How to unlock bootloader？

[Keneda]

@zhou

It's very, VERY difficult to unlock bootloader on a MX4 that was not given unlocked by design (to be clear, only MX4 ubuntu touch edition were unlocked).

Some MX4 can be unlocked by hack, but it need some special version of it and/or some specific version of androïd (edit : 4.2.8.2A), and an active flyme account on it (to enable root rights, that you must use to hack the MX4, to unlock its bootloader).

I bought a 32Go version of the MX4, i intended to unlock it by this hack, but unfortunately, flyme account was still active from old user (IMEI registered on Meizu servers, previous user is the only that can reset that...), so i did even not went there...

Edit : https://forum.xda-developers.com/t/tutorial-bootloader-unlocking-for-mx4-m1-note.3201715/
Some files are not even available to download, but if you have a rooted MX4, feel free to contact thread poster on XDA, maybe he still have them.

[CiberSheep]

@zhou I see...

@keneda
I have an Ubuntu Mx4. Tell me if there anything I could do...

[zhou]

@keneda I have flyme account and root enabled. Flyme version is the latest version 6. I am going to try again after the battery drained. A charged battery might be the reason. The power management function kicks in before BROM connection could be established when the battery is not fully discharged and it bloicks the BROM connection.

[Keneda]

@zhou said in How to unlock bootloader？:

I have flyme account and root enabled. Flyme version is the latest version 6.

So first of all you need to downgrade on Flyme 4.2.8.2A.
And then try having help on XDA for the rest.

@cibersheep said in How to unlock bootloader？:

I have an Ubuntu Mx4. Tell me if there anything I could do...

I'm afraid there is not a lot to do. Only other way would be to have the good (genuine) file for SPflashTool, to unlock it directly there. But that files only Meizu owns it.

[ropod7]

Done!. There is couple of issues about internal memory and downgrading to 4.2.8.2A with A version of phone, but works for me. I will prepare packages to upload and some experience of flashing latest version.

100euro beauty in pocket in case of previous 1+1 dying (battery, shell).

[CiberSheep]

@ropod7 Welcome to the family

[ropod7]

In my case I was downgraded twice to 5.1.9.0A from 6.3.0.2A and to 4.2.8.2A from 5.1.9.0A, noting that downgrade from 5.1.9.0A to 4.2.8.2A needs unlock of bootloader. It means, that there is large probability that we do not need (in any cases as mine) downgrade twice, because 5.1.9.0A patching uboot.img well, but lots of instructions saying that we must do it, those, following instruction (which is updated 4pda one) - contains 2 STAGES.

ATTENTION: It is Linux instruction where needed Windows just in steps 3-5, but we can skip them taking uboots from MEIZU_UNLOCK/UNLOCK in case if we are using given by me Flyme firmwares.

Please read full instructions before you start.
Recommended only for experienced users.

This was tested ONLY on MX4

Archives: https://drive.google.com/drive/folders/1GR67uSQDOnlCZRjrcMkHvWbFPZaaWQgC
NB. Following "relay race" be good to make mirror of given archives.

• Archive "flymes" contains stock firmwares:
  6.3.0.2A (in case if you need nothing what represents Flyme OS)
  5.1.9.0A
  4.2.8.2A

• Archive "MEIZU_UNLOCK" contains dirs we need to unlock MX4 flashing UBPorts:
  arale-ubports-recovery: - MX4 recovery from UBPorts
  gscript: - folder with apk terminal emulator and unlocking script
  patched-recovery: - patched stock recovery for MX4 (who wants to flash International (index I) firmware to chinese MX4 (index A), or flash stock-customs (deleted chinese soft, game center etc.))
  Patcher: - loader patcher

• Extra folders of "MEIZU_UNLOCK" contains:
  custom-recovery: - custom recovery philz touch 6 for MX4
  TWRP: - TWRP recovery 2.8.7.0
  UNLOCK: - patched uboots from 5.1.9.0A and 4.2.8.2A stock Flyme OS firmwares, to skip steps 3-5.

UNLOCKING PROCESS:

1. Flash clean stock firmware (do this ONLY on android version):
   STAGE 1: if current MX4 firmware != 4.2.8.2A: flash 5.1.9.0A
   STAGE 2: if current MX4 firmware == 5.1.9.0A (with unlocked bootloader): flash 4.2.8.2A

2. Get ROOT by standard method (Flyme account). SuperSu NO NEEDED

( if you wish to skip Windows steps 3-5, just take proper uboot.img from UNLOCK directory and rename it, according to current STAGE which based on Flyme firmware number)

3. Unpack on your disc (on PC) archive with firmware which you used to flash on your MX4: STAGE 1 or STAGE 2.

4. Place in a folder with unpacked archive (p.3) file "Meizu_Patch.exe" from folder "patcher" of your downloaded archive and open this with administrator rights.
   -Theoretically, antiviruses can alarm to packer which patcher was compilated (but Dr.Web is fine) / but antiviruses recommended to be closed.
   -If you are afraid about viruses and trojans, skip this step....and all the following.

   If all goes well - we see a flashing green "SusseccFully Patched" in the patcher round window - continue.
   If no and you see inscription "Patching Failed!", RED - STOP - something goes wrong and if you continue - BRICK!!!

5. Delete from this folder 2 files: "Meizu_Patch.exe" and "uboot.img.bak".

6. Create a folder with name "UNLOCK" in phone root directory (SD card) (DCIM folders, Picture, Music, data etc.) and:

   • if not skipped steps 3-5: copy in already patched loader file "uboot.img" of current STAGE from firmware folder from PC (where we started our patching (unpacked firmware))
   • if skipped steps 3-5: copy and rename from unzippet MEIZU_UNLOCK/UNLOCK/uboot.img.

6.1 if not skipped steps 3-5: Pack this firmware (on PC) back in archive (using 7-zip/winrar) with name "update.zip" (default flyme firmwares) - could be useful.

7. Copy a folder "gscript" together with content in phone root directory (SD card).

7.1 Install "terminal emulator" on your phone from "gscript" folder.

7.2 run with ROOT privileges "terminal emulator" and type (or call just second one from adb shell):
su
sh /sdcard/gscript/unlock.sh

7.4 Wait a little and reboot your phone. If it succesfully boots - congratulations, all is fine!!

• STAGE 1 steps:

8.0.STAGE 1: Upload to MX4 update.zip of 4.2.8.2A using command on your PC:
adb push /path_to_4.2.8.2A/update.zip /sdcard/update.zip

9.0.STAGE 1: Power off MX4.

9.1.STAGE 1: boot to fastboot by holding volume(-) & power buttons.

9.2.STAGE 1: flash recovery using patched recovery image from MEIZU_UNLOCK/patched-recovery by calling from given recovery path:
fastboot flash recovery patched_recovery.img

9.3.STAGE 1: reboot to recovery by holding Volume(+) & Power button, wipe data and downgrade system to 4.2.8.2A.

• STAGE 2 steps (make all from 1-7 by default for 4.2.8.2A and):

8.0.STAGE 2: run ubports-installer and follow instructions.

8.1.STAGE 2: high probability that ubports-installer returns exception while pushing dowloaded files to device, saying: "no space left on device".

8.2.STAGE 2: Press "Ignore".

9.0.STAGE 2: Two choices:

• Make all by your hands (manual movement);
• Or create file with lines of shell script given below (automation);

Manual movement:

All UBPorts files were downloaded to /pc_user/.cache/ubports/arale/Ubuntu\ Touch/ and they will be pushed to /cache/recovery on device, but there is just 102MB, in case of more than 400MB needs:
ls -lah $HOME/.cache/ubports/arale/Ubuntu\ Touch/
- Practically we need to push to the /cache/recovery just ubuntu_command file which mounts system, mounting sdcard into which we can push everything other from /pc_user/.cache/ubports/arale/Ubuntu\ Touch/
- but, before mount system in ubuntu_command two lines which call couple of tiny files uploaded by ubports-installer and couple of .asc signatures:
- image-master.tar.xz
- image-master.tar.xz.asc
- image-signing.tar.xz
- image-signing.tar.xz.asc

9.1.STAGE 2: boot to ubports-recovery, flashing it first if reflashed by Flyme_4.2.8.2A boot:

• noting that MX4 (arale) recovery.img placed in /pc_user/.cache/ubports/arale/ as recovery-arale.img:
  fastboot flash recovery /pc_user/.cache/ubports/arale/recovery-arale.img

9.1.STAGE 2: go to /pc_user/.cache/ubports/arale/Ubuntu\ Touch/:
cd $HOME/.cache/ubports/arale/Ubuntu\ Touch/

9.1.1.STAGE 2: remove all in /cache/recovery on device:
adb shell rm -f /cache/recovery/*

9.1.2.STAGE 2: and push all described above files to the /cache/recovery/ by typing:
adb push image-* /cache/recovery/
- remember abount ubuntu_command too:
adb push ubuntu_command /cache/recovery/

9.2.STAGE 2: mount sdcard and create recovery dir in there by typing:
adb shell mount -a
adb shell mkdir /sdcard/recovery or remove all files from recovery dir on device sdcard (in case of UBPorts system update: adb shell rm -f /sdcard/recovery/* )

9.3.STAGE 2: push all other files from /pc_user/.cache/ubports/arale/Ubuntu\ Touch/ to the created /sdcard/recovery by typing for each:
adb push file_name.extension /sdcard/recovery/

9.4.STAGE 2: create symbol links of all files pushed into /sdcard/recovery/ in /cache/recovery/ by typing for each:
adb shell ln -s /sdcard/recovery/file_name.extension /cache/recovery/

9.5.STAGE 2: checkout number of files in /cache/recovery by typing:
adb shell ls -lah /cache/recovery/
- and compare with PC container:
ls -lah .

10.STAGE 2: rebooting system to the UBPorts recovery, MX4 will launch update process using all uploaded files, flashing latest UBPorts system (in my case):
adb reboot recovery

9.0.STAGE 2 (automation):

arale.sh:

#!/bin/sh

#
# BEFORE USAGE NOTE:
# REMOVE CACHE (arale dir) FROM PREVIOUS PROCESSES IN /home/user/.cache/ubports/
# DISCONNECT ALL ADB DEVICES EXCEPT MEIZU MX4
# RUN UBPORTS INSTALLER
# FOLLOW INSTRUCTIONS
# AND REBOOT TO FASTBOOT ON FAIL (volume down + power btns)
# RUN SCRIPT: sh arale.sh
#

UBP_FILES=$HOME/.cache/ubports/arale
REC=recovery
RECOVERY_IMG=recovery-arale.img
UC=ubuntu_command
RF=$UBP_FILES/$REC

RED="\033[33;31m"
GREEN="\033[33;32m"
YELL="\033[33;33m"
NOCOLOR="\033[0m"

OK="$GREEN OK $NOCOLOR..."
DON="$GREEN Done!$NOCOLOR"
ERR="$RED Error."
STOP="does not exists. Stopping"
CHECK="$YELL Verifying"
DEV="device"
SD="sdcard"

echo -e "$CHECK dirs..."

if [ -d $RF ]
then
	echo -e "$OK $RF"
else
	echo -e "$ERR $RF $STOP"
	exit 0
fi

if [ -d $UBP_FILES/Ubuntu\ Touch ]
then
	echo -e "$OK $UBP_FILES/Ubuntu\ Touch"
else
	echo -e "$ERR $UBP_FILES/Ubuntu\ Touch $STOP"
fi

echo -e "$DON"
echo -e "\n$CHECK files..."

if [ -f $RF/$RECOVERY_IMG ]
then
	echo -e "$OK $RECOVERY_IMG"
else
	echo -e "\n$ERR $RF/$RECOVERY_IMG $STOP"
	exit 0
fi

cd $UBP_FILES/Ubuntu\ Touch

# Getting file list from ubuntu_command
if [ -f $UC ]
then
	FILES_TO_OPERATE="$UC `cat $UC | sed 's/\<mount\>//g' | sed 's/\<system\>//g' | sed 's/\<format\>//g' | sed 's/\<unmount\>//g' | sed 's/\<update\>//g' | sed 's/\<load_keyring\>//g' | sed 's/ /\n/g' | sed '/^$/d'`"
else
	echo -e "$ERR $UBP_FILES/Ubuntu\ Touch/$UC $STOP"
	exit 0
fi

for I in $FILES_TO_OPERATE 
do
	if ls | grep -q $I
	then
		echo -e "$OK $I"
	else
		echo -e "$ERR $UBP_FILES/Ubuntu\ Touch/$I $STOP"
		exit 0
	fi
done

echo -e "$DON"
echo -e "$YELL"

read -p "Is $DEV connected and in fastboot mode (volume down + power btns)? [Y]/n: " CONN
CONN=`echo $CONN | tr '[A-Z]' '[a-z]' | cut -c1-1`

echo -e "$NOCOLOR"

if [ "$CONN" = "n" ]
then
	echo -e "$NOCOLOR Exiting."
	exit 0
fi

if [ "$CONN" = "y" -o -z "$CONN" ]
then
	echo "" > /dev/null
else
	echo -e "$ERR. Unknown character: $CONN"
	exit 0
fi

echo -e "\n$YELL Flashing $REC...$NOCOLOR"

if fastboot flash $REC $RF/$RECOVERY_IMG
then
	echo -e "$OK fastboot flash $REC $RF/$RECOVERY_IMG"
	echo -e "\n$YELL Rebooting to $REC..."
else
	echo -e "$ERR Not in fastboot mode."
	exit 0
fi

echo -e "$GREEN Reboot to $REC (volume up + power btns)"
sleep 8
echo -e "\n$NOCOLOR Waiting for adb $DEV..."

while [ -z `adb devices | sed -n 2p | cut -f2` ]
do
	sleep 1	
done

# Check device adb connection
if [ `adb devices | sed -n 2p | cut -f2` = "$REC" ]
then
	echo -e "\n$OK Connected!"
	echo -e "\n$YELL Preparing $SD on $DEV...$NOCOLOR"
	adb shell mount -a > /dev/null
	sleep 4
	adb shell mkdir /$SD/$REC > /dev/null
	adb shell rm /$SD/$REC/*
	echo -e "$DON"
	echo -e "\n$YELL Preparing cache on $DEV...$NOCOLOR"
	adb shell rm -f /cache/
        echo -e "$DON"
else
	echo -e "\n$RED Unknown error$NOCOLOR"
	exit 0
fi

for I in $FILES_TO_OPERATE
do
	if [ `echo $I | cut -d- -f1` = "image" -o `echo $I | cut -d_ -f1` = "ubuntu" ]
	then
		adb push $I /cache/$REC/
		echo -e "$OK $PUSH $I"
	else
		adb push $I /sdcard/$REC/
		adb shell ln -s /sdcard/$REC/$I /cache/$REC/
		echo -e "$OK $PUSH $I"
	fi
done

echo -e "\n$YELL Rebooting to $REC..."

adb reboot $REC

echo -e "\n$OK Wait for Ubuntu Touch being flashed"

exit 0

PS. UBPorts update process needs repeat steps from 8.0.STAGE 2

[Keneda]

@ropod7 said in How to unlock bootloader？:

Get ROOT by standard method (Flyme account). SuperSu NO NEEDED

Is there a way to get root with a non standard method? (flyme account lost with prévious owner)?

[ropod7]

@keneda probably yes, but you need to smoke 4pda, and it's not to me.

[Keneda]

@ropod7 said in How to unlock bootloader？:

you need to smoke 4pda

Whuuttt?!?

[ropod7]

UBPorts update process needs repeat steps from 8.0.STAGE 2

[ropod7]

Over script post update/flash should look like: