In this article, we assume you’re familiar with Bash Shell commands, and you have Android SDK Platform Tools properly configured and unlock request submitted on our server (click here if you haven’t).
We’ve tested this procedure under following Linux distributions:
- Debian 11 AMD64, ARMHF, ARM64 (Raspberry Pi OS)
- This also includes Chrome OS Crostini.
- Ubuntu 20.04 and Ubuntu 22.04 AMD64
- Fedora 36 AMD64
- openSUSE Tumbleweed AMD64
- Deepin / UOS 20.7 AMD64
We cannot guarantee it will run under Termux, UserLAnd or Kali NetHunter.
Download UU4 for Windows and Extract
The reason why UU4 for Windows is still required is, you’ll need to use bootloader images inside. Go back to previous page to download it. We assume you extracted it to ~/uu4win/ .
Install Service Permission Granting Program
Execute these commands to install prerequisites. We assume you’re working under home directory (~, or /home/your_user_name/ ):
$ git clone https://github.com/HikariCalyx/uu4-linux
$ cd uu4-linux
$ sudo bash install.shDoing so will install Python-ADB and all necessary prerequisites. You can review what’s written in install.sh before you proceed.
The prerequisites installation procedure for macOS isn’t written, so you’ll have to understand how to utilize Homebrew to install prerequisites.
Enter Fastboot Mode and check if Unlock Request is submitted properly
You have two methods to enter Fastboot mode. Other than your familiar “adb reboot bootloader” command, you can also enter Fastboot mode by executing this command:
$ fastboot oem aliveThen power off the phone and connect it to PC.
To check if unlock request is submitted properly (Note, this step cannot be skipped), you’ll have to execute:
$ python3 auth_utility/checkOrder.py --uu4hash 1234 --mode checkIf you see output like this and the exit code is 0:
{'orderNumber': 'HCT-F1914001111', 'orderStatus': 'processing'}Then it means you have successfully requested bootloader unlock on our server. You can proceed now. If you see a bunch of error messages, please check if your PC is accessible to https://api.hikaricalyx.com .
Grant Service Permission and Flash Service Bootloader
Before you proceed, you should execute:
$ fastboot oem getversionsExample output:
(bootloader) model=A1N
(bootloader) sub_model=none
(bootloader) software version=A1N-5140-0-00WW-B01
(bootloader) SW model=00WW
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_Please take note of software version line and this is important for few phones.
To grant service permission, you’ll need to execute:
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234If you see output like this:
Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
DM-Veracity Challenge: 37394611CA83C2960FF9F957BBCD503A6E7FA545And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.
Please locate the bootloader image directory for your phone, and flash it to your phone like this:
## Phones that use emmc_appsboot should flash service bootloader like this:
$ fastboot flash aboot ~/uu4win/bootloader_image/(actual_path_for_your_phone)/emmc_appsboot_service.mbn
## Phones that use abl and xbl (if exists) should flash service bootloader like this:
$ fastboot flash abl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/abl_service.elf
$ fastboot flash xbl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/xbl_service.elf
## Phones that use LK should flash service bootloader like this:
$ fastboot flash lk_a ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot flash lk_b ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot reboot-bootloaderAll bootloader images are categorized by SoC model and project code. For MTK models, the LK version is sensitive, flashing wrong version LK image may cause your phone fail to boot. For Qualcomm models, make sure you selected the correct ABL/XBL/ABOOT image for your phone.
Grant Service Permission again and Perform Bootloader Unlock (for most of models)
Now you have booted into Service Bootloader, you can proceed to bootloader unlock procedure. First of all, execute this command to grant service permission.
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234If you see output like this:
Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
UID: D92F8C834538AD2654374904FDDA5B80C736C2E7And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.
For most of Qualcomm models excluding Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)
Now execute these commands to perform bootloader unlock.
$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot flashing unlock_critical
## confirm bootloader unlock on your phone if needed, then boot into Fastboot mode again
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot oem unlock-go
## confirm bootloader unlock on your phone if neededAdditional Steps for Nokia 6.1 running Chinese firmware
Do not follow this procedure if you’re not using Nokia 6.1.
