[Meizu M3 Note Guides, News, & Discussion] 99degree:
Dear all,

Finally have time to write for the unlock bootloader procedure. I found that search engine (internal / external) might mask new thread, thus for those are urgent need to repair or various reason to unlock bootloader, they might not ahve chance to reach helpful info.

[YOUTUBE]

ps6ngeDPiHc

[/YOUTUBE]

[YOUTUBE]

_9LwOmmF0_s

[/YOUTUBE]

[YOUTUBE]

Gsn8FynWxaU

[/YOUTUBE]

Here are extracted procedure from another thread of mine. Eventually I will remove all unlock bootloader info from the original thread and leave them here.

unlock bootloader manually may apply to many other MT6755 or similar soc can unlock by this way.

~~ YOUR OWN RISK ~~ ~~ YOUR OWN RISK ~~

developemtnt (uncrack procedure) detail is in below.

https://xdaforums.com/m3-note/how-to/m3-note-ported-kernel-source-twrp-3-3-0-t3956911

_AND_

https://github.com/99degree/android_kernel_m3note/tree/m3note_20190813

== Procedure ==

to unlock bootloader, generally the lk have a magic frp partition for security. Either for google suite use, or lk unlock bootloader use. In short, the last dword set to 1 will unlock the bootloader. So you dont have to had a very unfriendly (and possibly not working) tool installed.

if you wanted to know more about the lk and unlock magic, here are the URL, so the myth above can clear. https://github.com/mbskykill/m3note_android_bootable.git

There is a need to check the lk.bin before hand, since unlock bootloader involve "fastboot oem unlock" cmd. so do binary search and see if the string pattern "oem unlock" is appear in the lk.bin itself. if yes, it is likely the lk is capable to unlock. if not, the vendor disable it completely by the source code on purpose. please check the third video for detail idea. one example is m3note intl version, lk does not have "oem unlock", and "boot" cmd is comment out by purpose. that's why the need to install chn version of lk from chn rom that those logic are still available (see some success case is install chn beta rom).

Here are steps to unlock the bootloader.

===YOUR OWN RISK===

(a) make sure lower version (flyme5 ? ) installed

(b) install kingroot(or flyme root, it wont limited to flyme5) to get root

(c) install partitions backup (or other tool)

(d) backup frp partition (need root)

(e) edit with hex tool (hex editor for e.g.)

(f) locate last dword, write 1, save file, write back to frp

(g) reboot and install newer (6.3.0.3A) Chinese version of the rom

(h) optional, step g might fail due to chn/intl (G->A)rom different serial number below script to crack the barrier

http://forum.flymeos.com/thread-38493-1-1.html

(Updated 20191024)

(I)in fastboot mode, do fastboot.exe oem unlock

To garentee the phone is unlocked.

(J)do fastboot boot m3note.img and gets in twrp, format data partition

special notice in step e, the frp modification is shown and highlight clearly in video2 part2, same info is available at first video in 3:39s so please take a look. as well.

special notice in step J, if not doing so, m3note deadloop no matter press any button except power on/off. so in case this case happened, unplug the usb cable and leave it to use up the internal battery power. then vol-down + power button can revive the fastboot env.

then the M3 note is unlocked. please note step h running the said script might have draw back (wipe too much data) such as loss of CDMA MEID (Mobile Equipment Identifier) so do as of

~~ YOUR OWN RISK ~~ ~~ YOUR OWN RISK ~~

technical detail of unlock logic is as below

sec_unlock.c

fastboot_get_unlock_perm {

...

index = partition_get_index(FRP_NAME);

...

size = partition_get_size(index);

unlock_allowed_flag_offset = size - sizeof(unsigned int);

...

}

ok, sizeof(unsigned int) is dword. the offset is (size-1 * dword). so set to 1 means unlock.

Other unlock tutorials:

Meizu E3 bootloader unlock tutorial