[Moto G 5G Guides, News, & Discussion] _prosaist:
TL;DR: Don’t use a remote unlock service if you want to still be able to unlock your bootloader.

DISCLAIMER: I don’t recommend or endorse any of the vendors or tools mentioned in this post. I’m simply mentioning them in the interest of full transparency.

I recently bought a refurbished T-Mobile-locked Motorola Moto One 5G Ace (model XT2113-2). When I first received the device, I successfully unlocked the bootloader by following the instructions on Motorola’s website.

I was mistakenly under the impression that since the phone was paid off I could get it unlocked by T-Mobile directly. However, using the built-in tool to request a “Permanent Unlock” repeatedly failed with error code 255.

I spoke with one chat agent, two phone agents, and one T-Force agent (@TMobileHelp on Twitter) but couldn’t get anywhere with any of them. The T-Force agent ended up telling me that the original owner of the phone would have to request the unlock. Since I purchased it from a reseller on eBay, I have no idea who the original owner is. The eBay seller was likewise unable to help.

I decided to do some research and came to the conclusion that the only working way to unlock an XT2113-2 besides directly through the carrier is to use a remote unlocking service. Further research indicated that eBay is the best and safest place to purchase these types of unlocking services. Finally, I landed on only two vendors on eBay that advertise a remote unlocking service for this model: “quick_unlock89” and “thejmf2011”.

In the process, I also came across a single vendor on eBay (“gfix99”) advertising a T-Mobile unlock eligibility checker service that supposedly queries T-Mobile’s database directly. I have no idea if this service is legitimate or not or what less-than-legal means they have of accessing T-Mobile’s database. However, it was cheap at only $1.65, so I figured I’d order it to see what it said. Sure enough, it showed my device as being locked to T-Mobile.

From what I could tell, there was no appreciable difference between the two unlock vendors, so I went for the cheaper of the two (“quick_unlock89”). For the uninitiated, the way these remote unlocking services work is by connecting to your computer via TeamViewer or some other remote access software. Then, they copy over and run a software called USB Redirector (you can find it by Googling that plus “Incentives Pro”). This redirects your phone’s USB connection to your computer over the internet to the person on the other end. After that, they ask you to boot the phone into the bootloader by holding volume-down and power at the same time. Once you plug in the phone, they take it from there.

I created a Windows VM and used a VPN to have this procedure done on my phone, and I screen recorded the whole session. There’s not much to see, sadly. However, after the process was done, the phone indeed showed that it was unlocked in the Settings app. Also, I paid for a second report from “gfix99”, and the phone is now showing as unlocked in T-Mobile’s database as well, assuming the report is accurate.

However, as soon as they were done with the unlock, I noticed that my bootloader had re-locked. When I tried to unlock it again, I was unable to. Using the fastboot oem get_unlock_data command fails with this error: “Failed to get unlock data.” Attempting to run the fastboot oem unlock command with the unlock code I received from Motorola when I first bought the phone gives this error: “Code validation failure”.

My next step was to try Motorola’s Rescue and Smart Assistant (LMSA) tool, but even after repairing the phone with it, the bootloader unlock still failed with the same errors. Notably, the phone did still show as network unlocked after repairing it with Motorola’s tool.

I did some more digging and was finally able to find some Spanish-language forum posts talking about a program called Moto-Key Tool that is used for remote unlocking the XT2113-2 along with several other models. From what I can tell, this seems to be the tool that these two eBay vendors are using to do these remote unlocks. You can find it with a Google search if you’re so inclined (basically just add “.com” after “moto-key”). It requires the purchase of credits that seem to roughly equate to $1 USD per credit, with the entire unlock procedure requiring 25 credits.

The basic sequence of events that this software uses seems to be as follows:

From the bootloader, it enables “Factory Mode” on the phone and then boots it up into that mode.

Once in Factory Mode, it wipes the IMEI from the phone, runs some other command, and then re-writes the original IMEI back to the phone.

It reboots the phone back to the bootloader and does a factory reset.

It boots the phone back up into the normal Android OS at which point the process is finished.

I attempted to decompile some of the DLLs included with the software to see if I could figure out exactly what it’s doing, but I’m no developer, and I certainly can’t read assembly language. I have some theories as to how it’s accomplishing the unlock, but at the end of the day, it doesn’t really matter for the sake of this post.

It’s important to note that neither of the eBay vendors offering this service say anything in their listings about this being a possible outcome. Personally, I never would have purchased the service had I known that. I use a T-Mobile MVNO, so the network unlock was really a “nice-to-have” for me in case I ever get to travel abroad again. The bootloader unlock is far more important to me.

I reached out to the eBay seller to express my dissatisfaction and request a refund. I’ve copied and pasted the conversation below for transparency. If the mods need me to provide proof I’m happy to do so. I just want any potential customers such as myself to be aware of the type of individuals they’ll be dealing with when they purchase these unlock services.

To their credit, they did issue a full refund. I don’t have much faith that they won’t go ahead and purposely blacklist the IMEI anyway. At the very least, I want this information out there for anyone else considering this type of service so it’s not a total loss and the community can benefit.

If you’ve read this far, congratulations! Long story short, if you want an unlocked phone, just buy it unlocked direct from the manufacturer. Dealing with the carriers or these gray-market unlock services isn’t worth the headache.