yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Guides, News, & Discussion] djared704:
Unfortunately just milking it almost above a year seems too much for verizon, since they dislike how we get to have freedom to the device we own. We are going to have to look into the future for bypassing this oem lock. It's absolutely petty of verizon. I had more ideas. Such as finding the verizon ip, and spoofing it with our own data to make the device acknowledge that its a google store pixel. However I would need your guy's help. For people's pixels, devices that aren't your main device, it's time to set it up in the drawer to collect dust, complete waste product all thanks to verizon. I appreciate all your efforts in to trying to bypass this crap of a lock on our bootlooaders. It looks like we are going to actually need a skilled individual that understands security to get this because this is a extremely huge road block. Such as the CVE's that were out before october. It's too bad verizon has to do this, because I dont even know of any other company that does this. All the phones i have that are verizon are stored up, not touched for years because they don't have a unlockable bootloader. This is completely ridiculous. I don't see verizon being a company 15 years from now if they keep this up. I may try to sell my pixel, and buy one thats unlocked. It seems as if the oem unlock is completely a net feature and we with our own routers may be capable of bypassing it. Please someone look into it. I myself will attempt to do this spoofing but it will require a lot of time. Good luck all you people and I hope you can stay happy on a device that you ACTUALLY own.
[Google Pixel XL Guides, News, & Discussion] DuncDog:
Just wanted to pop in and mention that it seems you are onto something. I JUST set up a Pi-Hole earlier today and while fiddling with my (recently discovered to be VZW ) Pixel XL, I read your post and got curious. It appears that I'm seeing a ton of hits to api.push.verizonmedia.com being fired off, which seems odd as I didn't see those until I starting dinking with my Marlin...
[Google Pixel XL Guides, News, & Discussion] djared704:
Thank you for having interest in my concerns. Here is what I pulled up. this verizon domain you mentioned has the IP of 18.235.247.86. However the verizonwireless.com site has a different IP and this is not the target of what we are looking for. The verizon wireless site is just a site to direct users to certain places on the site, it doesnt hide anything under beneath. Now what I thought first. Try and force your router using a proxy to at least re direct the websites to google.com. Do this for any ip. If you have a router for a organization do not do this! Especially due to covid lol. If your router has the option try tunneling it for this specific ip, proxy to "google.com". Now this is router-sided so you shouldnt need a VPN or a proxy based off your changes. But you should connect to the SSID you made the changes on. Good luck!

To not stir up confusion. I'm trying to say is if you enter a domain like "bing.com", the router will redirect you to "google.com" under all costs.

---------- Post added at 11:18 PM ---------- Previous post was at 11:16 PM ----------

Or else - What if we try and pull up the api for google store and spoof that instead? Because we don't know if we need actual data to unlock, or if it's just trying to receive data off this server.
[Google Pixel XL Guides, News, & Discussion] rundllexe:
Mate this worked for me, got a refurbished Google Pixel for my wife with security patch from October 6, 2019; refused to unlock with the procedure in this thread (and the variations posted by others) - the only thing I did differently is after the OEM Unlock slider became active following what you advised - I initiated a reboot through ADB directly into the bootloader. This then allowed me to do 'FASTBOOT OEM UNLOCK' and boot the TWRP image.

Now have LineageOS 16 running on it! I must say that even now the OEM Unlock slider is greyed out but says 'Already unlocked' instead of 'Connect to Internet / Contact service provider'.

Hope this works for someone else!!
[Google Pixel XL Guides, News, & Discussion] djared704:
Didn't work for me. Your case may be that its a google store pixel but I hear it needs to have correct clock and date, and be somewhere latest firmware.
[Google Pixel XL Guides, News, & Discussion] DuncDog:
Looks like a red herring unfortunately. I've had the phone off for about 10 minutes now and I just saw another DNS request to that same subdomain from somewhere else on my home network... That said, it appears to be redirected at an AWS Host that is configured for either redundancy or load-balancing as it has 2 additional IPs assigned to it as well.

$ dig +short api.push.verizonmedia.com

prod-api.notificationsystems-mbp-prod.aws.oath.cloud.

prod-api-us-east-1.notificationsystems-mbp-prod.aws.oath.cloud.

18.235.247.86

35.168.212.133

34.202.7.203

Oh well, figured it may have been worth mentioning, but after a small amount of double checking that didn't pan out, so carry on!
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Are you sure your Pixel is a Verizon one?
[Google Pixel XL Guides, News, & Discussion] djared704:
Anything is useful for our journey to re unlock these devices. Try and see if you can spoof these IP's with your router settings.
[Google Pixel XL Guides, News, & Discussion] snapr122020:
FYI a Verizon Pixel IMEI begins with 35. Google has a different number (I think 39)
[Google Pixel XL Guides, News, & Discussion] djared704:
One of my friends showed me you can put your imei into google's repair website, and open up chrome, to networking tab and make sure it's recording status and press the "Get details" button, and in that network log you should see in the end "_vz" or "_ul" I believe. I can write a more accurate tutorial later if you are wanting to figure out if your pixel is true verizon or unlocked.
[Google Pixel XL Guides, News, & Discussion] micmalti:
I can confirm that.

1. Visit Google's repair website (can't paste the link because I'm new here)

2. Open Chrome Dev Tools (Ctrl + Shift + I) and go to the Network tab

3. Check that you're recording all network activity

4. Enter the serial number and hit Enter

5. View the Response tab of the network log and if the phone name ends in "_vz", then it's verizon (unfortunately).

I've been following this thread since late last year. Hopefully, someone can figure this out. Personally, I've tried to play around with resetting the IMEI but it was useless.
[Google Pixel XL Guides, News, & Discussion] djared704:
I have a crazy idea, doubt it would work. Is it possible to trick the package verification, make it think we're installing latest OTA, while we're actually installing 7.1.0 day of release? I heard of some people doing it on old Motorola phones. Thanks guys.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
I would have loved to help but I don't know ****!
[Google Pixel XL Guides, News, & Discussion] mrmattolsen:
Subbing. Just got a Pixel 1 from Amazon (refurbished) for app dev testing at work under the assumption I'd be able to unlock the bootloader and keep it updated with the latest versions of Android. Well, it's locked. Seller says it's GSM and not compatible with Verizon, but the IMEI starts with 35 and it's clearly locked down. Sigh.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
Happened to a lot of people bro. Including me.
[Google Pixel XL Guides, News, & Discussion] [-andi-]:
Hey,

I have two Google Pixel (both Sailfish), both with an IMEI starting with 35. One runs perfectly on LineageOS for over a year now (was unlockable without any problems or tricks, just went to the dev options and flipped the button), the other one has the button greyed out.

So IMHO the first two digits of the IMEI can't be used to distinguish between unlockable and not unlockable.
[Google Pixel XL Guides, News, & Discussion] djared704:
The IMEI starting with 35 doesnt determine if its Verizon. Try the network test with Google repair website.
[Google Pixel XL Guides, News, & Discussion] Homeboy76:
Google's repair website
[Google Pixel XL Guides, News, & Discussion] jnevels89:
Outdated Method?

Does this method still work? I thought I bought a factory unlocked version of the Pixel 2 but I think the seller sold me a Verizon version. I got a success message after typing in the command, but the option is still greyed out for me. It's been about 20 mins
[Google Pixel XL Guides, News, & Discussion] djared704:
Unfortunately, no it does not work. It especially won't work for pixel 2. My suggestion is to take it back to that seller and ask for a Unlocked one. Also for pixel 2, I believe you put it in that IMEI website for LG devices and it will tell you if its a verizon or unlocked. Use that to find out if its what you want before you bring it home.

I have a question of my own though, do we ever see this exploit coming back? How can we especially prove that this is permanent?
[Google Pixel XL Guides, News, & Discussion] sub_ubi:
Crap, just got a nice 128GB Pixel in the mail and found out it's Verizon :( OEM greyed out, "./fastboot unlock" returns "oem unlock is not allowed"

Anyone had any luck calling Verizon and asking them to unlock?

edit:

edit: I thought this worked for me, but it turns out (as you can see below) this wasn't actually a Verizon phone.
[Google Pixel XL Guides, News, & Discussion] djared704:
Hey! You look extremely lucky. Maybe perhaps your device isnt a Verizon after all. Like I asked earlier what if the "android.phone" exploit isn't permanent? None of us knows the engineering behind it. I'd say real quick to try these steps by this user to figure it out right now.

With this information will prove if your device is Verizon or Unlocked. My theory behind you being locked out in the first place is because the device didn't have a stable connection to either Google or verizon servers. Now we don't know for sure who talks to who, all we know one locks us all up. Good luck.

---------- Post added at 01:45 AM ---------- Previous post was at 01:42 AM ----------

I also would like to add that imei starting with "35" does not prove it's verizon.
[Google Pixel XL Guides, News, & Discussion] sub_ubi:
This was in the response tab, not sure what it means. I censored the middle of some of these strings.

[[["grd",["device","G-2PW4100-012-B","_pixel_phone_silver_128gb_p","Pixel","128 GB, Very Silver","https://lh3.googleusercontent.com/OsPTZ0Uonr59bD3E-hV_WDt_W8JgN_F5censoredbvLTrYh-SDuwcensoredtsrH0UaA","35268censored71327","FA6C5censored2264",0,0,1,"233543-1",0,null,null,"Pixel (128 GB, Very Silver)",15143censored0000,"Dec 27, 2017","Dec 20, 2018",null,0]
[Google Pixel XL Guides, News, & Discussion] djared704:
pixel_phone_silver_128gb_p

This right here shows your device is not verizon. It needs to have the XXGB_vz to conclude verizon. This is why you were able to bootloader unlock and my theory previously seems correct. Thanks for your time here though.
[Google Pixel XL Guides, News, & Discussion] djared704:
Anyone hear of that xHelper trojan? I don't know about many users being on Android Q but could we breakdown this trojan and use it for good? As far as I know it remounts the system as rw and this is exactly what we need.
[Google Pixel XL Guides, News, & Discussion] YandexStudio:
Any new way to unlock on Verizon XL with stock Android 10?
[Google Pixel XL Guides, News, & Discussion] CLPose:
Not yet. But we don't give up!
[Google Pixel XL Guides, News, & Discussion] djared704:
Hey guys. Me and my friends were talking about broadcast commands. We also looked at the logcat during boot, and found this

04-29 08:43:53.826 889 889 I SystemServiceManager: Starting com.android.server.oemlock.OemLockService
04-29 08:43:53.831 466 466 W hwservicemanager: getTransport: Cannot find entry android.hardware.oemlock@1.0::IOemLock/default in either framework or device manifest.
04-29 08:43:53.831 889 889 I OemLock : OemLock HAL not present on device
04-29 08:43:53.831 889 889 I OemLock : Using persistent data block based lock

Many logs were being initiated obviously, i just cut it out to these 4 only.

If you look up the source code, it takes you here.

https://android.googlesource.com/pl...om/android/server/oemlock/OemLockService.java

One of my other friends were actually talking about how on the Pixel 3 uses HAL to block oem lock. If anyone can reverse engineer this code, or know how to forcefully block this upon boot, please let me know and I'll work something out. Anyways about the broadcast commands. It went something like this:

adb shell "am start -n 'com.android.settings/.Settings$DevelopmentSettingsDashboardActivity'"
adb shell am start -a com.android.settings.APPLICATION_DEVELOPMENT_SETTINGS --ez isSimLockedDevice False
adb shell "am broadcast -a 'com.android.settings/.Settings$DevelopmentSettingsDashboardActivity' -ez isSimLockedDevice False"

About this, obviously it doesn't work. But in theory it should initiate something in the code. It will return zero for now, but Im not sure if it should return one if it's actually activating my command or zero if it's false. We also went into the "android.phone" apk and found some code like this

private void
updateOemUnlockSettingDescription() {
int i = 2131888532;
boolean bool = isBootloaderUnlocked();
if (bool)
i = 2131888528; }
else { bool = isSimLockedDevice();
if (bool) { i = 2131888531; } else {
bool = isOemUnlockAllowedBvUserAndCarrier
if (!bool)
i = 2131888530;
} }

We don't know if we need to be looking at the codes, or the tags that are identified. Anyways I tried both in the shell commands, didn't change anything. If anyone can work anything out, please let me know. I have all this info to let anyone work with, if you need some clarification, please let me know. Thanks. jared.
[Google Pixel XL Guides, News, & Discussion] Supaiku:
Seems like a good lead...

I wonder about making a bounty or something :P

Excited to say a refurb black pixel xl that has a 35 at the beginning managed to unlock with this method! But the white one I bought from "early upgrade" reseller doesn't seem to work...

Edit: by "this method" I mean the original revision in this thread, which had not worked for another phone I have (white)

Update: the black phone I just unlocked using has a cid of 1111111, which according to this thread means it's a google phone: https://xdaforums.com/pixel-xl/help/how-to-tell-pixel-xl-google-verizon-t3519351/page2

I was unable to use the google repair page method because I couldn't find the response tab in the Network tab of the Chrome Dev tools.
[Google Pixel XL Guides, News, & Discussion] zubblwump:
This worked (but maybe a Google edition after all?)

I spent most of the day reading every comment in this thread from the past couple of years, and I was not holding out much hope, but this method worked for me (except the fastboot unlock worked too, for me). I'd used the original method a couple years ago to unlock a couple Verizon edition Pixel XLs. The Pixel I just got in the mail, I believed to be a Verizon Edition too because the OEM unlocking slider in Dev tools was grayed out. But the original method would not unlock the slider this time...until I added the steps shown here to reinstall the phone app and try again. This is a Pixel, Android 9 PPR2, November 1, 2018 security patch. The Verizon BYOD site and adb shell getprop ro.boot.cid command both tell me this is Google version, but if that's the case why couldn't I just slide the toggle to begin with?
[Google Pixel XL Guides, News, & Discussion] Supaiku:
Thank you for your persistence and sharing!

This method really did just work for me on the white Pixel XL that I with 35 at the beginning for which the other method *wasn't* working. It took some 6 repeats of 12/13 and on the last one I kinda stopped to actually read an article for a minute or so. Amazingly, it worked

Update: I checked this phone's cid (after unlocking) and it's 1111111, which apparently means it's not verizon? However, the phone didn't work with the original method (while a different one did work with that method).

Update #2: Turns out I haven't been able to get it to work with the Verizon phone CID of VZW__001 - though only this method worked with another phone for which the other process didn't.

Still working on unrooting these Android 10 phones with the magisk method...

EDIT: Update

I did also need to finish the last two steps of the original process, so my ultimate process to unlock a previously unlockable Android 10 Pixel XL was:

1. Factory Reset

2. skip everything in setup, but turn off free up space, use location, and send usage data

3. Developer Options and enable USB debugging.

4. Connect your phone to computer. (I'm on linux mint)

5. adb shell pm uninstall --user 0 com.android.phone

6. restart from menu

7. Connect to Wifi

8.Visit website

9. Check Dev Options (OEM Grayed out)

10. adb shell cmd package install-existing com.android.phone

11. restart from menu

12. check dev

13. visit new website

14. repeat 12 and 13 until OEM Unlock is available

15. check unlock bootloader (once available)

16. Reboot into bootloader and via CMD run

Code:

fastboot oem unlock
[Google Pixel XL Guides, News, & Discussion] royerhdz:
I am gonna try it on a few minutes on my verizon Google Pixel XL on android 10! Few days ago I lost hope because I couldn't enable OEM Unlock but I was looking around this thread and just saw this comment..
[Google Pixel XL Guides, News, & Discussion] Vaugerbird:
Sorry if this is an obvious answer, but when you say check dev, do you mean just look to see is the toggle is available, or turn on/off dev options?
[Google Pixel XL Guides, News, & Discussion] Supaiku:
yes, that's what I did. I did find that both phones have a cid of 111111, which means they probably aren't verizon phones? - however, what's weird is that one of the phones worked with the first process and the other only with the second process.

I have a third white phone that currently has a CID of VZW__001 - It's been my main phone for a while, so once I've got things switched I'll give it a try on that one.

Upadate: I wasn't able to get it to work with the actual verizon phone.
[Google Pixel XL Guides, News, & Discussion] djared704:
You need to do the google store network tab to actually prove if it's a verizon pixel.
[Google Pixel XL Guides, News, & Discussion] Vaugerbird:
I wasn't able to unlock my Pixel after following the steps above multiple times, but I'm pretty sure it's a Verizon Pixel.

Edit: I just confirmed it has a CID of VZW__001
[Google Pixel XL Guides, News, & Discussion] zubblwump:
The adb command also tells you if its a Verizon or Google edition.

adb shell getprop ro.boot.cid

If it returns 11111111 it's google.

If it returns VZW__001 it's verizon.

You can also check at the google BYOD site https://www.verizon.com/onedp/byod#/dontKnow by entering you IMEI.

If it just returns the model of you phone, it's verizon, and it says PIXEL NON-VZW, it's google.

---------- Post added at 04:05 PM ---------- Previous post was at 03:50 PM ----------

What Android versions? (I don't think it matters, btw) It seems the Android version doesn't really matter (except very early 7.1.1 builds that could use dePixel8) It seems that something server-side changed at some point (around Sept. 2019?) that stops the original method from working on Verizon phones, regardless of Android version. Several comments have suggested this to be true. What I saw was when I remove the phone app, my phone stops showing an IMEI number...My theory is the server used to treat a "null" IMEI same as valid Google edition IMEI, and now it treats it as a non-Google IMEI.

What I cannot figure out is why my Google edition pixel had the OEM unlocking toggle grayed out in the first place.
[Google Pixel XL Guides, News, & Discussion] djared704:
Thanks for that. It's definitely more efficient than looking up networking status.

Anyways, I have found going through oem unlocking source code, that these properties exist. We may be able to bully these statuses. Here they are

isOemUnlockAllowedByUserAndCarrier
isSimLockedDevice
setOemUnlockAllowedByDevice
setPersistentDataBlockOemUnlockAllowedBit
enforceManageCarrierOemUnlockPermission
setOemUnlockAllowedByCarrier
isOemUnlockAllowedByCarrier
setOemUnlockAllowedByUser

setOemUnlockAllowedByUser

This statement. I feel as if it's our suspect. There is also code that the coder calls a monkey, and if I can read the code correctly, it's calling for ActivityManager, and disallows whoever can bully ActivityManager to modify it (Does not mean we can bully it through ADB). Here is the piece of code.

// The user has the final say so if they allow unlock, then the device allows the bootloader
// to OEM unlock it.
@Override
public void setOemUnlockAllowedByUser(boolean allowedByUser) {
if (ActivityManager.isUserAMonkey()) {
// Prevent a monkey from changing this
return;
}

The issue with this code is, obviously, isn't 100% of the OEM block engineering, and for once, we could potentially bully the phone to have that box open up.

adb shell "am broadcast -a 'com.android.settings/.Settings$DevelopmentSettingsDashboardActivity' -ez isSimLockedDevice False"

For example, this piece of code, a broadcast command I believe tells the device that it's not allowed to be sim locked. Someone else may have to take on what I started, because I cannot for the hell of it just figure it out completely. Here is the source code of the entire engineering of the OEM unlock. https://android.googlesource.com/pl...om/android/server/oemlock/OemLockService.java

Also, how broadcast commands work https://riptutorial.com/android/example/10642/sending-broadcast https://developer.android.com/studio/command-line/adb#am

The one by Android devs is obviously more detailed, and I believe it could just help someone understand better. But the other site tells what type of flags the code may need to just get it to work.

In conclusion. Who knows if we ever see any of the old exploits coming back. The developer of DePixel8 literally disappeared right after he released it, never to be seen again, the one who bountied this thread (long story, the only reason why android.phone exploit exists in the public is because the OP leaked it) also left, and users banging left and right on how they want to be able to OEM unlock the pixel. I don't blame them honestly. I was already 4 months late when I purchased my pixel in February of 2020 when there were users apparently stating of it working in October. Maybe we could work something out. But long story short, all the exploits from the past just aren't coming back. Thanks for all your work guys.
[Google Pixel XL Guides, News, & Discussion] Vaugerbird:
It's running the last update of Android that was made available, so I think the November patch of Android 10.
[Google Pixel XL Guides, News, & Discussion] Supaiku:
The description of the process I found is unclear. I was unable to find the referenced portion in the network tab of chrome's dev tools.

The CID seems pretty obvious, no?
[Google Pixel XL Guides, News, & Discussion] djared704:
You are given 3 network statuses when you press the blue button, and if I'm correct, it's the first one. When you click on it, it will tell you a full line, look for _vz somewhere.

I have also seen _01 and _z and _bb before, apparently these have some stipulations to allow a OEM unlock (EU versions?). Generally, _p means you are good to go and unlock.

Apparently I just talked to someone who've has a Play store pixel with the CID of VZW. I don't believe the cid completely knows what it's doing to be honest.
[Google Pixel XL Guides, News, & Discussion] ucantseeme:
Is there another way to work on pixelxl verizon android 10?
[Google Pixel XL Guides, News, & Discussion] kigabait:
Hello! I decided to make a petition on change.org to note Google and Verizon to our problem.

Please, do not see this like a spam, if it will gather a lot of votes, they really, probably, would help us.

This is petition

http://chng.it/pskYqnPRSx

Thanks.
[Google Pixel XL Guides, News, & Discussion] ThePhenomenalOne1:
So, if the OEM unlock option is greyed out that doesn't necessarily mean that it's a Verizon one?