[Lenovo ThinkPhone (by Motorola)] fire3element:
This post is to act an informant and guide to unlocking the bootloader on the Motorola ThinkPhone. (including models XT2309-3 and XT2309-2)(device codename: Bronco)

First and foremost, this information is being provided on strictly an educational and informational basis.

You accept any inherent risks involved with modifying the software of your own device.

The act of unlocking the bootloader on your device also voids your warranty with the manufacturer.

Do not expect warranty or support from Motorola or Lenovo after unlocking your device.

WARNING! Do NOT relock your bootloader if you flash a different firmware package from the one that came with your device.

Best case, your bootloader is permanently locked after. Nothing can be done to fix this. Worst case, your device is bricked.

Requrirements:

Back up anything you wish to save. Your phone WILL be wiped.

Internet connection​

ThinkPhone model XT2309-2 or XT2309-3​

A computer (preferably running Windows)​

Decent quality USB-C to USB-C or USB-C to USB-A cable that supports data transmission (2.0 or 3.0 should not matter)​

Motorola phone drivers installed on your computer​

Valid email address to sign-up for or log-in to a Motorola account​

ADB and Fastboot drivers (both installed and portable variants should work)​

Enabled "OEM Unlocking" in Settings>System>Developer Options (more on this part later)​

2 brain cells (yes, they are required)​

Quick bit of information:

There are many posts online about how to fix the issue of the "OEM Unlocking" option being greyed out. I tried quite a few, so the exact steps required may not be the same for everyone.​

I would like to note that if you are in the United States, it is common for most manufacturers to lock down the device and disallow the option to enable "OEM Unlocking". And in many cases, that option will

not be present

in the developer options menu at all. If this is the case for your device, unfortunately there is no way to unlock the bootloader.​

(If you are trying to bootloader unlock the US variant of this device, I highly recommend you try to do this from a fresh factory state before installing a sim card.)​

Typically the devices that are locked down in this manner are sold by cellular providers, such as Verizon, T-mobile, AT&T, and other partners that operate on those networks. The good news is, the ThinkPhone, as of the date of this post, is not sold by any of the carrier in partnership with Motorola. The device is directly purchased through Motorola.com​

This means the device (XT2309-3 for North America, XT2309-2 for Global Market) is eligible for the bootloader unlock program per Motorola's requirements.​

Bootloader Unlock Process:

Enable OEM Unlocking:

You need to toggle the "OEM Unlocking" option in the android developer settings on your device.​

More than likely, this option is going to be greyed out in your settings. That is ok, let's fix that.​

On your device go to Settings>About Phone>Build Number (tap on this 7 times)​

Developer Options is now enabled. Go back one screen, System>Developer Options​

You should now see the "OEM Unlocking" option about 6 items down from the top.​

Normally there is a 7 day waiting period for the OEM Unlocking option to be available to toggle. We can bypass this by attempting a few steps.​

Steps to bypass 7 day wait:

If you are in the US, I only connected my device over VPN to a location in the EU. This may not be required, but I did this as a precautionary measure to prevent the OEM unlock option from being disabled due to geo-location restrictions. If you were successful unlocking your bootloader without using a VPN, please reply in the thread so others are aware.​

On your device go to Settings>System Update>Check for updates. This may take a while. You may be required to reboot.​

Continue this process until the System Updates reports you are fully updated.​

At this point some people have had success changing the time manually in Settings>System>Date&Time to a date over 7 days past the current day. I attempted to change the date to a year forward, and also a year past. This did not work on my device. OEM Unlocking option remained greyed out.​

What did work however is resetting the device to factory condition via Settings>System>Reset Options>Erase All Data​

After the device resets, do not connect to internet, skip past all setup options, allow the phone to fully boot and settle down.​

Now connect to your wifi network. (again, I was using a VPN for EU location here)​

Go to Settings>About Phone and enable Developer Options again.​

The OEM Unlocking option should now be available to toggle.​

Also while you are in this menu, scroll down and toggle "USB Debugging" to the ON position.​

Prepare your Computer:

(below instructions are assuming you are running on a Windows computer)​

Go to this page, download and install the Motorola phone drivers on your computer.​

https://en-us.support.motorola.com/app/usb-drivers​

Next, download and install/unzip ADB and Fastboot drivers to an easily accessible location.​

Recommended: https://github.com/K3V1991/ADB-and-FastbootPlusPlus/releases (both .exe and portable work fine). If you are using the portable files, unzip that file to an easy to access location. Desktop is fine. (can delete after if you wish)​

Open the folder with the ADB and Fastboot drivers. In the File Explorer ribbon at the top of the window you should see the path address to this open folder.​

Right click on the last (furthest right) folder shown in that address bar and select "copy address as text"​

Now, open Command Prompt (click Windows key, type "CMD", open Command Prompt).​

PowerShell was unable to invoke fastboot for me, use CMD instead.​

​

We are now going to paste the directory address from the fastboot driver folder copied earlier.​

In the CMD window, type: cd [right-click mouse button, "paste"]​

You should now have: cd C:\Users\(username)\Desktop\ADB-and-Fastboot++_v1.0.8-Portable (or whatever address your files are at)​

Hit Enter. You should now have CMD open in the target directory.​

You can test if you are in the right place by typing: fastboot and hit Enter.​

If CMD responds with... fastboot: usage: no command ...you are in the right place. If not, you need to cd into the correct directory.​

Unlock the Bootloader:

Time to boot your phone into the bootloader mode.​

If device is powered on, power it off.​

With the phone OFF, hold down both the VOLUME DOWN and POWER key at the same time.​

Phone will vibrate and a green android figure appears on a black screen along with some text at the bottom.​

Release the both buttons and do not press the POWER button again, or that will restart the phone.​

Plug in your phone to your computer with an appropriate USB cable.​

If this is the first time connecting your device to your PC, it may take a moment for the drivers to install.​

Once the drivers are installed, on the CMD window type: fastboot devices and hit Enter.​

You should see a return line like: Z834F9ET53 fastboot​

(If you do not see the 10 character string before "fastboot", your device is either not in fastboot mode, drivers or computer does not recognize the device, or bad USB cable.)​

Now we need to issue the command to get the unlock data that will be entered on Motorola bootloader unlock request page.​

Type: fastboot oem get_unlock_data and hit Enter.​

Return line should appear as follows:​

(bootloader) Unlock data:
(bootloader) 3H480AC899F892E1#BA87E8225F62F3
(bootloader) 4F554200585431303533000000#8C49
(bootloader) BF7413A5640F469C57CCAB1D635F4E5
(bootloader) 435754205649866E6B65098CFCC58#6
(bootloader) 4H480AC899F892E0000000000000000
OKAY [ 0.027s ]
Finished. Total time: 0.027s

You must copy these strings of characters to a notepad or similar. The entire string must be a single line, like so:​

3H480AC899F892E1#BA87E8225F62F34F554200585431303533000000#8C49BF7413A5640F469C57CCAB1D635F4E5435754205649866E6B65098CFCC58#64H480AC899F892E0000000000000000​

No spaces, only a single line. This unlock data is unique to your specific device. No other unlock data from any other device will work.​

​

Now we go to the Motorola unlock request page and enter our unlock data string into the empty box, then click "Can my device be unlocked" button.​

https://en-us.support.motorola.com/app/standalone/bootloader/unlock-your-device-b (You will need to sign-in to your Motorola account.)​

If you do not see an error message "Your device is not eligible", then you may now scroll down, click Yes on the agreement warning, and click on the proceed button.​

The system will now email you the unlock code.​

Now that we have the unlock code, we go back to the CMD window and issue the unlock command.​

Type: fastboot oem unlock [paste unlock key here]​

Your command should look like: fastboot oem unlock GFYMSK8BSWL4BCCEH3VS​

Hit Enter and you should see a prompt on your phone's screen. Tap Yes or Proceed.​

That's it, your bootloader is now unlocked!​

(If you see a "Failed", either your key is not correct, or your OEM Unlocking option is still toggled off.​

Double check that you entered the key correctly. Boot back into Android and check your OEM Unlocking toggle.)​

Hopefully now that people know the bootloader on this device can be unlocked (especially for the US market), it will gain some traction from developers and tinker fanatics.

Now we need a TWRP recovery image to boot and give us all the goodies. Hopefully this happens soon.

Root is achievable without custom recovery (like TWRP).

Happy days. Enjoy :)​