If you’re using Chinese version of Nokia 6.1 or Foxconn internally customized Nokia 6.1 that running Chinese version firmware and would like to install Lineage OS afterwards, you’ll have to install bootloader image for Global ROM, then repeat the bootloader unlock procedure above.
To confirm if you’re using Chinese version of Nokia 6.1, check output of “fastboot oem getversions”.
(bootloader) model=P2C
(bootloader) sub_model=none
(bootloader) software version=PL2-347I-0-00CN-B02
(bootloader) SW model=00CN
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_If model is P2C, then you’re using Chinese version of Nokia 6.1. If SW model is 00CN then you’re using Chinese firmware as well, otherwise you can safely skip this procedure.
To install Global ROM bootloader images and perform bootloader unlock again, execute these commands:
$ cd ~/uu4win/bootloader_image/SDM660-835/PL2-C1N-4/P2C_additional/
$ fastboot flash partition gpt_both0.bin
$ fastboot flash abl_a ../abl_service.elf
$ fastboot flash xbl_a ../xbl_service.elf
$ fastboot flash tz_a tz.mbn
$ fastboot flash rpm_a rpm.mbn
$ fastboot flash hwcfg hwcfg.img
$ fastboot flash hyp_a hyp.mbn
$ fastboot flash pmic_a pmic.elf
$ fastboot flash keymaster_a keymaster64.mbn
$ fastboot flash cmnlib_a cmnlib.mbn
$ fastboot flash cmnlib64_a cmnlib64.mbn
$ fastboot flash dsp_a dspso.bin
$ fastboot flash devcfg_a devcfg.mbn
$ fastboot flash sec sec.dat
$ fastboot flash tz_a tz.mbn
$ fastboot flash systeminfo_a systeminfo.img
$ fastboot reboot-bootloader
$ cd ~/uu4-linux/
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem CustomerSKUID set 600WWThen, repeat the bootloader unlock procedure above. Once bootloader unlock finishes, you can proceed to Lineage OS installation or Global stock ROM installation procedure.
For MediaTek models
Simply execute these 2 commands.
$ fastboot flashing unlock
## confirm bootloader unlock on your phone by pressing Volume up key
$ fastboot rebootFor Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)
Procedure for these 2 models are super complicated. Proceed with caution!
$ fastboot oem fih on
$ fastboot oem allport
$ fastboot oem fuar
## Now your phone should boot into Rooted ADB Shell...Check if you really get Rooted ADB Shell
$ adb shell uid
## Just in case the phone does not include dd binary
$ adb push ~/uu4win/bin/linux/arm64/busybox /data/local/tmp/b
$ adb shell chmod +x /data/local/tmp/b
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/mfd of=/data/local/tmp/mfd.img
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/securefs of=/data/local/tmp/securefs.img
$ adb pull /data/local/tmp/mfd.img
$ adb pull /data/local/tmp/securefs.img
$ psn=$(adb shell getprop ro.serialno)
$ printf ${psn} | dd of=~/uu4win/bootloader_image/SDM710-845/mfdaop.img bs=1 seek=112 count=16 conv=notrunc
$ adb push ~/uu4win/bootloader_image/SDM710-845/mfdaop.img /data/local/tmp/
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/mfdaop.img /dev/block/bootdevice/by-name/mfd
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ adb push ~/uu4win/bootloader_image/SDM710-845/PNX/2-abl_service.elf /data/local/tmp/a
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ adb push ~/uu4win/bootloader_image/SDM710-845/AOP/4-abl_service.elf /data/local/tmp/a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_b
$ adb reboot bootloader
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock_critical
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot flash mfd mfd.img
$ fastboot flash mfdbk mfd.img
$ fastboot flash securefs securefs.img
$ fastboot flash securefsbk securefs.img
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/PNX/6-abl.elf
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/AOP/5-abl.elfThat concluded the procedure of bootloader unlock.
How about dump boot image for Magisk Root?
Since you’ve read how to enter Rooted ADB Shell from the procedure for Nokia 8.1 / X7 / 9, then I guess you should know how to dump boot image.
However, for Nokia 3.1 A / C (EAG) and 3.1 Plus C (RHD), entering Rooted ADB Shell will cause the bootloader unlock revert back to locked state, so we strongly recommend you dump boot image before you proceed to bootloader unlock.