what I'm doing here. Instead of poking around the bootloader files, I'm now going to looking into to the possibility of enabling ADB root. I've noticed that while in recovery ADBD is actually running. (It stops when you try to adb sideload OTAs) So, I believe this may be an access point. Once we have root, we may be able to change the bootloader files on the device and unlock this thing.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
That's interesting you mention that, I was thinking in the shower this morning that something like that would be necessary but I don't have the skills to investigate this properly, your proposed protocol is very clever, I'm following your work please keep us updated!
[Google Pixel 2 Guides, News, & Discussion] crixley:
If you figure this out you should tell the other HTC forums, as far as I know if has not been done ever.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
Is this the type of thing we are talking about? I just recently read this forum and followed the protocol here successfully

https://xdaforums.com/android/development/tool-unlock-bootloader-asus-zenpad-10-t3730909/page25
[Google Pixel 2 Guides, News, & Discussion] crixley:
I'm talking about on HTC phones, which ours is.

Edit: just read that link. What do you mean followed the protocol successfully?
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
We're you able to gain root?
[Google Pixel 2 Guides, News, & Discussion] crixley:
I believe he means on another phone
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
Yes, not a hard protocol to follow but you see, I have no clue what the tool contains, I am only entering commands and enjoying others research. I feel like someone with true knowledge in the field could apply this concept from the zenpad 3s 10 bootloader to that of the pixel 2. I hope this clarifies any confusion.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Doesn't work like that. All companies have different bootloaders, isn't a one size fits all solution.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
Ah interesting, what a puzzle this is.
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
Not a word since the January security patch stopped the initial route.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
I just think it's so interesting that I can get the enable oem unlocking icon to appear, toggle it and then once I enter the bootloader interface and enter the fastboot unlock command I get a failed response. It's like the adb interface isn't talking to the bootloader interface? Anyone following me here? I know I'm probably not using the correct terms please correct me
[Google Pixel 2 Guides, News, & Discussion] crixley:
Are you on a refurbished device or Verizon?
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
My build number is reads PPR2. 180950.006

Since I am having issues I believe it may be the Verizon varient? PPR2. 180950.006.A1

I bought the pixel 2 second hand, new and unlocked.
[Google Pixel 2 Guides, News, & Discussion] crixley:
I'm rooting around and finding some pretty interesting stuff! If I can manage to copy these files I feel like it'll be a huge help
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Again, I still believe it's a switch that gets tripped. Find that, and that'll be the key to the solution.
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
I totally agree. I've switch gears onto rooting simply because I feel like I keep hitting dead ends with the factory images. And I can't dump my devices files without root.

If there's a lead though with the bootloader, I'll follow it until it's dead. ;)
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
I can dump mine, if you think it will help. Just tell me how.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Well since you know what I should be looking for, again, then go ahead! You seem to be saying a lot but not doing anything

I'll look through related files and you search for magicswitch.dex or whatever
[Google Pixel 2 Guides, News, & Discussion] crixley:
I think stuff we can actually visibly look through and find cracks in is probably more fruitful, so I'll continue on
[Google Pixel 2 Guides, News, & Discussion] crixley:
It looks to me that there is a very small window on early boot where root is open. How small a window I'm unsure, but may be exploitable.
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
Well, this is what I've found so far with rooting. We can actually use the command "setprop service.adb.root 1" which will, if what I've read in the files is correct, allow the daemon to start as root. The problem is, this isn't a persistent change, and we can't restart the daemon without root.
[Google Pixel 2 Guides, News, & Discussion] crixley:
"adbd cannot run as root in production builds"

Good catch though!
[Google Pixel 2 Guides, News, & Discussion] crixley:
I wonder about updating the androidinfo.txt in an ota file to trick it into flashing?
[Google Pixel 2 Guides, News, & Discussion] Snorp09:
Can we actually modify android-info.txt in a OTA zip? All I get is payload-properties in a OTA zip.
[Google Pixel 2 Guides, News, & Discussion] DuckRuckus:
Okay I'll stop talking. But, look at the facts....

Google Pixel 2-unlockable

VZW Pixel 2-unlockable until the .016 patch

VZW Pixel 2-locked after .016

All Google RMAs-locked

All software builds are universal, with rare exception, so I really can't see it being a bootloader or software issue, as every Pixel 2 gets the same update. Good luck, though
[Google Pixel 2 Guides, News, & Discussion] crixley:
Verizon pixel 2 is locked by hardware, the lock critical thing was a bug.

