Software:Bootloader unlocking

From HandWiki
Short description: Process of disabling secure device booting
An unlocked bootloader, showing additional available options

Bootloader unlocking is the process of disabling the bootloader security that makes secure boot possible. It can make advanced customizations possible, such as installing a custom firmware. On smartphones this can be a custom Android distribution or another mobile operating system. Some bootloaders are not locked at all, others can be unlocked using a standard command, others need assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through a software exploit.

Bootloader unlocking is also done for mobile forensics purposes, to extract digital evidence from mobile devices, using tools such as Cellebrite UFED.

Background

Unlocking the bootloader usually voids any warranties and may make the device susceptible to data theft.[1] On Chromebooks, enabling developer mode makes the system less secure than a standard laptop running Linux.[2] Unlocking the bootloader may lead to data loss on Android and ChromeOS devices, as some data is impossible to back up without root permission.

Sascha Segan from PCMag considered a locked bootloader a mistake on the Qualcomm Snapdragon Insiders phone, which is targeted at advanced users.[3]

Platforms

Android

Unlocking the bootloader is typically done during the process to obtain root access.

Android bootloader unlocking as of 2023[4]
Manufacturer Difficulty level Method
Google Easy (non-Verizon)
Impossible (Verizon)		 Command-line (unlocked variant, not restricted to carrier, and non-Verizon carrier variants when paid off fully)
Samsung Easy (outside North America)
Impossible (North America)		 Development settings (except North America variants)
OnePlus Easy (non-T-Mobile)
Medium (T-Mobile)		 Command-line, except on T-Mobile US variants where an unlock code is needed
Xiaomi Hard / Impossible Add Mi account, request code via Windows Only software, wait up to a month ( limited to one device per month ).

On devices with Mediatek system on a chip it is easy with a third-party tool called MTKClient

ASUS Impossible Unlocking was performed via a first party Unlocking Tool, but servers and app were removed.
Sony Medium Command-line, request code at Sony website
Fairphone Medium Command-line, request code at Fairphone website
Motorola Medium Command-line, request code at Motorola website
Realme Medium-Hard Command-line, after installation of the in-depth test app and submitting a application for in depth-testing.
Nothing Easy Command-line
Huawei Impossible, due to unlocking services being shut down N/A
OPPO Impossible (Fastboot Binaries Are Removed) N/A
HMD-Nokia Impossible N/A
vivo Impossible[5] N/A
LG Impossible, due to unlocking services being shut down,[6] only G and V series models from 2015 onwards were affected, including Velvet N/A
Tecno Easy Command-line
Infinix Easy Command-line
TCL Impossible N/A

History

The bootloaders of Nexus and Pixel devices can be unlocked by using the fastboot command fastboot oem unlock or if it doesn't recognize the command fastboot flashing unlock.[7]

When Motorola released a bootloader unlocking tool for the Droid Razr, Verizon removed the tool from their models.[8]

In 2011, Sony Ericsson released an online bootloader unlocking tool.[9] Sony requires the IMEI number to be filled in on their website.[10] For the Asus Transformer Prime TF201, Asus has released a special bootloader unlock tool.[11]

In 2012, Motorola released a limited tool for unlocking bootloaders.[12] They require accepting terms and conditions and creating an account before the bootloader can be unlocked for a Moto G.[13]

HTC phones have an additional layer of lock called "S-OFF/S-ON".

Bootloaders can be unlocked using an exploit or using a way that the vendor supplied. The latter method usually requires wiping all data on the device.[14] In addition, some manufacturers prohibit unlocking on carrier locked phones. Samsung phones and cellular tablets sold in the US and Canada do not allow bootloader unlocks regardless of carrier status.

