Step 3 / 4

Please click the button below to download our bootloader unlock tool, then find somewhere to extract it. The directory path cannot have brackets or spaces.

Install Driver

For Generic x86 or x64 PC

If you’re using Generic x86 or x64 based Windows PC (in other words, this PC is powered by Intel or AMD processor), all you need to do is open “setup.exe” inside of Driver folder, then import “RegistryFix.reg”.

If you see this error message, it means you have drivers installed previously, which is expected.

Now you’re all set for using HCTSW Care UU4!

Start Unlocking

Once you have driver installed, please open “HCTSW_Care_UU4.cmd” directly. You cannot run it as Administrator. Then power off and connect your phone. It will try to check if you have submitted unlock request from our website. If yes the tool will allow you proceed to further step. Just press [Y] key to proceed.

Now just wait patiently and it will tell you what to do next.

Once the unlock procedure finishes, UU4 will submit unlock successful message to server and your request will be marked as finished immediately.

We assume you’re familiar with Bash Shell commands, and you have Android SDK Platform Tools properly configured.

We’ve tested this procedure under following Linux distributions:

• Debian 11 AMD64, ARMHF, ARM64 (Raspberry Pi OS)
• This also includes Chrome OS Crostini.

• Ubuntu 20.04 and Ubuntu 22.04 AMD64

• Fedora 36 AMD64

• openSUSE Tumbleweed AMD64

• Deepin / UOS 20.7 AMD64

We cannot guarantee it will run under Termux, UserLAnd or Kali NetHunter.

Download UU4 for Windows and Extract

The reason why UU4 for Windows is still required is, you’ll need to use bootloader images inside. We assume you extracted it to ~/uu4win/ .

Install Service Permission Granting Program

Execute these commands to install prerequisites. We assume you’re working under home directory (~, or /home/your_user_name/ ):

$ git clone https://github.com/HikariCalyx/uu4-linux
$ cd uu4-linux
$ sudo bash install.sh

Doing so will install Python-ADB and all necessary prerequisites. You can review what’s written in install.sh before you proceed. If you’re using pyenv, please install prerequisites manually afterwards:

$ pip install -r requirements.txt

The prerequisites installation procedure for macOS isn’t written, so you’ll have to understand how to utilize Homebrew to install prerequisites.

Enter Fastboot Mode and check if Unlock Request is submitted properly

You have two methods to enter Fastboot mode. Other than your familiar “adb reboot bootloader” command, you can also enter Fastboot mode by executing this command:

$ fastboot oem alive

Then power off the phone and connect it to PC.

To check if unlock request is submitted properly (Note, this step cannot be skipped), you’ll have to execute:

$ python3 auth_utility/checkOrder.py --uu4hash 1234 --mode check

If you see output like this and the exit code is 0:

{'orderNumber': 'HCT-F1914001111', 'orderStatus': 'processing'}

Then it means you have successfully requested bootloader unlock on our server. You can proceed now. If you see a bunch of error messages, please check if your PC is accessible to https://api.hikaricalyx.com .

Grant Service Permission and Flash Service Bootloader

Before you proceed, you should execute:

$ fastboot oem getversions

Example output:

(bootloader) model=A1N
(bootloader) sub_model=none
(bootloader) software version=A1N-5140-0-00WW-B01
(bootloader) SW model=00WW
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_

Please take note of software version line and this is important for few phones.

To grant service permission, you’ll need to execute:

$ python3 auth_utility/fihGetPermission.py --uu4hash 1234

If you see output like this:

Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
DM-Veracity Challenge: 37394611CA83C2960FF9F957BBCD503A6E7FA545

And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.

Please locate the bootloader image directory for your phone, and flash it to your phone like this:

## Phones that use emmc_appsboot should flash service bootloader like this:
$ fastboot flash aboot ~/uu4win/bootloader_image/(actual_path_for_your_phone)/emmc_appsboot_service.mbn
## Phones that use abl and xbl (if exists) should flash service bootloader like this:
$ fastboot flash abl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/abl_service.elf
$ fastboot flash xbl ~/uu4win/bootloader_image/(actual_path_for_your_phone)/xbl_service.elf
## Phones that use LK should flash service bootloader like this:
$ fastboot flash lk_a ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot flash lk_b ~/uu4win/bootloader_image/(actual_path_for_your_phone)/lk_service.img
$ fastboot reboot-bootloader

All bootloader images are categorized by SoC model and project code. For MTK models, the LK version is sensitive, flashing wrong version LK image may cause your phone fail to boot. For Qualcomm models, make sure you selected the correct ABL/XBL/ABOOT image for your phone.

Grant Service Permission again and Perform Bootloader Unlock (for most of models)

Now you have booted into Service Bootloader, you can proceed to bootloader unlock procedure. First of all, execute this command to grant service permission.

$ python3 auth_utility/fihGetPermission.py --uu4hash 1234

If you see output like this:

Security Version: 0004
Project Code: A1N1
PSN: A1NGA5xxxxxxxxxx
UID: D92F8C834538AD2654374904FDDA5B80C736C2E7

And the exit code is 0, then you have successfully granted service permission. Now you can flash Service Bootloader image.

For most of Qualcomm models excluding Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)

Now execute these commands to perform bootloader unlock.

$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot flashing unlock_critical
## confirm bootloader unlock on your phone if needed, then boot into Fastboot mode again
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem fih on
$ fastboot oem devlock allow_unlock
$ fastboot oem unlock-go
## confirm bootloader unlock on your phone if needed

Additional Steps for Nokia 6.1 running Chinese firmware

Do not follow this procedure if you’re not using Nokia 6.1.

If you’re using Chinese version of Nokia 6.1 or Foxconn internally customized Nokia 6.1 that running Chinese version firmware and would like to install Lineage OS afterwards, you’ll have to install bootloader image for Global ROM, then repeat the bootloader unlock procedure above.

To confirm if you’re using Chinese version of Nokia 6.1, check output of “fastboot oem getversions”.

(bootloader) model=P2C
(bootloader) sub_model=none
(bootloader) software version=PL2-347I-0-00CN-B02
(bootloader) SW model=00CN
(bootloader) build number=B01
(bootloader) hardware version=3.0
(bootloader) RF band id=G_850_900_1800_1900^W_1_2_5_8^C_0^T_34_39^L_1_2_

If model is P2C, then you’re using Chinese version of Nokia 6.1. If SW model is 00CN then you’re using Chinese firmware as well, otherwise you can safely skip this procedure.

To install Global ROM bootloader images and perform bootloader unlock again, execute these commands:

$ cd  ~/uu4win/bootloader_image/SDM660-835/PL2-C1N-4/P2C_additional/
$ fastboot flash partition gpt_both0.bin
$ fastboot flash abl_a ../abl_service.elf
$ fastboot flash xbl_a ../xbl_service.elf
$ fastboot flash tz_a tz.mbn
$ fastboot flash rpm_a rpm.mbn
$ fastboot flash hwcfg hwcfg.img
$ fastboot flash hyp_a hyp.mbn
$ fastboot flash pmic_a pmic.elf
$ fastboot flash keymaster_a keymaster64.mbn
$ fastboot flash cmnlib_a cmnlib.mbn
$ fastboot flash cmnlib64_a cmnlib64.mbn
$ fastboot flash dsp_a dspso.bin
$ fastboot flash devcfg_a devcfg.mbn
$ fastboot flash sec sec.dat
$ fastboot flash tz_a tz.mbn
$ fastboot flash systeminfo_a systeminfo.img
$ fastboot reboot-bootloader
$ cd ~/uu4-linux/
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot oem CustomerSKUID set 600WW

Then, repeat the bootloader unlock procedure above. Once bootloader unlock finishes, you can proceed to Lineage OS installation or Global stock ROM installation procedure.

For MediaTek models

Simply execute these 2 commands.

$ fastboot flashing unlock
## confirm bootloader unlock on your phone by pressing Volume up key
$ fastboot reboot

For Nokia 8.1/X7 (PNX) and Nokia 9 (AOP)

Procedure for these 2 models are super complicated. Proceed with caution!

$ fastboot oem fih on
$ fastboot oem allport
$ fastboot oem fuar
## Now your phone should boot into Rooted ADB Shell...Check if you really get Rooted ADB Shell
$ adb shell uid
## Just in case the phone does not include dd binary
$ adb push ~/uu4win/bin/linux/arm64/busybox /data/local/tmp/b
$ adb shell chmod +x /data/local/tmp/b
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/mfd of=/data/local/tmp/mfd.img
$ adb shell /data/local/tmp/b dd if=/dev/block/bootdevice/by-name/securefs of=/data/local/tmp/securefs.img
$ adb pull /data/local/tmp/mfd.img
$ adb pull /data/local/tmp/securefs.img
$ psn=$(adb shell getprop ro.serialno)
$ printf ${psn} | dd of=~/uu4win/bootloader_image/SDM710-845/mfdaop.img bs=1 seek=112 count=16 conv=notrunc
$ adb push ~/uu4win/bootloader_image/SDM710-845/mfdaop.img /data/local/tmp/
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/mfdaop.img /dev/block/bootdevice/by-name/mfd
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ adb push ~/uu4win/bootloader_image/SDM710-845/PNX/2-abl_service.elf /data/local/tmp/a
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ adb push ~/uu4win/bootloader_image/SDM710-845/AOP/4-abl_service.elf /data/local/tmp/a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_a
$ adb shell /data/local/tmp/b dd if=/data/local/tmp/a of=/dev/block/bootdevice/by-name/abl_b
$ adb reboot bootloader
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock_critical
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ fastboot flash unlock ~/uu4win/bootloader_image/SDM710-845/nb1collision.key
$ fastboot flashing unlock
## Confirm bootloader unlock on your phone within 30 seconds or the confirmation message will disappear
## Execute these commands when phone is erasing:
$ fastboot oem alive
$ python3 auth_utility/fihGetPermission.py --uu4hash 1234
$ fastboot flash mfd mfd.img
$ fastboot flash mfdbk mfd.img
$ fastboot flash securefs securefs.img
$ fastboot flash securefsbk securefs.img
## for Nokia 8.1 / X7 (PNX) - Don't execute this on Nokia 9 (AOP)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/PNX/6-abl.elf
## for Nokia 9 (AOP) - Don't execute this on Nokia 8.1 / X7 (PNX)
$ fastboot flash abl ~/uu4win/bootloader_image/SDM710-845/AOP/5-abl.elf

That concluded the procedure of bootloader unlock.

How about dump boot image for Magisk Root?

Since you’ve read how to enter Rooted ADB Shell from the procedure for Nokia 8.1 / X7 / 9, then I guess you should know how to dump boot image.

However, for Nokia 3.1 A / C (EAG) and 3.1 Plus C (RHD), entering Rooted ADB Shell will cause the bootloader unlock revert back to locked state, so we strongly recommend you dump boot image before you proceed to bootloader unlock.