I’ve gotten away with using a low-end phone for some time, but 1GB RAM only gets you so far. The prospect of shelling nearly 220 quid spurred me to root my old phone (Sanders). Besides, re-use fits my ‘green’ philosophy. And oh there’s the anti-China sentiment brought to bear too.
Why keep a superior configuration as spare, to a low-end model? Well, for one it’s a hand me down, and for another, in the tradition of manufacturers limiting over the air (OTA) Android updates to one year or two, OTA updates for Sanders stopped at 8.1 (Oreo). On the other hand, low-budget phone has Android 10 (Go Edition – but still).
‘Jailbreaking’ — iOS/Apple’s romanticised equivalent– is perhaps a better word. Manufacturers really do ring-fence the device to stop you from upgrading the OS on your own.
Although the root was successful, it’s not all song and dance. Took me two attempts, a day apiece. The first being a partial success (marred by camera hang) — yet elating.
The second, let’s fix this with a re-do, pulled it off but oddly didn’t give me the same high. Hmmph…
A run down of my experience for the slightly nerdy, who’d like a challenge:
The first thing to get your head around is that Android (just like Mac OS) stands on the shoulders of Linux. So your phone is really running an operating System (OS). A decade ago it was common to download virtual disc images (ISOs) to install operating systems like Fedora or Ubuntu on our PC. An ISO is really a binary image (snapshot) of a disc like a DVD, in a file format for loading up into a virtual disc drive.
Conceptually a ROM is similar. It represents an image of a particular flavour of Android with the additional restriction that a ROM is tied to a particular Android device. Yes they’re not very portable.
Rooting is akin to installing a new OS on your PC – from Windows to Linux. The similarities between computers and smartphones make it easier to grasp. Your device has RAM, solid-state (flash) disk space, and a CPU (reduced RISC based ARM processors as opposed to complex CISC based chips in PCs).
When a PC or a phone boots up (powers on), there’s a special section of the disk (usually the first few sectors or locations) that are reserved for the bootloader. This is basically a program with instructions on what hardware drivers to load and where to find the OS.
Unlocking the bootloader
Smartphone manufacturers lock (password protect) the bootloader to prevent a malicious actor (hackers) from inserting maleficent code that could subvert your phone. But it also prevents you from re-orienting the bootloader to load a new OS.
Some more egalitarian manufacturers provide a route to unlocking, where you register on their website and provide a hardware key and they email you the bootloader unlock key in response. For example HTC allows models from the year 2011 onwards to be unlocked from their HTCDev Bootloader Unlock site. Moto has a customer help portal.
To get the hardware key and follow the rest of the rooting process you need to take care of a couple of things:
- install your device hardware drivers (download from manufacturer)
- set up debug communication channel betwixt phone and PC
- install the android debug bridge (adb) toolset on your PC (as part of Android SDK or standalone)
- enable Developer mode by tapping 7 times on Build Info (on Marshmallow (6.0): About > Software Infmn. > More > Build number)
- enable Developer options > USB Debugging
- enable OEM unlock (not required on older devices like HTC One (M8))
This done, your device and PC can communicate in debug mode. Connect both via a USB cable, open a command prompt and type:
$ adb devices List of devices attached SH4… unauthorized
If you see an empty list, it might mean the device wasn’t detected. The fastboot display can provide insights, for example while rooting the Htc One (M8), I ran into:
- FASTBOOT AC
Points to a faulty USB cable (only two of four pins in action, ie, simply charging rather than providing data connectivity). Replace the cable until the AC goes away. - FASTBOOT
Device drivers were not installed. A recognised (driver installed) device, shows “FASTBOOT USB” when connected.
Now to get the key for use in unlocking. The command varies with oem (manufacturer), and is provided on their unlocking support site.
// For HTC $ fastboot oem get_identifier_token (bootloader) (bootloader) < Please cut following message > (bootloader) <<<< Identifier Token Start >>>> (bootloader) 3E1………DC71CB4………… (bootloader) 11BAC……………1A319FE (bootloader) 61CC7………………0A70F4 ... (bootloader) AB………………1C5946D2C (bootloader) 7D73F058………………68F (bootloader) 491DF9C3………………2B8 (bootloader) <<<<< Identifier Token End >>>>> OKAY Finished. // On Moto: $ fastboot oem get_unlock_data
Once you get the unlock key, you usually submit it to the oem support site using a web form and they typically mail you back an unlock key. Again the steps to apply this key vary.
// on HTC: $ fastboot flash unlocktoken Unlock_code.bin Sending 'unlocktoken' (0 KB) OKAY Writing 'unlocktoken' (bootloader) unlock token check successfully OKAY Finished // on Moto: $ fastboot oem unlock <UNIQUE_KEY>
The bootloader is unlocked post a confirmation screen.
Once again, re-enable your device Developer Options and Debug mode (the unlock resets them).
There is also a command available to re-lock the bootloader (eg on HTC, ‘fastboot oem lock’).
fastboot mode
Think of it as a cross between BIOS and safemode on your pc.
$ adb reboot bootloader // the first time, device will prompt to accept connection from // PC identified by MAC Id (hardware key). Check to remember.
Or you could power off your device, and press down the Volume Down button and Power button together for upto 4 seconds. In fastboot, the device screen should list build details…
AP Fastboot Flash Mode Variant: sanders XT180... CPU: MSM8953 eMMC: 64GB Sam... DRAM: 4GB Sa... // and on your pc: $ fastboot devices SH4… fastboot
Flashing a Recovery Image
Your device comes with a stock recovery image that loads your OS. Team Win Recovery Project (TWRP) is a cool project that provides a recovery image specific to each phone model. You replace the stock image on your device with your device specific twrp image, thereby letting you install a different OS version (a different ROM).
$ fastboot flash recovery twrp-<n.n.n-n>-<yourdevice>.img Writing 'recovery' (bootloader) Image not signed or corrupt OKAY Finished.
Then you boot in recovery mode, or just boot up to the recovery image, thusly:
$ fastboot boot twrp-<n.n.n-n>-<yourdevice>.img Sending 'boot.img' (… MB) OKAY Booting OKAY Finished.
At this point you better have previously downloaded the ROM (like PixelExperience 10 Plus) that you want to install.
Removing Device Encryption
When twrp loads, it asks for a password. Select cancel, and then:
- tap Wipe > Format Data.
This removes the encryption on your device. - Go back and choose Advanced Wipe. Check the Cache & System boxes (and Dalvik and Data), and swipe to wipe.
Sideloading the OS
Now onto side-loading the ROM. Side-loading is installing an unofficial (non Google Play Store) app on your device.
Still in twrp return to the main screen, select Advanced > Adb sideload > swipe right.
The phone then waits for you to run this on your machine:
$ adb sideload <rom_file>.zip Total xfer: 1.00x
One curious (mayhaps a Windows 10) issue I ran across on an M8: in recovery mode, it takes forever before the device is recognised or shows up in fastboot mode. So you’ll be waiting in sideload mode for some time with the sideload failing the first few times, until it finally discovers the device and works.
$ fastboot devices $adb devices List of devices attached $ adb devices List of devices attached SH4........ sideload $ adb sideload lineage-<NN.N>-<build>-m8-signed.zip Total xfer: 1.01x
Repeat the Sideload process for any other tool you wish to install.
$ adb sideload Magisk-20.4(20400).zip
Some tools have corresponding apk files that you can load using the Install option on the twrp main screen.
Now reboot your phone or type:
$ adb reboot
Disclaimer
Be warned that unlocking your bootloader means kissing your warranty good-bye. And there’s the risk of bricking your device if you take a wrong turn. Also, rooting is tripwire to mobile device managers (MDM) that some employers require on your (BYOD) device before you can access company resources. A rooted device will be out of compliance. Workarounds where possible, will still run foul of your employer’s policies. These involve hiding the rooted nature of your device from applications that seek superuser (root in Linux parlance) access, or locking the bootloader once the process is complete.
Differences between first and second rounds. The second time I used the adb toolset from Android Studio versus a standalone minimal toolset previously. Also, I might’ve strayed from the wipe sequence the first time in confusion.
Hope that gives you some perspective. If you’re brave enough to try this on your own, choose an older, out of warranty device, and, do some research on the specific instructions for your device. Don’t treat this piece as a guide, my purpose is only to help give you a high-level understanding of what it takes.
Endnote
Rooting can leave you with really strange bugs, such as on Lineage OS and HTC One M8, file transfer doesn’t work out of the box when connected in USB. The resolution is to disable developer mode, switch to PTP and then jump back to File Transfer. I know!
Device feature rundown
| Htc One (M8) | Moto G(5S) Plus | |
| Provenance | Summer ’14 | Winter ’17 |
| Last OTA Update | Marshmallow (6.0) | Oreo (8.1) |
| Rooted ROM | Android 10 — Lineage OS 17.1 (sideloaded AOSP Gapps arm nano separately) | Android 10 – PixelExperience 10 Plus (gapps in-built) |
| System on a Chip (SoC) | Qualcomm Snapdragon 801 | Qualcomm Snapdragon 625 |
| CPU | Quad-core, 2.26 GHz / MSM 8974 ABv3 | Octa-core, 2 GHz / Cortex A53 |
| RAM | 2 GB LPDD33 | 4 GB |
| Flash Drive | 16 GB | 64 GB |
| Battery | 2600 mAh Li-po | 3000 mAh |
| GPU | Adreno 330 | Adreno 506 |
| Sensors/Activators: | Accelerometer, Gyro, IR blaster | |
| Screen / Resolution | 5″ / 1920 x 1080 pxl | 5.5″ / 1920 x 1080 pxl |
| Rear Camera | 4 Mpx, F2.0, with 2 MPx DoF sensor | 13 Mpx |
2 replies on “Unlocking Android”
Nicely explained 👍
Thanks Prashant. Glad you liked it.