Just under a year ago, I changed carriers due to carrier unlock policies. The provider I switched to I was able to get the Pixel 7 Pro on a payment plan (2 years). With it being a Pixel, I thought at the time all Pixels were OEM unlockable. Man was I wrong, not only am I stuck paying off this phone for 2 years, but without carrier unlock first that can't happen. I know in every other device that If I issued a certain adb disable command, it bypassed that.

Is there not something similar I can do to get OEM unlock without carrier unlock? Any help is much appreciated.

  • If you plan to root a device it is in general not recommended to buy the device through a carrier. Carriers only want simple customers that don't make problems, but unlocking and rooting are an easy way to cause problems and even brick the device, thus carriers don't like it. Companies that produce smartphones don't have this problem as you loose guarantee when unlocking so all the problems you may cause don't affect them.
    – Robert
    Commented Nov 5, 2023 at 22:10
  • No, there isn't something else you can do... And all the Pixel's that are OEM unlocking blocked by the carrier, will always be so... even when paid off, they will carrier unlock the device, but that will not allow it to be OEM unlocked or allow bootloader unlocking. That is just "impossible", or at least it is as of now and has been since the inception of this policy.
    – acejavelin
    Commented Nov 5, 2023 at 23:04
  • Damn. My last few devices were oneplus and same thing carrier locked with OEM unlock greyed out but as soon as I issued adb shell pm disable-user com.qualcomm.qti.uim I would be able to toggle oem unlock and unlock bootloader even without cust_unlock.bin and that has worked from 6t-9 pro until 10t came along Commented Nov 6, 2023 at 2:45
  • And so at the end of the day any device that's not bootloader unlockable means that regardless if consumer pays it off the device is still truly never yours. How is that legal having a provider tell you what u can and cannot do with your own device. Another form of dysfunctional control Commented Nov 6, 2023 at 2:49
  • Welcome to Android Enthusiasts Stack Exchange. Unfortunately, this practice has started at least since Pixel 2 for refurbished and carrier-locked devices: Bootloader wont unlock on Google Pixel 2 (G011A), Google Pixel 2: Is it possible to verify that it cannot be OEM unlocked and why?.
    – Andrew T.
    Commented Nov 6, 2023 at 5:52

1 Answer 1


OEM unlocking in Settings > System > Developer options queries Google web service to check if the device was sold as locked by a carrier.

The get_unlock_ability flag is stored in the OEM lock data block which is backed by Titan M on Pixels just like lock state, verified boot rollback indexes for the OS, user flashed verified boot key, Weaver tokens used as an extra input for encryption for throttling, factory reset protection data block, etc.

It is entirely implemented at the UI layer and bypassing that just requires OS (not even root) exploit. Another way is, you can fake the message to Trusted Execution Environment (TEE) that OEM unlocking has been authorized by Google web service but that will require dismantling of the SoC and fuzzing SPI bus channel which is not practical.

Either way, the attack will only work if Google is not signing the response for TEE to verify (have to confirm this).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .