This is a guide explaining how to unlock and flash a Huawei Mate 10 Pro (BLA-L09 in this guide) with a stock firmware, and how to retrieve a stock firmware from the Internet. I wrote it as a reminder to myself, but others could find it useful too.
IMPORTANT: The steps presented here can harm/brick your phone, and I cannot be held responsible for any damage you phone could suffer.
This guide assume that:
- You don't mind losing all of your data
- Your phone is not bricked (if it's the case there are ways of finding the required information for completing this guide − I cover some parts in this guide, but not everything)
- You have either a Linux or Windows computer available
- You have sufficient knowledge for understanding what you're doing and the risks you expose your phone to
- You don't have to be root on your phone
This guide has been tested by myself, and (when done properly) works. For writing this guide, I relied on my own experiments made of the environment described below. Don't forget to replace with your actual configuration. It may work for other phones as well.
There are three sections in this guide:
- Unlock the boot loader: how to prepare your phone so you can flash it using fastboot
- Get a flashable stock firmware: how to download a stock firmware from the Internet and making it "flashable"
- Flash a firmware: how to flash your phone using fastboot
You will need information about your phone in order to unlock it. I explain how to find it here, then how to use it to unlock the boot loader.
IMPORTANT: unlocking the boot loader will delete all the data on your phone!
This is the configuration of my Huawei Mate 10 Pro. You will need those values for your phone in order to complete this guide. For each one I explain how to find it.
- Phone model:
BLA-L09(printed on the phone's box and behind the phone, or visible in the Android settings) - Build number:
BLA-L09 8.0.0.127(C109)(Android settings) - Build number version:
BLA-L09C109B127(see below for finding it) - Android version: 8.0.0 (Android settings)
- IMEI: 15 digits number (Android settings, or type
*#06#in the dialer) - Serial number (Android settings)
- Product ID: ~8 digits number (type
*#*#1357946*#*#in the dialer) - Unlocking password (obtained on Huawei's website − this might be disabled in the future, and you will have to send a request email to Huawei's customer support)
For finding out your build number version, take the build number (e.g. BLA-L09 8.0.0.127(C109)) and replace the Android version (e.g. 8.0.0) by the number in parentheses (e.g. C109). Finally, add the character B before the last number (e.g. .127 becomes B127). You obtain the build number version. Source.
There are already many resources on the Internet explaining how to get this piece of information. For summarizing, go to the Huawei's website linked above, create an account, accept and understand the terms, then fill in all the required data on the page and click Commit. If the data you entered is correct, you will get the unlocking password. Write it down for later. Double check everything if it doesn't work, without forgetting the first fields (happened to me)!
Now it seems that this page will be deleted in the near future. The only way to retrieve the unlocking password will be to send an email to the customer support, with all the required information listed above.
If your phone is bricked, know that there is a tool on Windows for retrieving some values (serial number, …): DC-unlocker. It's easy to use, just connect your phone to your computer, then fill in the required parameters (hardware type, etc…) and start the analysis.
You won't be able to retrieve the product ID using this tool, however there is another which will allow you to generate a product ID: Huawei Product ID Generator. I'm unsure of which phone model you should select for a Huawei Mate 10 Pro, a bit of investigation might be needed here. Note that the generated product ID won't be the same as the one you will get using the dialer method described previously, however it will still work for getting the unlocking password using Huawei's website. This XDA thread might be of interest.
You won't need this information for completing the guide, but I put it here anyway for helping identifying the software/hardware (all this is visible in the Android settings):
- CPU: HiSilicon Kirin 970
- RAM: 6GB
- Storage: 128GB
- Android security patch: 1 January 2018
- Baseband version:
21C10B551S000C000 - Kernel version:
4.4.23+ android@localhost #1 Thu Dec 28 02:30:16 CST 2017 - EMUI version: 8.0.0
Go into the Android settings and unlock developers options (search the web on how to do that). In the developers options, enable OEM unlock. If this option is grayed out:
- either it is already enabled (yes, even if grayed out) in which case you have nothing more to do
- or it is disabled in which case you must connect your phone to the Internet (Wifi or SIM card), then reboot it. The option should now be available
Refer to the picture Huawei_Mate_10_Pro_OEM_unlock.jpg.
The option OEM unlock in the settings matches the field "FRP" in the boot loader. It must be enabled. When entering the boot loader (see below) if you see "FRP locked", it means that OEM unlock is disabled. In that case, sorry, but I am 95% sure that there is nothing you can do. If you see "FRP unlocked", well you're a lucky one.
You will need fastboot. There are plenty of material on the Internet explaining how to install it for any OS, just search the web.
Now that the phone is "OEM unlocked", reboot in the boot loader. To do this, connect your phone to a computer, then reboot or power on it normally. As soon as it starts up, hold the volume down key until you end up on a white screen with an Android (refer to the picture Huawei_Mate_10_Pro_bootloader.jpg). That's the boot loader.
We will unlock it now. Note that this will delete all your data!. Fire up a terminal / command prompt, and type: fastboot oem unlock XXXXXXXXXXXXXXXX where the last part is the unlocking password you found earlier (obviously, replace by fastboot.exe on Windows). If it does not work, it's because the password is wrong. If it does work, the phone will display a screen asking if you are sure. Just follow the instructions on the phone. When returning to the boot loader, you should see "PHONE Unlocked". Congrats, your phone is now unlocked! For exiting the boot loader: fastboot reboot.
If you want to relock your phone, here is how to do it. Do that only when you're sure that the firmwares you flashed let the phone boot! Note that this will delete all your data!.
First return to the boot loader, and issue this command: fastboot oem relock XXXXXXXXXXXXXXXX (replace with the unlocking password). Follow the instructions on screen. When returning to the boot loader, you should see "PHONE Relocked", and "FRP Lock". You can exit the boot loader: fastboot reboot.
There is no need to do the reverse operation about the OEM unlock option that we did earlier. Relocking the boot loader automatically disables it. At this point, your phone is properly relocked.
Note that this method is in no way official. Huawei has stopped providing stock firmwares some time ago. Note also that you cannot retrieve the user data partition using this method − it may be a problem for some.
There is no official way of downloading a stock firmware. However, there is a website which lists OTAs (updates Over The Air) pushed by Huawei, and which can be used for getting a stock firmware.
Identify the build number version of the build you wish to retrieve. Then search it on this page, and click on "update" to download it (choose one with "FullOTA-MF", because the others "OTA-MF" are differentials, i.e. not complete firmwares). The downloaded file will be named update.zip. Unzip it. Inside there is another file UPDATE.APP which is the actual payload of the firmware. Source.
If you're on Windows download Huawei Update Extractor − on Linux splitupdate (not tested by me). Start it and use it for extracting the content of UPDATE.APP. With Huawei Update Extractor, select "Unknown (worstenbrood)" for the phone model, and in the settings uncheck "Verify header checksum" (source). Still on Huawei Update Extractor, once extracted and the listing of the files displayed, right click on one of them and "Extract all". With splitupdate, just follow the README.md.
Now you should have the list of images SYSTEM.img, RAMDISK.img, etc… Those can be flashed on the mobile! Maybe there will be other files types as well (*.img.header), but those are useless as far as I know.
Source. Note that there is another alternative for downloading the firmwares: search on GetDroidTips or read this article on GetDroidTips (both not tested).
Before flashing those files, I recommend that you check that the operation went well and that the retrieved files are correct. You will need Linux here. Fire up a terminal, and type file XXXXX.img (replace by the file you want to check). Refer to the following revelant subsections depending on the output of the command.
If the output begins with "Android sparse image" we can extract what is in the image file to be sure that it's consistent:
- Install simg2img (on Ubuntu it's included in the package
android-tools-fsutils) - Make a copy of the image file you want to check in another directory, for not messing up anything
- Run
simg2img XXXXX.img XXXXX.ext4.img. A new file is created - Then create a directory for mounting the extracted EXT4 image:
mkdir mnt(the name is not important) - Mount the file:
sudo mount -t ext4 -o loop system.ext4.img ./mnt. If successful, enter the directory and check that its content makes sense, i.e. there are readable files. If yes, your image is not corrupted! - Unmount (
sudo umount mnt), then delete all this stuff which is not needed anymore
If the output begins with "Android bootimg" we can try to extract what is in the image file to be sure that it's consistent using a different method than for sparse images. Note that it does not work for every image, but if it does you can be sure your image is correct. Otherwise, as far as I know there is no way to know apart from actually flashing it. Here we go:
- Install abootimg (on Ubuntu it's included in the package
abootimg) - Make a copy of the image file you want to check in another directory, for not messing up anything
- Run
abootimg -x XXXXX.img. Several files are created, and in particularinitrd.imgwhich is −in my experience− a gzip file (check that by runningfileon it) - Create a new directory and enter it:
mkdir ramdisk && cd ramdisk - Extract the content of
initrd.img:gunzip -c ../initrd.img | cpio -i. If successful, check that the created content makes sense, i.e. there are readable files. If yes, your image is not corrupted! - Delete all this stuff which is not needed anymore
If the output begins with one of the following items, I cannot help you. The image might be correct, or it might not:
- ASCII text: well, that's just plain text, having a look at it will tell you if it's corrupted or not. But I don't know if those files are relevant for flashing
- DOS/MBR boot sector: no idea at all
- data: that means
filewas unable to find out what the file format is. It can be anything, and as to know if it's corrupted or not… - BIOS ROM Ext: BIOS ROM extension, this is one of the
*.img.headerfiles. I know nothing more about them
For information, here is the list of the files I got after extraction, with their types inspected with file:
CACHE.img: Android sparse image, version: 1.0, Total of 32768 4096-byte output blocks in 10 input chunks.
CRC.img: data
CURVER.img: ASCII text, with no line terminators
DTO.img: data
DTS.img: data
ERECOVERY_KERNE.img: data
ERECOVERY_RAMDI.img: Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
ERECOVERY_VBMET.img: data
ERECOVERY_VENDO.img: Android bootimg, ramdisk (0x11000000), page size: 2048
FASTBOOT.img: data
FW_HIFI.img: data
FW_LPM3.img: data
HDCP.img: data
HHEE.img: data
HISEE_FS.img: Android sparse image, version: 1.0, Total of 2048 4096-byte output blocks in 12 input chunks.
HISEE_IMG.img: data
HISIUFS_GPT.img: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 1, 0 sectors, extended partition table (last)
ISP_FIRMWARE.img: data
KERNEL.img: data
MODEM_FW.img: data
MODEMNVM_CUST.img: data
MODEMNVM_UPDATE.img: data
ODM.img: Android sparse image, version: 1.0, Total of 32768 4096-byte output blocks in 1355 input chunks.
PACKAGE_TYPE.img: ASCII text
PRODUCT.img: Android sparse image, version: 1.0, Total of 49152 4096-byte output blocks in 338 input chunks.
RAMDISK.img: Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
RECOVERY_RAMDIS.img: Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
RECOVERY_VBMETA.img: data
RECOVERY_VENDOR.img: Android bootimg, ramdisk (0x11000000), page size: 2048
SENSORHUB.img: data
SHA256RSA.img: data
SYSTEM.img: Android sparse image, version: 1.0, Total of 1200128 4096-byte output blocks in 7150 input chunks.
TEEOS.img: data
TRUSTFIRMWARE.img: data
VBMETA.img: data
VECTOR.img: data
VENDOR.img: Android sparse image, version: 1.0, Total of 200704 4096-byte output blocks in 3316 input chunks.
VERLIST.img: ASCII text, with CRLF line terminators
XLOADER.img: data
And the *.img.header files:
CACHE.img.header: BIOS (ia32) ROM Ext. (90*512)
CRC.img.header: BIOS (ia32) ROM Ext. (90*512)
CURVER.img.header: BIOS (ia32) ROM Ext. (90*512)
DTO.img.header: BIOS (ia32) ROM Ext. (90*512)
DTS.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_KERNE.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_RAMDI.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_VBMET.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_VENDO.img.header: BIOS (ia32) ROM Ext. (90*512)
FASTBOOT.img.header: BIOS (ia32) ROM Ext. (90*512)
FW_HIFI.img.header: BIOS (ia32) ROM Ext. (90*512)
FW_LPM3.img.header: BIOS (ia32) ROM Ext. (90*512)
HDCP.img.header: BIOS (ia32) ROM Ext. (90*512)
HHEE.img.header: BIOS (ia32) ROM Ext. (90*512)
HISEE_FS.img.header: BIOS (ia32) ROM Ext. (90*512)
HISEE_IMG.img.header: BIOS (ia32) ROM Ext. (90*512)
HISIUFS_GPT.img.header: BIOS (ia32) ROM Ext. (90*512)
ISP_FIRMWARE.img.header: BIOS (ia32) ROM Ext. (90*512)
KERNEL.img.header: BIOS (ia32) ROM Ext. (90*512)
MODEM_FW.img.header: BIOS (ia32) ROM Ext. (90*512)
MODEMNVM_CUST.img.header: BIOS (ia32) ROM Ext. (90*512)
MODEMNVM_UPDATE.img.header: BIOS (ia32) ROM Ext. (90*512)
ODM.img.header: BIOS (ia32) ROM Ext. (90*512)
PACKAGE_TYPE.img.header: BIOS (ia32) ROM Ext. (90*512)
PRODUCT.img.header: BIOS (ia32) ROM Ext. (90*512)
RAMDISK.img.header: BIOS (ia32) ROM Ext. (90*512)
RECOVERY_RAMDIS.img.header: BIOS (ia32) ROM Ext. (90*512)
RECOVERY_VBMETA.img.header: BIOS (ia32) ROM Ext. (90*512)
RECOVERY_VENDOR.img.header: BIOS (ia32) ROM Ext. (90*512)
SENSORHUB.img.header: BIOS (ia32) ROM Ext. (90*512)
SHA256RSA.img.header: BIOS (ia32) ROM Ext. (90*512)
SYSTEM.img.header: BIOS (ia32) ROM Ext. (90*512)
TEEOS.img.header: BIOS (ia32) ROM Ext. (90*512)
TRUSTFIRMWARE.img.header: BIOS (ia32) ROM Ext. (90*512)
VBMETA.img.header: BIOS (ia32) ROM Ext. (90*512)
VECTOR.img.header: BIOS (ia32) ROM Ext. (90*512)
VENDOR.img.header: BIOS (ia32) ROM Ext. (90*512)
VERLIST.img.header: BIOS (ia32) ROM Ext. (90*512)
XLOADER.img.header: BIOS (ia32) ROM Ext. (90*512)
IMPORTANT: I suggest that you first try to flash a stock firmware for making sure that everything works as expected before flashing a customized one.
IMPORTANT: This can brick your phone! If you are a complete novice and don't know what you're doing, maybe it's not a good idea to continue.
Your phone must be unlocked. If it is not, refer to the previous sections for how to do that. You need fastboot, but if you unlocked your phone earlier you should already have it.
Reboot your phone to the boot loader. To do this, connect your phone to a computer, then reboot or power on it normally. As soon as it starts up, hold the volume down key until you end up on a white screen with an Android.
Now, flash an image. I suggest that you start by flashing the stock system image in order to be sure that it works before trying to flash anything else: fastboot flash system SYSTEM.img (obviously, replace by fastboot.exe on Windows). If it succeeds, you will see something of the like:
Sending sparse 'system' 1/7 (460799 KB) OKAY [ 3.753s]
Writing sparse 'system' 1/7 OKAY [ 3.351s]
Sending sparse 'system' 2/7 (459263 KB) OKAY [ 3.696s]
Writing sparse 'system' 2/7 OKAY [ 2.535s]
Sending sparse 'system' 3/7 (453785 KB) OKAY [ 3.642s]
Writing sparse 'system' 3/7 OKAY [ 2.637s]
Sending sparse 'system' 4/7 (429929 KB) OKAY [ 3.366s]
Writing sparse 'system' 4/7 OKAY [ 2.516s]
Sending sparse 'system' 5/7 (445295 KB) OKAY [ 3.487s]
Writing sparse 'system' 5/7 OKAY [ 2.283s]
Sending sparse 'system' 6/7 (432560 KB) OKAY [ 3.368s]
Writing sparse 'system' 6/7 OKAY [ 2.250s]
Sending sparse 'system' 7/7 (302746 KB) OKAY [ 2.327s]
Writing sparse 'system' 7/7 OKAY [ 1.518s]
Finished. Total time: 41.245s
The phone can now be rebooted: fastboot reboot. Even without wiping the data partition, and granted that you flashed the same stock system image as you had previously on the phone, the phone should start up. If it does not:
- if it suggests to wipe the data partition (it might do that after a few reboots), do that then reboot
- if it just fails to boot repeatedly, switch it off, return to the boot loader and try to wipe the data partition (this will delete all your data):
fastboot -w. Then reboot - if that still do not work: it's bricked, and you'll have to search for a solution yourself
Note that the USB cable could prevent the phone from booting with some images, making the phone directly enter recovery mode (in that case just unplug the USB cable after having flashed). When you've checked that the phone boots with the new system partition, you can start trying to flash the other partitions or other images granted you know what you're doing.
That's the end of this guide. Keep experimenting, but be careful!
