yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] sd_shadow:
List of CIDs

Run getvar cid to see which CID your device has.

fastboot getvar cid

The table below will indicate whether your device is eligible for the bootloader unlock program:

Your device is unlockable if the CID

value returned is:

Your device is NOT eligible for bootloader unlock

if the CID value returned is one of these:

0x0000

0x0003

0x0007

0x0009

0x000B

0x000C

0x000D

0x000E

0x0014

0x0015

0x00DE

0x0032	0x0001

0x0002

0x0004

0x0005

0x0006

0x0008

0x000A

0x000F

0x0010

0x0011

as well as any other not listed on the left

Source

English Community-Lenovo Community
[Upgrading, Modifying and Unlocking] rotorline:
Thanks for the very helpful writeup.

One question tho. I've gotten the email with the unlock code but how do I apply it? I'm assumng ADB?

NM, I reread your first post

fastboot oem unlock UNIQUE_KEY

Thanks again for the info
[Upgrading, Modifying and Unlocking] sd_shadow:
The same way you got the code you gave Motorola

All fastboot commands are used in fastboot or bootloader mode.

fastboot oem unlock UNIQUE_KEY
[Upgrading, Modifying and Unlocking] smartasiankid:
i need help relocking motorola one p30 play bootloader usa variant. please help!
[Upgrading, Modifying and Unlocking] smartasiankid:
i have a motorola one(xt1941-3) and i really need help locking the bootloader :(. whenever i type 'fastboot oem lock' it says it still requires signed boot.img even though im on the latest august security patch(qpks30.54-22-24).
[Upgrading, Modifying and Unlocking] sd_shadow:
Yes, Locking Moto Bootloaders is a mess.

Locking is actually more likely to cause a bricked device than unlocking.

The only advice I can give is the following
[Upgrading, Modifying and Unlocking] smartasiankid:
Idid all that safely till it says "still requires signed boot.img"d
[Upgrading, Modifying and Unlocking] sd_shadow:
Yes, I don't recommend Locking Moto Devices, too many issues.
[Upgrading, Modifying and Unlocking] Afgil:
hello!

is there any chance to remove the "verity mode is set to disabled"?

thank you
[Upgrading, Modifying and Unlocking] Songbird47:
Thank you. Since all I really want to do is restore deleted text pics and data, Is there any other way you might recommend that doesn't require an unlocked bootloader?
[Upgrading, Modifying and Unlocking] Songbird47:
I have also read an article suggested to install TWRP and that the bootloader doesnt have to be unlocked in order to do it. Therefore , enabling root like capabilities. Any thoughts on this?

And another article saying that the Tracfones will unlock after 12 months and 1 day of service?
[Upgrading, Modifying and Unlocking] WoKoschekk:
it's working now?
[Upgrading, Modifying and Unlocking] hydroman202:
Blocked links work fine? Does that mean I can get an unlock code? Just curious
[Upgrading, Modifying and Unlocking] Renate:
No, I mean instead of getting a single line of error text in Times Roman I get a graphic page.
[Upgrading, Modifying and Unlocking] WoKoschekk:
it's not depending on any cookies or what account you use to sign in. I used a newly installed browser and a new account to sign in on motorola.com and was able to receive an unlock code. I used the URL for my Moto G6+.
[Upgrading, Modifying and Unlocking] Renate:
Fine. My point was that if you are not signed in you still get different responses for allowed to unlock and not allowed to unlock.

