Skip to content

Instantly share code, notes, and snippets.

@Jim-Bar
Last active September 3, 2023 03:38
Show Gist options
  • Save Jim-Bar/37066cb916ec6044e9ec2a8d931cc6fb to your computer and use it in GitHub Desktop.
Save Jim-Bar/37066cb916ec6044e9ec2a8d931cc6fb to your computer and use it in GitHub Desktop.
Huawei Mate 10 Pro - Stock Firmware

What is this?

This is a guide explaining how to unlock and flash a Huawei Mate 10 Pro (BLA-L09 in this guide) with a stock firmware, and how to retrieve a stock firmware from the Internet. I wrote it as a reminder to myself, but others could find it useful too.

IMPORTANT: The steps presented here can harm/brick your phone, and I cannot be held responsible for any damage you phone could suffer.

This guide assume that:

  • You don't mind losing all of your data
  • Your phone is not bricked (if it's the case there are ways of finding the required information for completing this guide − I cover some parts in this guide, but not everything)
  • You have either a Linux or Windows computer available
  • You have sufficient knowledge for understanding what you're doing and the risks you expose your phone to
  • You don't have to be root on your phone

This guide has been tested by myself, and (when done properly) works. For writing this guide, I relied on my own experiments made of the environment described below. Don't forget to replace with your actual configuration. It may work for other phones as well.

There are three sections in this guide:

  1. Unlock the boot loader: how to prepare your phone so you can flash it using fastboot
  2. Get a flashable stock firmware: how to download a stock firmware from the Internet and making it "flashable"
  3. Flash a firmware: how to flash your phone using fastboot

Unlock the boot loader

You will need information about your phone in order to unlock it. I explain how to find it here, then how to use it to unlock the boot loader.

IMPORTANT: unlocking the boot loader will delete all the data on your phone!

Configuration

This is the configuration of my Huawei Mate 10 Pro. You will need those values for your phone in order to complete this guide. For each one I explain how to find it.

  • Phone model: BLA-L09 (printed on the phone's box and behind the phone, or visible in the Android settings)
  • Build number: BLA-L09 8.0.0.127(C109) (Android settings)
  • Build number version: BLA-L09C109B127 (see below for finding it)
  • Android version: 8.0.0 (Android settings)
  • IMEI: 15 digits number (Android settings, or type *#06# in the dialer)
  • Serial number (Android settings)
  • Product ID: ~8 digits number (type *#*#1357946*#*# in the dialer)
  • Unlocking password (obtained on Huawei's website − this might be disabled in the future, and you will have to send a request email to Huawei's customer support)

Build number version

For finding out your build number version, take the build number (e.g. BLA-L09 8.0.0.127(C109)) and replace the Android version (e.g. 8.0.0) by the number in parentheses (e.g. C109). Finally, add the character B before the last number (e.g. .127 becomes B127). You obtain the build number version. Source.

Unlocking password

There are already many resources on the Internet explaining how to get this piece of information. For summarizing, go to the Huawei's website linked above, create an account, accept and understand the terms, then fill in all the required data on the page and click Commit. If the data you entered is correct, you will get the unlocking password. Write it down for later. Double check everything if it doesn't work, without forgetting the first fields (happened to me)!

Now it seems that this page will be deleted in the near future. The only way to retrieve the unlocking password will be to send an email to the customer support, with all the required information listed above.

Extras

Windows tools for bricked phones

If your phone is bricked, know that there is a tool on Windows for retrieving some values (serial number, …): DC-unlocker. It's easy to use, just connect your phone to your computer, then fill in the required parameters (hardware type, etc…) and start the analysis.

You won't be able to retrieve the product ID using this tool, however there is another which will allow you to generate a product ID: Huawei Product ID Generator. I'm unsure of which phone model you should select for a Huawei Mate 10 Pro, a bit of investigation might be needed here. Note that the generated product ID won't be the same as the one you will get using the dialer method described previously, however it will still work for getting the unlocking password using Huawei's website. This XDA thread might be of interest.

Extra configuration

You won't need this information for completing the guide, but I put it here anyway for helping identifying the software/hardware (all this is visible in the Android settings):

  • CPU: HiSilicon Kirin 970
  • RAM: 6GB
  • Storage: 128GB
  • Android security patch: 1 January 2018
  • Baseband version: 21C10B551S000C000
  • Kernel version: 4.4.23+ android@localhost #1 Thu Dec 28 02:30:16 CST 2017
  • EMUI version: 8.0.0

Unlock!

OEM unlock

Go into the Android settings and unlock developers options (search the web on how to do that). In the developers options, enable OEM unlock. If this option is grayed out:

  1. either it is already enabled (yes, even if grayed out) in which case you have nothing more to do
  2. or it is disabled in which case you must connect your phone to the Internet (Wifi or SIM card), then reboot it. The option should now be available

Refer to the picture Huawei_Mate_10_Pro_OEM_unlock.jpg.

Note about bricked phones

The option OEM unlock in the settings matches the field "FRP" in the boot loader. It must be enabled. When entering the boot loader (see below) if you see "FRP locked", it means that OEM unlock is disabled. In that case, sorry, but I am 95% sure that there is nothing you can do. If you see "FRP unlocked", well you're a lucky one.

Fastboot unlock

You will need fastboot. There are plenty of material on the Internet explaining how to install it for any OS, just search the web.

Now that the phone is "OEM unlocked", reboot in the boot loader. To do this, connect your phone to a computer, then reboot or power on it normally. As soon as it starts up, hold the volume down key until you end up on a white screen with an Android (refer to the picture Huawei_Mate_10_Pro_bootloader.jpg). That's the boot loader.

We will unlock it now. Note that this will delete all your data!. Fire up a terminal / command prompt, and type: fastboot oem unlock XXXXXXXXXXXXXXXX where the last part is the unlocking password you found earlier (obviously, replace by fastboot.exe on Windows). If it does not work, it's because the password is wrong. If it does work, the phone will display a screen asking if you are sure. Just follow the instructions on the phone. When returning to the boot loader, you should see "PHONE Unlocked". Congrats, your phone is now unlocked! For exiting the boot loader: fastboot reboot.

(Re)lock

If you want to relock your phone, here is how to do it. Do that only when you're sure that the firmwares you flashed let the phone boot! Note that this will delete all your data!.

First return to the boot loader, and issue this command: fastboot oem relock XXXXXXXXXXXXXXXX (replace with the unlocking password). Follow the instructions on screen. When returning to the boot loader, you should see "PHONE Relocked", and "FRP Lock". You can exit the boot loader: fastboot reboot.

There is no need to do the reverse operation about the OEM unlock option that we did earlier. Relocking the boot loader automatically disables it. At this point, your phone is properly relocked.

Get a flashable stock firmware

Note that this method is in no way official. Huawei has stopped providing stock firmwares some time ago. Note also that you cannot retrieve the user data partition using this method − it may be a problem for some.

Download an OTA

There is no official way of downloading a stock firmware. However, there is a website which lists OTAs (updates Over The Air) pushed by Huawei, and which can be used for getting a stock firmware.

Identify the build number version of the build you wish to retrieve. Then search it on this page, and click on "update" to download it (choose one with "FullOTA-MF", because the others "OTA-MF" are differentials, i.e. not complete firmwares). The downloaded file will be named update.zip. Unzip it. Inside there is another file UPDATE.APP which is the actual payload of the firmware. Source.

Extract the firmware from the OTA file

If you're on Windows download Huawei Update Extractor − on Linux splitupdate (not tested by me). Start it and use it for extracting the content of UPDATE.APP. With Huawei Update Extractor, select "Unknown (worstenbrood)" for the phone model, and in the settings uncheck "Verify header checksum" (source). Still on Huawei Update Extractor, once extracted and the listing of the files displayed, right click on one of them and "Extract all". With splitupdate, just follow the README.md.

Now you should have the list of images SYSTEM.img, RAMDISK.img, etc… Those can be flashed on the mobile! Maybe there will be other files types as well (*.img.header), but those are useless as far as I know.

Source. Note that there is another alternative for downloading the firmwares: search on GetDroidTips or read this article on GetDroidTips (both not tested).

Before flashing those files, I recommend that you check that the operation went well and that the retrieved files are correct. You will need Linux here. Fire up a terminal, and type file XXXXX.img (replace by the file you want to check). Refer to the following revelant subsections depending on the output of the command.

Android sparse image

If the output begins with "Android sparse image" we can extract what is in the image file to be sure that it's consistent:

  1. Install simg2img (on Ubuntu it's included in the package android-tools-fsutils)
  2. Make a copy of the image file you want to check in another directory, for not messing up anything
  3. Run simg2img XXXXX.img XXXXX.ext4.img. A new file is created
  4. Then create a directory for mounting the extracted EXT4 image: mkdir mnt (the name is not important)
  5. Mount the file: sudo mount -t ext4 -o loop system.ext4.img ./mnt. If successful, enter the directory and check that its content makes sense, i.e. there are readable files. If yes, your image is not corrupted!
  6. Unmount (sudo umount mnt), then delete all this stuff which is not needed anymore

Android bootimg

If the output begins with "Android bootimg" we can try to extract what is in the image file to be sure that it's consistent using a different method than for sparse images. Note that it does not work for every image, but if it does you can be sure your image is correct. Otherwise, as far as I know there is no way to know apart from actually flashing it. Here we go:

  1. Install abootimg (on Ubuntu it's included in the package abootimg)
  2. Make a copy of the image file you want to check in another directory, for not messing up anything
  3. Run abootimg -x XXXXX.img. Several files are created, and in particular initrd.img which is −in my experience− a gzip file (check that by running file on it)
  4. Create a new directory and enter it: mkdir ramdisk && cd ramdisk
  5. Extract the content of initrd.img: gunzip -c ../initrd.img | cpio -i. If successful, check that the created content makes sense, i.e. there are readable files. If yes, your image is not corrupted!
  6. Delete all this stuff which is not needed anymore

ASCII text, DOS/MBR boot sector, data, BIOS ROM Ext

If the output begins with one of the following items, I cannot help you. The image might be correct, or it might not:

  1. ASCII text: well, that's just plain text, having a look at it will tell you if it's corrupted or not. But I don't know if those files are relevant for flashing
  2. DOS/MBR boot sector: no idea at all
  3. data: that means file was unable to find out what the file format is. It can be anything, and as to know if it's corrupted or not…
  4. BIOS ROM Ext: BIOS ROM extension, this is one of the *.img.header files. I know nothing more about them

List of files

For information, here is the list of the files I got after extraction, with their types inspected with file:

CACHE.img:           Android sparse image, version: 1.0, Total of 32768 4096-byte output blocks in 10 input chunks.
CRC.img:             data
CURVER.img:          ASCII text, with no line terminators
DTO.img:             data
DTS.img:             data
ERECOVERY_KERNE.img: data
ERECOVERY_RAMDI.img: Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
ERECOVERY_VBMET.img: data
ERECOVERY_VENDO.img: Android bootimg, ramdisk (0x11000000), page size: 2048
FASTBOOT.img:        data
FW_HIFI.img:         data
FW_LPM3.img:         data
HDCP.img:            data
HHEE.img:            data
HISEE_FS.img:        Android sparse image, version: 1.0, Total of 2048 4096-byte output blocks in 12 input chunks.
HISEE_IMG.img:       data
HISIUFS_GPT.img:     DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x3ff,255,63), end-CHS (0x3ff,255,63), startsector 1, 0 sectors, extended partition table (last)
ISP_FIRMWARE.img:    data
KERNEL.img:          data
MODEM_FW.img:        data
MODEMNVM_CUST.img:   data
MODEMNVM_UPDATE.img: data
ODM.img:             Android sparse image, version: 1.0, Total of 32768 4096-byte output blocks in 1355 input chunks.
PACKAGE_TYPE.img:    ASCII text
PRODUCT.img:         Android sparse image, version: 1.0, Total of 49152 4096-byte output blocks in 338 input chunks.
RAMDISK.img:         Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
RECOVERY_RAMDIS.img: Android bootimg, ramdisk (0x11000000), page size: 2048, cmdline (buildvariant=user)
RECOVERY_VBMETA.img: data
RECOVERY_VENDOR.img: Android bootimg, ramdisk (0x11000000), page size: 2048
SENSORHUB.img:       data
SHA256RSA.img:       data
SYSTEM.img:          Android sparse image, version: 1.0, Total of 1200128 4096-byte output blocks in 7150 input chunks.
TEEOS.img:           data
TRUSTFIRMWARE.img:   data
VBMETA.img:          data
VECTOR.img:          data
VENDOR.img:          Android sparse image, version: 1.0, Total of 200704 4096-byte output blocks in 3316 input chunks.
VERLIST.img:         ASCII text, with CRLF line terminators
XLOADER.img:         data

And the *.img.header files:

CACHE.img.header:           BIOS (ia32) ROM Ext. (90*512)
CRC.img.header:             BIOS (ia32) ROM Ext. (90*512)
CURVER.img.header:          BIOS (ia32) ROM Ext. (90*512)
DTO.img.header:             BIOS (ia32) ROM Ext. (90*512)
DTS.img.header:             BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_KERNE.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_RAMDI.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_VBMET.img.header: BIOS (ia32) ROM Ext. (90*512)
ERECOVERY_VENDO.img.header: BIOS (ia32) ROM Ext. (90*512)
FASTBOOT.img.header:        BIOS (ia32) ROM Ext. (90*512)
FW_HIFI.img.header:         BIOS (ia32) ROM Ext. (90*512)
FW_LPM3.img.header:         BIOS (ia32) ROM Ext. (90*512)
HDCP.img.header:            BIOS (ia32) ROM Ext. (90*512)
HHEE.img.header:            BIOS (ia32) ROM Ext. (90*512)
HISEE_FS.img.header:        BIOS (ia32) ROM Ext. (90*512)
HISEE_IMG.img.header:       BIOS (ia32) ROM Ext. (90*512)
HISIUFS_GPT.img.header:     BIOS (ia32) ROM Ext. (90*512)
ISP_FIRMWARE.img.header:    BIOS (ia32) ROM Ext. (90*512)
KERNEL.img.header:          BIOS (ia32) ROM Ext. (90*512)
MODEM_FW.img.header:        BIOS (ia32) ROM Ext. (90*512)
MODEMNVM_CUST.img.header:   BIOS (ia32) ROM Ext. (90*512)
MODEMNVM_UPDATE.img.header: BIOS (ia32) ROM Ext. (90*512)
ODM.img.header:             BIOS (ia32) ROM Ext. (90*512)
PACKAGE_TYPE.img.header:    BIOS (ia32) ROM Ext. (90*512)
PRODUCT.img.header:         BIOS (ia32) ROM Ext. (90*512)
RAMDISK.img.header:         BIOS (ia32) ROM Ext. (90*512)
RECOVERY_RAMDIS.img.header: BIOS (ia32) ROM Ext. (90*512)
RECOVERY_VBMETA.img.header: BIOS (ia32) ROM Ext. (90*512)
RECOVERY_VENDOR.img.header: BIOS (ia32) ROM Ext. (90*512)
SENSORHUB.img.header:       BIOS (ia32) ROM Ext. (90*512)
SHA256RSA.img.header:       BIOS (ia32) ROM Ext. (90*512)
SYSTEM.img.header:          BIOS (ia32) ROM Ext. (90*512)
TEEOS.img.header:           BIOS (ia32) ROM Ext. (90*512)
TRUSTFIRMWARE.img.header:   BIOS (ia32) ROM Ext. (90*512)
VBMETA.img.header:          BIOS (ia32) ROM Ext. (90*512)
VECTOR.img.header:          BIOS (ia32) ROM Ext. (90*512)
VENDOR.img.header:          BIOS (ia32) ROM Ext. (90*512)
VERLIST.img.header:         BIOS (ia32) ROM Ext. (90*512)
XLOADER.img.header:         BIOS (ia32) ROM Ext. (90*512)

Flash a firmware

IMPORTANT: I suggest that you first try to flash a stock firmware for making sure that everything works as expected before flashing a customized one.

IMPORTANT: This can brick your phone! If you are a complete novice and don't know what you're doing, maybe it's not a good idea to continue.

Your phone must be unlocked. If it is not, refer to the previous sections for how to do that. You need fastboot, but if you unlocked your phone earlier you should already have it.

Reboot your phone to the boot loader. To do this, connect your phone to a computer, then reboot or power on it normally. As soon as it starts up, hold the volume down key until you end up on a white screen with an Android.

Now, flash an image. I suggest that you start by flashing the stock system image in order to be sure that it works before trying to flash anything else: fastboot flash system SYSTEM.img (obviously, replace by fastboot.exe on Windows). If it succeeds, you will see something of the like:

Sending sparse 'system' 1/7 (460799 KB)            OKAY [  3.753s]
Writing sparse 'system' 1/7                        OKAY [  3.351s]
Sending sparse 'system' 2/7 (459263 KB)            OKAY [  3.696s]
Writing sparse 'system' 2/7                        OKAY [  2.535s]
Sending sparse 'system' 3/7 (453785 KB)            OKAY [  3.642s]
Writing sparse 'system' 3/7                        OKAY [  2.637s]
Sending sparse 'system' 4/7 (429929 KB)            OKAY [  3.366s]
Writing sparse 'system' 4/7                        OKAY [  2.516s]
Sending sparse 'system' 5/7 (445295 KB)            OKAY [  3.487s]
Writing sparse 'system' 5/7                        OKAY [  2.283s]
Sending sparse 'system' 6/7 (432560 KB)            OKAY [  3.368s]
Writing sparse 'system' 6/7                        OKAY [  2.250s]
Sending sparse 'system' 7/7 (302746 KB)            OKAY [  2.327s]
Writing sparse 'system' 7/7                        OKAY [  1.518s]
Finished. Total time: 41.245s

The phone can now be rebooted: fastboot reboot. Even without wiping the data partition, and granted that you flashed the same stock system image as you had previously on the phone, the phone should start up. If it does not:

  1. if it suggests to wipe the data partition (it might do that after a few reboots), do that then reboot
  2. if it just fails to boot repeatedly, switch it off, return to the boot loader and try to wipe the data partition (this will delete all your data): fastboot -w. Then reboot
  3. if that still do not work: it's bricked, and you'll have to search for a solution yourself

Note that the USB cable could prevent the phone from booting with some images, making the phone directly enter recovery mode (in that case just unplug the USB cable after having flashed). When you've checked that the phone boots with the new system partition, you can start trying to flash the other partitions or other images granted you know what you're doing.

That's the end of this guide. Keep experimenting, but be careful!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment