yashsingh1/xdaforums huggingface dataset:
[Google Pixel 3 Questions & Answers] FernBch:
So, it seems this is running the same course as my attempt a couple years back. During setup the phone "phones home" to Google. Based on what carrier restrictions are in place 2 conditions must be met to enable the unlock toggle in developer options, one of them being "is carrier unlock allowed". Since an unlock token is generated if both conditions are met that process cannot be beaten. The only other way would be to find a root exploit, or more than one that could be combined to allow one to either take control of the unlock service or the kernel directly. Bypassing the token would be the only way.
[Google Pixel 3 Questions & Answers] stevenetphone:
I have the Google pixel 3 I got for free from airetalkwireless.com but the carrier network is unlocked just not the OEM unlock options it's greyed out is there a way to do it with hex editor I called TMobile because it has a TMobile file in it but yet it works with qlink Wireless because I switched the service cause ** has slow internet they said I had to get a hold of ** wireless and they would have to call TMobile to confirm it anyway to do it with hex editor
[Google Pixel 3 Questions & Answers] dcarvil:
google " imei checker" , then do an imei search to determine if it is a Verizon phone or a T-Mobile phone. If it is a Verizon phone, you cannot unlock the bootloader. If it is a T-Mobile phone, you should be able to unlock it without resorting to a hex editor.

Carrier unlock and OEM unlock out are two different things. Carrier unlock does not mean it can be OEM unlocked.
[Google Pixel 3 Questions & Answers] stevenetphone:
Yeah warranty is expired and it's Verizon I just have a different sim card in it and works just not OEM unlock I seen something on here that they unlocked it but if they did mabey it's patched by now idk can I downgrade with a ota and downgrade the system that way and try it?
[Google Pixel 3 Questions & Answers] FernBch:
You cannot downgrade via OTA. One of the security protections of Android blocks that.
[Google Pixel 3 Questions & Answers] t3chg33k:
I never had a Pixel device before so purchased a refurbished one locally as a secondary phone for about $120. The device is spotless, though it is OEM locked and disabled, with no eSIM support.

Unfortunately, the seller only replaces and doesn't refund, but he also confirmed that all the refurbished Pixel devices are received with OEM unlock disabled. It doesn't turn up as an operator variant either on IMEI.info, so just seems to be how the devices are refurbished.

Bit of a shame that it cannot be unlocked but at least it has recent-ish software with much better camera and software than what I would have got from an equivalent Redmi device.
[Google Pixel 3 Questions & Answers] minhat0601:
sorry because i not well in English. I see below your comment someone helped you get the apk file you need. Can you tell me if you can unlock that apk file your way?

Sorry but can I know the status of your project? Sorry because my not well English.
[Google Pixel 3 Questions & Answers] TechnoHT:
I don't know if you still researching on this, but I asked my friend and got a few things:

+ The number of locks on bootloader indicate the boot chain locks of the devices: ROM Code ( most likely the Titan M chip ) - Hardware Interface Code - First Stage Bootloader - Second Stage Bootloader, any locks triggered on the boot chain basically prevents you from booting custom code, if you have to unlock it then it must be all of them at 0 (not tested fully)

+ As for the slot changing state, I believe the citadel reset triggered the wipe of the key on its current slot, it fails to boot and undoubtly switch to the other one?

+ RMA command *can be used to unlock the bootloader*, however the catch is it require an argument that seem to be the key that used to sign the bootloader.

+ The Titan M chip play an important role as its contains and verify all the low-level cryptographics key, by staging the ROM file and replace components with custom boot code, then you can boot any image signed with it. But I guess the only way to do that is obtain its source code.
[Google Pixel 3 Questions & Answers] eyoome:
Hi,

Hugely interested too here, please, don't give up :cheer:
[Google Pixel 3 Questions & Answers] DragonFire1024:
thought this OEM command might be useful regarding RMA.doesn't work on bootloader though.

$ fastboot oem sha1sum
(bootloader) Usage:
(bootloader) sha1sum <partition-name>
(bootloader) sha1sum <partition-name> <size-in-bytes>
(bootloader) sha1sum <partition-name> <offset-in-bytes> <size-in-bytes>
FAILED (remote: '')
fastboot: error: Command failed

$ fastboot oem sha1sum bootloader_a
FAILED (remote: 'Not allowed to sha1sum the partition bootloader_a (bootloade')
fastboot: error: Command failed

$ fastboot oem sha1sum boot
(bootloader) Hash: partition=boot_a size=0x04000000 offset=0x00000000
(bootloader) sha1sum:
(bootloader) 5B5CAB6978781902D1F12B9C98E0664572722B12
OKAY [ 0.222s]
Finished. Total time: 0.222s

Well at least we know we can definitely flash the Titan chip if that helps any. i did that successfully.
[Google Pixel 3 Questions & Answers] DragonFire1024:
one more thing. If you reset citadel, the bootloader goes from 1 (locked) to 0 (unlocked) this will persist until device reboots. this is where i think our door might exist for the titan flashing. if that 0 really does mean unlocked, that might be all we need and modifying its firmware might already be allowed and flashable after editing. this may actually be the only reason i was able to flash the chip in the first place.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
While I'm not a total noob at this sort of stuff I'm going to are you suggesting to modify the titan m chips firmware as to allow it to undo all of the locks?
[Google Pixel 3 Questions & Answers] DragonFire1024:
Something to that effect. From what I've been able to gather, the firmware is totally writable. So I'm assuming to some extent there are no checks and balances going on in some parts of that area. What we really need to do is actually modify a firmware file and attempt to flash it and see what happens. I would imagine if anything got screwed up flashing the right firmware files would suffice but I haven't gone that far.

I have also recently acquired a Dell Chromebook 11. I am going to attempt to build and install chromium on it. I have been experimenting over the last week with flashing custom operating systems and bios to the device in order to get various forms of operating systems to boot on it and see how well I do or screw up. So far I have been able to install ChromeOS Flex, Ubuntu 22 and Android x86 as well as being able to go back to stock on several occasions even if I didn't have to. I will have much better luck using the tools in a chromium operating system than trying to get standalone tools to work on Linux alone. Which despite the abilities of being able to flash firmware files to the device, I lack the ability to use much of the other tools just because they simply will not work. It also has answered a few question as to what I have been seeing. For example I'm almost positive that disabling right protection, which is something I had only mentioned a few times in the past, probably would not be possible on these devices. For example removing right protection from a Chromebook involves removing a screw from the motherboard. Though it is quite possible these devices may have a right protection screw in them, I am more willing to break a device that I may have a better possibility of fixing down the road than opening one up and never being able to put it back together again. So I must admit with my experience and devices that doesn't happen too often.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
Got it. I'll be looking forward to hearing any news. If there's anything I could do to help possibly let me know.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
Also if I'm not mistaken when you say chromium operating system wouldn't that apply to forks such as FydeOS and older Cloudready OS instances?
[Google Pixel 3 Questions & Answers] t3chg33k:
I had tried a custom GSI as well resulting in the "corrupt" boot message that doesn't go away with a reset or reinstall. Are you aware as to how this can be reset so that the message is not visible at boot?
[Google Pixel 3 Questions & Answers] DragonFire1024:
I'm not sure. I going to go out on a limb and say they will vary from OS variety to OS variety much like Ubuntu does with Linux and other platforms. For example Ubuntu will only get me so far no matter how good I am at tweaking various packages and tools to get them to work properly. Some of the tools and software needed to get deeper into the phone just simply won't work on Ubuntu and are only designed to work on chromium based operating systems.
[Google Pixel 3 Questions & Answers] DragonFire1024:
As far as I know the only way to fix it is to use 'Android flash tool' which is an online service provided by Google to help people restore or repair software damages on their pixel devices. It is the only thing I know that works. The reason why flashing the Verizon stock firmware back to your device is because Verizon simply doesn't flash those partitions because when restoring the system and related items only, they aren't normally required. Theoretically speaking, those parts of the device and partitions shouldn't have been affected because these devices are locked. The reason why I'm happy that you experienced this, by the way this doesn't actually do any damage to your phone whatsoever nor does it do any damage to the software existing on it. But if you've ever had a Motorola phone or similar devices, when it's bootloader unlocked you would be presented with a warning every time you rebooted your device. In part this morning is a good because it tells us that there was an image flashed to the device that wasn't signed by any official keys and bypassed the restrictions we have in fastboot because the devices are locked or are at least supposed to be. So something is going on in that area of the phone that allows a VB meta image to be flashed to the device, though unsuccessfully. But the reason why the Android flash tool will be the only thing that works is because those images are signed by Google and their official keys and literally every partition and file required to possibly restore a device that's not hardware damaged are flashed to it. The downside is you lose all data on everything else on your phone in the process. Just Google search Android flash tool and it should be one of the first options that appear
[Google Pixel 3 Questions & Answers] t3chg33k:
I did try it at some point as well but it always checks for an unlocked bootloader and fails.

View attachment 5784311
[Google Pixel 3 Questions & Answers] DragonFire1024:
If there is the ability to still do so you need to sign up for the beta program which if I'm not mistaken would throw you right in Android 13. That is how I managed to put mine on 12 before it was available to the public. You also won't be able to downgrade again you will be stuck on the current version of the release. You won't be able to flash any other version unless it's newer and approved.
[Google Pixel 3 Questions & Answers] t3chg33k:
Oh yeah, had tried that too. Pixel 3 is no longer listed as an eligible device for the beta program, so guess there is no other option to actually fully reset the device.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
I would assume if archive.org had archived it at the time you could theoretically flash the beta from there? Although you have a newer version on the device so I'm not sure.
[Google Pixel 3 Questions & Answers] t3chg33k:
The problem is that there is no way to reflash all the partitions. The web and offline tools require an unlocked bootloader. Even if I were to get the beta image, at most I may be able to sideload it via adb, which again will do nothing to remove the error message on boot.
[Google Pixel 3 Questions & Answers] DragonFire1024:
here you go. found it randomly looking through bookmarks. this will restore any pixel phone. https://pixelrepair.withgoogle.com/carrier_selection
[Google Pixel 3 Questions & Answers] DragonFire1024:
Also note that you can choose whatever carrier. Though it doesn't seem to have an effect on much of anything. So I chose the "others" option. I did a quick refresh on mine and chose that option then proceeded to look at the props. At least the one good thing about it is it seemed to have wiped any history of the phone being connected to Verizon. There are a bunch of props that I don't recall seeing before. But it still doesn't allow for OEM unlock though I didn't have enough time to experiment further with that.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
This sounds like a really good development seeing the old Verizon Pixel 2 bootloader unlock trick was also partially related to the phone knowing it was on Verizon maybe...
[Google Pixel 3 Questions & Answers] DragonFire1024:
Well as I said I didn't have time to play around with it aside from bypassing all the logins and connections to the internet. And as far as I remember though I didn't check, I didn't have a SIM card in it either. But I did a thorough check of the props and there wasn't a single mention of Verizon and a few other props that I should have seen that either I missed or I didn't see. But I am actually surprised somewhat because it technically shouldn't have flashed anything but the Verizon variant of the stock firmware. If what you say is true then I guess I'll have to go back and look at previous steps to try and ungray the OEM unlock
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
I'm actually considering resetting my phone and attempting this soon if it works I'll report back here. NGL I find it funny it seems like there is a possibility to do it with official tools. (ADB and the repair site) IIRC the method to make it reset on the og Verizon Pixel 2 was to fully reset skip connecting to the internet use adb to uninstall the phone app (because it's used for checkin) connect to WiFi and then use chrome for a bit (to give it time to talk I would assume not much detail for the method was given there) and then the option would appear. And also after the bootloader unlock and reset the "client=" string the in URL field for Google search no longer references Verizon either.
[Google Pixel 3 Questions & Answers] t3chg33k:
Had tried it earlier and while my phone was detected, nothing happened and it always timed out. Then I manually ran the command 'adb rescue install blueline....zip' in rescue mode to install the latest OTA file. That worked in terms of installing the update with the proper splash screen on the phone, but the 'corrupt phone' message is still there.

Thereafter, the phone is now detected on the pixelrepair website, but it is unable to do anything with the latest software version.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
How in the world did you get a newer software version than Google has?
[Google Pixel 3 Questions & Answers] DragonFire1024:
Wow even I don't have that version mine is everything the same except for the very end I believe it says C1. So I guess it would depend on what he selected as his phone carrier before installing the update. I would presume that based on whatever carrier you choose either have the more updated version or an outdated version depending on whether or not they actually throw out their own versions.

So far in regards to reply about uninstalling the application, I have gotten as far as skipping all the sign in and not even connecting to wi-fi. However I was experimenting with some old OEM commands that I had found online and I don't recall which one had done it or why but after running the command I noticed that airplane mode was turned on. I don't know if that has any significance at all but I found it interesting nonetheless.

I've studied a bit more on looking into possibly modifying the firmware file for Titan M. In theory this could potentially work but we would have to do some experimentation and probably a bit of searching for the firmware itself. And come across a couple of study projects that found a couple of vulnerabilities inside the chip which allowed for code execution. But it also allowed pretty much any version of firmware to install an override any of the save firmware on the chip in order to become a permanent install so to speak. So theoretically editing the firmware code or binary file to unlock these locks could work. I would imagine it would be a matter of properly unpacking and repacking the file so it flashes correctly. Based on Google's source code for all intense purposes this should work. In posts a further back, you would have to take a look, I already experimented with downgrading the firmware on the Titan chip and was successful at doing so. It's a matter of just finding the right firmware version inside the folders of the ota's or factory images. Not all of them have the firmware packed in the proper directories or at all.
[Google Pixel 3 Questions & Answers] DragonFire1024:
Well I'm not surprised in this case that the corrupted screen still remains. Because you probably didn't choose Verizon as being the carrier for flashing firmware the VB image is probably different therefore the the corrupted device splash screen Still remains. You would have to experiment with other carriers and see if it will work in flashing or downgrading the firmware version. But if I were you if you got off of Verizon I would stay away from it. If you can deal with the splash screen you're better off not changing it back to them.
[Google Pixel 3 Questions & Answers] DragonFire1024:
Using the Pixel repair tool from Google (i didn't need to repair anything), I was able to flash new firmware to my Pixel 3. I chose the "other USA" as the carrier instead of choosing Verizon. The app you mention, does not exist on this firmware. I tried searching for ir using "pm list packages" in a shell, searched for OTA, pre, config and zero, and nothing was listed that matched. Secondly, I was actually very surprised the tool flashed different firmware that wasn't verizon. I haven't decided if this is good or bad yet. After it updated, I skipped the signin process, didn't connect to WiFi and I took the sim card out way before I used the tool. Thirdly, there is not a single mention of "verizon" when searching the props using getprop in a shell. Getprop also didn't show some of the props I was accustomed to seeing for a verizon phone, including some props mentioned in previous threads, that some were convinced had something to do with the OEM lock. However I can confirm it is still grayed out, but i have not yet connected it to the internet or attached an account.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
Wouldn't the only way of knowing if it made the bootloader unlockable be connecting it to the network IIRC that's when it checks.
[Google Pixel 3 Questions & Answers] Bluedragon Hacks:
Well now that I reread this I'm thinking about what would happen if we packet logged the response for a Google model Pixel 3 and spoofed it to get that response (I'm sure that it has other safety functions to stop it)
[Google Pixel 3 Questions & Answers] t3chg33k:
This is the last release from June 2022 that has to be sideloaded. I updated it so as it has VoLTE support for roaming which is quite useful for me. Guess the repair tool was never updated to the last release.
[Google Pixel 3 Questions & Answers] NANDO1413:
how does unsamlock/sampwn work? any possibility of something similar for verizon pixel?

PSA: Unlock Bootloader on Snapdragon Galaxy Devices with SamPWND (Paid Service)

SamPWND is a paid remote service that allows you to unlock the bootloader on Snapdragon Samsung Galaxy devices sold in the USA and Canada.

www.thecustomdroid.com
[Google Pixel 3 Questions & Answers] Bluedragon2008:
I remember hearing that there was also a group that could unlock Verizon pixels when paid seems similar although I don't know the technicalitys of it I do know people do it.
[Google Pixel 3 Questions & Answers] fuegoroderick:
Is there any update for this issue?
[Google Pixel 3 Questions & Answers] Bluedragon2008:
As far as I'm aware there hadn't been any progress. I would be experimenting myself if my pixel 3 wasn't my main phone
[Google Pixel 3 Questions & Answers] DragonFire1024:
ok 2 chromebooks later (I acquired one from a friend at no charge after it suddenly died on him and i managed to fix it...long story short) i have been able to gather some more info.

On the Dell Chromebook 5190, in order to achieve full developer mode, you have to disable certain write-protected areas like software and hardware. On older models it is just a matter of removing a screw if one exists, and running a few commands in a root shell. On newer chromebooks, like mine, it requires a bit more time and a piece of hardware. Now you might be thinking how this is relevant...in order to fully disable write protection on the chromebook you MUST have a suzyq cable.

The pixel 3 have or in some way uses the embedded controller (EC) and there exists an ec.bin in some of the factory images for the Pixel 3xl that you can flash to our pixel 3 (I don't have a link but explained this process and noted i was able to flash the EC on our pixel 3 successfully). On my chromebook, to disable write protect you have to use a feedback loop with your Suzyq cable and run some annoying commands which disable firmware and hardware write protect in developer mode. This allows for modification of the bios to boot any OS you want from windows to linux and android, from a USB stick. If you stay on stock ChromeOS it allows you to modify rootfs (which is like having SU in android) to modify configurations and what not.

So in theory, if the pixel 3 is in the proper state (it's been a while and i will have to reread my work to refresh myself) we could used the embedded controller binary (Flashrom) to either disable the write protection or flash a new ec.bin that does. I have been able to get as far as installing hdctools on my chromebook environment but have struggled to get them working because, and again its been a while, i can't directly recall how to get the phone into the state needed.

The trick is, when it's in the proper mode, running "ls /dev/ttyUSB*" in a root shell will produce the value for available sonnected devices. So far I have not been able to reproduce this on the Pixel 3. I believe the reason for this is the lack of a USB-OTG adapter. On the my chromebook the debugging port is USB-C based and based on the feedback loop you create to turn off write protection, i am surmising you also need a USBC connection with the same loop on the pixel 3. I could be wrong, but i don't think the suzyq cable is capable of this. I think all of this is possible because the titan chip allows for it with relatively little work, once everything works right.
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Sounds like progress! I'll try and get a suzyq cable if I can. If you get this working and explain the method I'll be attempting to make it work on a FydeOS Cloudready or Chrome OS Flex device.