yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Guides, News, & Discussion] djared704:
Yes that's correct. There are certain prerequisites that are required when unlocking. Are you a individual with a PS pixel with a grayed out unlock? Try this then https://xdaforums.com/pixel/how-to/how-to-unlock-bootloader-pixel-google-t3883437
[Google Pixel XL Guides, News, & Discussion] carper84:
Hello guys, I just purchased a Pixel 4/128 from Chinese amazon seller and after i uploaded to android q, i read this thread and discovered that mine is a Verizon Pixel ?

I tried the methods described here, without success.

I bought it just to try some modifications (my other phone is a oneplus 7t completly stock) and other roms.

I signed the petition, I hope we will have some news soon
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Thanks for the reply.

How do I confirm that my Pixel is a Verizon one?

Actually, it's my daily driver, I don't wanna factory reset it just to find out it's a Verizon one.

Is there any other way?

Thanks for the help
[Google Pixel XL Guides, News, & Discussion] kigabait:
Do this steps:

1. Visit Google's repair website https://store.google.com/us/repair

2. Open Chrome Dev Tools (Ctrl + Shift + I or F12) and go to the Network tab

3. Check that you're recording all network activity

4. Enter the serial number and hit Enter

5. View the Response tab of the network log and if the phone name ends in "_vz", then it's verizon (unfortunately)
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Unfortunately, it is. Thanks for the help.

Let's just hope we are able to find a way to unlock the bootloader on 10
[Google Pixel XL Guides, News, & Discussion] djared704:
Remember dePixel8? Why is there barely any information about it? Why did the developer boast a Twitter post about it on how it was so easy, then hit the road, never to return? If we can take on the dePixel8 project, I certainly think it is possible. Theres a couple CVE's that users mentioned on our TG channel. Like CVE 2020-059 and CVE 2020-0041. Some arguments rising that CVE 2019 2215 cannot be used only because of the kernel difference. However if it crashes the device that means we are open to find a type of behavior that leaves the kernel vulnerable (the point of 2019-2215!). I hope someone that understands unsigned code execution can get the rock moving and finally help us unlock the bootloaders. Because I definitely can't. We tried about everything at this point, correct? That's why I'm proud of every single person here.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
You have a lot of knowledge about this stuff.

How you tried anything?

Or got in touch with people who knew?
[Google Pixel XL Guides, News, & Discussion] djared704:
We've tried everything. We've even have a open telegram channel where many people gave us really good ideas that unfortunately did not work but it gave us a idea of how we had to work around it. Maybe someday the table will flip and that oem unlock will be selectable again.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Can you share the group? Thanks

Does every manufacturer has a different way they lock their boot loader with Verizon?

There must be some other device whose bootloader has been unlocked and on Verizon
[Google Pixel XL Guides, News, & Discussion] djared704:
Somewhere in late 2017 (or 2018 probably) some of the Moto G5+'s that were by amazon were actually accepting bootloader unlock codes. Now with Motorola you have to send them a bootloader key like back in the HTC days and they will give you a code that unlock the bootloader. However by default Amazon devices were not supposed to be capable of unlocking the bootloader, but this short period of time some Amazon users just found the perfect time when the site was (probably?) broken and they got the site to accept them a bootloader key. In theory all you need to do to ungray the OEM unlock is to modify the FRP partition in some way since there are what they call "bits" on the frp partition that I suppose contain data for OEM unlock.

Regarding TG, I cannot because the mods don't like me lol
[Google Pixel XL Guides, News, & Discussion] ohioDroid:
Hello. This is a long thread - it's difficult to catch up. I just got a Pixel 3 "open box". It's got an IMEI that begins with 35 (verizon?), and the current build is pd1a.180720.030 (international?). Do I have any options for unlocking anything on this device?
[Google Pixel XL Guides, News, & Discussion] djared704:
This is Pixel 1, I assume you know that, obviously this isn't going to work. You will have you refer to your board to talk with them with unlocking the bootloader for verizon.

Regarding IMEI 35, it's a 50/50 chance, but run that checker that consists of the Google store network tab, as far as I know it works with all Pixels, but the little code at the end is always different, for example, on Pixel 2, when I last checked, the number has some letters consisting "P_R" meaning unlocked, but refurbished. As far as I know you cannot unlock refurbished models.
[Google Pixel XL Guides, News, & Discussion] ohioDroid:
Hey, thanks. I had like 20 tabs open and I replied on the wrong forum - thanks for pointing it out. I'll look into that checker. Thus far "OEM Unlocking" has not been an option so I'm betting this phone is a no-go, but I'll look further.
[Google Pixel XL Guides, News, & Discussion] DarkXonline:
I follow this instruction on my Android 10 google pixel and IT IS WORKING.

but for safety I add some steps to the instruction.

