yashsingh1/xdaforums huggingface dataset:
[Google Pixel 3 Questions & Answers] rolandNW:
I tested the sim unlock on a Pixel 3a and it does seem that the code to enable the OEM unlocking feature is in the com.google.android.apps.work.oobconfig package.

If you remove sim, do a factory reset, connect to internet, swipe down the notification bar and follow the complete phone setup instructions, it will change the toggle switch description from 'connect to internet or contact your carrier' to 'carrier does not support oem unlocking' (going from memory here - may not be verbatim).

If you remove sim, do a factory reset, uninstall the oobconfig package, connect to internet, finish phone setup, the toggle switch message remains the same. So something within that package is responsible for performing the verification of oem unlocking permissions and then changing the setting.

I would say you could just open the apk in a hex editor, tweak a value or two, then install the apk over adb. The oobconfig package points to the OTAConfigPrebuilt.apk file. So you can use adb pull to copy to your pc. Tweak whatever code you want.

The problem is that I can't find a way to re-install the package due to the certificates check failing. Even after disabling 'verify apps over usb' it still fails the certificates check. I even copied it to the internal tmp folder and tried to install using the command below and it failed.

adb shell cmd package install /data/local/tmp/OTAConfigPrebuilt.apk

The good news is there's no danger in removing the oobconfig package. Just factory reset and it'll be right as rain.

A few tips...

// to find the apk for any given package name
pm path nameOfPackage

// to search the contents of binary files for keywords
// -R is recursively search folders
// -a is binary
grep -Ra "oem_unlock" /product/priv-app/*
[Google Pixel 3 Questions & Answers] yaw360:
Hello,

Just FYI, I tried factory reset and phone setup with/without uninstalling the oobconfig on my Pixel 3 by Verizon (according to the seller of eBay), but both resulted in "Connect to the internet or contact your carrier".

Since I am using this phone only for development purpose, I can reset it without hesitation.

Let me know if there is what I can help.
[Google Pixel 3 Questions & Answers] rolandNW:
Connecting to wifi must be done prior to finishing the phone activation. With the package installed, wifi connected, phone activation results in "unavailable on carrier locked devices." With package removed, wifi connected, the toggle switch message remains the same.

The next thing I would try is to re-install the apk file without any mods. Just unpack, repack, sign. If that works then there are a number of possibilities that can be tried with that package. I'm using the 3a as my main phone right now so factory reset isn't an option. I'd recommend the links below if you want to try and repack/sign/reinstall. Please post your results.

adb pull /product/priv-app/OTAConfigPrebuilt/OTAConfigPrebuilt.apk

Repackaging apk file with smali and baksmali

We may require to repack an apk for the various reasons. One of the most common being to bypass SSL Pinning. Source: #!/bin/bash -e if ! [ “$1” ]; then echo “usage: $0 <…

asifbalasinor.com

Repacking and Resigning an Android APK to Target Different Environments - Nick's .NET Travels

In my previous post talking about targeting different environments I ended with the proposition that what we need to be able to do as part of the release pipeline for an app is to adjust the configuration file that’s included in the app package. In this post I’m going to manually walk through...

nicksnettravels.builttoroam.com

adb install OTAConfigPrebuilt_repacked.apk
[Google Pixel 3 Questions & Answers] yaw360:
It was connected to wifi because the phone setup doesn't appear unless the connection.

So I don't think there was an option to change the result.

Anyway I will look into reinstallation of the oobconfig too.
[Google Pixel 3 Questions & Answers] Ele Na:
Hi. Can you help me to find it on russian 4pda forum? If you have the way to get bootloader unlocked on Verizon Pixel 3a xl explained in russian I'd be appreciated.
[Google Pixel 3 Questions & Answers] Ele Na:
Privet! I have refurbished Verizon Pixel 3a XL. Do you have any data how to get it bootloader unlocked? In russian would be awesome)))
[Google Pixel 3 Questions & Answers] yaw360:
Currently, it is known that only brand new ones which haven't connected with Verizon SIM cards can be unlocked.

If yours hasn't connected yet, you can unlock it in normal way, otherwise you can't.
[Google Pixel 3 Questions & Answers] Ele Na:
Ok, thanks for the data. I already decided to return it to the seller and search for the Google edition.
[Google Pixel 3 Questions & Answers] AsItLies:
You can still find a few listings on ebay for them. Be sure to look closely if they say a carrier version or not. Also look for 'factory unlocked'. That usually means a google edition, but not always, as sellers don't always know what they're talking about.

If yer uncertain by the listing, ask the seller if it has a barcode (on the side of the box) for EID. that means it has an esim, and that it's not a vzw phone.

I just bought one. This is the ebay seller. From the listing, pretty sure this is a google edition. Once these are gone, that's it, I don't think you'll find a smaller normal sized phone again. The whole industry is heading toward the gigantic and heavy phones.

cheers
[Google Pixel 3 Questions & Answers] Ele Na:
Thank you very much for advises! I found several google edition 3a xl phones on swappa. They actually note if it's google or verizon or whatever else so I hope it is what it's written :unsure:
[Google Pixel 3 Questions & Answers] AsItLies:
Yes, swappa is probably the most trusted possible. If it's not as they say, easy return.

I got p3 new on the ebay, no new on swappa for p3. But it won't be long, and they'll all be gone, then only used (abused?) avail.

too bad, cuz they really really really are great phones. Look at the p6! gigantic heavy phones now. Gawd, put a brick in yer pocket!

cheers
[Google Pixel 3 Questions & Answers] Ele Na:
Well, if it's factory unlocked and in excellent condition then I'm totally fine with the refurbished one.

I found some on ebay also. Now I'm thinking maybe to take 3a instead of 3a xl, it's a bit smaller and hence more comfortable for hand :unsure:

cheers
[Google Pixel 3 Questions & Answers] AsItLies:
It is a difficult decision, and basically comes down to what you're happy with / your personal usage. I prefer smaller devices as I don't really use it much (other than to mess with the android part ;)). Thus it's easier to carry around and use as a phone.

I've bought / sold quite a few devices on swappa. Almost always good luck. Recent purchase (lg g8) described as mint, wasn't what I'd hoped for. On the outside, it's really very close to mint, no complaints there. But the oleophobic coating is almost gone, and the battery is acting strange, seems to discharge rapidly when situations with phone heating up...

It's always a chance. Sometimes lucky, some not, when buying used. Swappa is more likely to have the listing accurate though in the 'unlocked' regard. That link I provided above? Says 'factory unlocked', but email I just received from them says 'not e-sim compatible' (even though their listing says it is!).

alas, it's not easy to find a good phone at an inexpensive price.

cheers
[Google Pixel 3 Questions & Answers] DragonFire1024:
Sorry everyone. I have had to put a hold on this and all other tinkering I had been doing. I started a new job that required me to get used to a new way of living (and sleeping) that required a lot of adjusting and getting used to. Shortly thereafter on September 16, I was in a severe accident in which I nearly lost my life. I was struck by a car while riding my bicycle home from work and had to have emergency surgery to stop internal bleeding and remove a ruptured spleen. I am ok now, but have been spending a lot of time resting and recovering. Once I return to near 100% I hope to continue my various works and tinkering on XDA.
[Google Pixel 3 Questions & Answers] Ele Na:
OMG! thanks God you're ok now and came back.
[Google Pixel 3 Questions & Answers] Johnius:
Thanks for getting things started. How are you feeling after the accident? Have you made any further progress? With the OTA push of Android 12, I'd really like to get back to the OTA Android 11 which worked well.
[Google Pixel 3 Questions & Answers] pH3ra:
I don't know if this is going to be of any help, but I read in this forum that the SuzyQable doesn't work on Pixel phones, while instead suggests to use this handmade debugging cable.

I haven't found any documentation available on wether or not this cable can work around the Verizon Lock, but since we're tinkering I thought it might be useful to throw this on the table.
[Google Pixel 3 Questions & Answers] DragonFire1024:
I have had no issues with this cable. you have to enable the use of the feature using 'fastboot oem citadel'. you have to check this often because sometimes it will default back to disabled every so often.

The only thing I can think of that may be of value are logs. I am convinced the switches in citadel and the commands or whatnot are in a log somewhere. this phone has a million different log capabilities. When supposedly accessing the device in uart, logs are displayed with every command. In earlier posts another user confirmed the citadel switches do indeed have to do with the OEM toggle in settings. we can change at least one of these toggles to a 0 which we assume means "unlocked" though does no good so far as I can tell but I could be wrong. Without a better set of logs, I have no idea what's going on. I think all of this might be better done on a full chromium OS. Most of what I have done is patched into my Linux distro. It all works very well, but commands are severely limited without all the proper software which unfortunately isn't all compatible with Linux/Ubuntu. The amount of work alone I have done just to get this far took almost a couple of months...most of which was spent on figuring out wtf I had going on.

