Step 3
Now please download our bootloader unlock tool.
Depends on your operating system on your PC, we provide two methods.
Please click the button below to download our bootloader unlock tool, then find somewhere to extract it. The directory path cannot have brackets or spaces.
Install Driver
For Generic x86 or x64 PC
If you’re using Generic x86 or x64 based Windows PC (in other words, this PC is powered by Intel or AMD processor), all you need to do is open “setup.exe” inside of Driver folder, then import “RegistryFix.reg”.
If you see this error message, it means you have drivers installed previously, which is expected.
Now you’re all set for using HCTSW Care UU4!
Start Unlocking
Once you have driver installed, please open “HCTSW_Care_UU4.cmd” directly. You cannot run it as Administrator. Then power off and connect your phone. It will try to check if you have submitted unlock request from our website. If yes the tool will allow you proceed to further step. Just press [Y] key to proceed.
Now just wait patiently and it will tell you what to do next.
Once the unlock procedure finishes, UU4 will submit unlock successful message to server and your order will be marked as finished immediately.
Troubleshoot
‘reg’ is not recognized as an internal or external command,
operable program or batch file.
Your “PATH” environment variable is corrupted. To fix it, right click on Start – Run, and execute:
SystemPropertiesAdvanced
Then click “Environment Variables…” button and change the value of “Path” under “System variables” into:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files\dotnet\;
The tool crashed immediately!
Check if the PATH environment variable mentioned above is corrupted. Then, please make sure the folder you stored UU4 does not contain spaces or brackets. Avoid placing it on your desktop especially when your user name contains space.
ERROR: Unable to connect to Hikari Calyx Tech API Server. Error Code: 6
Please make sure you can access to https://api.hikaricalyx.com/ properly.
The tool does run, but I’m unable to proceed properly!
Please check if your IP address is under AbuseIPDB database. To prevent the server being abused we have a blocklist based on AbuseIPDB database and our custom blocklist. If your believe your IP address is wrongly banned, please report your IP address to HCTSW Care and we will put your IP address into allowlist.
We did not find your order in our website.
If you think that’s an error, please contact HCT by providing your order number.
Error Code: 00001006
If you really have requested the service from our website, please check if you have provided serial number properly. If your Product Serial Number is 0123456789ABCDEF then it cannot be processed with our unattended service.
ERROR: Program version is too old or corrupted.
Please re-download the correct and latest client file.
Error Code: 00002005
Please make sure you have downloaded latest version of UU4 from this website instead of other sources. Besides our server does not accept request from modified tool.
ERROR: Your OS doesn’t have Universal C Runtime (KB2999226) installed.
If you’re using Windows 7 Service Pack 1 or newer, this tool will install Universal C Runtime automatically. Once installed, reboot your PC (if required) and open HCTSW_Care_UU4 again.
If the KB2999226 update installation dialog didn’t show up, you’re still using outdated OS. Please upgrade your OS to Windows 10 before you use this tool.
We assume you’re familiar with Bash Shell commands, and you have Android SDK Platform Tools properly configured.
We’ve tested this procedure under following Linux distributions:
- Debian 11 AMD64, ARMHF, ARM64 (Raspberry Pi OS)
- This also includes Chrome OS Crostini.
- Ubuntu 20.04 and Ubuntu 22.04 AMD64
- Fedora 36 AMD64
- openSUSE Tumbleweed AMD64
- Deepin / UOS 20.7 AMD64
We cannot guarantee it will run under Termux, UserLAnd or Kali NetHunter.
Download UU4 for Windows and Extract
The reason why UU4 for Windows is still required is, you’ll need to use bootloader images inside. Go back to previous page to download it. We assume you extracted it to ~/uu4win/ .
Install Service Permission Granting Program
Execute these commands to install prerequisites. We assume you’re working under home directory (~, or /home/your_user_name/ ):
$ git clone https://github.com/HikariCalyx/uu4-linux
$ cd uu4-linux
$ sudo bash install.sh
Doing so will install Python-ADB and all necessary prerequisites. You can review what’s written in install.sh before you proceed.
The prerequisites installation procedure for macOS isn’t written, so you’ll have to understand how to utilize Homebrew to install prerequisites.
Enter Fastboot Mode and check if Unlock Request is submitted properly
You have two methods to enter Fastboot mode. Other than your familiar “adb reboot bootloader” command, you can also enter Fastboot mode by executing this command:
$ fastboot oem alive
Then power off the phone and connect it to PC.
To check if unlock request is submitted properly (Note, this step cannot be skipped), you’ll have to execute:
$ python3 auth_utility/checkOrder.py --uu4hash 1234 --mode check
If you see output like this and the exit code is 0:
{'orderNumber': 'HCT-F1914001111', 'orderStatus': 'processing'}
Then it means you have successfully requested bootloader unlock on our server. You can proceed now. If you see a bunch of error messages, please check if your PC is accessible to https://api.hikaricalyx.com .
Grant Service Permission and Flash Service Bootloader
Before you proceed, you should execute:
$ fastboot oem getversions
Example output:
(bootloader) model=A1N
(bootloader) sub_model=none
(bootloader) software version=A1N-5140-0-00WW-B01
(bootloader) SW model=00WW
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_
Please take note of software version line and this is important for few phones.
To grant service permission, you’ll need to execute:
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
If you see output like this:
Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
DM-Veracity Challenge: 37394611CA83C2960FF9F957BBCD503A6E7FA545
And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.
Please locate the bootloader image directory for your phone, and flash it to your phone like this:
## Phones that use emmc_appsboot should flash service bootloader like this:
$ fastboot flash aboot ~/uu4win/bootloader_image/(actual_path_for_your_phone)/emmc_appsboot_service.mbn
## Phones that use abl and xbl (if exists) should flash service bootloader like this:
$ fastboot flash abl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/abl_service.elf
$ fastboot flash xbl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/xbl_service.elf
## Phones that use LK should flash service bootloader like this:
$ fastboot flash lk_a ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot flash lk_b ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot reboot-bootloader
All bootloader images are categorized by SoC model and project code. For MTK models, the LK version is sensitive, flashing wrong version LK image may cause your phone fail to boot. For Qualcomm models, make sure you selected the correct ABL/XBL/ABOOT image for your phone.
Grant Service Permission again and Perform Bootloader Unlock (for most of models)
Now you have booted into Service Bootloader, you can proceed to bootloader unlock procedure. First of all, execute this command to grant service permission.
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
If you see output like this:
Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
UID: D92F8C834538AD2654374904FDDA5B80C736C2E7
And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.
For most of Qualcomm models excluding Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)
Now execute these commands to perform bootloader unlock.
$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot flashing unlock_critical
## confirm bootloader unlock on your phone if needed, then boot into Fastboot mode again
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot oem unlock-go
## confirm bootloader unlock on your phone if needed
Additional Steps for Nokia 6.1 running Chinese firmware
Do not follow this procedure if you’re not using Nokia 6.1.
If you’re using Chinese version of Nokia 6.1 or Foxconn internally customized Nokia 6.1 that running Chinese version firmware and would like to install Lineage OS afterwards, you’ll have to install bootloader image for Global ROM, then repeat the bootloader unlock procedure above.
To confirm if you’re using Chinese version of Nokia 6.1, check output of “fastboot oem getversions”.
(bootloader) model=P2C
(bootloader) sub_model=none
(bootloader) software version=PL2-347I-0-00CN-B02
(bootloader) SW model=00CN
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_
If model is P2C, then you’re using Chinese version of Nokia 6.1. If SW model is 00CN then you’re using Chinese firmware as well, otherwise you can safely skip this procedure.
To install Global ROM bootloader images and perform bootloader unlock again, execute these commands:
$ cd ~/uu4win/bootloader_image/SDM660-835/PL2-C1N-4/P2C_additional/
$ fastboot flash partition gpt_both0.bin
$ fastboot flash abl_a ../abl_service.elf
$ fastboot flash xbl_a ../xbl_service.elf
$ fastboot flash tz_a tz.mbn
$ fastboot flash rpm_a rpm.mbn
$ fastboot flash hwcfg hwcfg.img
$ fastboot flash hyp_a hyp.mbn
$ fastboot flash pmic_a pmic.elf
$ fastboot flash keymaster_a keymaster64.mbn
$ fastboot flash cmnlib_a cmnlib.mbn
$ fastboot flash cmnlib64_a cmnlib64.mbn
$ fastboot flash dsp_a dspso.bin
$ fastboot flash devcfg_a devcfg.mbn
$ fastboot flash sec sec.dat
$ fastboot flash tz_a tz.mbn
$ fastboot flash systeminfo_a systeminfo.img
$ fastboot reboot-bootloader
$ cd ~/uu4-linux/
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem CustomerSKUID set 600WW
Then, repeat the bootloader unlock procedure above. Once bootloader unlock finishes, you can proceed to Lineage OS installation or Global stock ROM installation procedure.
For MediaTek models
Simply execute these 2 commands.
$ fastboot flashing unlock
## confirm bootloader unlock on your phone by pressing Volume up key
$ fastboot reboot
For Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)
Procedure for these 2 models are super complicated. Proceed with caution!
$ fastboot oem fih on
$ fastboot oem allport
$ fastboot oem fuar
## Now your phone should boot into Rooted ADB Shell...Check if you really get Rooted ADB Shell
$ adb shell uid
## Just in case the phone does not include dd binary
$ adb push ~/uu4win/bin/linux/arm64/busybox /data/local/tmp/b
$ adb shell chmod +x /data/local/tmp/b
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/mfd of=/data/local/tmp/mfd.img
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/securefs of=/data/local/tmp/securefs.img
$ adb pull /data/local/tmp/mfd.img
$ adb pull /data/local/tmp/securefs.img
$ psn=$(adb shell getprop ro.serialno)
$ printf ${psn} | dd of=~/uu4win/bootloader_image/SDM710-845/mfdaop.img bs=1 seek=112 count=16 conv=notrunc
$ adb push ~/uu4win/bootloader_image/SDM710-845/mfdaop.img /data/local/tmp/
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/mfdaop.img /dev/block/bootdevice/by-name/mfd
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ adb push ~/uu4win/bootloader_image/SDM710-845/PNX/2-abl_service.elf /data/local/tmp/a
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ adb push ~/uu4win/bootloader_image/SDM710-845/AOP/4-abl_service.elf /data/local/tmp/a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_b
$ adb reboot bootloader
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock_critical
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot flash mfd mfd.img
$ fastboot flash mfdbk mfd.img
$ fastboot flash securefs securefs.img
$ fastboot flash securefsbk securefs.img
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/PNX/6-abl.elf
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/AOP/5-abl.elf
That concluded the procedure of bootloader unlock.
How about dump boot image for Magisk Root?
Since you’ve read how to enter Rooted ADB Shell from the procedure for Nokia 8.1 / X7 / 9, then I guess you should know how to dump boot image.
However, for Nokia 3.1 A / C (EAG) and 3.1 Plus C (RHD), entering Rooted ADB Shell will cause the bootloader unlock revert back to locked state, so we strongly recommend you dump boot image before you proceed to bootloader unlock.