15. After toggle the OEM Unlock, do adb shell pm uninstall --user 0 com.android.phone (like step 5)
16. Power off the phone and go to fastboot and then unlock the bootloader.

The profit is mine. Thank you all XDA members. I cannot do it without your help.
[Google Pixel XL Guides, News, & Discussion] jayank2000:
Good to hear you manage to toggle the OEM unlock on your phone and on your bootloader the bootloader is unlocked. I was not able to get that far. I tried to follow along the steps multiple times but mine didnt allow to toggle. Mine is Verizon Android 9 with Mar 2019 security updates.

All the best to you.
[Google Pixel XL Guides, News, & Discussion] djared704:
Did you prove your pixel Verizon or store first? Remember it has already been documented here if you read the few last pages that it cannot be done like this.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Can you confirm that your Pixel is a Verizon one?
[Google Pixel XL Guides, News, & Discussion] Hammad1029:
your variant is probably US/Global and not verizon
[Google Pixel XL Guides, News, & Discussion] shdwdrake8:
Does this still work? I've done the steps in OP twice and even waited with the menu open as some have said that was needed. I bought a Pixel listed as unlocked but confirmed it is a Verizon model. This would be the second return I'd be doing because of this and I'd much rather just make it work. Sounds like I am going to do yet another return.
[Google Pixel XL Guides, News, & Discussion] n3kf:
If it's a Verizon model, return it.
[Google Pixel XL Guides, News, & Discussion] djared704:
Apparently there may a very very small case of possibly unlocking bootloader on VZW pixel 1 again. There is a Chinese service known by the name of "Taobao", performing premium paid bootloader unlocks for Pixel 1. Now at XDA, we do not agree with charging people in any way. The first way the old adb uninstall exploit was even discovered was because some user leaked, also a premium service in China. This is a bit different. The interface they are using is in Chinese (I know this because I connected with a user in our TG channel that has used this service). When I talked with this user they spoken about how they used the getvar command to determine if it was a actual VZW model or not. He went on to tell me that he used a VPN service to connect to their (data centre?) or his own phone, built for going long distances, I guess. He tells me he hasn't paid attention to the PC that much, and in a bit his bootloader was successfully unlocked. I actually took a look at the fastboot toolkit when I was on his PC and it was actually a toolkit from 2016, and it was obviously a bit modified, having a chinese file shortcut that directs to system32 cmd. The shortcut was obviously "命令提示符", translating Command Prompt. I can't understand why you would need admin access for adb, but to spin off, the commands in the help directory of both fastboot and ADB are different. Some I noticed were "flashing get_unlock_bootloader_nonce" "flashing unlock_bootloader <request>" "flashing lock_bootloader". However the ADB directory looks a bit similar to what we see today. I looked at a couple of the proprietary apps he used and the interfaces of those kinda reminded me of IP grabbing applications. Some great people at TG attempted to translate for me, and it looked about right.

In theory, they use these apps to grab a VZW IP and maybe bully it with your own router? Or maybe they infiltrate it with their own IP which explains turning on the VPN. We have to work together, and figure out exactly how it was done. We have some info, but no steps on reproducing it. Lets try and work this out together! WE ARE so close! Thanks so much.
[Google Pixel XL Guides, News, & Discussion] jayank2000:
Thanks djared704 for the update.
[Google Pixel XL Guides, News, & Discussion] DarkXonline:
I didn't really know it's a Verizon version or not. I did brought it second hand from an online store, and it does not mention anything about what model it is. But the OEM unlock button are greyed out by default. The imei does start with 35 so I assume that it is Verizon's model. Correct me if I'm wrong :)
[Google Pixel XL Guides, News, & Discussion] holy_shirt:
[MENTION=9295007]djared704[/MENTION] hello, can u send me link of "premium paid unlock bootloader" on Taobao in PM
[Google Pixel XL Guides, News, & Discussion] kya797:
So. I am new to rooting and I have had one other Pixel device that I tried but stopped bothering when I found out it was a Verizon model and couldn't be done. I am wondering (hoping...) that because I have a pixel that seems to have been new in the box, is there a chance I can get it rooted? It shows Nougat for the OS and as far as I know, hasn't done any updates. Am I SOL or is there a fighting chance?

I checked the IMEI and it did show as VZ in the Chrome Dev Tools. I was unable to get the OEM toggle to be toggle-able after a few reboots. Anyone have any suggestions?

I should add, I am unable to get the phone to go through setup without doing a wifi setup. I tried rebooted a few times, tried just powering off, then back on after a few minutes.
[Google Pixel XL Guides, News, & Discussion] holy_shirt:
Try dePixel8, it should works with Nougat
[Google Pixel XL Guides, News, & Discussion] djared704:
You may have to turn on wifi because it has to check with the inet to prove if it's a store or VZW pixel.

Regarding BL unlock, you may unlock with dePixel8 only on 7.1.0, you MAY get away with it on 7.1.1, but so little reports of it happening almost make it seem fake.

Good luck.
[Google Pixel XL Guides, News, & Discussion] klevin1017:
just did this .. they didnt recognize my serial number ..	:eek:
[Google Pixel XL Guides, News, & Discussion] djared704:
Try your IMEI number with the same exact steps.
[Google Pixel XL Guides, News, & Discussion] beeewell:
I had given up all hope of unlocking the bootloader. It's a Verizon device with Q Build QP1A.191005.007.A3. and up until an hour ago, whenever I looked, enable OEM unlocking was always greyed out. But I just happen to see it not greyed out, hit the toggle switch, did the fastboot unlock, and lo and behold, my Pixel XL now has an unlocked bootloader. I wish I could explain it, but there's no logical explanation. It could happen to you too.
[Google Pixel XL Guides, News, & Discussion] pekas:
It has work perfectly for me. thanks a lot
[Google Pixel XL Guides, News, & Discussion] djared704:
You have to do the quick tests to actually ensure if it's a VZW device or unlocked (Unlocked should be _p on google site, vzw will be _vz)

Mate if this was the case this whole entire thread wouldn't exist.
[Google Pixel XL Guides, News, & Discussion] Vandan.Patel:
At this point is there any hope for people running the last update for the pixel XL Verizon to be able to unlock the bootloader?
[Google Pixel XL Guides, News, & Discussion] beeewell:
I'm very skeptical too, and maybe I screwed up. It took me awhile to figure out the google test thing, but I think this is the data that's in question below. I see the name has a _vz at the end of it. Does this look like the data you would get from the Google repair site to see if it's a Verizon model? I put xxx's and yyy's in for my imei & serial.

)]}'

[[["grd",["device","G-2PW2100-022-B","_pixel_xl_phone_silver_128gb_vz","Pixel XL","128 GB, Very Silver","https://lh3.googleusercontent.com/OsPTZ0Uonr59bD3E-hV_WDt_W8JgN_F5iGtFHGSrNC5bvLTrYh-SDuwgmytsrH0UaA","xxx","yyy",1,null,1,null,0,null,null,"Pixel XL (128 GB, Very Silver)",1595314800000,"Jul 21, 2020",null,null,0]

,1]

,["e",2,null,null,376]

]]
[Google Pixel XL Guides, News, & Discussion] djared704:
I have a theory for your case then. It has also been proven on the Pixel 4. If you bought the device brand stinkin new with no VZW sim in it, that means NO one ever turned on the device before you did, and it especially booted without a VZW sim in it, potentially it would unlock as a regular pixel.

This still doesn't support our previous theories that VZW pixels require the Google server to unlock. I have also seen documentation of Pixel 1 not being permitted to be unlocked even proven unlocked, and not refurbished.

The questions will keep adding up.

Anyways, if any one of you remember this video, it features "hTC-download", including a "Token AUTHENTICATION PASS/FAIL" It honestly looks really neat and I believe if we can get a TOKEN PASS we can actually unlock the bootloaders for ourselves. If I'm correct, these tokens are distributed along the factories in China, Taiwan, where pixels are built, and my only theory is someone stole a token and also knows how to work on pixels (It makes sense because it's a chinese service) I also had one of my friends do a taobao service a few days ago, and they also successfully unlocked his bootloader! However it's completely different. I do not want to post it here for privacy reasons but to explain it, the camera is basically staring at the phone for a solid 35 minutes, then ting, you see the phone light up into a "Unlock bootloader?" display

Which is interesting, and completely different to what we know as of right now. There is absolutely 0 documentation of anyone just completely exploiting the pixel bootloader, and frankly, I have 0 doubts it can be done.

We're so close!

Thanks everybody.
[Google Pixel XL Guides, News, & Discussion] beeewell:
The only thing I can add, and I'm not sure it's at all helpful, but another hypothesis - My wife bought this phone REFURBISHED. She took it out of the box, charged it, put in her Verizon sim card, and fired it up. Maybe there was something in the refurbishing process that ultimately allowed it to be unlocked. It really defies explanation. As I mentioned before, based on what I read here and trying numerous times, I had given up on unlocking this phone to the point of ordering another unlocked phone. Since I lucked out if you will in unlocking it, I've cancelled the other order. As of now, I have a rooted stock in one slot, and PixelDust in the other slot.
[Google Pixel XL Guides, News, & Discussion] bpatterson007:
So just to be clear, if you have a Verizon Pixel XL with the last update installed, you cannot currently unlock the bootloader? So no Lineage 17.1 install for me?
[Google Pixel XL Guides, News, & Discussion] djared704:
Rather than a solid "no" like it has before, there are sudden reports of this chinese service unlocking it. At the moment I'm still gather information regarding it, but you may always look at my previous posts about it. Cheers.
[Google Pixel XL Guides, News, & Discussion] bpatterson007:
Good luck and godspeed. It pisses me off owning something and being restricted like this. I know I'm not the only one!
[Google Pixel XL Guides, News, & Discussion] punkmangg:
Does anyone have information about this?

I'm on android 10 and want to go back to 9 with locked bootloader (Pixel 2 - Verizon)
[Google Pixel XL Guides, News, & Discussion] jayank2000:
Came across this. https://9to5google.com/2020/06/11/google-pixel-android-flash-tool-past-updates/. Not sure if it applies to Verizon pixels, I highly doubt it.
[Google Pixel XL Guides, News, & Discussion] punkmangg:
Android flash tool recognizes my device (Pixel 2 verizon) with usb debugging activated but I'm afraid to start the flash and brike :confuso:
[Google Pixel XL Guides, News, & Discussion] StanleySnafu:
Anyone had luck with Pixel XL Verizon with Android 9 (Security Patch August 1, 2019)?
[Google Pixel XL Guides, News, & Discussion] hairycheez:
If following the steps and going to Google.com (not any website) doesn't work, maybe try using the check in command from Google.
[Google Pixel XL Guides, News, & Discussion] divhandyman:
I tried this, running android 10, now no data connection and the phone app keeps crashing. factory reset didn't fix it. Anyone else experience this issue?
[Google Pixel XL Guides, News, & Discussion] YandexStudio:
I've also noticed the unlocking service on Taobao, currently I still didn't buy it, but usually, they use teamviewer to contorl your computer and then transfer their unlocking scripts, and they oprate it fast, then delete the script file, ( I've bought a fiber modem unlocking service before, I don't know if it's similar for unlocking mobile phones)

Is there anyway to grab their script file without let them notice? If so, maybe I can buy it and have a try.
[Google Pixel XL Guides, News, & Discussion] CLPose:
I've PM you with some relevant info. Looking forward to seeing you! ;)
[Google Pixel XL Guides, News, & Discussion] biman__17:
Maybe you can close the TeamViewer connection after the script has been transferred to your system.
[Google Pixel XL Guides, News, & Discussion] kha1rul:
Great to see there's a lot of progress, keep it up guys! I really appreciate your efforts.

Out of curiosity, Does anyone have a link to the Taobao unlocking service?
[Google Pixel XL Guides, News, & Discussion] n3kf:
Well darn, that would be great to be able to move back to an earlier build. Looks like it's only for Pixel 2 on up though. Sure wish it was open source......
[Google Pixel XL Guides, News, & Discussion] mrkhigh:
I own a locked p2 and tried this. This doesn't allow locked bootloaders to downgrade. Pretty sure it's just an online adb/fastboot tool.
[Google Pixel XL Guides, News, & Discussion] YandexStudio:
If things are such easy as you said, you can have a try.
[Google Pixel XL Guides, News, & Discussion] toast550:
Hi Jared, just made an account here to share my thoughts on this issue. I just got into this rooting thing today and was hoping to install something on my VZW Pixel 1 but we've got this whole thing blocking us. I took a look and browsed around the code you sent. I can definitely read Java but I've never reverse engineered anything. Below are my thoughts on the code, hopefully some of it helps our efforts to beat this thing!

Looking at the original file, OemLockService.java, we can see a function called ]setOemUnlockAllowedByCarrier that takes a boolean and a vendor-supplied signature. I'm assuming that this is the check that fails when you open dev tools, but I can't confirm this. On the pixel 1, these values are manipulated through the PersistentDataBlockService.java file (would have posted a link but I can't), which I figured out manipulates a linux block device at /dev/block/sde1 by looking at the ro.frp.pst prop specified at the top of the file.

Looking at the comments of this file, we see this structure of this block partition is defined as follows:

* The persistent data block is currently laid out as follows:
* | ---------BEGINNING OF PARTITION-------------|
* | Partition digest (32 bytes) |
* | --------------------------------------------|
* | PARTITION_TYPE_MARKER (4 bytes) |
* | --------------------------------------------|
* | FRP data block length (4 bytes) |
* | --------------------------------------------|
* | FRP data (variable length) |
* | --------------------------------------------|
* | ... |
* | --------------------------------------------|
* | Test mode data block (10000 bytes) |
* | --------------------------------------------|
* | | Test mode data length (4 bytes) |
* | --------------------------------------------|
* | | Test mode data (variable length) |
* | | ... |
* | --------------------------------------------|
* | FRP credential handle block (1000 bytes) |
* | --------------------------------------------|
* | | FRP credential handle length (4 bytes)|
* | --------------------------------------------|
* | | FRP credential handle (variable len) |
* | | ... |
* | --------------------------------------------|
* | OEM Unlock bit (1 byte) |
* | ---------END OF PARTITION-------------------|

There's just one single byte at the end of the partition. Can we edit it directly by using /dev/block/sde1? Or does the OEMLock implementation do some other signature checks that make editing this byte directly impossible? Maybe I'll try and change the bit directly and see what happens. Here's hoping I don't brick my device!

- Toast
[Google Pixel XL Guides, News, & Discussion] djared704:
Thanks so much for this info. I've DM'd you something, get to it by clicking your avatar in the sidebar.
[Google Pixel XL Guides, News, & Discussion] Cucumber_Man1990:
Just thought I'd share my experience, I had the exact same issue as everyone else, with my EE locked google pixel XL, the OEM unlocker option was greyed out so couldn't unlock the bootloader. I tried every suggestion ad variation of this posts instructions and nothing worked. FYI I was running the latest 2019 December update.

I managed to unlock it by pure luck, I was just about to give up so I did one last factory reset (through recovery mode) and set up the device to wifi and finished the pixel setup run through it makes you do in the notification window. once I did this I went and enabled developer options and for whatever reason the option was unlocked, so i enabled it and debugging mode, connected to the all in one tool, reset to bootloader and unlocked it.

I don't know if it was a coincidence or not but 5 minutes prior to doing this, I logged onto my EE account and requested a carrier unlock as the phone was locked to EE sim cards, but I doubt they did anything that quickly.

I don't know if this will help anyone else, but the only real thing that I did different was set up my google account through the notification bar, and I did not enable developer options until this was done.
[Google Pixel XL Guides, News, & Discussion] djared704:
I have heard EE cell service has different stipulations to Verizon. Do you think you can attempt the google store repair website inspect element to identify your model?
[Google Pixel XL Guides, News, & Discussion] jonr2975:
Android 10, Security patch October 6th, 2019? There is another way to factory reset without Android booted. In Fastboot, try going to recovery, it will say “No Command” and use POWER and VOLUME UP until the recovery comes up and factory reset there. Hope this helps.
[Google Pixel XL Guides, News, & Discussion] divhandyman:
I was able to get data connection back a few days ago, and its working fine, but as far as recovery mode goes as many time as I have tried it will never get beyond the "No Command Screen" I cannot access recovery at all.
[Google Pixel XL Guides, News, & Discussion] jonr2975:
I see. I think that you might have you phone plugged into a computer have the adb server running with ‘adb devices’ and there also might be certain amount of time that you hold each button to get past “No Command”.
[Google Pixel XL Guides, News, & Discussion] divhandyman:
I have tried with and without the adb connected, I have tried every combination I could think of, and I cannot get into recovery. The phone is working fine now, Im just waiting for a solution to unlock the bootloader.:good: