{"id":13470517,"url":"https://github.com/mashed-potatoes/PotatoNV","last_synced_at":"2025-03-26T11:32:09.926Z","repository":{"id":37841485,"uuid":"275149605","full_name":"mashed-potatoes/PotatoNV","owner":"mashed-potatoes","description":"Unlock bootloader of Huawei devices on Kirin 960/95x/65x/620","archived":false,"fork":false,"pushed_at":"2023-10-28T14:40:38.000Z","size":477,"stargazers_count":1283,"open_issues_count":25,"forks_count":153,"subscribers_count":37,"default_branch":"master","last_synced_at":"2024-10-16T09:05:59.153Z","etag":null,"topics":["android","bootloader","fastboot","huawei","libusb","potato","unlock"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mashed-potatoes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-06-26T12:21:53.000Z","updated_at":"2024-10-15T08:07:11.000Z","dependencies_parsed_at":"2024-01-16T07:22:00.305Z","dependency_job_id":"4e0b87b3-7b8b-4707-9519-065f0a5e5cf4","html_url":"https://github.com/mashed-potatoes/PotatoNV","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mashed-potatoes%2FPotatoNV","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mashed-potatoes%2FPotatoNV/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mashed-potatoes%2FPotatoNV/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mashed-potatoes%2FPotatoNV/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mashed-potatoes","download_url":"https://codeload.github.com/mashed-potatoes/PotatoNV/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222084231,"owners_count":16928138,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","bootloader","fastboot","huawei","libusb","potato","unlock"],"created_at":"2024-07-31T16:00:31.535Z","updated_at":"2024-10-30T00:31:09.847Z","avatar_url":"https://github.com/mashed-potatoes.png","language":"C#","funding_links":[],"categories":["C# #","C\\#"],"sub_categories":[],"readme":"\u003cimg src=\"./assets/header.png\" width=\"100%\" height=\"auto\" alt=\"PotatoNV\"\u003e\n\n![GitHub release (latest by date including pre-releases)](https://img.shields.io/github/v/release/mashed-potatoes/PotatoNV?include_prereleases)\n![GitHub](https://img.shields.io/github/license/mashed-potatoes/PotatoNV)\n![GitHub All Releases](https://img.shields.io/github/downloads/mashed-potatoes/PotatoNV/total)\n\n---\n\n## Download\n\n### 👉 [Click here to download the latest version](https://github.com/mashed-potatoes/PotatoNV/releases/download/v2.2.1_2022.03/PotatoNV-next-v2.2.1_2022.03-x86.zip).\n\nGet binaries for Windows in [the releases section](https://github.com/mashed-potatoes/PotatoNV/releases).\nFor Linux or macOS consider using the [PotatoNV-crossplatform](https://github.com/mashed-potatoes/PotatoNV-crossplatform).\n\n## User manual\n\nFollow the [video guide](https://www.youtube.com/watch?v=YkGugQ019ZY) or read the manual below.\n\n### Make sure your device is compatible\n\n0. Are you sure you're actually using a Huawei/Honor device?\n1. Open the Settings → About phone. Check the CPU: it should be _**HiSilicon Kirin** \\*\\*\\*_. If it is not your case (MediaTek, Qualcomm), then alas, your device is not supported. :(\n2. Okay, now you know CPU model. It should be one of these modification:\n    - Kirin 620\n    - Kirin 650\n    - Kirin 655\n    - Kirin 658\n    - Kirin 659\n    - Kirin 925\n    - Kirin 935\n    - Kirin 950\n    - Kirin 960\n3. **100% incompatible CPUs with PotatoNV: Kirin 710, 710A, 710F, 810, 970, 980, 985, 990 \u0026 newer.**\n4. As for Kirin 710, 710F, 970 \u0026 980, there is an alternative **paid** option — [see the \"Alternatives\" section below](#alternatives).\n\n### Getting inside\n\nThe first step is the most difficult thing to do. You need to disassemble your device: this is necessary in order to access the contacts on the motherboard.\n\nIf you're not sure that you have enough experience to disassemble the device, then consider using paid software, that supports _\"software testpoint\"_.\n\n\u003e **Warning**\n\u003e\n\u003e I strongly recommend watching video manuals for disassembling your device.\n\n\u003e **Warning**\n\u003e\n\u003e **Be extremely careful with planar cables!**\n\u003e\n\u003e These cables are used in tablets, as well as in phones with a fingerprint scanner on the back cover.\n\nYou will need: a hair dryer, a guitar pick or a plastic card, conductive tweezers and maybe a screwdriver.\n\n1. Turn off the device.\n2. Heat the back cover evenly with a hair dryer.\n3. After a couple of minutes, try to stick the plastic card into the corner between case and lid, try to lift the edge and then deepen the card.\n4. Move around the perimeter of the back cover, peeling off glue.\n5. Now you can remove the back cover.\n\n### Entering download mode\n\nIt's time to Google. You need to find the location of a special point on the motherboard – testpoint.\n\n\u003e **Note**\n\u003e\n\u003e If you are wondering why you need to do something with the unfortunate testpoint, then read [the contents of the spoiler below](#how-it-works).\n\nTo search, use the model name before the hyphen + \"testpoint\".\nFor example for Honor 9 Lite (LLD-L31) you should Google [\"lld testpoint\"](https://www.google.com/search?q=lld+testpoint\u0026tbm=isch).\n\n\u003cdetails\u003e\n\u003csummary\u003eAn example how a typical testpoint photo looks like.\u003c/summary\u003e\n\n![Honor 9 Lite Testpoint location](https://i.imgur.com/233Kn27.jpg)\n\u003c/details\u003e\n\nThe marks may vary:\n\n1. Only one point is marked in the photo.\n2. In the photo, a line is drawn between the point and the metal shield.\n3. In the photo, a line is drawn between two points.\n\nHere you will need sleight of hand: try to short-circuit the point and the metal shield (in option 1 and 2), or short-circuit both points (option 3) with tweezers.\nWithout removing the tweezers, connect the USB cable to the computer.\n\nAfter 3 seconds, the tweezers can be removed.\n\nOpen the \"Device Manager\" – you should see an unknown device named `USB SER`, or Serial Port `HUAWEI USB COM 1.0`.\n\nIf the device has not been detected, make sure you are using a good cable, the tweezers are not a dielectric, and you are shorting the desired point.\n\n### Unlocking the bootloader\n\n- Install [HiSuite](https://consumer.huawei.com/en/support/hisuite/).\n- Install [Huawei Testpoint Drivers](https://files.dc-unlocker.com/share.html?v=share/18B15B9D02C945A79B1967234CECB423).\n- Download [the latest release](https://github.com/mashed-potatoes/PotatoNV/releases) of PotatoNV.\n- Start PotatoNV.\n\n\u003e **Note**\n\u003e\n\u003e All bootloaders are flashing to RAM, so an incorrect bootloader cannot harm the device.\n\n\u003e **Note**\n\u003e\n\u003e `Disable FBLOCK` checkbox disables a special securtiy check.\n\u003e That modification allows you to flash/erase secure partitions or execute oem commands,\n\u003e that are not available with normal unlocking by unlock code \\[`USERLOCK`].\n\n\u003e **Warning**\n\u003e\n\u003e `FBLOCK` unlocking works correctly only on devices with Kirin 960 or Kirin 65x.\n\u003e Disabling this option can cause serious problems on legacy devices.\n\nOkay, now refer to [this table](#tested-devices) and select the appropriate bootloader.\n\nPress the Start button. 🪄\n\nThe procedure will take no more than a minute.\nThe program should write a new unlock code, keep it in a safe place.\n\nReboot your device to fastboot mode and execute following command on the host machine:\n\n```shell\nfastboot oem unlock YOUR_CODE_HERE\n```\n\nhave fun.\n\u003c!-- right, anti? :) --\u003e\n\n## How it works\n\n\u003cdetails\u003e\n\nEven before creating PotatoNV, [@TishSerg](https://github.com/TishSerg) discovered that unlock key can be rewritten with the **SHA256 hash** of the desired key to the `USRKEY` property. However, to access **_NVME_** _(a raw partition that stores stuff like serial number, device traits, etc.)_, a user should flash _custom_ recovery or gain temporary root privileges. But both methods are complex and are not guaranteed to work. After researching the legacy bootloader of some Huawei devices, I've found a `nve` command, which allows to read or write any property in the **_NVME_** partition. Of course, this command requires an unlocked bootloader.\nSo it remains to find a way to quickly unlock the bootloader. The way out is quite simple - use the bootloader from the board software.\n\nThe program uploads a special **_\"USB bootloader\"_** _(exported from the board software)_ through the `DOWNLOAD_VCOM` mode. **_VCOM_** is smth like **_EDL_** on Qualcomm devices: it can be triggered by a system failure or by **shorting testpoint**.\nAfter uploading the bootloader, the device should switch to the fastboot mode. The \"USB bootloader\" has an important trait: it's **unlocked out-of-the-box**, so it allows to execute any command.\n\nSo, we're just going to send a command through the USB bulk interface to write SHA256 hash to USRKEY and reboot the device.\n\nThat's it.\n\u003c/details\u003e\n\n## Tested devices\n\nDevice | Model | Bootloader\n------ | ----- | ----------\nHuawei P8 Lite (2015) | `ALE` | Kirin 620\nHuawei Y6II | `CAM` | Kirin 620\nHonor 5C / 7 Lite | `NEM` | Kirin 65x (A)\nHonor 6X | `BLN` | Kirin 65x (A)\nHonor 7X | `BND` | Kirin 65x (A)\nHonor 9 Lite | `LLD` | Kirin 65x (A)\nHuawei MediaPad T5 | `AGS2` | Kirin 65x (A)\nHuawei Nova 2 | `PIC` | Kirin 65x (A)\nHuawei P10 Lite | `WAS` | Kirin 65x (A)\nHuawei P20 Lite / Nova 3e | `ANE` | Kirin 65x (A)\nHuawei P8 Lite (2017) | `PRA` | Kirin 65x (A)\nHuawei P9 Lite | `VNS` | Kirin 65x (A)\nHuawei Y9 (2018) | `FLA` | Kirin 65x (A)\nHuawei MediaPad M5 Lite | `BAH2` | Kirin 65x (B)\nHuawei Nova 2i / Mate 10 Lite | `RNE` | Kirin 65x (B)\nHuawei P Smart 2018 | `FIG` | Kirin 65x (B)\nHonor 6 Plus | `PE` | Kirin 925\nHonor 7 | `PLK` | Kirin 935\nHuawei P8 | `GRA` | Kirin 935\nHonor 8 Pro / V9 | `DUK` | Kirin 950\nHonor 8 | `FRD` | Kirin 950\nHuawei P9 Standart | `EVA` | Kirin 950\nHonor 9 | `STF` | Kirin 960\nHuawei Mate 9 Pro | `LON` | Kirin 960\nHuawei Mate 9 | `MHA` | Kirin 960\nHuawei MediaPad M5 | `CMR` | Kirin 960\nHuawei Nova 2s | `HWI` | Kirin 960\nHuawei P10 | `VTR` | Kirin 960\n\n## Alternatives\n\n#### HCU Client\n\nAs far as I know, there is currently only one tool that can deal with newer CPUs — HCU Client.\n\nThis software requires a license, the most affordable plan is 3 days of access for €19.\n\nSee supported models by HCU Client [here](https://hcu-client.com/supported-models.php).\n\n\u003e **Note**\n\u003e \n\u003e [Timed licenses locked to first used PC](https://hcu-client.com/buy/#:~:text=Timed%20licenses%20locked%20to%20first%20used%20PC) for two days.\n\u003e Therefore, it would be problematic to use such a license on more than one phone.\n\n###### Disclaimer: I am not affiliated, associated, authorized, endorsed by, or in any way officially connected with UAB Digiteka, or any of its subsidiaries or its affiliates, including DC-Phoenix and HCU Client.\n\n## License\n\nLogo by Icons8.\n\nAll bootloaders are Huawei Technologies Co., Ltd. property.\n\nThis project is not affiliated with Huawei.\n\n---\n\nBootloader unlock tool for Huawei devices on Kirin SoC.\nCopyright (C) 2019-2020  mashed-potatoes\n\nThis program is free software: you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation, either version 3 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program.  If not, see \u003chttps://www.gnu.org/licenses/\u003e.\n\n---\n\nThank you, Martin, Moisés, Tibor, Emanuele \u0026 all those I've forgotten (sorry!).\n\n### Sponsored by JetBrains\n\n\u003cimg src=\"https://resources.jetbrains.com/storage/products/company/brand/logos/jb_beam.svg\" alt=\"JetBrains logo.\" width=\"120\"\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmashed-potatoes%2FPotatoNV","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmashed-potatoes%2FPotatoNV","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmashed-potatoes%2FPotatoNV/lists"}