And besides that, the state of being logged in is obviously stored in cookies since there is no token in the URL.
[Upgrading, Modifying and Unlocking] hydroman202:
I've heard of someone getting a bootloader unlock code through Motorola's cust.help domain. Using their international service. Although I don't know how to access it....
[Upgrading, Modifying and Unlocking] jiraianam:
I try this method in Motorola edge plus UW 5g Verizon unlocked and I receive a email with unique key AAAAAAAAAAAAAAAAAAAA

My mailbox was full I do not receive the first email, I think it not work for me or maybe the unique key just is give one time in the life. I do not receive the first email now all unlocked unique key to come with me is AAAAAAAAAAAAAAAAAAAA

Can you check it again for see if you require two times this code they send AAAAAAAAAAAAAAAAAAAA for all devices, thanks
[Upgrading, Modifying and Unlocking] WoKoschekk:
you can request it as many times as you want and it's always the same key
[Upgrading, Modifying and Unlocking] WoKoschekk:
you send your unique string (represents IMEI and some other unique IDs of your device taken from the partition /cid) and it gets converted to the key. I assume by a hash algorithm developed by Motorola.
[Upgrading, Modifying and Unlocking] hydroman202:
3A95350809976720#5A59333233564E573732006D6F746F2067280000#7283560CE39A487E2FD3BAD884B55B430D89EFA6#A857F635000000000000000000000000

Still trying to get unlock code for bootloader. Anyone have any ideas?
[Upgrading, Modifying and Unlocking] Jaguar_90:
what to do in case your cid is unlockable (0x0032) but the site keeps saying "your device does not qualify"?

my device is not carrier locked, and as you can see , the cid shows it can be unlocked...

it is manufactured in argentina, dont know if someone did unlock one from here
[Upgrading, Modifying and Unlocking] hydroman202:
If you can post your “get_unlock_data” string I’ll see if I can help
[Upgrading, Modifying and Unlocking] Jaguar_90:
here it is: 3A85252241086284#5A593232484635355432006D6F746F2067330000#F735696ADC78E940EC6EEE149673655F7BC5D11ACFF42727DDAB9226752286F2#2638AE3F001B80E10000000000000000

i already tried the "line 1 , 4 and 3" thing, and the uk, but no luck
[Upgrading, Modifying and Unlocking] Renate:
FWIW, your data is not like the other data.

The other data is 16#40#40#32

You are 16#40#64#32
[Upgrading, Modifying and Unlocking] Jaguar_90:
well, i noted that it has more characters, but, i didnt think that it should be a problem
[Upgrading, Modifying and Unlocking] Renate:
I have no idea. I was only noting it.
[Upgrading, Modifying and Unlocking] Jaguar_90:
i had my theory that the problem is that my device was assembled two months ago
[Upgrading, Modifying and Unlocking] Renate:
Probably Motorola is upping their game.
[Upgrading, Modifying and Unlocking] sd_shadow:
I don't think the cid has been a reliable way to determine if the bootloader can be unlocked for a few years now, and should be used as a general reference and not an absolute.

Many people have posted similar problems, sometimes it's the moto unlocksite being weird.

Other times I think it's when a carrier buys stock retail models from Motorola and Motorola is asked to block unlocking the bootloader.

The getvar all (remove the imei before posting) may have some clues in it.

fastboot getvar all
[Upgrading, Modifying and Unlocking] WoKoschekk:
cid = 0x0032 means:

This build is customer signed.

Use "fastboot getvar cid" to confirm customer ID on secure HW.

Value must be 0 (developer HW) or match this value:

Retail => 50
RetailLocked => 51

For signed build support, please see:

motorola/security/certs/README.txt

found in: /oem/etc/oem_sign_info

0x0032 (hex) => 50 (dec)
[Upgrading, Modifying and Unlocking] Renate:
I've done a bit of sleuthing of Motorola Firehose loaders.

I forget whether it was CID==0x00 or CID ==0xff that would bypass partition restrictions in the Firehose loader.

In any case, I believe that where the CID is stored is cryptologically signed.
[Upgrading, Modifying and Unlocking] Jaguar_90:
i dont know exactly what can i do with this info, but it keeps looking like the device should be unlockable
[Upgrading, Modifying and Unlocking] Renate:
borneo:/ $ getprop|grep cid
[ro.boot.hab.cid]: [50]

That's mine, it's full-priced, non-subsidized, unlocked.
[Upgrading, Modifying and Unlocking] Jaguar_90:
so why the site doest want to give me the code :C
[Upgrading, Modifying and Unlocking] WoKoschekk:
the complete string (that needs to get pasted on Moto's website for receiving the unlock code) can be found on partition /cid which is cryptologically signed (see attachment).

my string:

C:\ADB_Fastboot>fastboot oem get_unlock_data
(bootloader) Unlock data:
(bootloader) 3A15580429801173#5A593332325638
(bootloader) 4B3238006D6F746F2067280000#262D
(bootloader) 78B2328BB19B95A3A9BD50F964A0C14
(bootloader) 8962E#BFF0F7E200000000000000000
(bootloader) 0000000

on the corresponding cid.img:

0x2E (8 Byte) # 0x38 (20 Byte) # 0x4E (20 Byte) # 0x08 (16 Byte)

maybe the CID can be found at 0x2A??
[Upgrading, Modifying and Unlocking] WoKoschekk:
I do understand that RetailLocked = carrier locked like Verizon phones or others.
[Upgrading, Modifying and Unlocking] Renate:
Isn't it only one byte @ 0x2b?
[Upgrading, Modifying and Unlocking] WoKoschekk:
output is 0x0032 and not 0x32
[Upgrading, Modifying and Unlocking] Jaguar_90:
so im seeing that mine is only "Retail" and no "RetailLocked".

in the motorola comunity they answer me that my device should be unlockable, and they were checking if it was a server or data base error
[Upgrading, Modifying and Unlocking] WoKoschekk:
yes, but cid 0x0032 doesn't solely determine whether it's unlockable or not.
[Upgrading, Modifying and Unlocking] hydroman202:
What countries does Motorola support bootloader unlocking in besides us and uk?
[Upgrading, Modifying and Unlocking] RvnSRvNs:
please please help! Moto G Stylus 5G 2022

(bootloader) Unlock data:

(bootloader) 3A55917511773002#5A593232475A4C

(bootloader) 4D4432006D6F746F2067200000#9943

(bootloader) 80F516381D8F1C2733B1F00889B1E5D

(bootloader) E9801B7E2C4FE9E382ED67A5579C3#7

(bootloader) E2272A9000000000000000000000000
[Upgrading, Modifying and Unlocking] awme:
my cid is

(bootloader) cid: 0x0002

so is it unlockable?

here the unlock data -

fastboot oem get_unlock_data

(bootloader) 9900052825628760#5A583146323453

(bootloader) 5A484300585431323534000000#2608

(bootloader) 0AC9B1CFD59BA7CD5EDB6DB01777C3F

(bootloader) E4184#6E10990111000000000000000

(bootloader) 0000000

i have tried both sites us and uk, but no luck :<
[Upgrading, Modifying and Unlocking] sd_shadow:
No,

Your device is NOT eligible for bootloader unlock

if the CID value returned is one of these:

0x0001

0x0002

0x0004

0x0005

0x0006

0x0008

0x000A

0x000F

0x0010

0x0011

List of CIDs

Same
[Upgrading, Modifying and Unlocking] hydroman202:
Yeah even if you force the unlock button to appear and request the key it will just show an error of “there’s nothing here”. Could be there really is no code in their system for unqualified devices.
[Upgrading, Modifying and Unlocking] xdaxd1996:
Hello, I unlocked the bootloader of my motorola edge 40 neo (to use magisk) after a few days I decided to relock my bootloader again with the fastboot oem lock command, a confirmation message appeared on the screen. I select yes and did a wipe (all this after doing a rescue with rsa software that ended without problems) but when trying to do the rescue with the bootloader closed in rsa I get a message that says "The connected device does not match the shipping software values expected and Rescue cannot be run". I unlocked the bootloader again and rsa allows me to do the rescue but when I close the bootaloder again it comes back and I get the error. The phone works normally without problems but i would to know how can I solve it?
[Upgrading, Modifying and Unlocking] BungholeOS-x64:
I've got an XT2271-3 Moto G Play (2023). I tried a naked fastboot oem unlock, which gives me the unlock prompt and everything but when I don't think anything changes when I choose yes and the unlock site's no good for this device. With a 0x0001 cid, is there any hope of unlocking this bootloader?
[Upgrading, Modifying and Unlocking] sd_shadow:
I don’t think so
[Upgrading, Modifying and Unlocking] gorei23:
Hey thanks for keeping this thread up to date.

Does this code have any kind of time element? Or should I just go ahead and request it as soon as I get a Motorola device and therefore ensure I can unlock my phone even if Motorola takes down that site?
[Upgrading, Modifying and Unlocking] sd_shadow:
No time expiration
[Upgrading, Modifying and Unlocking] hydroman202:
XEACLIH4FF2X22ORLFI4
[Upgrading, Modifying and Unlocking] WoKoschekk:
long story short: fastboot oem get_unlock_data = /cid (partition)
[Upgrading, Modifying and Unlocking] WoKoschekk:
@999repeating find attached my unlock_data + unlock code + /cid (as a hexdump)

the unlock code seems to be generated by an algorithm created by Motorola. it's like a SHA checksum that can't get reconverted to its original value. however, you won't be able to recreate that algorithm.
[Upgrading, Modifying and Unlocking] 999repeating:
/cid contains way more information which is why I asked for both.
[Upgrading, Modifying and Unlocking] 999repeating:
Actually that's the thing about hashing. If we know the value (which is in these cases is the key given by Motorola) we can compare it against the hash. The thing that makes this a possibility? It's only ever 20 characters in length, mostly capital letters, most of the time letters are only used once, the digits in the key are always found in the IMEI (frequency of digits is not considered from IMEI), most common is 2 & 4 with the frequency of digits not ever being higher than 5 with the other 15 characters being capital letters, the reason we see a higher frequency of certain letters is because the the first few bytes of the IMEI or MEID are usually the same, either starting with A3xxxxx or 99xxxx which gives us a hint at the digits/letters to use, that's a huge part of the puzzle. There's is no limit to the amount of attempts at submitting the key to your bootloader. A script utilizing a combolist/wordlist could easily brute force this.

Think of it like this, with password hashing you have to know the value of the password+salt because they use salting (random data). This is way easier than that and unhashing passwords is relatively easy and many programs exist to streamline it. They even have websites dedicated to crowd source hashing. That's another route to consider since we ALREADY HAVE the "password(key)" and various hashes. There are way more hashing algorithms than sha256 and if that's all they're using then this is actually feasible.
[Upgrading, Modifying and Unlocking] 999repeating:
I already had that unlock data/key I scraped from this thread but I definitely needed that /cid

Thank you for that.

I'll go hunt for more, the only reason this needs to be aggregated is because the /cid partition is unique to each device and with a large enough dataset, I can guarantee we will discover some valuable insights.
[Upgrading, Modifying and Unlocking] WoKoschekk:
here are two more cid images.

structure of /cid:

hex address (lenght in byte) - description

0x00 (2 byte) - partition identifier "00 F0"

0x02 (2 byte) - partition block lenght in hex value "00 01" (little endian, start reading from end to beginning)

=> hex value 100 = dec value 256 blocks a 512B = 128kB

0x04 (4 byte) - unknown parameter, but is always "00 00 00 62"

0x08 (4 byte) - seems to be a CRC32 checksum for ???

0x12 (31 byte) - alway "00"

0x2B (1 byte) - always "32", maybe check digest for CRC variant EDIT: cid_moto_g.img has value "07"

0x2C - always "00"

0x2E (52 byte) - output of "fastboot oem get_unlock_data"

0x62 (161 byte) - unknown value

0x103 - root certification

that's all and the only interesting part is at 0x62 because I don't know what it is.

the unlock code is a digest genaerated by an algorithm. it's very similar to the one that Android uses for creating the APK folder for each app. see my com.whatsapp folder in /data/app for example:

com.whatsapp-5pC68EhDDmGtiZx9x-iVVg==

that digest is created by using the timestamp of the installation. but I don't know what checksum variant it is. all common checksums using hex values and not alphanumeric characters from A-Z and 0-9.
[Upgrading, Modifying and Unlocking] 999repeating:
I think it's a checksum converted to base64 or ASCII or something along those lines. I ought to correct my first post because it's not generating the key that's feasible. It's brute forcing it with a dictionary script. Although I do think once we have more data of the complete pieces of the puzzle, we will begin to see patterns and better understand how the key value is constructed.
[Upgrading, Modifying and Unlocking] WoKoschekk:
maybe... but which checksum? the entire output of get_unlock_data? or a part of /cid?
[Upgrading, Modifying and Unlocking] WoKoschekk:
the unlock codes for the cid images:

cid_g6 : XHH7DRHHBMCPP2VLK72D

cid_moto_g: FAMU3WTI5YFMYYMP2DPD
[Upgrading, Modifying and Unlocking] WoKoschekk:
to keep it easy, here are the output strings

cid_moto_g:

3A45890045927482#5441383833303257384600585431303332000000#D20BD55B8E975758DF1DC3C87A2E229A727A0DDF#CBCBBA010F0000000000000000000000

cid_g6:

3A15680519336885#5A593332325053434B57006D6F746F2067280000#1DB3461D3CA6920226B980FC18250D79B2399EC4#0ADACA62000000000000000000000000
[Upgrading, Modifying and Unlocking] 999repeating:
So that's yet to be determined. I honestly think it's verified against the bootloader hash which we believe is Sha-256. Essentially is looking more like the unlock string received by Motorola is actually the password used to generate the hash and not the other way around. This is solvable, but let's be honest the best route here is to craft a script with logic that uses a word list. The wordlist should be generated with rules omitting 0 & 1 and limiting digits to a maximum of 5 character spaces, the rest being capital letters ranging from A-Z but not all letters in the alphabet have to be used with a maximum frequency of each letter being 0-3, the script should also consider the devices IMEI for digit selection.
[Upgrading, Modifying and Unlocking] WoKoschekk:
good luck! ;)
[Upgrading, Modifying and Unlocking] WoKoschekk:
btw: base64 uses also "/" and "=" and some other special characters

ASCII would mean you need a very limited set of hex characters to get A-Z and 0-9
[Upgrading, Modifying and Unlocking] 999repeating:
Yeah I haven't even actually given it any real analysis. My first endeavor is the script. Since the bootloader returns a "verification error" when the incorrect unlock string is entered, all that needs to happen is to stop the script and record the value that didn't return the error, this can all be done autonomously when the correct logic is applied.
[Upgrading, Modifying and Unlocking] 999repeating:
Even with the format I have, its still (26+6)^20. Its a huge number. A wordlist isnt feasible but I'm going to try to use the logic that built the wordlist to try each one individually. This might take a few days. If I had multiple devices I could potentially run multiple threads. Either way I'll wait until this device isn't my daily driver to begin this. I'm making progress nonetheless, albeit slowly.

Actually my first step would be to attempt to truncate the strings to only use the strings favoring 2, 4 &5 for older devices and 4,6,7 for newer devices. It's a pattern I recognized, from the ancient unlock keys I still had compared to the 2021+ devices. While it's not always the case, it was more common than not the newer keys favored those digits indicating Motorola is selecting from a generated list JUST LIKE THIS in some order. I mean.. I could be wrong but it's worth exploring. The size of the list explains how they keep each key unique to each device.

To capture a correct unlock code may be more simple than I originally thought as a correct unlock code hangs the shell until you respond with a key press. The same way no unlock code prints the Bootloader unlock warranty explanation. It's reasoned it does that so the people who have to service these things can test that function without having the key. However if you issue any string 20 characters in length it will return a verification error suggesting that the correct unlock code will prompt like normal allowing me to capture the correct issued string and only log that particular Shell call.
[Upgrading, Modifying and Unlocking] Jaguar_90:
A comunity manager in lenovo site already gave the code. I have bl already unlocked.

Thank you anyways.
[Upgrading, Modifying and Unlocking] Rexkh:
Hi Dear All

I have tried to use the site for 2 motorola phones to get unlock code. The site said that an email will be sent to my email address with unlock code but I received nothing. Is the site broken? Can anyone try?
[Upgrading, Modifying and Unlocking] sd_shadow:
Moto site is very flaky.

Try using a different email address, or post your bootloader code here, and one of us can try it.
[Upgrading, Modifying and Unlocking] Rexkh:
Yes please

[Code Removed]
[Upgrading, Modifying and Unlocking] sd_shadow:
Edited
[Upgrading, Modifying and Unlocking] Rexkh:
It works. Thank you.

Did you use gmail with Motorola US site, right?

Can you get last one please?

[Code Removed]
[Upgrading, Modifying and Unlocking] hydroman202:
3A95350809976720#5A59333233564E573732006D6F746F2067280000#7283560CE39A487E2FD3BAD884B55B430D89EFA6#A857F635000000000000000000000000 i need unlock code too
[Upgrading, Modifying and Unlocking] sd_shadow:
Edit: Yes Gmail
[Upgrading, Modifying and Unlocking] sd_shadow:
Sorry,
[Upgrading, Modifying and Unlocking] Rexkh:
I got the code. You deserved 2 Like. Thank you

If it doesn't disturb you, please censor the unlock code from your post.
[Upgrading, Modifying and Unlocking] TraderJack:
Hey all. I've got an older spare G6 that I am handing off to my daughter. Would love to be able to unlock it, but looks like I'm probably out of luck. I found this thread and rather then waste a bunch of time on it figure I would come here and ask.

It looks like I am out of luck it is a Tracfone model with CID 0x000F which from what I can tell is not unlockable, but that info is several years old. Is there any newer way to get around this, or the situation is still the same?

thanks.
[Upgrading, Modifying and Unlocking] andreexw:
Por favor me ajude, o site diz que meu dispositivo não está qualificado. A url que estou usando é esta:

Page Not Found | Motorola Support US

Visit the customer support page to view user guides, FAQs, bluetooth pairing, software downloads, drivers, tutorials and to get repair and contact us information.

en-us.support.motorola.com
[Upgrading, Modifying and Unlocking] sd_shadow:
Bootloader unlocking nothing has changed.

If you mean carrier unlock see this

Pardon Our Interruption
[Upgrading, Modifying and Unlocking] sd_shadow:
Looks like your info is incomplete?

What is the full code from bootloader?

4. Use the English language.

We understand that with all the different nationalities, not everyone speaks English well, but please try. If you're really unable to post in English, use an online translator. You're free to include your original message in your own language, below the English translation. (This rule covers your posts, profile entries and signature). You could try :- https://translate.google.com/ , https://www.babelfish.com/ or https://fanyi.baidu.com/#auto/en or use one of your choice.
[Upgrading, Modifying and Unlocking] andreexw:
thank you for your attention. here is the bootloader code:

3A85856142898481#5A46353233364E444844006D6F746F2067280000#FE374C35FC96261ECC217CFB4BFA5A61F8891F20#0C490D80000000000000000000000000
[Upgrading, Modifying and Unlocking] sd_shadow:
Here is the unique code to unlock the bootloader of your Motorola phone.

Unlock Code: 4HSNQEMOQ6XBO62SGHYQ

Please follow the instructions here to unlock your bootloader.

Good Luck!
[Upgrading, Modifying and Unlocking] TricolorHen061:
Can you please do mine? I've tried the "special" link on page 6 of this forum, but that didn't work. I also tried the gb site like someone else posted, but that just redirects to the US one. Here's my info:

```

(bootloader) Unlock data:

(bootloader) 3A95350809472022#

(bootloader) 5A59333233564A53394A006D6F746F2067280000#

(bootloader) 5A098D0C28BE21DE8BDF9EA92F727DBD8A57F650#

(bootloader) 5242D31B000000000000000000000000

```
[Upgrading, Modifying and Unlocking] sd_shadow:
Your device does not qualify for bootloader unlocking.
[Upgrading, Modifying and Unlocking] TricolorHen061:
Thanks for trying