I have tried more tools to recover oppo A9 2020 (Model CPH1937; patch: oct,2020; Android Version: Android 10; ColorOs Version: 7) from the forgotten PIN. I'm using Snapdragon 665 device. Since I couldn't get FRP unlocking tool, I have tried to wipe device or atleast reset /data to recover OPPO A9 2020. In anyway (either wiping or recovering) how can i recover by tools without BOX?. I recognished, EDL mode is the only way to recover phone from PIN.

Tried ways,

  • Tried to build brute-force machine.

    I know 6 digit PIN protection is not big deal to predict the right PIN among 10,00,000 numbers. (10 lack numbers from 000000 to 999999).

Enter PIN


1 2 3 // This is the structure and prediction rate for any single try (1/1000000)100 => (probability100)%

4 5 6 // If Android accept keyboard even from lock screen it will be possible.

7 8 9 // 8279 programmable keyboard or 8051 controller will be the brute-force machine.

0 // I recognished using emergency call type *#899# (Works in Oppo A9 2020) -> manual test -> last title panel (on topbar) write/read log -> It will asks for PIN (safest way to try PINs it won't show timer after certain attempts you can try infinite times using programmable keyboard). note: It won't Erase your data and applications. You don't need to spend more internet packs, It is the best method to find old "PIN". You can unlock your phone with this. Not best for password, I don't know about pattern .

I'm 100% sure, It will work. "If your android can recognize keyboard in lock screen and if has secret log write option"

chip not available in my district shops. But available in online shopping(use trusted shopping sites). The dare is, I don't have mobile to use mobile banking now to work with above option.

  • Wipe mobile via Google account phone recovery (find my device),

=> Mobile internet and location service both were turned on but google find my device didn't detect mobile after phone locked.

  • Used MSM Download tool to recover device (Stock ROM + setup file = 6.5Gb).

=> Mobile didn't responds to windows after 15 seconds of EDL mode. Prompts(log, message or whatever) to restart device(every time after 15 seconds).

  • Asked(via call) oppo store to help.

=> Oppo store not present in my district to go :-(.

  • Given to service center,

=> Again refered OPPO Store :-(.

  • Used QFil (Python and linux) it seems to be work.

=> There is no clear command list for repartitioning using .img file. How to use QFil?

=> Signature verification failed even for Stock ROM. notable: I don't even tried to flash custom ROM and OPPO A9 2020 has almost all feature ie. Dolby, HIGH performance mode(Game Boost), floating window apps(*supported Apps), Dark Mode, Custom snapshot, OPPO secure storage(CHIP level encryption), Recovery Mode Encryption(This is why I can't wipe my device via Recovery :-(. ),...etc.

  • Used QFil(Prebuild GUI Application) in windows.

=> Sahara protocol Error => Read 0 bit header in Rx (Fixes more annoying and not available).

=> Respose timeout

  • **Used QDL tool for linux from these channels,
    1. Via snap package manager
    2. Via Official git source code repository
    3. Prebuild download**

=> Starts to work (from the debug log). But not writing (and still stuck there before writing into port(ttyUSB0))

qdl --storage ufs --include path/to/image/ prog_firehose_ddr_ufs.elf rawprogram0_ufs.xml patch0_ufs.xml

To point snap,

/snap/bin/qdl --storage ufs --include path/to/image/ prog_firehose_ddr_ufs.elf rawprogram0_ufs.xml patch0_ufs.xml

To point current(git cloned directory) working directory("."),

./qdl --storage ufs --include path/to/image/ prog_firehose_ddr_ufs.elf rawprogram0_ufs.xml patch0_ufs.xml

After the installation of prebuild(downloaded) from internet,

$ which qdl
/usr/bin/qdl  <= pointing 'make install'/apt/dpkg/yum/pacman/... installation 
$ qdl --storage ufs --include path/to/image/ prog_firehose_ddr_ufs.elf rawprogram0_ufs.xml patch0_ufs.xml

Result does not have any error and stucks after displaying details about device(ventor id, product id, device id, ...etc).

  • Tried EDL tool(edl.py) available with QFil(Python, [used Linux] CLI no-GUI),

Used following command to format userdata partition,

$ python edl.py --debug --memory ufs --loader ../extracted/prog_firehose_ddr_ufs.elf r userdata userdata.img

The error result was,

No such volume named 'userdata'

***I'm proved to have such secure device(Just lol).

How to remove PIN in mobile with/without wiping whole data?.

If can, How to unlock using FRP method?.

Any methods available without opening device body and without Box?.

Any kind of suggestion, which you can give?.***

I only used these commands in these(above) tools, If you know tool usage or methods or new tools please kindly share to help people and for me too.

  • the bruteforce part is nonsense, there is a timeout (30 sec) after 10 attempts, increases after 30 attempts up to 1 day from 140 attempts on. but EDL mode is good choice, you should be able to wipe data and frp, all you need is oppo signed firehose programmer for sdm665
    – alecxs
    Dec 16 '20 at 22:31
  • @alecxs Thanks, Yeah I know, Also I could not recognize that till opening engineer mode(on OPPO A9 2020). So I'm keep trying since yesterday But it seems to be night mare. It didn't make time delay even after too many attempts only when you are in engineer mode. I have highlighted This above -> I recognished using emergency call type *#899# (Works in Oppo A9 2020) -> manual test -> last title panel (on topbar) write/read log -> It will asks for PIN (safest way to try PINs it won't show timer after certain attempts you can try infinite times using programmable keyboard)
    – Sivamani V
    Dec 17 '20 at 0:47
  • @alecxs I could not get correct sdm665 for oppo. Stock ROM's signature is not working. Does other(OPPO) ROM's signature will work?. Where i can download (without bricking) it?. Thanks in advance.
    – Sivamani V
    Dec 17 '20 at 0:58
  • the qualcomm factory loader (firehose programmer) is independent from ROM, so yes any sdm665 loader will work as long as it is for Oppo (or Realme) device
    – alecxs
    Dec 17 '20 at 9:12
  • gatekeeper is limiting timeout on lower level (TEE) so attempts will (silently) fail with(out) warning no matter what mode you try
    – alecxs
    Dec 17 '20 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.