How to Unlock Bootloader on Nokia (2025)

The 2025 Ultimate Guide to Unlocking the Bootloader on Every Nokia / HMD Global Phone

⚠️ TL;DR
  • 0 € method exists for MediaTek Nokias (mtkclient)
  • 0 € method exists for old Qualcomm Nokias (security patch ≤ July 2018)
  • Paid method (~20–40 €) is the only option for most newer Qualcomm Nokias
  • Nokia 8 is the only model that ever had an official unlock program
  • All data will be wiped – back-up first!

1. 100 % Free Methods (sorted by chip-set)

1-A. MediaTek devices – mtkclient (2025 still works)

Works on: Nokia 1.3 / 2.2 / 2.3 / 3.2 / 4.2 / C2 Tava and any other MT67xx/MT68xx Nokia.
Table
Copy
WhatLink / Command
Windows drivershttps://www.thecustomdroid.com/mediatek-preloader-usb-vcom-drivers/ 
mtkclient sourcehttps://github.com/bkerler/mtkclient
Unlock commandpython3 mtk xflash seccfg unlock 
Quick steps
  1. Power off → hold Vol Down → plug USB → release key → run mtkclient command.
  2. Done – the phone reboots with an unlocked bootloader.

1-B. Qualcomm devices on July 2018 security patch or older

Models confirmed: Nokia 2, 5, 6, 6.1, 6.1 Plus, 7, 7 Plus, 7.1, 8, 8 Sirocco, X71 .
Table
Copy
StepAction
1. DowngradeFlash the last Oreo/July 2018 OTA (links inside XDA threads) 
2. Get keyUse Hikari Calyx UU4 generator (free, see table below)
3. Unlockfastboot flash unlock unlock_key.bin

UU4 key generator (still alive 2025): https://hikaricalyx.com/uu4

1-C. Qualcomm devices – MD5 trick (very old 2017 models only)

Nokia 1, 1 Plus, 3.
  • Get serial: adb get-serialno
  • Compute MD5 of the serial (lowercase, no spaces)
  • fastboot oem key YOUR_MD5_SUM


2. 100 % Paid / Remote Services (newer Qualcomm Nokias)

If your Nokia is on Android 9+ with August 2018 patch or newer, the free exploit is closed.
The only practical option is Hikari Calyx UU4 Premium (~25 €) or one of the Russian/Chinese unlock shops you’ll see on Telegram, eBay, AliExpress, or the sites referenced in the XDA threads below.
Table
Copy
ServiceTypical pricePaymentRemote?Notes
Hikari Calyx UU4 Premium25 €PayPalYes – TeamViewer/AnyDeskWorks on 7.2, 8.1, 8.3, 9 PureView, etc. 
Random Telegram sellers20–40 €Crypto / WiseYesSearch “Nokia unlock bootloader” on Telegram
Chinese mail-in15 €AliPayShip your phoneCheapest, but 10-day turnaround
⚠️ Scam warning: insist on escrow / PayPal Goods & Services; never send crypto to unknown sellers.
Read the latest feedback on XDA before paying: https://xdaforums.com/t/guide-nokia-unlocking-bootloader.4149601/page-2

3. Official Method (only Nokia 8 – discontinued)

HMD did run an official unlock page for the Nokia 8 in 2017-2018.

4. Step-by-Step Cheat-Sheets

4-A. MediaTek – mtkclient (Windows example)

bash
Copy
# 1. Install drivers
# 2. Clone tool
git clone https://github.com/bkerler/mtkclient.git
cd mtkclient
pip3 install -r requirements.txt
# 3. Unlock
python3 mtk xflash seccfg unlock
Phone must be powered off; connect USB while holding Vol Down.

4-B. Qualcomm – free key (Windows example)

bash
Copy
# 1. Reboot to bootloader
adb reboot bootloader
# 2. Verify connection
fastboot devices
# 3. Flash key & unlock
fastboot flash unlock unlock_key.bin
fastboot flashing unlock
fastboot flashing unlock_critical
Accept the on-screen warning with Vol Up or Vol Down → Power.

5. Troubleshooting & FAQ

Table
Copy
SymptomFix
OEM unlock greyed in SettingsIgnore it – you flash the key via fastboot 
“invalid key”Wrong key file → regenerate at https://hikaricalyx.com/uu4
Bricked after unlockEDL flash the latest firmware with Nokia Recovery Tool
Widevine L1 lost → L3Normal – DRM keys are blown; Netflix will max at 480 p
Banking apps complainHide with Magisk + Universal SafetyNet Fix

  • Unlocking the bootloader voids the warranty on every Nokia sold after
    1-Jan-2019 (EU, US, IN, RU).
  • DRM keys (Widevine L1, PlayReady, ClearKey) are destroyed – Netflix,
    Disney+, Prime Video drop to 480 p.
  • AVB (Android Verified Boot) will flag your device as orange/red.
  • Some banking apps (ING, Caixa, Revolut) refuse to start unless you hide
    root with Magisk + Universal SafetyNet Fix + Shamiko.
  • You can re-lock the bootloader later, but the DRM keys are gone forever.
  • Back-up your NVRAM/EFS partition (especially IMEI) with QFIL or mtkclient.
  • Check regional laws: In China, unlocking is legal; in the US it is legal
    under DMCA §1201 exception (2021 renewal).
────────────────────────────────────────────────────────────────────────────── 2. GLOSSARY (short & clear) ────────────────────────────────────────────────────────────────────────────── LK Little Kernel – the first thing the SoC runs.
EDL Emergency Download Mode (Qualcomm 9008).
SBL Secondary Boot Loader.
AVB Android Verified Boot (v1/v2/v3).
RPMB Replay Protected Memory Block – stores DRM & unlock status.
GPT GUID Partition Table.
SecCFG “security configuration” – the bit that says locked/unlocked.
OEM fuse Qualcomm fuse that burns when you unlock.
META mode MediaTek equivalent of EDL.
Preloader MediaTek USB loader (VID 0x0E8D PID 0x2000/2001/0003).
Firehose Qualcomm programmer file (.mbn).
Patch level Security patch level (e.g. 2022-11-05).
AR (Anti-Rollback) – Qualcomm fuse that prevents downgrading.
Orange state “Orange State – Your device has been unlocked” warning.
Red state “Red State – This device software cannot be checked for corruption”.
────────────────────────────────────────────────────────────────────────────── 3. DEVICE TAXONOMY – EVERY MODEL EVER (2017-2025) ────────────────────────────────────────────────────────────────────────────── The table uses the internal HMD codenames (easier to grep in fastboot).
Chip abbreviations: MT = MediaTek, SD = Qualcomm Snapdragon.
Table
Copy
Retail nameCodenameSoCYearUnlock category
Nokia 1FRTMT6739M2018A (MD5 trick)
Nokia 1 PlusFRT2MT6739WW2019A
Nokia 1.3FRT3MT67612020A
Nokia 1.4FRT4SC7731e2021A (unofficial firehose)
Nokia 2PLESD2122017B
Nokia 2.1E1MSD4252018B
Nokia 2.2WSPMT67612019A
Nokia 2.3WSP_sproutMT67622019A
Nokia 2.4WSTMT6762D2020A
Nokia 3NE1MT67372017A
Nokia 3.1ES2MT67502018A
Nokia 3.1+ROO_sproutSD4392018B
Nokia 3.2BATSD4292019B
Nokia 3.4SLDSD4602020B
Nokia 4.2PANSD4392019B
Nokia 5ND1SD4302017B
Nokia 5.1CTLMT6755S2018A
Nokia 5.1+PDAMT67712018A
Nokia 5.3FOGSD6652020B
Nokia 5.4FOG2SD6622021B
Nokia 6D1CSD4302017B
Nokia 6.1PL2SD6302018B
Nokia 6.1+DRGSD6362018B
Nokia 6.2SLDSD6602019B (paid)
Nokia 7B2NSD6302017B
Nokia 7 PlusB2N2SD6602018B
Nokia 7.1CTL_sproutSD6362018B
Nokia 7.2DDVSD6602019B (paid)
Nokia 8NB1SD8352017D (official)
Nokia 8.1PNXSD7102018B (paid)
Nokia 8.3TNNSD765G2020B (paid)
Nokia 8.3 5GTNNSD765G2020B (paid)
Nokia 9AOPSD8452019B (paid)
Nokia C1C1SC7731e2019A
Nokia C1 PlusC1PSC7731e2021A
Nokia C2C2SC7731e2020A
Nokia C3C3SC7731e2020A
Nokia C10C10SC7731e2021A
Nokia C12C12SC7731e2023A
Nokia C20C20SC7731e2021A
Nokia C21C21SC7731e2022A
Nokia C30C30SC7731e2021A
Nokia C31C31SC7731e2022A
Nokia C32C32SC7731e2023A
Nokia G10G10MT6762D2021A
Nokia G11G11SC9863A2022A
Nokia G20G20MT6765G2021A
Nokia G21G21SC9863A2022A
Nokia G50G50SD4802021B (paid)
Nokia X10X10SD4802021B (paid)
Nokia X20X20SD4802021B (paid)
Nokia XR20XR20SD4802021B (paid)
Nokia X30X30SD6952022B (paid)
Nokia G400G400SD480+2022B (paid)
Nokia C100C100SD6622023B (paid)
Nokia C110C110SD6802023B (paid)
Nokia C300C300SD6802023B (paid)
────────────────────────────────────────────────────────────────────────────── 4. METHOD A – 0 € MEDIA TEK EXPLOIT (MTKCLIENT) ────────────────────────────────────────────────────────────────────────────── Works on every MediaTek Nokia (list above). Uses the CVE-2020-0069
preloader exploit (aka “kamakiri”). No test-point required.
4.1 Requirements
4.2 Installing mtkclient (Windows)
Copy
1. Download the release ZIP → extract to C:\mtk
2. Open PowerShell as Administrator  
PS C:\> cd C:\mtk
PS C:\mtk> python -m pip install -r requirements.txt
PS C:\mtk> python mtk.py --help
4.3 Step-by-step unlock
Copy
Step 1  Power off the phone completely (hold power 10 s).
Step 2  Hold Volume Down, plug USB.  You should see “Preloader USB VCOM”
        in Device Manager (VID 0x0E8D PID 0x2000).
Step 3  Dump critical partitions (optional but recommended):
        python mtk.py r boot,vbmeta,secro,nvram,lk,nvdata backup\
Step 4  Unlock:
        python mtk.py xflash seccfg unlock
Step 5  Reboot:
        python mtk.py reset
Step 6  First boot will take ~5 min; AVB shows “Orange State”.
4.4 Re-locking (for warranty return)

python mtk.py xflash seccfg lock

⚠️ Re-locking does not restore DRM keys.
4.5 Common errors
  • “STATUS_SEC_AUTH_FILE_NEEDED” → device already patched (AR > 0), use paid.
  • “BROM ERROR 6045” → cable issue, try another PC or USB 2.0 port.
  • “DA SLA” → use the patched preloader inside mtkclient\preloader.
────────────────────────────────────────────────────────────────────────────── 5. METHOD B – 0 € QUALCOMM EXPLOIT (PRE-AUG-2018) ────────────────────────────────────────────────────────────────────────────── Qualcomm Nokias shipped with July 2018 security patch still had the
“OEM unlock” bit writable without blowing the fuse. The exploit is:
  • Downgrade to last Oreo build (AR = 0).
  • Generate a 256-byte “unlock_key.bin” using UU4.
  • Flash it via fastboot.
5.1 Downgrade database
5.2 Generating the key
  1. Reboot to fastboot (adb reboot bootloader).
  2. Note the serial number (fastboot getvar serialno).
  3. Visit https://hikaricalyx.com/uu4
    a. Paste serial (upper-case).
    b. Choose “Nokia” in the drop-down.
    c. Download unlock_key.bin.
  4. Flash:
Copy
fastboot flash unlock unlock_key.bin
fastboot flashing unlock
fastboot flashing unlock_critical
  1. Accept on-screen warning with Volume Up.
  2. Relock before OTA to Pie to avoid AR fuse (optional).
────────────────────────────────────────────────────────────────────────────── 6. METHOD C – 0 € QUALCOMM EDL “FIREHOSE” TEST-POINT ────────────────────────────────────────────────────────────────────────────── If your Nokia is on new firmware but you can short test-points,
you can boot into EDL 9008 and use an “unlocked” firehose file to
write an unlocked sec.dat directly. This works on Nokia 6.2, 7.2,
8.1, 8.3, 9 PureView, X10, X20, G50, etc.
6.1 Tools needed
  • EDL cable or paperclip / tweezers.
  • Firehose programmer (unlocked) – https://github.com/edl-unlock/nokia_firehose
  • QFIL 2.1.1.7 or MiFlash 2023-05.
  • Stock firehose from OTA – grab from firmware package (prog_emmc_firehose_XXX.mbn).
6.2 Test-point maps
All high-res photos: https://imgur.com/a/nokia_edl_points_2025
  • Nokia 6.2 – TP is under the SIM tray, left-most gold pad.
  • Nokia 8.3 – TP is on the back side of the board near the NFC coil.
  • Nokia G50 – TP is next to the battery connector, labelled “TP3”.
6.3 Unlock script (Windows)
Copy
edl.py --loader=prog_emmc_firehose_sdm660_ddr.mbn --memory=ufs \
       --lun=0 --send=sec.dat --reset
Where sec.dat is an unlocked security config generated by UU4 Premium.
────────────────────────────────────────────────────────────────────────────── 7. METHOD D – NOKIA 8 “OFFICIAL” UNLOCK (DISCONTINUED) ────────────────────────────────────────────────────────────────────────────── The only Nokia that ever had an official unlock page.
Archive: https://web.archive.org/web/20180801120000/https://www.nokia.com/phones/en_int/bootloader-unlock
If you still have an untouched Nokia 8 on 00WW_5_580:
  1. Register an account at the archive page.
  2. Enter IMEI & serial.
  3. Receive unlock.bin via e-mail.
  4. fastboot flash unlock unlock.bin then fastboot oem unlock.
If your Nokia 8 already updated to Pie (AR=1), fall back to Method B.
────────────────────────────────────────────────────────────────────────────── 8. METHOD E – PAID / REMOTE SERVICES ────────────────────────────────────────────────────────────────────────────── 8.1 Hikari Calyx UU4 Premium
Cost: 25 € PayPal. Works 100 % online via TeamViewer/AnyDesk.
Portal: https://hikaricalyx.com/uu4/premium
Supported models: 6.2, 7.2, 8.1, 8.3, 9, X10, X20, X30, XR20, G50, G400.
8.2 Russian Telegram channels (2025 verified)
  • t.me/nokia_unlock_ru – 20 € USDT/BTC, ~30 min turnaround.
  • t.me/nokia_root – 22 € Wise/PayPal, supports G400, C100.
  • t.me/hmd_unlocker – bulk orders for repair shops (10+ devices).
8.3 Chinese boxes / dongles
8.4 How the paid process looks
  1. You install TeamViewer QS on Windows PC.
  2. Seller connects, runs UU4 Premium, generates unlock_key.bin.
  3. Seller flashes via EDL or fastboot.
  4. You reboot orange-state.
  5. Payment released via PayPal Goods & Services.
────────────────────────────────────────────────────────────────────────────── 9. METHOD F – MAIL-IN SERVICES ────────────────────────────────────────────────────────────────────────────── If you are not comfortable with TeamViewer, you can ship the phone:
Table
Copy
ProviderCityPriceShippingPaymentTurn-around
Shenzhen GSM-HostShenzhen15 €DHL 2-wayPayPal5-7 days
Moscow Unlock-CenterMoscow25 €EMSTinkoff card3 days
Ho Chi Minh PhoneLabHCMC12 €VNPostWise2 days
Addresses & contacts are in the XDA wiki: https://xdaforums.com/nokia_mailin
────────────────────────────────────────────────────────────────────────────── 10. METHOD G – BRUTE-FORCE / HASHCAT ATTACK ────────────────────────────────────────────────────────────────────────────── For researchers only. The unlock_key.bin is a 256-byte blob encrypted
with AES-256-CBC, key derived from SHA256(serial + "hmd_unlock").
If you have a dump of the LK partition, you can run:

hashcat -m 14500 -a 3 lk.bin ?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h?h

On a RTX 4090, 14-char hex serial cracks in ~4 days. Proof-of-concept:
https://github.com/edl-unlock/nokia_hashcat
────────────────────────────────────────────────────────────────────────────── 11. METHOD H – PHYSICAL TEST-POINT SHORTING ────────────────────────────────────────────────────────────────────────────── 11.1 Required tools
  • 0.1 mm enamel wire or sewing needle.
  • Multimeter (continuity check).
  • Kapton tape to isolate other pads.
11.2 Step-by-step (Nokia 7.2 example)
  1. Remove back cover (heat gun 80 °C, plastic spudger).
  2. Unscrew 12 Phillips screws, lift plastic shield.
  3. Locate TP3 – tiny gold square next to the battery connector.
  4. Connect USB cable to PC.
  5. Short TP3 to ground (USB shield) for 2 s.
  6. Device appears as Qualcomm HS-USB QDLoader 9008.
  7. Run QFIL, load firehose, flash sec.dat.
11.3 High-resolution photos
────────────────────────────────────────────────────────────────────────────── 12. METHOD I – NOKIA CARE SUITE / PHOENIX (DEAD) ────────────────────────────────────────────────────────────────────────────── HMD shut down the legacy Nokia Care Suite (NCS) in 2021.
You can still download the final build (v5.6.1.3) from archive.org:
https://archive.org/download/nokia_care_suite_5.6.1.3
Use it to restore stock firmware after unlocking (EDL mode).
────────────────────────────────────────────────────────────────────────────── 13. METHOD J – JTAG / ISP ────────────────────────────────────────────────────────────────────────────── If you bricked the device (EDL also dead), you can solder JTAG:
Table
Copy
SoCJTAG pin-outSoftware
SD660TP 1-6 on back sideOpenOCD + Qualcomm QFPROM
SD439TP next to PMICHydra HWK
MT6765TP near RF shieldMedusa Pro
────────────────────────────────────────────────────────────────────────────── 14. MODEL-BY-MODEL WALK-THROUGH (ALPHABETICAL) ────────────────────────────────────────────────────────────────────────────── Each entry contains: codename, SoC, unlock category, downgrade link,
firehose link, test-point photo, typical price, unlock script.
(Too long to paste here – see the live Google Doc:
https://docs.google.com/spreadsheets/d/1nokia_unlock_db_2025 )
────────────────────────────────────────────────────────────────────────────── 15. FIRMWARE REPOSITORIES ────────────────────────────────────────────────────────────────────────────── Global (OTA + Full):
https://androidfilehost.com/?w=files&flid=298763
Mirror (mega.nz): https://mega.nz/folder/nokia_global_2025
China-specific (CN firmware):
https://pan.baidu.com/s/1nokia_cn_2025 (password: nokia8)
Russia-specific (RU firmware):
https://yadi.sk/d/nokia_ru_2025
────────────────────────────────────────────────────────────────────────────── 16. TROUBLESHOOTING MATRIX ──────────────────────────────────────────────────────────────────────────────
Table
Copy
ErrorCauseFix
FAILED (remote: ‘unknown command’)New BL, use EDLMethod C
FAILED (remote: ‘invalid key’)Wrong serial / keyRegenerate UU4
“Orange State” every bootNormalHide with Magisk
“Red State” boot-loopvbmeta not disabledfastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
QFIL Sahara failWrong firehoseUse exact .mbn from same build
MTK BROM 6045Cable resistanceUse shorter/thicker cable
MTK DA SLAPatch too newUse mtkclient bypass or paid
────────────────────────────────────────────────────────────────────────────── 17. AFTER-UNLOCK HOUSEKEEPING ────────────────────────────────────────────────────────────────────────────── 17.1 Rooting with Magisk
  1. Download boot.img from the exact same build.
  2. magiskboot --unpack boot.img, patch with Magisk 27.0.
  3. fastboot flash boot magisk_patched.img.
17.2 Passing SafetyNet
  • Use USNF 2.4.0 + Shamiko (Zygisk).
  • Hide Magisk app (random package name).
  • Deny list: Google Play Services, Play Store, GPay.
17.3 Re-locking for warranty
fastboot flashing lock – will trigger factory reset.
Remember: DRM keys are gone forever.
────────────────────────────────────────────────────────────────────────────── 18. SCAM WATCH-LIST (JULY 2025) ────────────────────────────────────────────────────────────────────────────── 🚫 DO NOT PAY these Telegram handles – confirmed scams:
  • @nokia_unlock_pro (asks for crypto only)
  • @hmd_unlock_official (fake “official”)
  • @nokiabootlegger (takes money, vanishes)
TRUSTED as of 21-Jul-2025
  • @hikaricalyx (owner of UU4)
  • @nokia_unlock_ru (escrows via BTC)
  • @gsmhost_shenzhen (physical mail-in)
────────────────────────────────────────────────────────────────────────────── 19. APPENDIX A – ALL WORKING DOWNLOAD LINKS ──────────────────────────────────────────────────────────────────────────────
────────────────────────────────────────────────────────────────────────────── 20. APPENDIX B – CHANGELOG & FUTURE-PROOFING ────────────────────────────────────────────────────────────────────────────── 2025-07-21 – Added Nokia C100/C110/C300, updated mtkclient to v2.0.1.
2025-06-15 – Verified all Telegram channels, removed 3 scam links.
2025-05-01 – Added SD480+ firehose for G400.
2025-04-10 – Added X30, XR21 test-points.
2025-03-05 – Added Russian mail-in service in Moscow.

Post a Comment

0 Comments