[ASUS ZenFone 8] bnsmb:
The Android CLI command

cmd lock_settings

can be used to get or set the lock screen settings in an adb session or a script. The command should be executed by the default user in the adb session (-> no root access necessary).

The known options for the command cmd lock_settings are

Spoiler content hidden.

To define a pin for the lock screen use

cmd lock_settings set-pin <new_pin>

e.g. to set the pin to "12345" use:

ASUS_I006D:/ $ cmd lock_settings set-pin 12345
Pin set to '12345'
ASUS_I006D:/ $

To define a password for the lock screen use

cmd lock_settings set-password <new_password>

e.g. to set the password to "start" use:

ASUS_I006D:/ $ cmd lock_settings set-password start
Password set to 'start'
ASUS_I006D:/ $

To change an existing pin or password the additional parameter --old <old_credentials> is required

E.g. to change the pin from "12345" to "45678" use

ASUS_I006D:/ $ cmd lock_settings set-pin --old 12345 45678
Pin set to '45678'
ASUS_I006D:/ $

To verify the lock screen settings use

cmd lock settings verify --old <pin_or_password>

e.g . if the current pin is 45678 :

ASUS_I006D:/ $ cmd lock_settings verify --old 45678
Lock credential verified successfully

ASUS_I006D:/ $ cmd lock_settings verify --old 12345
Old password '12345' didn't match
255|ASUS_I006D:/ $

To clear the lock settings use

cmd lock_settings --old <pin_or_password> clear

Note: The old credentials are mandatory for this command

e.g

ASUS_I006D:/ $ cmd lock_settings clear --old 45678
Lock credential cleared
ASUS_I006D:/ $

ASUS_I006D:/ $ cmd lock_settings verify --old 45678
Old password provided but user has no password
255|ASUS_I006D:/ $

To check if a screen lock is defined use

cmd lock_settings verify --old <any_credentials>

e.g:

ASUS_I006D:/ $ cmd lock_settings verify --old 45678 ; echo $?
Old password provided but user has no password
255
ASUS_I006D:/

If the provided credentials match the configured lock settings the output is

ASUS_I006D:/ $ cmd lock_settings verify --old 45678 ; echo $?
Lock credential verified successfully
0
ASUS_I006D:/ $

If the there is a pin or password set but the credentials used in the command are wrong the output of the command is:

ASUS_I006D:/ $ cmd lock_settings verify --old 45679 ; echo $?
Old password '45679' didn't match
255
ASUS_I006D:/ $

If you have entered incorrect old login data more than 5 times, the command issues the message Request throttled:

ASUS_I006D:/ $ cmd lock_settings set-pin --old 12376 12345
Request throttled
255|ASUS_I006D:/ $

and you must wait 30 seconds (or more - this value is increased dynamically - see below) before you can start another attempt.

Note:

The command cmd lock_settings can also be used to define a screen pattern for the lock screen using the parameter set-pattern.

To enable or disable a locked screen on the phone in an adb session use the command input.

To lock the screen in an adb session via a CLI command use :

input keyevent 26

To wake up the phone use:

input keyevent 82

To unlock the phone screen via a CLI command use (assuming the pin used is "12345"):

input keyevent 82 ; input swipe 930 880 930 380 10 ; input text 12345 ; input keyevent 66

Note:

The parameter for the command "input swipe" in the example work for the ASUS Zenfone 8 - other values might be required for other phones.

To unlock the phone screen if no password, pin, or pattern is defined use:

input keyevent 82 && input keyevent 66

Note:

Credits for the input command examples go to: https://www.pentestpartners.com/blo...ns-or-why-you-should-never-enable-adb-part-1/

The usage help for the command input is

Spoiler content hidden.

A list of known values for keyevent is here http://www.temblast.com/ref/akeyscode.htm or in the Android documentation https://developer.android.com/reference/android/view/KeyEvent

As far as I know there is no parameter for the command cmd lock_settings to clear or read unknown credentials.

In Android 14 (and previous Android versions with file based encryption) removing the credentials to unlock the phone by deleting one or more files no longer works.

The commands mentioned in various blogs on the internet to clear the credentials :

su - -c "mv /data/system/locksettings.db /data/system/locksettings.db.old" ; reboot

or

su - -c "rm /data /system/*.key"

do not work anymore in Android versions using file based encryption.

And even if it would work, it does not help because the data on the phone is encrypted with these credentials.

Brute forcing the password using the command "cmd lock_settings" in an adb shell is in principle possible but because the necessary time between the unsuccessfull attempts will increase exponential a brute force attack against a 4 digit PIN would take around 27 years to complete in the worst case.

This is also true for using the command "trwp decrypt" while booted into the TWRP recovery.

For those interested in the details:

A detailed description about the implementation of the file based encryption in Android can be found here:

https://security.stackexchange.com/...n-pin-password-and-encryption-keys-in-android

The only method I currently know of to get rid of an unknown PIN/password is to reset the phone to factory settings. However, this will delete all data on the phone. So it is only an option for phones without important data or if you do have a backup of the data on the phone.

History

25.12.2023

The details about the throtteling were wrong

26.12.2023

Added more details about why it is not possible to remove unknown credentials without data loss