Back in 2016, Verizon secured a carrier exclusivity deal with Google for sales of the first-generation Google Pixel and Pixel XL within the United States. Unlike the regular variants of the Pixel/Pixel XL, the devices purchased from the carrier came with a permanently locked bootloader. A free-to-use bootloader unlock exploit named dePixel8 was released rather quickly, but Google closed the loophole in a subsequent security update. Another bypass technique popped up in our forums in 2018, which had been patched in a similar manner. It looks like the community has now managed to discover yet another interesting bypass method that can be used to permanently unlock the bootloader of the first-generation Google Pixel and Pixel XL sold by Verizon.
As a matter of fact, the newly discovered process is largely similar to the previous bypass method. You have to uninstall the stock phone application (package name:
com.android.phone) from the current user using ADB in both cases. The primary advantage of the new method is that you can perform the whole bypassing process and proceed with the bootloader unlocking even if your phone is running the stock Android 10 firmware.
How to unlock the bootloader of the Verizon Google Pixel/Pixel XL running Android 10
Steps to bypass the bootloader unlock restriction
- On the phone, open Settings>System>Reset Options and factory reset the phone. It should say “Restarting” or something similar.
- When the screen goes black, press and hold the Volume Down key until you get into the Bootloader mode. Use the volume keys to navigate to “Recovery Mode” and select it with the power button.
- Hold the Volume Down key for about a minute (while it resets) until you see an android lying down graphic.
- Hold the Power button then press the Volume Up button once. It should give you a menu.
- Use the volume and power buttons to select “Wipe Data/Factory Reset”.
- Once it finishes, select an option that says “Sideload OTA”.
- Connect your phone to your computer and type the following.
For Google Pixel:
adb sideload sailfish-ota-qp1a.191005.007.a3-394b5899.zip
For Google Pixel XL:
adb sideload marlin-ota-qp1a.191005.007.a3-23002a57.zip
- Factory reset again from recovery mode.
- Reboot to system.
- While it just shows the G, press the power button until the phone restarts.
- Once it boots up, skip all of the steps but disable the options for sending information to Google.
- Enable Developer Options by tapping “Build Number” seven times.
- In Developer Options, enable USB Debugging.
- On your computer, run
adb shell pm uninstall --user 0 com.android.phone
- Reboot twice.
- Connect to Wi-Fi.
- Open google.com in Chrome.
- Check Developer Options to see if you can enable OEM unlocking.
- If you can’t, swipe away Settings from the Recents menu and go back to Chrome.
- In Chrome, open a bunch of websites. After opening each one, check the OEM Unlocking option again and close Settings afterward.
- Once you can enable it, do so! Now you can unlock the bootloader.
Unlock the bootloader on Verizon Google Pixel and Pixel XL
- Reboot and press the Volume Down key when the screen goes black
- On the computer, type
fastboot flashing unlock
So far, multiple users on our forums have reported that they have successfully unlocked the bootloader of the Verizon Google Pixel and Pixel XL using this method. Apparently, sideloading the latest firmware and uninstalling the phone app on these models is sufficient to block the “call-home” routine. The nature of the bypass is itself a bit finicky, though, but if you own a Verizon Google Pixel/Pixel XL and want your bootloader unlocked, now may be your last chance. Do give it a shot and let us know if it worked for you!