When you first set up your phone, it sends your imsi to Google to verify if OEM unlock is allowed, which then sets a bit in a hal/vendor partition which cannot be modified afterwards.

What I'm trying to do is either find a way to write that bit before or after the fact, or find a loophole the same way the lock critical bug happened.

If we can find a way to use the diagnostic functions of the bootloader would be another method. See my linked photo. I also found some user IDs that were buried that I'm going to try with bootloader set-action-nonce force-unlock, which uses kernelflingers OAK function.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
woah, great work and research, truly interesting findings that I can get behind. I'm impressed by your analytical strategies, how can I increase my skill set in order to contribute more fruitfully? The boot loader locked by hardware is definitely an argument I support.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Honestly I just read a lot and try to sneak through system files where possible. I don't really know that much unfortunately, just what I've learned in my many years using android (2008 or 09). There are members here that know wayyyyy more than I do.

Thank you though!

---------- Post added at 06:45 PM ---------- Previous post was at 06:03 PM ----------

Did you guys see this?

How to unlock bootloader:

BEFORE ANYTHING RESTART THE DEVICE.

once restarted go into settings and do a factory data reset WITH YOUR VZW SIM INSERTED.

once it hits the "G" logo with the loading bar, force reset into the bootloader, and then boot into recovery.

NOW REMOVE YOUR SIM CARD, and reinsert until the FIRST POP feeling. not entirely. For whatever reason when the initial reset is done without the sim card it DOES NOT work, and it does not work without the sim partially inserted.

Factory data reset the device -TWICE- and then reboot with no sim, and skip throught the set up menu.

enable ADB in settings and enter the following commands:

taimen:/ $ pm uninstall --user 0 com.android.vzwomatrigger

Success

taimen:/ $ pm uninstall --user 0 com.android.phone

Success

taimen:/ $ pm uninstall --user 0 com.verizon.llkagent

Success

taimen:/ $ pm uninstall --user 0 com.customermobile.preload.vzw

Success

taimen:/ $ pm uninstall --user 0 com.qualcomm.ltebc_vzw

Success

taimen:/ $ pm uninstall --user 0 com.verizon.mips.services

Connect to wifi, go to google.com and search anything. wait 3-5 minutes, payload.

IMPORTANT: DO NOT RESTART AND BOOT INTO BOOTLOADER- USE HARDWARE BUTTONS TO FORCE RESTART INTO BOOTLOADER

I haven't tried it yet since I'm at work
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
So this may be a dumb question but I have a Sprint carrier but same problem, same responses to adb commands ect... My question is; should I follow the same protocol or should I make logical variations?
[Google Pixel 2 Guides, News, & Discussion] Cklauber:
Have anyone tried this witchcraft or seen it before? I mean... It sounds real different, but I kind of think it could have some results.
[Google Pixel 2 Guides, News, & Discussion] mrkhigh:
he did something with cdma tool as well. A few people claim to have tried those steps, to my knowledge nobody has changed the cdma settings and tried those steps.
[Google Pixel 2 Guides, News, & Discussion] crixley:
Not sure how to change the cdma settings since we don't have diag mode from what I know
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
I think he used this cdma tool to create a shell in adb with root, unlock bootloader, boot into a patched boot image made with magisk then install magisk, reboot and then you have persistent root, after this you can install TWRP then flash whatever. Am I correct here? Can someone articulate my amatur hypothesis?
[Google Pixel 2 Guides, News, & Discussion] crixley:
nope no root was needed, the commands he ran you do not need root for. I'm honestly not sure what the diag mode accomplishes.

Apparently with this fastboot allows you to flash things, but at the same time does not think it is unlocked. We could then flash an earlier bootloader and unlock to make it stick.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
I want to try this, perhaps if I follow the steps outlined above, no CDMA modification necessary I will have success since I am on a different carrier already?
[Google Pixel 2 Guides, News, & Discussion] crixley:
I honestly have no idea. I'm not on Verizon either, nor is my phone a Verizon phone. I'm tempted to give it a shot, but I hate constantly having to start from scratch.
[Google Pixel 2 Guides, News, & Discussion] crixley:
I think we can use *#*#4636#*#* to switch to CDMA mode, I'm assuming this wouldn't persist through a factory reset though.
[Google Pixel 2 Guides, News, & Discussion] alecthenice:
I agree with you here...I am lost on how what to do with this tool though
[Google Pixel 2 Guides, News, & Discussion] mattie_49:
I'm going to tonight. Seems like maybe an option. If the fastboot commands will go through successfully. Where is this from? I don't care to factory reset and reinstall all. Worth a shot for me.