In 2018, a developer from XDA Developers launched a service which allowed users to unlock the bootloader of some Nokia smartphone models.[15] Similarly, another developer from XDA Developers launched a service to allow users to unlock the bootloaders of Samsung Galaxy S20 and Samsung Galaxy S21 Phones.[16]

Huawei announced plans to allow users to unlock the bootloader of the Mate 30 series, but later retracted that.[17] Huawei has stopped providing bootloader unlock codes since 2018.[18] A bootloader exploit named checkm30 has been developed for HiSilicon based Huawei phones.[19][non-primary source needed]

When the bootloader of the Samsung Galaxy Z Fold 3 was unlocked, the camera became less functional. This could be restored by re-locking the bootloader.[20] This issue was later fixed by Samsung.[21] For the Samsung Galaxy S22 series, unlocking the bootloader has no effect on the camera.[22]

Others

Microsoft

The WPInternals tool is able to unlock bootloaders of all Nokia Lumia phones running Windows Phone, but not phones like the Alcatel Idol 4 or HP Elite x3.[23][24] Version 1.0 was released in November 2015.[25] In October 2018, the tool was released as open source software when the main developer René Lergner (also known as HeathCliff74) stepped down.[26]

The slab bootloader used by Windows RT could be unlocked using a vulnerability, but was silently patched by Microsoft in 2016.[27] UEFI Secure Boot on x86 systems can generally be unlocked.

Apple

The boot ROM protection on iOS devices with an A11 processor or older can be bypassed with a hardware exploit known as checkm8, which makes it possible to run other operating systems including Linux.[28]

The bootloader on Apple Silicon-based Macs can be unlocked.[29] However, other Apple devices like the iPhone and iPad cannot be bootloader unlocked even when using the same chip used in a Mac.

Google

The equivalent of bootloader unlocking is called developer mode in Chromebooks.[30] Chromebooks use custom bootloaders that can be modified or overwritten by removing a Write-protect screw.[31] Some models lack a screw and instead may or may not require disabling the onboard Cr50 chip.[1]

In 2013, the bootloader of the Chromecast was hacked using an exploit.[32] In 2021, it was hacked again for newer versions.[33]

ASUS

ASUS used to provide an Unlocking tool for both of their smartphone lines, the Zenfone and ROG Phone. This worked as an installable .apk file that the user could install on their phone, then unlock the bootloader. The app worked by contacting ASUS unlocking servers, then prompting the user to perform a factory reset. In 2023 ASUS removed the tool from their website and closed the unlocking servers, so even phones with the .apk file installed couldn't unlock their bootloaders. Representatives on the ASUS forums claimed the tool would be available again, but as of January 2024 no additional information has been provided, even after the release of their latest device the ROG Phone 8.

SpaceX

In August 2022, security researcher Lennert Wouters applied a voltage injection attack to bypass firmware verification of a Starlink satellite dish from SpaceX.[34]

Relocking

On Android, it is possible to relock the bootloader.[35]

Shutdown of online services

In 2018, Huawei stopped providing bootloader unlock codes.[36] On 31 December 2021, LG shut down their website which provided bootloader unlock codes.[37] On august 2023 ASUS removed the unlocking tool from their website and shut down the servers used to unlock the bootloader.[38]

See also

Explanatory notes

References

  1. ↑ Tamma, Rohit; Donnie Tindall (2015). Learning Android forensics: a hands-on guide to Android forensics, from setting up the forensic workstation to analyzing key forensic artifacts. Birmingham, UK. ISBN 978-1-78217-444-8. OCLC 910639389. 
  2. ↑ Porup, J. M. (2017-06-19). "How to install Linux on a Chromebook (and why you should)" (in en-us). https://arstechnica.com/gadgets/2017/06/how-to-install-linux-on-a-chromebook/. 
  3. ↑ "Qualcomm Smartphone for Snapdragon Insiders Review" (in en). https://www.pcmag.com/reviews/qualcomm-smartphone-for-snapdragon-insiders. 
  4. ↑ Wokke, Arnoud (2021-08-28). "Custom roms voor Android - Hoe zijn installatie en gebruik anno nu?" (in NL). https://tweakers.net/reviews/9256/custom-roms-voor-android-hoe-zijn-installatie-en-gebruik-anno-nu.html. 
  5. ↑ "vivo Smartphone FAQs | vivo India". https://www.vivo.com/in/support/questionList?categoryId=10047&FAQId=10204. 
  6. ↑ "Termination of LG Mobile Developer website service". https://developer.lge.com/main/RetrieveNoticePop.dev?nticId=NOT00005060. 
  7. ↑ "Factory Images for Nexus and Pixel Devices | Google Play services" (in en). https://developers.google.com/android/images. 
  8. ↑ Ingraham, Nathan (2011-10-24). "GSM Motorola RAZR hits the FCC; Verizon model has locked bootloader" (in en). https://www.theverge.com/android/2011/10/24/2511339/droid-razr-att-verizon-fcc. 
  9. ↑ By (2011-04-14). "Sony Ericsson Promotes Android Bootloader Unlocking" (in en-US). https://hackaday.com/2011/04/14/sony-ericsson-android-bootloader-unlockin/. 
  10. ↑ Kotipalli, Srinivasa Rao; Mohammed A. Imran (2016). Hacking Android: explore every nook and cranny of the Android OS to modify your device and guard it against security threats. Birmingham, UK. ISBN 978-1-78588-800-7. OCLC 957298786. 
  11. ↑ Tiefenthäler, Ronald (22 February 2012). "Asus: Bootloader Unlock Tool für Tablet Transformer Prime TF201 verfügbar" (in de). https://www.notebookcheck.com/Asus-Bootloader-Unlock-Tool-fuer-Tablet-Transformer-Prime-TF201-verfuegbar.70597.0.html. 
  12. ↑ Rodgers, Evan (2012-08-17). "Motorola unveils Android bootloader unlocking tool with limited device support" (in en). https://www.theverge.com/2012/8/17/3250448/motorola-bootloader-unlock-website. 
  13. ↑ Viscomi, Rick; Andy Davies; Marcel Duran (2015). Using WebPageTest: web performance testing for novices and power users. Sebastopol, CA. ISBN 978-1-4919-0281-3. OCLC 927108295. 
  14. ↑ Afonin, Oleg (2016). Mobile Forensics ' Advanced Investigative Strategies (1 ed.). Packt Publishing. ISBN 978-1-78646-408-8. OCLC 960040717. 
  15. ↑ Rox, Ricci (2 April 2018). "Nokia users can now unofficially unlock their bootloaders but the methodology is as sketchy as it gets" (in en). https://www.notebookcheck.net/Nokia-users-can-now-unofficially-unlock-their-bootloaders-but-the-methodology-is-as-sketchy-as-it-gets.293912.0.html. 
  16. ↑ "Android[UNSAMLOCK"]. 8 January 2021. https://forum.xda-developers.com/t/android-unsamlock-bootloader-unlock-for-samsung-us-canada-devices.4215101/. 
  17. ↑ "Huawei Mate 30 will not have an unlocked bootloader" (in en). 2019-09-25. https://indianexpress.com/article/technology/mobile-tabs/no-huawei-mate-30-will-not-have-an-unlocked-bootloader-6025448/. 
  18. ↑ "Huawei will no longer offer bootloader unlock codes for its Android devices" (in en-US). 2018-05-24. https://9to5google.com/2018/05/24/huawei-bootloader-unlock-stop/. 
  19. ↑ "Checkmate Mate 30 - Attack the bootrom of Huawei smartphones". https://raw.githubusercontent.com/hhj4ck/checkm30/master/checkm30.pdf. 
  20. ↑ Clark, Mitchell (2021-08-24). "Samsung will let you unlock your Z Fold 3's bootloader, but at the cost of your cameras" (in en). https://www.theverge.com/2021/8/24/22639869/samsung-galaxy-z-fold-3-camera-disable-bootloader-unlock. 
  21. ↑ "Unlocking the bootloader no longer kills the Galaxy Z Fold 3's cameras" (in en-US). 2021-12-07. https://www.xda-developers.com/bootloader-unlocking-no-longer-kills-galaxy-z-fold-3-cameras/. 
  22. ↑ "Unlocking the bootloader doesn't break the camera on the Samsung Galaxy S22 series" (in en-US). 2022-02-26. https://www.xda-developers.com/samsung-galaxy-s22-bootloader-unlock-camera-working/. 
  23. ↑ "Tool van Nederlandse ontwikkelaar kan custom roms op alle Lumia's flashen" (in NL). https://tweakers.net/nieuws/132519/tool-van-nederlandse-ontwikkelaar-kan-custom-roms-op-alle-lumias-flashen.html. 
  24. ↑ "Windows Phone Internals 2.2 Unlocks the Bootloader on all Windows 8 & 10 Lumia Smartphones" (in en-US). 2017-12-04. https://www.xda-developers.com/windows-phone-internals-2-2-unlocks-bootloader-windows-8-10-lumia-smartphones/. 
  25. ↑ Andrew Orlowski. "Rooting and modding a Windows Phone is now child's play" (in en). https://www.theregister.com/2015/11/27/rooting_and_modding_a_windows_phone_is_now_childs_play/. 
  26. ↑ "Windows 10 Mobile's bootloader unlocker is now open source" (in en). https://www.neowin.net/news/windows-10-mobiles-bootloader-unlocker-is-now-open-source/. 
  27. ↑ Francisco, Shaun Nichols in San. "Microsoft silently kills dev backdoor that boots Linux on locked-down Windows RT slabs" (in en). https://www.theregister.com/2016/07/15/windows_fix_closes_rt_unlock_loophole/. 
  28. ↑ Lundberg, Anders. "16-year-old runs Linux on iPhone 7" (in en). https://www.macworld.co.uk/news/linux-iphone-7-3800398/. 
  29. ↑ January 2021, Michelle Ehrhardt 19 (2021-01-19). "Linux is Finally on Apple M1...Kind Of." (in en). https://www.tomshardware.com/news/linux-for-apple-m1-beta. 
  30. ↑ December 2014, Lucian Armasu 31 (2014-12-31). "You Can Now Run Full Linux Apps Inside A Chrome OS Window" (in en). https://www.tomshardware.com/news/linux-apps-chrome-os-window,28293.html. 
  31. ↑ Robert, Foss (2017-03-08). "Quick hack: Removing the Chromebook Write-Protect screw" (in en). https://www.collabora.com/news-and-blog/blog/2017/03/08/quick-hack-removing-the-chromebook-write-protect-screw/. 
  32. ↑ "Chromecast bootloader exploit surfaces, opens up plenty of possibilities (video)" (in en-US). https://www.engadget.com/2013-07-28-chromecast-bootloader-exploit-video-hack.html. 
  33. ↑ "Modders ontgrendelen bootloader van Google Chromecast met Google TV" (in NL). https://tweakers.net/nieuws/185136/modders-ontgrendelen-bootloader-van-google-chromecast-met-google-tv.html. 
  34. ↑ Hardcastle, Jessica Lyons. "Starlink satellite dish cracked on stage at Black Hat" (in en). https://www.theregister.com/2022/08/12/starlink_terminal_hack_black_hat/. 
  35. ↑ Wilde, Damien (2021-09-09). "How to downgrade from Android 12 Beta to Android 11 on Google Pixel [Video"] (in en-US). https://9to5google.com/2021/09/09/how-to-downgrade-from-the-android-12-to-android-11-on-google-pixel/. 
  36. ↑ "Huawei stopt met het uitdelen van codes om bootloader vrij te geven" (in NL). https://tweakers.net/nieuws/139023/huawei-stopt-met-het-uitdelen-van-codes-om-bootloader-vrij-te-geven.html. 
  37. ↑ "LG stopt eind dit jaar met tool voor unlocken van smartphonebootloaders" (in NL). https://tweakers.net/nieuws/190366/lg-stopt-eind-dit-jaar-met-tool-voor-unlocken-van-smartphonebootloaders.html. 
  38. ↑ "ASUS is apparently killing the ability to root Zenfones" (in EN). https://www.androidauthority.com/asus-unlock-bootloader-tool-removed-3352783/. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Software:Bootloader_unlocking&oldid=3468166"