Hikari Calyx Tech Uncategorized How to unlock the bootloader and root Nokia X7 – 8.1 – 9 PureView

How to unlock the bootloader and root Nokia X7 – 8.1 – 9 PureView

Thanks for reading this article from my website!


Before that, I must tell you, DO NOT trust any anonymous website with tons of fake guides. Since I can really unlock the bootloader of both Nokia X7/8.1 and Nokia 9 PureView, I know how terrible the FIH Mobile is. Please check my tweets below if you still not sure.


From Nokia 3.1 Plus and Nokia X7, HMD introduced their 0x0008 Security Level to ensure they will have full control of device flashing. Not only that, they have changed a lot on bootloader and critical partitions. So none of the old methods are usable on Nokia X7/8.1/9 PureView, including CERT_TIMECOUNT hacking, unlock key generating by NTool, and devlock commands.

I know HMD Global doesn’t want us to unlock the bootloader of their phone, as I can sense it strongly when I finished bootloader unlock. I still need to work on the efuse disable to allow it being flashed casually.

Luckily, HMD released Nokia 8 Official Bootloader Unlock that will only usable after August 2018 Update last year, which made me stop bootloader unlock request of Nokia 8. That’s why I made the bootloader unlock of Nokia X7/8.1 and Nokia 9 PureView possible. You’ll know later.

Now, before you request bootloader unlock + root service for Nokia X7/8.1 or Nokia 9 PureView, you must read this article.

If you acknowledged that, let me tell you what will I do to acquire root permission.

  • Part I: Perform Pretest with NTool, and request unlock on my website
  • Part II: Trick the phone with temporarily root permission under FTM mode, and unlock the bootloader
  • Part III: Restore the phone info back to original
  • Part IV: Root the phone

Let’s get started.

Part I: Pretest and request unlock

To do pretest with NTool, you must use at least Windows 7 Service Pack 1. Windows 8, Windows 10 and respective Server Editions are also acceptable.

However, If you’re a loyally macOS or Linux distro user, or you failed pretest, you can do it under Virtual Machine with clean Windows OS installation. If you want to install Windows under VM, you can download Windows Installation Image from Microsoft officially or TechBench by WZT / UUPdump. These websites can be found easily by Googling. You don’t need to activate Windows since we only use it for bootloader unlocking and we will discard it once finished.

If you want to know how to do pretest, please watch this video:

Although video above uses Nokia 6.1 Plus X6 for demonstration, it will be the same for all of the HMD Nokia Phones when I mentioned “pretest”.

FYC, you can download NTool from following sites:

NTool Server

When pretest passed, please place order on my website. Just click “buy now” below.


Part II: Trick the phone and unlock it

This will introduce my secret unlock tool, which uses Mega Man EXE emblem as icon – you know I really love Mega Man Battle Network / Rockman.EXE, I just can’t totally get rid of it. 😛

This tool is available from my website or Telegram Channel “HCT Activities on Telegram”. To prevent reverse engineering and antivirus app checking, I’ve added extraction password which is 123, and an operation password to prevent unauthorized use, which I will never disclose.



Anyway, when correct operation password is typed, you’ll see this.

Please enable USB debugging on your phone, which I needn’t to mention how to do so. After I typed username and password of NTool, I’ll click SERVICE – you’ll need to power off your phone and connect it to PC.

When NTool asking for typing new IMEI, disconnect your phone, and I’ll click STOP. Then your phone will stay at FTM mode, which will have temporarily root permission under ADB shell. Now reconnect your phone and keep the screen unlocked to help me proceed.

Now focus on my secret unlock tool. It will recognize your phone automatically and check if your phone has enabled FTM mode. If yes, it will back up your original phone info, and trick the phone’s bootloader with Nokia 8’s Identification.

Screenshot above is taken with my early Nokia X7 unlock testing. I can guarantee all the procedure have no differences.

After phone is successfully tricked, it will reboot your phone to Fastboot mode automatically and import the Nokia 8 official unlock key to your phone, and ask you to confirm unlock on your phone.

In early test, critical unlock is unusable due to terrible bootloader coding by FIH Mobile, so I removed critical unlock in current version of tool.

That’s all you need to do about bootloader unlocking. Unlike previous models, Bootloader Unlock will only allow you root the phone, it won’t allow you flash your phone under fastboot anytime you want without flashing permission granting by either OSTLA or NTool.


Part III: Restore your phone info

After bootloader unlocked, I have to restore your phone info to make sure everything will still work as usual.

When the phone entered first boot, please finish it, skip Wi-Fi connection, DO NOT login Google account, and enable USB debugging.

I’ll put your phone to FTM mode again.

Then I can use my secret unlock tool to restore your phone’s original info.

Current version will restore your partitions that backed up automatically.

Part IV: Root the phone

Let me tell you the limitations of latest bootloader of PNX and AOP.

You might already know FIH introduced service bootloader inside their firmware, and that’s a critical part of everything since early days of Nokia 6 (2017) rooting.

Before I can break the efuse to ensure everything, here are the limitations:

Under Commercial Bootloader:

If service permission isn’t granted, then
fastboot flash command and fastboot –set-active
commands will refuse to work, and tell you the error below.

Flashing is not rooted for fused device

If service permission granted, these commands will work. However, they removed fastboot boot command in Commercial Bootloader, so the phone will tell you fastboot boot is Unknown Command.

Under Service Bootloader:

If service permission isn’t granted, then same as above. If service permission granted, then you can use almost every commands you’re familiar with, including fastboot boot.

However, service bootloader (mainly abl_service.elf) will not be verified as a part of OTA update, so I still need to restore it back to original.

After you know the limitations, let me tell you how I’ll root the phone.

  • Install Magisk Manager before everything, which you can download from topjohnwu’s Github Repository.
  • I’ll use NTool to flash respective grantabl.mlf in initroot package, that available for Download from FIH Firmware site. Before I use it, I’ll replace abl file first, which you needn’t to care.
  • NTool will grant service permission under service bootloader, and restore the abl partition back to your original one, that will allow you install further OTA updates.
  • Now I’ll perform temporarily boot with pre-made Magisk V19 Patched boot image under fastboot.
  • When the phone entered the desktop, open Magisk Manager. Tap “No thanks” if it asks you for extra installation. Reinstall or Update the Magisk itself with “Direct Install” option, or add latest Magisk zip as a Magisk module, which you can download from the Github Repo.

That’s all I need to do about Nokia X7 / 8.1 / 9 PureView bootloader unlocking and rooting.

You might want to ask, “How can I trust you if your procedure is not fake? “

Let me introduce you a friend of mine Narender Singh, whom operating a website known as TechMesto. He is also providing HMD Nokia bootloader unlock service and he has learned a lot from me. You can ask him if that’s real.

Leave a Reply

Related Post

[GUIDE] How to unlock bootloader for your Qualcomm based Nokia Android Phone[GUIDE] How to unlock bootloader for your Qualcomm based Nokia Android Phone

This article is a backup of original XDA topic because original topic violates the rule of XDA – any kind of selling is prohibited. 本文是XDA原帖的备份,因为原帖违反了XDA相关规定——禁止以任何形式在论坛贩卖、出售。 中文版教程请看这里 Please join NokiaMobile Telegram

享受属于Windows Phone的最后时光:OTC Updater实时下载推送方法享受属于Windows Phone的最后时光:OTC Updater实时下载推送方法

早在2017年,我就及时感觉到了Windows 10 Mobile升级的困难性,制作了Windows 10 Mobile离线更新包。两年之后,Windows Phone 8.1的应用商店早已经关闭,升级助手也无法使用了。这个时候,离线更新包得以派上用场。 如果需要使用离线更新包,请阅读本文(IT之家存档)——稍后本站会相应更新以适应现在版本的情况。 (IT之家发表的教程)https://www.ithome.com/html/win10/295565.htm (英文)https://forum.xda-developers.com/windows-10-mobile/guide-win10-mobile-offline-update-t3527340 在那之后的今天,我们依然可以通过从电脑往手机推送更新的方法让手机能够重新使用Windows 10 Mobile。根据机型的不同,当初支持能升级Windows 10 Mobile的机型更加推荐这一方法——OTC Updater。 OTC Updater是什么? 即便有IT之家报道,微软还是非常低调地发布了一款“通过线缆升级工具”(Over-The-Cable Updater),用于应对Windows Phone 8.1应用商店关闭之后的现状。 该工具支持曾经能够通过升级顾问升级的任何机型。以Lumia来讲,支持这些: 430, 435, 532, 535, 540, 635 1GB