comparing f15471b782577bb3a094d1a996435422c31487aa and main on www.zenfyr.dev/bootloader-unlock-wall-of-shame

+2 -2

README.md

···

       97
       97
        
       

     

       98
       98
        
       ### [Xiaomi/Redmi/POCO](./brands/xiaomi/README.md)

     

       99
       99
        
       

     

       100
       100
       -
       ### [ZTE/nubia](./brands/zte/README.md)

     

       101
       101
       -
       

     

       102
       100
        
       ## ⚠️ Proceed with caution!

     

       103
       101
        
       

     

       104
       102
        
       The following manufacturers require an online account and/or a waiting period before unlocking.

     
···

       116
       114
        
       ### [Sony](./brands/sony/README.md)

     

       117
       115
        
       

     

       118
       116
        
       ### [Tecno](./brands/tecno/README.md)

     

       117
       117
       +
       

     

       118
       118
       +
       ### [ZTE/nubia](./brands/zte/README.md)

     

       119
       119
        
       

     

       120
       120
        
       ## ℹ️ "Safe for now" :trollface: 

     

       121
       121

+1 -1

brands/apple/README.md

···

       4
       4
        
       

     

       5
       5
        
       This one is probably expected. No iPhone, iPad, iPod Touch or Apple TV model has had an unlockable bootloader. 

     

       6
       6
        
       

     

       7
       7
       -
       As expected, Apple does not allow bootloader unlocking, and never has. Most Apple dives also have an aggressive anti-rollback system, stopping you from downgrading to an older iOS version for jailbreaking purposes.

     

       7
       7
       +
       As expected, Apple does not allow bootloader unlocking, and never has. Most Apple devices also have an aggressive anti-rollback system, stopping you from downgrading to an older iOS version for jailbreaking purposes.

     

       8
       8
        
       

     

       9
       9
        
       ## Firmware signing

     

       10
       10
        
       Apple has a server called "Tatsu Signing Server", typically shortened to TSS. When you try to install firmware on an Apple device, iTunes or Finder will send several things to TSS so it can generate a signed SHSH blob to allow the restore, the following being

+52 -7

brands/motorola/README.md

···

       1
       1
        
       # Motorola/Lenovo/NEC

     

       2
       2
        
       

     

       3
       3
        
       - Verdict: **⛔ Avoid!**

     

       4
       4
       -
       - Verdict: **🍅 Terrible!** (Unisoc)

     

       4
       4
       +
       - Verdict: **🍅 Terrible!** (Unisoc/MTK Legacy)

     

       5
       5
        
       

     

       6
       6
        
       ## Kernel sources

     

       7
       7
        
       Motorola is one of the manufacturers that provide kernel source code for their devices via official repositories on GitHub. However, they usually have weird build instructions, and will not share them unless you threaten to report to the SFC. 

     
···

       17
       17
        
       - [Texas Instruments devices](https://github.com/MotorolaMobilityLLC/kernel-omap)

     

       18
       18
        
       

     

       19
       19
        
       ## Bootloader

     

       20
       20
       -
       To unlock your bootloader, you have to submit a request on [this][Unlock Code Website] website, which is pretty bad on its own (*wink* [Huawei](../huawei/README.md)). Unisoc devices will never be unlockable, this is *not* Motorola's fault, Unisoc does not allow unlocking.

     

       20
       20
       +
       Motorola has three device classes:

     

       21
       21
       +
       * Qualcomm devices

     

       22
       22
       +
       * MTK CID

     

       23
       23
       +
       * MTK Legacy/Unisoc

     

       24
       24
       +
       

     

       25
       25
       +
       Qualcomm and MTK CID devices are developed and manufactured by the Motorola main team. MTK Legacy and UNISOC manufacturing process is often delegated to third parties ODMs, mainly their partner [Tinno](https://en.tinno.com/news/69.html), and sometimes other like [Huaqin](https://en.huaqin.com/).

     

       26
       26
       +
       

     

       27
       27
       +
       

     

       28
       28
       +
       For Qualcomm and MTK CID device, to unlock your bootloader, you have to submit a request on [this][Unlock Code Website] website, which is pretty bad on its own (*wink* [Huawei](../huawei/README.md)). Unisoc devices will never be unlockable, this is *not* Motorola's fault, Unisoc does not allow unlocking.

     

       21
       29
        
       

     

       22
       30
        
       In addition, [this forum post][Old devices ineligible] says that once a device passes a certain age (the age not being specified), the device becomes ineligible.

     

       23
       31
        
       

     
···

       29
       37
        
       * [This page][Some Devices] says only "Photon Q 4G LTE, DROID RAZR M(Developer Edition), DROID RAZR HD(Developer Edition CDMA-LTE), MOTOROLA RAZR HD (Rest of World -UMTS/LTE), MOTOROLA RAZR HD (Rogers Canada - UMTS/LTE) and MOTOROLA RAZR i are supported by the Bootloader Unlock site." -- Considering these devices are all over 13 years old, this is likely outdated.

     

       30
       38
        
       * [And from this conversation][turistu's post] [turistu](https://github.com/turistu) had with their support: "most of our E devices doesn't support bootloader unlock program. Please see below a list of devices that support the bootloader unlock program : g100, g51 , g71 , g200 , g52 , g82 , g42 , g62 , g32"

     

       31
       39
        
       * There's also an unofficial way with CID to check if your device can be unlocked, check here: [xdaforums.com][CID check]

     

       40
       40
       +
       * Generally, devices from the g3x series and higher can be unlocked, while G2x and lower (including E devices) cannot be unlocked *officially*.

     

       32
       41
        
       

     

       33
       42
        
       Once your bootloader is unlocked, Motorola does not allow you to relock, attempting to re-lock will [brick your device][brick on relock]

     

       34
       43
        
       

     

       44
       44
       +
       Furthermore, on Motorola CID devices a valid **cid** partition needs to be present in the device to be unlocked or even to be able to boot normally. The unlock data is in fact contained in that partition, and cannot be haltered without getting cid `0xDEAD`.

     

       45
       45
       +
       In case of a corrupted cid partition, you'll need to bring your device for *cid provisioning*, where the cid data is regenerated and signed.

     

       46
       46
       +
       

     

       47
       47
       +
       On MTK CID devices, it is impossible to unlock using third party tools (like mtkclient or Chimera), because Motorola validates the unlock state contained in `seccfg` against a stored value in the RPMB region in the flash storage.

     

       48
       48
       +
       Furthermore, Motorola disables BROM USBDL by efuse on newer devices (MTK V6 as well), and the stock Download Agent are limited to only allow flashing the bootloader.

     

       49
       49
       +
       

     

       50
       50
       +
       ### Possible bypasses?

     

       51
       51
       +
       #### Debug Token

     

       52
       52
       +
       Motorola CID devices (both Qualcomm and Mediatek ones) have a customized bootloader by Motorola, including their security library `mot_sec`.

     

       53
       53
       +
       

     

       54
       54
       +
       Decompiling the bootloader it is possible to notice how Motorola includes a special *virtual* partition (it is just part of the cid partition) called `debug_token`.

     

       55
       55
       +
       By issuing `fastboot flash debug_token <debug-token-file>`, it is theoretically possible to disable all security on the device, including secure boot and more.

     

       56
       56
       +
       

     

       57
       57
       +
       This file, though, cannot be obtained, since it is most likely used internally by Motorola development team, and it is verified against the public key.  

     

       58
       58
       +
       

     

       59
       59
       +
       #### Keygen

     

       60
       60
       +
       Many on XDA have wondered [if it was possible to develop a keygen](https://xdaforums.com/t/help-with-moto-g-bootloader-unlock-keygen.2631686/).

     

       61
       61
       +
       Motorola unlock process (on CID devices only) involves getting the unlock data from the phone using `fastboot oem get_unlock_data`.

     

       62
       62
       +
       

     

       63
       63
       +
       The phone spits out some random data, that can be parsed the following way:

     

       64
       64
       +
       ```

     

       65
       65
       +
       1A23457698214365

     

       66
       66
       +
       5441383930304242443700585431303332000000

     

       67
       67
       +
       140A858731D55F3B5DF78F0F6BB9EAE32A2B8945

     

       68
       68
       +
       3D372B020F0000000000000000000000

     

       69
       69
       +
       ```

     

       70
       70
       +
       * The first line is the IMEI, with an additional A as padding to reach 16 bytes (IMEI as 15 characters long)

     

       71
       71
       +
       * The second line is the serial number + phone model

     

       72
       72
       +
       * The third line is thought to be the phone hash or processor UID

     

       73
       73
       +
       * The 4th line seem to be flash UID

     

       74
       74
       +
       

     

       75
       75
       +
       Unfortunately, Motorola seems to use asymmetric encryption for generating the unlock key, meaning that without a private key it is impossible to make a keygen.

     

       76
       76
       +
       On the other hand, the bootloader verifies the key by first generating one on the fly based on the data in CID and hashing it with either HMAC-SHA256 (CID DB v2) or HMAC-SHA1 (CID DB v1), then comparing the hashes of the generated key with the hash of the bytes representation of the provided unlock key.

     

       77
       77
       +
       

     

       35
       78
        
       ### Non-Lenovo devices

     

       36
       79
        
       Even though Motorola has been owned by Lenovo for a while, there are still devices around that aren't made by Lenovo.

     

       37
       80
        
       

     

       38
       38
       -
       ### Certain G series devices

     

       39
       39
       -
       For some Motorola devices, the firmware is not developed by the company's core team, but simply purchased solutions from various OEMs.

     

       81
       81
       +
       ### Certain G and E series devices

     

       82
       82
       +
       For some Motorola devices, the firmware is not developed by the company's core team, but simply purchased solutions from various ODMs.

     

       40
       83
        
       

     

       41
       84
        
       These are exactly the devices that lack any instructions on how to unlock the bootloader or are completely locked, with no way to unlock. 

     

       42
       85
        
       

     

       43
       43
       -
       Examples of such devices include the Moto G23, G13, G24, and G24 Power. 

     

       86
       86
       +
       Examples of such devices include the Moto G23, G13, G22, G24, and G24 Power. 

     

       44
       87
        
       

     

       45
       88
        
       Fortunately, enthusiasts have managed to find unofficial ways to unlock these devices, despite the fact that Moto Agents stubbornly deny the existence of such methods:

     

       46
       89
        
       * Moto G13/G23 - Decompiled the bootloader, studied the algorithm for unlocking the bootloader and [developed a keygen](https://penangf.fuckyoumoto.xyz/docs/dev/bootloader), which is required to get the key to unlock the bootloader.

     

       47
       47
       -
       * Moto G24/G24 Power - Thanks to a leaked engineering DA with full permissions to all partitions and using a custom ChouChou bootloader, [a way to unlock was found](https://fogorow.fuckyoumoto.xyz/docs/dev/bootloader)

     

       90
       90
       +
       * Moto G24/G24 Power - Thanks to Carbonara, allowing privilege excalation in DA mode and a custom bootloader (chouchou), [a way to unlock was found](https://fogorow.fuckyoumoto.xyz/docs/dev/bootloader)

     

       48
       91
        
       

     

       49
       92
        
       ### Google Motos (2012-2014)

     

       50
       93
        
       For a short while, Google owned Motorola Mobility (from May 2012 to October 2014). Despite Google devices following the normal procedure, Google Motos used the same unlock portal that the modern Lenovo devices use, and of course, Lenovo removed the ability to unlock older devices, so these Google-era Motos are no longer unlockable. This does not include the Nexus 6, see the [Google](../google/README.md) page for Nexus devices.

     
···

       56
       99
        
       tldr, Motorola split into two companies in 2011. Motorola Mobility, which made the phones and DVRs and is now owned by Lenovo, and Motorola Solutions, who makes everything else. Solutions has recently started making radios which run Android. Not much is known about these devices, Motorola doesn't even reveal which SoC they use, so nothing is really known about these devices. This [datasheet] for the MOTOTRBO ION mentions "Root Detection: Standard", which in Moto-speak, means "this device always ships with root detection.", indicating that the bootloader is probably not unlockable on these devices. Via [this spreadsheet] from Google, you can see the MOTOTRBO ION's codename -- mkz_sdm660_64, which indicates that possibly it uses a Snapdragon 660 SoC, but the MOTOTRBO ION runs Android 13, which seems weirdly new for a 2017 SoC, no it might just be gibberish or something unrelated.

     

       57
       100
        
       

     

       58
       101
        
       ### MTKClient + BROM

     

       59
       59
       -
       Most MTK-based Motorola devices **released before 2022 are susceptible to [mtkclient](https://github.com/bkerler/mtkclient) bypass**, and full unlock may require [ChouChou](https://github.com/R0rt1z2/chouchou) / [Kaeru](https://github.com/R0rt1z2/kaeru) patches to disable automatic bootloader lock.

     

       102
       102
       +
       Most MTK-based Motorola devices **released before 2022 are susceptible to [mtkclient](https://github.com/bkerler/mtkclient) auth bypass**, and full unlock may require [chouchou](https://github.com/R0rt1z2/chouchou) / [Kaeru](https://github.com/R0rt1z2/kaeru) patches to disable automatic bootloader lock (as seen on Moto E7, codename `malta`).

     

       60
       103
        
       

     

       61
       104
        
       However, on devices **released after 2022, this method is ineffective** as the preloader vulnerability has been patched and the BROM is blocked via eFuse, and attempting to crash the preloader results in a bootloop in the preloader.

     

       105
       105
       +
       Devices released before 2024 (and some released during 2024 as well) though are vulnerable to [Carbonara](https://shomy.is-a.dev/penumbra/Mediatek/Exploits/Carbonara), a DA1 memory corruption exploit that allows arbitrary code execution.

     

       62
       106
        
       

     

       63
       107
        
       ### Non-Motorola Lenovo devices, NEC devices and some Motorola tablets.

     

       64
       108
        
       Lenovo usually does not use the Motorola name on their tablets and gaming-oriented phones, and these are typically branded as Lenovo or NEC. While similar to Motorola's unlock process, these have to be unlocked on the [ZUI website], which requires your IMEI, serial number, and email, and they'll send you an unlock-bootloader.img which you flash to the unlock partition in Fastboot to unlock. However, similar to Xiaomi, Lenovo has a quota, which if you surpass, you cannot unlock your bootloader, @MlgmXyysd has created an [unofficial unlock portal] which may work on recent tablets like Legion Y700 4th Gen. Some Motorola tablets, such as the G62, also use the ZUI website to unlock instead of Motorola's unlock portal.

     
···

       80
       124
        
       Additional info provided by [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439).<br/>

     

       81
       125
        
       CID info provided by [FPSensor](https://github.com/FPSensor).<br/>

     

       82
       126
        
       Unofficial ways to unlock "Moto G13/G23/G24/G24 Power" bootloader provided by [DiabloSat](https://github.com/progzone122) & [Shomy](https://github.com/shomykohai).<br/>

     

       127
       127
       +
       Additional info for Motorola CID devices and mtkclient provided by [Shomy](https://github.com/shomykohai).<br/>

     

       83
       128
        
       Legal agreement info provided by [FaridZelli](https://github.com/FaridZelli).<br/>

     

       84
       129
        
       Lenovo branded and NEC unlock information provided by [CakesTwix](https://github.com/CakesTwix) and [Calyx Hikari](https://github.com/HikariCalyx).<br/>

     

       85
       130
        
       Authored by [melontini](https://github.com/melontini).

+47 -3

brands/samsung/README.md

···

9
9

10
10

Snapdragon phones prior to the S7/Note7 (2016) can be unlocked regardless of region, as long as it's not locked to a carrier like AT&T or Verizon. The Canadian S7 can also be unlocked as it uses an Exynos SoC, despite Canada normally being a Snapdragon region.

11
11

12
12
-
Be aware that unlocking a Samsung device will permanently trip Knox. As a result, many Knox-based features will be broken. This includes, but not limited to: Samsung Pay, Pass, Flow, Health, Secure Folder, Secure Wi-Fi, Smart View. Furthermore, tripping Knox may serve as grounds for voiding your warranty.

12
12
+
**Be aware that unlocking a Samsung device will permanently trip Knox.** As a result, many Knox-based features will be broken. This includes, but not limited to: Samsung Pay, Pass, Flow, Health, Secure Folder, Secure Wi-Fi, Smart View. Furthermore, tripping Knox may serve as grounds for voiding your warranty.

13
13
+

14
14
+
There have been hardware issues caused by unlocking the bootloader, but these have been fixed for some regions. See [here][1] and [here][2]. As of late 2023, Korean Galaxy Fold3 running OneUI 5 still got camera disabled after unlocking, while EU/CN variants had fixed the issue.

15
15
+

16
16
+
As of September 2025, Galaxy Z Fold 5 also has a camera issue after unlocking the bootloader. After analyzing it, we found out it is a "Security Mechanism" to prevent the user from "taking photos" once they unlock the bootloader by providing a "black screen" in the viewfinder. (Fixable by re-locking the bootloader)

17
17
+

18
18
+
---

19
19
+

20
20
+
As of September 2025, all budget phones that have **Helio G99**, **Dimensity 6100+**, and **Dimensity 6300** have **serious connectivity and unfixable bootloop issues** after unlocking the bootloader and flashing a custom binary which "trips Knox".

21
21
+

22
22
+
**Example Devices Affected:**

23
23
+
- **Helio G99:** Galaxy A15 4G, A16 4G, etc.

24
24
+
- **Dimensity 6100+/6300:** Galaxy A06 5G, A15 5G, M15 5G, A16 5G, etc.

13
25

14
14
-
In the past, there have been hardware issues caused by unlocking the boatloader, but these have been fixed for some regions. See [here][1] and [here][2]. As of late 2023, Korean Galaxy Fold3 running OneUI 5 still got camera disabled after unlocking, while EU/CN variants had fixed the issue.

26
26
+
**If your device has Helio G99 or Dimensity 6100+/6300, you are a victim too!**

27
27
+

28
28
+
As a result, in the Helio G99 models, the `ril-daemon` will crash every 6 hours, leading to your SIM cards being disabled and showing a NULL IMEI in the settings (temporary). The only fix as of now is restarting the phone or using "third-party" Magisk modules to restart the `ril-daemon` every 6 hours. This is unfixable even after re-locking the bootloader.

29
29
+

30
30
+
In the Dimensity 6100+/6300 models, **you will completely lose 5G connectivity permanently**, and this is unfixable even after re-locking the bootloader. **The modem will crash when connecting to a 5G network**, leading to high battery drain and overheating. The only fix as of now is putting your device in 4G mode.

31
31
+

32
32
+
After intense analysis by ~5 experienced members of the Helio G99 and Dimensity 6100+/6300 community, we found why this happens. It looks like Samsung implemented checks at **both the modem firmware level and software level** to check for the value of the property `ro.vendor.boot.warranty_bit`. The software check uses a function called `DoOemSetwarrantyBit` in `/vendor/lib64/libsec-ril.so`.

33
33
+

34
34
+
**Why does a RIL-related HAL need to check "is Knox tripped?"**

35
35
+

36
36
+
After patching the necessary libs in the vendor, we thought it was over until we found out 5G still wasn't working and discovered that a similar but different function is baked into the modem firmware itself by analyzing the contents of the `md1img` partition. This firmware check differs from the libsec-ril's function and isn't patchable by a third party.

37
37
+

38
38
+
> The only fix is to be aware of this issue and not unlock the bootloader and trip Knox in the first place if you don't like these consequences. You have to sacrifice something to root these 2 device types.

39
39
+

40
40
+
**🔴 Regarding the unfixable bootloop issue**, it literally feels like a hard brick. The only thing that works is the display turning on. No matter what you do, even after flashing the stock ROM and re-locking the bootloader, this issue remains unfixable.

41
41
+

42
42
+
This was a serious issue in the initial firmware of the Dimensity 6100+ and 6300 devices and was **fixed by later firmware updates.**

43
43
+

44
44
+
If you want to unlock the bootloader, first update your phone to any firmware released with the 2025 January/April/July security patch.

45
45
+

46
46
+
**Symptoms:**

47
47
+
1. User can unlock the bootloader without any issues and the phone boots normally.

48
48
+
2. When they attempt to flash an unsigned binary (such as a custom kernel or Magisk-patched AP/boot image), the boot process instantly crashes after the splash screen (first Samsung Galaxy logo).

49
49
+
- What it looks like: A grey fuzzy screen with vertical blue/yellow lines appears when the crash occurs.

50
50
+
3. This issue is unfixable even after reverting the changes, and **you cannot access Android recovery - only download mode remains accessible.**

51
51
+

52
52
+
**There is nothing to worry about regarding this issue if your phone firmware is already updated.**

53
53
+

54
54
+
**Sources:**

55
55
+
- As the [writer of this section](https://github.com/ravindu644) of this documentation, I personally experienced this issue and lost $200. I have video proof but will not provide Telegram links here. You can find them in the Galaxy A16 Community if interested.

56
56
+
- [XDA Forum post regarding this exact issue](https://xdaforums.com/t/bootloop-without-access-to-recovery-need-insights-a156e-dsn.4707443/)

57
57
+

58
58
+
---

15
59

16
60

## SoC level exploits

17
61

One of the first things Samsung bootloaders do on phone bootup is check if the bootloader is unlocked, and if it is, and a bootloader unlock has not been authorized, the bootloader will automatically relock. This means SoC level exploits such as mtkclient or EDLUnlock will not work on Samsung devices, unless you reverse engineer, modify and re-flash Samsung's bootloader to stop the bootloader from re-locking.

···

27
71

There is an [open source VoLTE service] developed by phh, but it's incomplete and not stable.

28
72

29
73

***

30
30
-
Additional info provided by [aries-ts-indo](https://github.com/aries-ts-indo) and [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439).<br/>

74
74
+
Additional info provided by [aries-ts-indo](https://github.com/aries-ts-indo), [ravindu644](https://github.com/ravindu644) and [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439).<br/>

31
75

Authored by [melontini](https://github.com/melontini).

32
76

33
77

[1]:https://www.xda-developers.com/bootloader-unlocking-no-longer-kills-galaxy-z-fold-3-cameras/

+5 -1

brands/sony/README.md

···

       2
       2
        
       

     

       3
       3
        
       - Verdict: **⚠️ Proceed with caution!**

     

       4
       4
        
       

     

       5
       5
       +
       - Verdict: **🍅 Terrible!** (Japan variants only)

     

       6
       6
       +
       

     

       5
       7
        
       Sony has an open policy for software developers:

     

       6
       8
        
       - They are releasing AOSP sources under [Sony Open Devices Program].

     

       7
       9
        
       - Jolla provides first-class support for installing [Sailfish OS] on select Xperias.

     
···

       22
       24
        
       

     

       23
       25
        
       Sony supports [Custom AVB](../../README.md#custom-avb-keys) Since 2020.

     

       24
       26
        
       

     

       25
       25
       -
       ***

     

       27
       27
       +
       You also can't unlock Japan variants. For some reason.

     

       26
       28
        
       

     

       29
       29
       +
       ***

     

       30
       30
       +
       Info about Japan devices provided by [madeline-yana](https://github.com/madeline-yana)

     

       27
       31
        
       Additional info provided by [K4sum1](https://github.com/K4sum1).<br/>

     

       28
       32
        
       Authored by [konradmb](https://github.com/konradmb).

     

       29
       33

+1 -1

brands/vivo/README.md

···

       14
       14
        
       There is also a chance that your device is vulnerable to one of the MTK or Unisoc [exploits](../../README.md#universal-soc-based-methods).

     

       15
       15
        
       

     

       16
       16
        
       ## Magisk

     

       17
       17
       -
       Vivo devices have kernel-level patches to block the `su` binary, so to use Magisk you should flash this modified version with `suu`.

     

       17
       17
       +
       Vivo devices have kernel-level patches to block the `su` binary, so to use Magisk you should flash this modified version with `suu`. This only applies on devices which run Funtouch, for devices which run OriginOS (mainly their Chinese market devices), while the bootloader is still not unlockable, `su` is not blocked.

     

       18
       18
        
       - [Magisk][patched-magisk]

     

       19
       19
        
       - [Magisk Delta][patched-magisk-delta]

     

       20
       20

+1 -1

brands/zte/README.md

···

       2
       2
        
       

     

       3
       3
        
       > 🧹 This page is missing a lot of info!

     

       4
       4
        
       

     

       5
       5
       -
       - Verdict: **⛔ Avoid!**

     

       5
       5
       +
       - Verdict: **⚠️ Proceed with caution!**

     

       6
       6
        
       - Verdict: **🍅 Terrible!** (Unisoc)

     

       7
       7
        
       

     

       8
       8
        
       Snapdragon-based nubia devices can be unlocked with the Fastboot command `fastboot oem nubia_unlock NUBIA_MODEL` (e.g. -- if your phone's model number is NX609J, the command would be `fastboot oem nubia_unlock NUBIA_NX609J`.). Newer ZTE devices can also be unlocked with the standard `fastboot flashing unlock` command, but this tends to break the fingerprint sensor, Unisoc devices will never be unlockable, this is *not* ZTE's fault, Unisoc does not allow unlocking. As for non-nubia ZTE devices:

+5 -1

carriers/README.md

···

       16
       16
        
       

     

       17
       17
        
       ### [Verizon/Visible](./brands/verizon/README.md)

     

       18
       18
        
       

     

       19
       19
       +
       ### [Spectrum](./brands/spectrum/README.md)

     

       20
       20
       +
       

     

       19
       21
        
       ## Canada

     

       20
       22
        
       All devices sold in Canada after December 1, 2017 are sold unlocked, and any devices sold before then legally have to be unlocked for free, thanks to [the Wireless Code](https://crtc.gc.ca/eng/archive/2017/2017-200.htm). For devices sold before then however..

     

       21
       23
        
       

     
···

       28
       30
        
       ## Japan

     

       29
       31
        
       If you buy a Sony or Sharp phone used, high chance it's going to be locked to a Japanese carrier as that's just where Sony and Sharp are popular.

     

       30
       32
        
       

     

       31
       31
       -
       ### [NTT Docomo](./brands/nttdocomo/README.md)

     

       33
       33
       +
       ### [NTT Docomo/b-mobile/IIJMIO/DMM](./brands/nttdocomo/README.md)

     

       34
       34
       +
       

     

       35
       35
       +
       ### [SoftBank/y!mobile](./brands/softbank/README.md)

carriers/brands/nttdocomo/README.md

···

       5
       5
        
       NTT Docomo (and associated MVNOs) do not allow you to unlock your bootloader, the OEM unlock option is greyed out.

     

       6
       6
        
       ***

     

       7
       7
        
       Authored by [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439), with additional MVNOs added by [madeline-yana](https://github.com/madeline-yana).<br/>

     

       8
       8
       +

carriers/brands/softbank/README.md

···

       1
       1
       +
       # Softbank/y!mobile

     

       2
       2
       +
       

     

       3
       3
       +
       Verdict: **🍅 Terrible!**

     

       4
       4
       +
       

     

       5
       5
       +
       Softbank and y!mobile do not let you unlock the bootloader either.

     

       6
       6
       +
       OEM unlocking works fine, however [it seems that Fastboot is modified.](https://www.reddit.com/r/SonyXperia/comments/15qdxt2/bootloader_unlocking_trouble_for_softbank_xperia/)

     

       7
       7
       +
       

     

       8
       8
       +
       Authored by [madeline-yana](https://github.com/madeline-yana).<br/>

     

       9
       9
       +

carriers/brands/spectrum/README.md

···

       1
       1
       +
       # Spectrum

     

       2
       2
       +
       

     

       3
       3
       +
       * Verdict **ℹ️ "Safe for now" :trollface:**

     

       4
       4
       +
       

     

       5
       5
       +
       Despite being a Verizon MVNO, Spectrum does not have Verizon's hostility and allows bootloader unlocking.

     

       6
       6
       +
       ***

     

       7
       7
       +
       Authored by [Ivy / Lost-Entrepreneur439](https://github.com/Lost-Entrepreneur439).<br/>

Compare changes