Secondly, there is a way to exploit DSU (dynamic system update/image). Trying to load a custom ROM image, like Resurrection Remix, causes vbmeta to be corrupted. It maybe nothing, it maybe something. but if that happens, it tells me it's writing somewhere it shouldn't be...and on a verizon device, that's not supposed to be the least bit possible. Find a way to exploit DSU or vbmeta, you can have a custom rom on here without screwing too much up.
[Google Pixel 3 Questions & Answers] Dionicio3:
Hey, has there been any updates on this?
[Google Pixel 3 Questions & Answers] Mr Hassan:
Looks like everyone givesup here
[Google Pixel 3 Questions & Answers] begundalsbereal:
TIsn't it possible to unlock oem listen to the latest android 12 version 😭😭😭😭
[Google Pixel 3 Questions & Answers] heckstor:
Not only does the SuzyQable not work on Pixels allegedly but it has also been discontinued due to supply chain concerns. You can no longer buy it on sparkfun.

The special USB debugger cable also works on the Pixel 2/2XL line which the SuzyQable was supposedly not able to even communicate with. If the writup on that wiki is correct then they already explained why that is, it's because the SuzyQable was actually just talking to the Titan-M chip and completely ignoring the Snapdragon SoC through which the actual debugging is supposed to be done.

The Pixel 2 and Pixel 2XL do not have the Titan chip hence the complete failure in communications with those phones.
[Google Pixel 3 Questions & Answers] DragonFire1024:
would dirtypipe work on this phone?
[Google Pixel 3 Questions & Answers] smokeyou:
Not familiar with the Pixel 3, Verizon variants, or ChromeBook debugging but I stumbled on this thread and thought I would share some personal insight.

The "SuzyQable" is basically just tying SBU1 and SBU2 to USB D+/D-.

Ref: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md

For Android/Pixel debugging it's a little different.. It's still SBU1 and SBU2 but here it's is a UART signal.

Ref: https://github.com/Peter-Easton/android-debug-cable-howto

I have only personally done it on a new Pixel 6 Pro (Fi Variant) after running fastboot oem uart enable but it should work on any 2+ variant I believe. Problem is that it's only debug output (no console for input) so it's good for troubleshooting boot related issues but exploitation options may be limited.

My recommendations:

1. Continue down the DSU path because GSI runs as user-debug or eng (allowing adb root). The DSU page does not suggest any carrier limitations or unlocking requirements. It's possible that you just need to use a different DSU image.

A red EIO page with a DSU image is actually not a terrible thing (see ref below). "Your device is corrupt. It can't be trusted and may not function properly" is only a warning due to dm-verity failing. I have seen many devices boot with this error present.

In theory, the signing is not a problem unless you hit the "No valid OS found" page. Google issued GSI's are all signed with Google test keys so they should run without trouble.

A user started to make progress here a couple years back when DSU was first introduced. They never got it and that thread has since closed but it's where I would start. This should be possible.

Ref: https://source.android.com/security/verifiedboot/boot-flow

Ref: https://source.android.com/security/verifiedboot/device-state

2. Firehose for imaging could be possible also. This would allow raw access to the disk where you could then re-flash abl, xbl, and others with pure google images (no unlock needed). Again mentioned in the other thread with no luck a couple years ago (hard to find the right elf/mbm files).

It's just a snapdragon device at the end of the day and you may get lucky with a loader file for a different device (with the same chipset). I personally found succuss here on other devices in the past.

Or, I'm sure the board has emmc test points..
[Google Pixel 3 Questions & Answers] DragonFire1024:
Well I was tinkering and decided to go all out. So we have access to citadel in fastboot right? so I spent a few hours looking into 'fastboot oem citadel rescue', which appears to work. Using this command, we can supposedly flash whatever firmware we want, to the titanm chip (any official firmware, any version). This paper does a great job at explaining a lot of what I have been either seeing, or trying to do. In any sense, in theory, when the device is in 'Boot ROM mode', according to that paper, we theoretically have the ability to flash at least 2 partition on this chip that ar permission RW. I can at least confirm a few things on my Pixel 3a. first, i extracted the citadel rescue firmware from the vendor.img on my Pixel 4a at /vendor/firmware/citadel/ec.rec (there also exists here ec.bin, the firmware for citadel) as well as from the stock factory image (android 12). Booted the Pixel 3a to bootloader and opened a fastboot command window in the folder/directory containing the ec.rec file and ran:

dragon@dragon:~/Downloads$ fastboot oem citadel state
(bootloader) Citadel state:
(bootloader) Version : 1
(bootloader) Bootloader state: 1
(bootloader) Production state: 1
(bootloader) Number of locks : 4
(bootloader) Lock[0]: 1
(bootloader) Lock[1]: 1
(bootloader) Lock[2]: 1
(bootloader) Lock[3]: 0
OKAY [ 0.086s]
Finished. Total time: 0.086s
dragon@dragon:~/Downloads$ fastboot stage ec.rec
Sending 'ec.rec' (188 KB) OKAY [ 0.120s]
Finished. Total time: 0.139s
dragon@dragon:~/Downloads$ fastboot oem citadel rescue
(bootloader) Recovering citadel - it may take a couple of minutes
OKAY [ 28.595s]
Finished. Total time: 28.595s
dragon@dragon:~/Downloads$ fastboot oem citadel state
(bootloader) Citadel state:
(bootloader) Version : 1
(bootloader) Bootloader state: 0
(bootloader) Production state: 1
(bootloader) Number of locks : 4
(bootloader) Lock[0]: 1
(bootloader) Lock[1]: 1
(bootloader) Lock[2]: 1
(bootloader) Lock[3]: 0
OKAY [ 0.090s]
Finished. Total time: 0.090s

It works. Any way we can exploit this ability? also notice the bootloader went from 1 (I assume means locked) to a 0 (Unlocked? Does not persist on reboot).
[Google Pixel 3 Questions & Answers] DragonFire1024:
And there is rescue mode. Got to a screen where it tells me it's waiting for rescue commands.
[Google Pixel 3 Questions & Answers] DragonFire1024:
Haven't had time to do any more experiments the last few days but I have been reading up on some information. Apparently we have the ability to create our own firmware file and flash it to this chip. I won't get into details because it's too much for the moment. But this may be beneficial given the fact that this chip handles all the cryptographic keys from the lock screen to account passwords right up to the device and bootloader keys. If we are able to successfully create our own firmware file and successfully flash it to this chip I am wondering if we are able to alter this firmware so the OEM lock believes the device is unlocked therefore actually unlocking it. I had come across the source code for the chip in which it stated what the purpose was or is of the four lock functions. The source code was pretty clear that it had everything to do with OEM locking and unlocking. So this could be a way in.
[Google Pixel 3 Questions & Answers] DragonFire1024:
May 2022. New CVE effecting Pixel devices. CVE-2022-20120 is a bootloader vulnerability. Can't find much on it yet other than it was supposedly patched with the latest update. From here
[Google Pixel 3 Questions & Answers] dood6017:
Just like you, I ended up getting stuck with a verizon pixel 3 by accident about a year ago, and today I started looking at your progress. I'm glad someone who knows more than me is also worried about this, because it sucks that I can't use this phone for the purpose I bought it for. That CVE looks very promising, and since my pixel 3 is running android security update from August 5, 2021 it should be vulnerable. I am excited to see what this vulnerability entails.
[Google Pixel 3 Questions & Answers] DragonFire1024:
Well the security patch may or may not matter. I have done a bit more reading about the firmware for the Titan chip. The is a CVE affecting firmware for this chip. You can read about some of them here. The firmware version is n 0.0.3/brick_v0.0.8232-b1e3ea340 which can be found in the factory firmware on Google's firmware page. I am using my Windows machine at the moment, so I can't tell you what version of android contains that firmware version which is on my Linux boot. I can tell you the firmware flashes with success (you can downgrade or upgrade to any version firmware for this chip). You can also read about another big bug here. Note: we have access to all the firmware for the chip, and you can cross flash the firmware. For example you can flash the chips firmware from factory firmware for the Pixel 4a (or any other pixel). My pixel 3 is currently running the firmware version listed above.
[Google Pixel 3 Questions & Answers] mikeman400:
Just wanted to say nice progress on and thanks for figuring out what you and everyone else have so far.

I have read through the entire thread and it is quite interesting.

I have a pixel 3 that I'm hoping I can bootloader unlock some day.

Sorry I don't have anything other than encouragement to add, but I will keep an eye on this thread.
[Google Pixel 3 Questions & Answers] FernBch:
Stumbled across this today and am quite curious. I also have a couple ideas and questions. I tried to figure out how to exploit and/or unlock the 3 XL a couple years back. The farthest I managed to get was to crash the device.

The various cables such as Suzyq, etc., anyone have a link on how to make them?

I have read that once activated on Verizon any loopholes became useless. If that is so that would mean that something persists through a hard reset. Does anyone know what that may be and is it possible to delete/erase that data?

I have new ideas and this may open doors but I have to get in the level obtained here. Any help would be appreciated and any progress would be shared.

Thanks
[Google Pixel 3 Questions & Answers] FernBch:
Also, there is an unlock bit, I believe, that is written to /persist. If that could be manually applied problem is solved.
[Google Pixel 3 Questions & Answers] mikeman400:
Well here is the link to make the SuzyQ cable. It is a youtube video but also has links in the description for wiring diagrams.
[Google Pixel 3 Questions & Answers] mikeman400:
I found this interesting schematic for a SuzyQable from Chrome docs. Appears there is more to the cable than the one the above video shows.

It includes a Cypress CY7C65634 USB hub and an Atmel AT24C02C. The Atmel is just an eprom that is part of the usb hub's example cirucit.

But the interesting thing is it connects 2 ports from the hub to the Phone. One set of USB data lines goes to the the (Sideband) SBU1 / SBU2 pins The same as the one from the video above. The second set of data lines goes to the (Standard) D+ / D- like a normal USB cable.

I'm not sure what, if any difference this makes. But you could easily replicate this by skipping the hub circuit and wiring it to 2 USB ports on your PC. (And might even provide an opportunity to get some other behavior out of the phone by plugging and unplugging them at different times)

According to the documentation from the video, the SuzyQable from Sparkfun includes a USB hub in it.

hdctools: Chrome OS Hardware Debug & Control Tools - Closed Case Debug (CCD)

https://www.chromium.org/chromium-os/ccd/951-00273-01_20180607_suzyqable_SCH_1.pdf
[Google Pixel 3 Questions & Answers] vonDubenshire:
interesting stuff here
[Google Pixel 3 Questions & Answers] Jhnoth:
I diffed the ec files in

/vendor/etc/citadel

from a Verizon and Google ROM but they're identical.
[Google Pixel 3 Questions & Answers] Jhnoth:
I took a peek at the oob package (which is now called OTAConfigNoZeroTouchPrebuilt.apk btw) and found that it phones afwprovisioning-pa.googleapis.com to get provisioning information for the device. Fun fact, I just discovered that Google Chrome history filters out 404 history.

Anyways, perhaps GetDeviceProvisioningRecord() and friends could be modified to return a preset record for a Google non-VZW Pixel. However, the records would have to be sniffed on a brand new (or factory reset? idk) Google non-VZW Pixel (info on android packet sniffing is on Google). Once obtained, the values can be used to patch the apk, then installed with

adb install -r

I haven't completely analyzed the apk, but my guess is that the provisioning info is passed out through intents to system settings (probably bounces through other services), which determines whether OEM Unlock is enabled or not. We probably can't spoof the provisioning process (like sonick's iCloud-Lock server spoof), which is an assumption, but we can modify the APK and reinstall it.

Edit: I would try this out, but I don't exactly have time and my Pixel 3 is a primary device.
[Google Pixel 3 Questions & Answers] minhat0601:
So good when I saw that. I'm sorry cause my English is not good. But can I do it in Pixel 4?
[Google Pixel 3 Questions & Answers] DragonFire1024:
If you can get me a copy of the APK...I can try my hand at modifying it. I am pretty good with APK tool.
[Google Pixel 3 Questions & Answers] Tigermouthbear:
You can pull a copy from your phone using adb:

adb pull $(adb shell "pm path com.google.android.apps.work.oobconfig | awk -F':' '{print \$2}'")

I did some digging around and it seems like the main controller of OEM unlock state is in com.google.android.apps.work.oobconfig.DeviceRestrictionsTask. Notably, it requires a OEM unlock token (ByteString) from the com.google.internal.android.work.provisioning.v1.DeviceProvisioningConfig its using.

The decompilation is pretty mangled near the token's actual use which makes things hard, but I'm going to look more into it tomorrow.
[Google Pixel 3 Questions & Answers] galibalmasanick:
So,any way to unlock verizon pixel bootloader?my phone is pixel 3 verizon,i try my best but no way i find
[Google Pixel 3 Questions & Answers] dcarvil:
You can't find a way because there is no way to unlock the Verizon variant.