Huawei bootloader: what is

Huawei bootloader: what is "FB Lock" and how to unlock it?

Question

I was playing around with my spare Huawei phone trying to bypass the security without wiping data and came along this article: https://blog.salvationdata.com/2018/09/07/case-study-mobile-forensics-a-practical-solution-to-unlock-huawei-bootloader/

In step 3, you should "temporarily disable FB lock". What does this mean and how do I unlock it using fastboot? I suppose, that I cannot do that using standard fastboot oem unlock command, but I couldn't find anything else in the fastboot documentation.

EDIT: Result of fastboot help command as requested:
https://pastebin.com/2rhr1PTT

platform-tools$ ./fastboot help

usage: fastboot [OPTION...] COMMAND...



flashing:

 update ZIP

  Flash all partitions from an update.zip package.

 flashall

 Flash all partitions from $ANDROID_PRODUCT_OUT.


 On A/B devices, flashed slot is set as active.


 Secondary images may be flashed to inactive slot.

 flash PARTITION [FILENAME] Flash given partition, using the image from


 $ANDROID_PRODUCT_OUT if no filename is given.



basics:

 devices [-l]

List devices in bootloader (-l: with device paths).

 getvar NAME

 Display given bootloader variable.

 reboot [bootloader]

  Reboot device.



locking/unlocking:

 flashing lock|unlock

 Lock/unlock partitions for flashing

 flashing lock_critical|unlock_critical


 Lock/unlock 'critical' bootloader partitions.

 flashing get_unlock_ability


 Check whether unlocking is allowed (1) or not(0).



advanced:

 erase PARTITION

Erase a flash partition.

 format[:FS_TYPE[:SIZE]] PARTITION


 Format a flash partition.

 set_active SLOT

Set the active slot.

 oem [COMMAND...]

  Execute OEM-specific command.



boot image:

 boot KERNEL [RAMDISK [SECOND]]


 Download and boot kernel from RAM.

 flash:raw PARTITION KERNEL [RAMDISK [SECOND]]


 Create boot image and flash it.

 --cmdline CMDLINE

 Override kernel command line.

 --base ADDRESS

 Set kernel base address (default: 0x10000000).

 --kernel-offset

Set kernel offset (default: 0x00008000).

 --ramdisk-offset

  Set ramdisk offset (default: 0x01000000).

 --tags-offset

  Set tags offset (default: 0x00000100).

 --page-size BYTES

 Set flash page size (default: 2048).

 --header-version VERSION
Set boot image header version.

 --os-version MAJOR[.MINOR[.PATCH]]


 Set boot image OS version (default: 0.0.0).

 --os-patch-level YYYY-MM-DD


 Set boot image OS security patch level.



Android Things:

 stage IN_FILE

  Sends given file to stage for the next command.

 get_staged OUT_FILE

  Writes data staged by the last command to a file.



options:

 -w

 Wipe userdata.

 -s SERIAL

Specify a USB device.

 -s tcp|udp:HOST[:PORT]
  Specify a network device.

 -S SIZE[K|M|G]

 Break into sparse files no larger than SIZE.

 --slot SLOT

 Use SLOT; 'all' for both slots, 'other' for


 non-current slot (default: current active slot).

 --set-active[=SLOT]

  Sets the active slot before rebooting.

 --skip-secondary

  Don't flash secondary slots in flashall/update.

 --skip-reboot

  Don't reboot device after flashing.

 --disable-verity

  Sets disable-verity when flashing vbmeta.

 --disable-verification
  Sets disable-verification when flashing vbmeta.

 --wipe-and-use-fbe

Enable file-based encryption, wiping userdata.

 --unbuffered

Don't buffer input or output.

 --verbose, -v

  Verbose output.

 --version

Display version.

 --help, -h

  Show this message.

— Jackie | Sources

Answer

There are two types of bootloader locks in Huawei devices: FB Lock and USER Lock.

USER Lock restricts the standard partitions like system, data, recovery, kernel etc, but not the critical bootloader-partitions which I don't remember the names of. (So you can't edit them even if you perform a USER Unlock) The USER Lock is what requires the bootloader unlock code to unlock. Also, there are some hidden hardware commands which are used for serious debugging like JTAG, that cannot be accessed with a USER Unlock.

FB Lock is used for protecting these restricted functions. A FB Unlock works as a key for all of Fastboot. (So if you perform a FB Unlock then you can unlock everything USER Unlock does, and the other restricted stuff) FB Lock is intended to be used by Huawei personnel for repairing. It is NOT supposed to be unlocked by users, but it is possible anyway, as I discovered after quite some research, but it doesn't work on very new firmware versions like EMUI 8.2 or July/August Security patch. It has been used for years by paid software for performing FRP Unlock, full system restoring, and it can even be used for obtaining a bootloader code for USER Unlock. A FB Unlock is usually temporary.

The method of FB Unlock has been kept behind cover for quite some time now, but I saw recently that it has been leaked on XDA. You can check it out here. That guide also covers a method for extracting the NVME partition for a permanent FB Unlock. If you don't want a permanent FB Unlock, but would like just a normal USER Unlock, you can skip doing steps after 3, but instead when you boot into TWRP, you can use:

su -c "grep -m1 -aoE 'WVLOCK.{
14
}
[0-9]{
16
}
' /dev/block/mmcblk0p7 |grep -aoE '[0-9]{
16
}
'"

That will output the bootloader unlock code which you can use for standard USER Unlock. Good Luck!

— Supersonic | Sources

Huawei bootloader: what is "FB Lock" and how to unlock it?

Topics