[Google Pixel XL Guides, News, & Discussion] alano99:
Potential ideas

If anyone could direct me to any of the details of what is known about how the VZ bootloader on Pixel 1 works I may be able to help. I am a programmer although I have no real experience with phones, other than unlocking/flashing and rooting using various tools with various phones.

I do have an idea that I've gleaned from firmware locking on home automation devices (mostly Chinese HA sensors that are based on the ESP8266 board/chipset that lots of Chinese companies use in their sensors to put their fimware on). A very popular software/method for "unlocking" and flashing these devices is known as Tuya Convert (can't link because I'm a new user but just search Tuya-Convert and look at the github link). It's a very interesting method to me, but it may just because I am fairly ignorant of unlocking and flashing hacks and workarounds. Basically the idea of Tuya Convert is that you copy it onto a device with a wifi chip, usually a raspberry pi zero w or raspberry pi 3 but you could also use a regular PC with a wifi card/chip etc also. When you run Tuya Convert it broadcasts it's own WiFi network with the chip on the device. You then connect a phone or tablet to that wifi network first (the details and reasoning of this part escape me a bit) and after you have done this you then put the HA sensor device that you want to flash in sync mode. Now the beauty is, the Tuya Convert program and wifi network it has made actually intercepts that communication and poses as the authorizing server that the HA device is supposed to connect with and get updates from. So Tuya Convert poses as "home base" so to speak and allows you access to the device, and more importantly, allows you to push/flash your own (usually Tasmota or ESPEasy) firmware onto the device at this point.

Last year, or possibly the year before, companies got wise on this and started to connect in a different way (mostly using https instead of just http) to "home base" but another user was able to write a modification of Tuya Convert that was able to defeat this new https phone home technique and now it has been merged into the original Tuya Convert so now that Tuya Convert uses both methods to flash olders devices and newer ones.

Anyway, without know many details, this method may not work at all for bootloader unlocking in general or for the Pixel VZ in particular, it's just an idea. From reading and trying this myself it seems like the whole idea behind this exploit is to block the comms to VZ or route them different to avoid the base Google firmware from activating the bootloader lock, but I may wrong in my interpretation. If there is anything I can do to help or test or research I would love to try if someone could push or nudge me in the right direction. I think it's ridiculous that we have phones/hardware that we cannot truly do what we want to with, especially so with older hardware that is out of date/support now anyway. I would love to be able to free up so to speak the Pixels that I have and put whatever firmware/OS that I choose to on them; the hardware is amazing on these phones and it is a shame that we are stuck with what we have on it and cannot even downgrade to an older official version even if it works better than new versions (I'm looking at you Android 10 vs 9 and 8 and possibly even 7, at least on the Pixel 1 anyway!)