Huawei bootloader: what is "FB Lock" and how to unlock it?

Question

I was playing around with my spare Huawei phone trying to bypass the security without wiping data and came along this article: https://blog.salvationdata.com/2018/09/07/case-study-mobile-forensics-a-practical-solution-to-unlock-huawei-bootloader/

In step 3, you should "temporarily disable FB lock". What does this mean and how do I unlock it using fastboot? I suppose, that I cannot do that using standard fastboot oem unlock command, but I couldn't find anything else in the fastboot documentation.

EDIT: Result of fastboot help command as requested: https://pastebin.com/2rhr1PTT

platform-tools$ ./fastboot help
usage: fastboot [OPTION...] COMMAND...

flashing:
 update ZIP                 Flash all partitions from an update.zip package.
 flashall                   Flash all partitions from $ANDROID_PRODUCT_OUT.
                            On A/B devices, flashed slot is set as active.
                            Secondary images may be flashed to inactive slot.
 flash PARTITION [FILENAME] Flash given partition, using the image from
                            $ANDROID_PRODUCT_OUT if no filename is given.

basics:
 devices [-l]               List devices in bootloader (-l: with device paths).
 getvar NAME                Display given bootloader variable.
 reboot [bootloader]        Reboot device.

locking/unlocking:
 flashing lock|unlock       Lock/unlock partitions for flashing
 flashing lock_critical|unlock_critical
                            Lock/unlock 'critical' bootloader partitions.
 flashing get_unlock_ability
                            Check whether unlocking is allowed (1) or not(0).

advanced:
 erase PARTITION            Erase a flash partition.
 format[:FS_TYPE[:SIZE]] PARTITION
                            Format a flash partition.
 set_active SLOT            Set the active slot.
 oem [COMMAND...]           Execute OEM-specific command.

boot image:
 boot KERNEL [RAMDISK [SECOND]]
                            Download and boot kernel from RAM.
 flash:raw PARTITION KERNEL [RAMDISK [SECOND]]
                            Create boot image and flash it.
 --cmdline CMDLINE          Override kernel command line.
 --base ADDRESS             Set kernel base address (default: 0x10000000).
 --kernel-offset            Set kernel offset (default: 0x00008000).
 --ramdisk-offset           Set ramdisk offset (default: 0x01000000).
 --tags-offset              Set tags offset (default: 0x00000100).
 --page-size BYTES          Set flash page size (default: 2048).
 --header-version VERSION   Set boot image header version.
 --os-version MAJOR[.MINOR[.PATCH]]
                            Set boot image OS version (default: 0.0.0).
 --os-patch-level YYYY-MM-DD
                            Set boot image OS security patch level.

Android Things:
 stage IN_FILE              Sends given file to stage for the next command.
 get_staged OUT_FILE        Writes data staged by the last command to a file.

options:
 -w                         Wipe userdata.
 -s SERIAL                  Specify a USB device.
 -s tcp|udp:HOST[:PORT]     Specify a network device.
 -S SIZE[K|M|G]             Break into sparse files no larger than SIZE.
 --slot SLOT                Use SLOT; 'all' for both slots, 'other' for
                            non-current slot (default: current active slot).
 --set-active[=SLOT]        Sets the active slot before rebooting.
 --skip-secondary           Don't flash secondary slots in flashall/update.
 --skip-reboot              Don't reboot device after flashing.
 --disable-verity           Sets disable-verity when flashing vbmeta.
 --disable-verification     Sets disable-verification when flashing vbmeta.
 --wipe-and-use-fbe         Enable file-based encryption, wiping userdata.
 --unbuffered               Don't buffer input or output.
 --verbose, -v              Verbose output.
 --version                  Display version.
 --help, -h                 Show this message.

Answer 1

There are two types of bootloader locks in Huawei devices: FB Lock and USER Lock.

USER Lock restricts the standard partitions like system, data, recovery, kernel etc, but not the critical bootloader-partitions which I don't remember the names of. (So you can't edit them even if you perform a USER Unlock) The USER Lock is what requires the bootloader unlock code to unlock. Also, there are some hidden hardware commands which are used for serious debugging like JTAG, that cannot be accessed with a USER Unlock.

FB Lock is used for protecting these restricted functions. A FB Unlock works as a key for all of Fastboot. (So if you perform a FB Unlock then you can unlock everything USER Unlock does, and the other restricted stuff) FB Lock is intended to be used by Huawei personnel for repairing. It is NOT supposed to be unlocked by users, but it is possible anyway, as I discovered after quite some research, but it doesn't work on very new firmware versions like EMUI 8.2 or July/August Security patch. It has been used for years by paid software for performing FRP Unlock, full system restoring, and it can even be used for obtaining a bootloader code for USER Unlock. A FB Unlock is usually temporary.

The method of FB Unlock has been kept behind cover for quite some time now, but I saw recently that it has been leaked on XDA. You can check it out here. That guide also covers a method for extracting the NVME partition for a permanent FB Unlock. If you don't want a permanent FB Unlock, but would like just a normal USER Unlock, you can skip doing steps after 3, but instead when you boot into TWRP, you can use:

su -c "grep -m1 -aoE 'WVLOCK.{14}[0-9]{16}' /dev/block/mmcblk0p7 |grep -aoE '[0-9]{16}'"

That will output the bootloader unlock code which you can use for standard USER Unlock. Good Luck!