[Nokia 6.1 (2018) Guides, News, & Discussion] hikari_calyx:
Well, this method is different from the paid method that forbidden by forum.

As far as I know, this method tested on following models:

- Nokia 6.1 (TA-1054 only)

- Nokia 7

- Nokia 8

- Sharp Aquos S2

WARNING! THIS METHOD IS PRETTY COMPLICATED AND DANGEROUS!

I'M NOT RESPONSIBLE FOR BRICKING THE DEVICE! DO IT AT YOUR OWN RISK!

FIH made Android Phones with Android 7.x pre-installed can unlock the phone with the method I mentioned.

Preparations:

- Your phone must have Android 7.x running, or you're able to downgrade abl/xbl provided with Android 7.x firmware with other methods.

You can find an excuse at service point to let them downgrade for you, like "My work application is incompatible with Android 8.0" or something.

But Nokia 6.1 Android One Global Variant has Android 8.0 installed out of factory, so it's not likely possible.

Install following software on your PC.

- Patched OST LA 6.0.4: https://drive.google.com/open?id=1n91aYT9Di6_v4F3Wjlv8TjfeLc64AcYA

To install it properly, extract the archive and right click on setup.bat, run it with Administrator previleges. You may want to reinstall every Visual C++ Redistributable Runtime.

- QPST, the newer the better, I personally choose 2.7.460, the latest version should be 2.7.472.4. You can find it by simply Googling.

- A Hex editor. You can choose HxD or any other professional Hex Editor like UltraEdit.

And of course, the stock firmware for your phone. For example, I’ve posted the stock firmware for Nokia 7 on xda-developers Nokia 7 forum.

Since the guide involves the proprietary tool OST LA, it only works on Windows. I recommend you use latest Windows 10 stable release to finish the guide.

Minimal OS: Windows 7 Service Pack 1 with latest updates installed, both 32bit and 64bit are acceptable

Let’s get started.

Part 1: Before Unlocking

1. Backup your data on the phone, and logout your Google Account if you’ve logged in.

2. Enable Allow OEM Unlocking and USB Debugging to make following procedure convenient.

3. Extract early stock firmware or I'll upload required abl (to be added).

Part 2: Flash Service abl/xbl

You have multiple methods to flash abl/xbl.

If your phone is running Android 7.1, you can use old "Edit Phone Information" method I mentioned on Nokia 6 forum.

But let me tell you a method to flash service bootloader.

1. Enter fastboot mode (Download mode), and check which slot are you using.

fastboot getvar current-slot

I assume your current slot is A.

2. Now calculate the md5 checksum of your serial number. For example, the md5 checksum of PL2GAM1234567890 is 154b7ad463038ec186aafa5909505695.

If you have no idea about your serial number, execute this command:

fastboot devices

Expected output:

PL2GAM1234567890 fastboot

Of course your serial number can't be PL2GAM1234567890, I'm just making an example.

3. Execute these commands to flash service abl and xbl:

fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot flash abl_a D:\C1N-0-0430-abl_service.elf
fastboot flash xbl_a D:\C1N-0-0430-xbl_service.elf

The service abl and xbl are extracted from Nokia 7 stock firmware, which can be also used on Nokia 6.1.

4. Reload the service bootloader:

fastboot reboot-bootloader

Part 3: Enter EDL mode

Skip this part if you can use wire trick to trigger EDL mode.

Execute these commands:

fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem reboot-edl

Part 4: Dump a partition

1. Check Device Manager, "Port (COM and LPT)" category to see if your phone is listed as HS-USB QDLoader 9008 (COMx).

If it's listed as HS-USB Diagnostics 9008 or QUSB__BULK in "Universal Serial Bus devices", you need to update the driver manually to HS-USB QDLoader 9008 (COMx), then force reboot your phone and re-enter the EDL mode.

2. Open QFIL, and load the firehose file from stock firmware.

If you're using Nokia 8, you'll also need to change the storage type to UFS in FireHose Configuration.

3. Click "Tools" - "Partition Manager", and click OK.

4. Find deviceinfo (not devinfo) partition, right click on it and click "Manage Partition", then click "Read Image". This will dump deviceinfo partition.

Dumped deviceinfo partition will be placed at "%AppData%\Qualcomm\QFIL\COMPORT_*" with filename like this:

ReadData_eMMC_Lun0_0xb828_Len2048_DT_15_04_2018_15_16_32.bin

5. Use a Hex Editor and jump to offset 0x5101, data will be looked like this:

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

00005000 02 50 ED 13 EF C4 07 C3 67 3B CC 83 E1 7F 0B 7E
00005010 CC 40 DD DF 66 6A E8 52 F4 E8 78 7C 8B 87 CC DC
00005020 0F 45 EE F7 E9 71 E6 B0 DE 53 6E 97 84 10 EA 15
00005030 F3 78 07 B4 30 87 29 E3 1B DF 96 31 DE 30 1B 46
00005040 EC D3 33 F5 19 1D 56 EE 0A 5A A9 48 8D A1 83 80
00005050 F6 BA 29 AC 1A 10 BF FD A9 64 D5 79 4D C2 AF 9B
00005060 BD 62 87 49 07 A6 CB 88 22 6D 8C 65 10 94 CD 2F
00005070 3B B7 0C C9 91 92 67 F5 02 17 32 55 4C 5E 8B E7
00005080 1B 4D 70 65 61 46 CB 63 F4 C3 EE F8 45 E0 8D 48
00005090 6B 1E 1C FB 0C 94 48 BB FE AF 01 98 4F 47 4D 3A
000050A0 2A 5F 7F 3E 1E 49 C9 6D 4A 11 A5 19 D6 F1 E7 91
000050B0 5D B6 C8 A4 FA AA 15 BB 69 5F 8B C8 72 2A DD A5
000050C0 D0 DC 8B 4E 33 C8 20 57 6D D5 B8 D4 BF 17 0E B1
000050D0 30 5B 3E 13 BC FF 08 10 4C E2 3E 12 9F 9A A6 54
000050E0 6B D8 DE 98 D4 D7 44 37 7C 6D 43 CA A4 BA D9 C7
000050F0 BB F1 1F 12 90 8D 0D 4B 1B 1E 04 69 69 FD 44 1B
00005100 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If data exists between 0x5000 and 0x5100, you'll be able to use this method to unlock. Modify the value of 0x5101 to 0xFF like this:

00005100 06 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00

6. Save it as deviceinfo_mod.bin to another place and use QFIL to write it back.

Click "Load Image" and choose your deviceinfo_mod.bin. This will write modified deviceinfo back to your phone.

7. Close QPST and reboot your phone to fastboot mode (Download mode).

Part 5: Unlock the phone

1. Remember to keep the OST LA opened to make sure your phone will stay at Download mode.

2. Execute following commands:

fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem cert_timecount get

If the output cert_timecount is not zero, you can proceed. Otherwise... (Click to unhide)

execute these commands and check again:

fastboot flash deviceinfo D:\deviceinfo_mod.bin
fastboot reboot-bootloader

3. Then unlock your phone with following commands:

fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot flashing unlock_critical
(Do confirmation on your phone)
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem unlock-go
(Do confirmation on your phone again)

Now your phone is fully unlocked with not serious typo:

Part 6: Restore to stock

You may not be able to install further OTA update unless you switch the slot to previous build and update again, or reinstall stock firmware.

To switch the slot, check your current slot with this command (I assume the current slot is A):

fastboot --set-active=_b

Then reboot your phone and reinstall OTA update.

To reinstall stock firmware, follow the guide on Nokia 7 plus forum:

https://xdaforums.com/nokia-7-plus/how-to/workaround-flashing-oreo-firmware-t3793791

Required service abl/xbl and firehose for Nokia 6.1 and Nokia 7:

https://drive.google.com/open?id=1lN24vWc8edc_i9BINRTyg-bsNpsKfqCs

Extract password is "WLBGFIH123" (without quotes)

Special thanks:

[MENTION=1611492]heineken78[/MENTION] for Sharp Aquos S2 bootloader unlock