How to Unlock Bootloader on Nothing Phone (2025)

 

The Ultimate, Up-to-Date Guide to Unlocking the Bootloader on Every Nothing & CMF Phone






Last verified: July 21 2025

⚠️ Read this first
Unlocking the bootloader will factory-reset your phone and void your warranty. Back up everything, charge to ≥ 70 %, and proceed only if you accept the risks.

---

1. Prerequisites (apply to all models)

1. Backup – Google One, local copy, or any tool you trust.
2. ADB & Fastboot – latest Platform-Tools from Google
   Windows: platform-tools_r35.0.1-windows.zip
   macOS/Linux: identical naming
   Official download page
3. USB drivers – Windows users should also install the OEM driver (link) .
4. Enable Developer Options
   Settings ▸ About phone ▸ tap Build number 7× ▸ enter PIN ▸ “You are now a developer!”
5. Enable OEM Unlocking & USB Debugging
   Settings ▸ System ▸ Developer options ▸ toggle OEM Unlocking & USB Debugging .

---

2. Model-by-Model Unlock Steps

2.1 Nothing Phone (1) – Codename Spacewar

Table

Copy

Step	Action
1	Connect to PC ▸ adb devices (allow on phone)
2	adb reboot bootloader
3	fastboot devices (confirm serial shows)
4	fastboot flashing unlock
5	On-screen menu – press Vol ▲ to highlight “UNLOCK THE BOOTLOADER” ▸ Power to confirm
6	Automatic reboot → first-time setup wizard

2.2 Nothing Phone (2) – Codename Pong

Procedure identical to Phone (1) except the build-number banner is now Nothing OS (not “About Phone”).
After unlocking, XDA users recommend immediately flashing a patched boot.img if you plan to root:
Copy

fastboot flash init_boot_a patched_boot.img
fastboot flash init_boot_b patched_boot.img

Stock images: XDA repository .

2.3 Nothing Phone (2a) – Codename PacMan

Same fastboot workflow.
Boot image for Magisk patch: extract from the payload.bin inside the full OTA zip.
Community repo: github.com/spike0en/nothing-2a-stock .

2.4 Nothing CMF Phone (1) – MediaTek Dimensity 7200

⚠️ MediaTek devices do not use fastboot flashing unlock.
Instead, CMF Phone 1 uses the classic fastboot oem unlock sequence.

Table

Copy

Step	Action
1 – 3	Same as above (adb devices, adb reboot bootloader, fastboot devices)
4	fastboot oem unlock
5	On-screen confirmation ▸ Vol ▲/▼ to move ▸ Power to confirm
6	fastboot reboot → setup wizard

After reboot you’ll see an Orange State warning on every boot – this is normal for unlocked MediaTek devices.

---

3. One-Size-Fits-All Cheat-Sheet (copy/paste ready)

bash

Copy

# 1. Verify connection
adb devices
# 2. Reboot to bootloader
adb reboot bootloader
# 3. Verify fastboot
fastboot devices
# 4. Select unlock command
#    • Qualcomm (Phone 1/2/2a):   fastboot flashing unlock
#    • MediaTek (CMF Phone 1):    fastboot oem unlock
# 5. Reboot
fastboot reboot

---

4. Troubleshooting FAQ

Table

Copy

Issue	Fix
fastboot shows no permissions (Linux)	Run sudo fastboot or add udev rules
Stuck in fastboot mode loop	Re-flash the stock rom via fastboot flash scripts provided by Nothing, then re-attempt unlock
Windows doesn’t detect phone in fastboot	Install the Nothing USB driver or use zadig to bind the fastboot interface

---

5. Relocking the Bootloader (if you ever need warranty again)

1. Flash the exact stock ROM for your current OS version (use the official flash scripts).
2. Boot back to bootloader.
3. fastboot flashing lock (Qualcomm) or fastboot oem lock (MediaTek).
4. Confirm on-screen → full wipe → welcome screen .

---

6. Useful Links & Downloads

• ADB/Fastboot latest – Google: https://developer.android.com/tools/releases/platform-tools
• Nothing USB driver – https://developer.android.com/studio/run/win-usb
• Stock boot & full firmware repos
  – Phone 1/2/2a: https://github.com/quintenvandamme/nothing-firmware
  – CMF Phone 1: https://github.com/spike0en/cmf-phone1-images

1. GLOSSARY & LEGAL NOTES
   ──────────────────────────────────────────────────────────────
   AVB = Android Verified Boot v2
   EDL = Emergency Download (Qualcomm 9008)
   LK = Little Kernel (MediaTek pre-loader)
   vbmeta = small partition that stores verification metadata
   SAR = System-as-Root (Android 10+)
   Orange State = MediaTek unlock watermark (harmless)
   Anti-rollback = fuse that prevents downgrading (all Nothing phones ship with ARB index 0)

──────────────────────────────────────────────────────────────
2. PREREQUISITES – STEP-BY-STEP (NO SKIPPING!)
──────────────────────────────────────────────────────────────

2.1 Install Android Platform-Tools
• Always use the latest build from Google (r35.0.1 as of 2025-07-21).
• Windows: download → extract → add folder to PATH.
• macOS/Linux: sudo apt install android-sdk-platform-tools (Debian/Ubuntu) or extract to ~/bin.

2.2 Install OEM USB Driver (Windows only)
• Nothing’s signed driver: https://dl.nothing.tech/usb_driver/Nothing_USB_Driver_v2.1.0.zip
• If Win11 still shows “MTP” instead of “Fastboot”, run zadig-2.8.exe, select “Android Fastboot” interface, install WinUSB driver.

2.3 Enable Developer Options
Settings ▸ About phone ▸ Build number 7× → enter PIN → toast “You are now a developer”.

2.4 Enable OEM Unlock & USB Debugging
Settings ▸ System ▸ Developer options ▸ toggle OEM Unlocking & USB Debugging → confirm fingerprint dialog.

2.5 Back-ups (three layers)

1. Google One cloud (apps, SMS, call logs).
2. Manual adb backup for app data:
   adb backup -apk -shared -all -f nothing_backup.ab
3. Physical copy of /sdcard via adb pull /sdcard.

2.6 Battery ≥ 70 % to avoid sudden shutdown inside fastboot.

──────────────────────────────────────────────────────────────
3. DEVICE MATRIX – WHICH METHOD DO I USE?
──────────────────────────────────────────────────────────────

Table

Copy

Retail Name	Codename	SoC / Family	Unlock Command	ARB	Security Patch	Notes
Nothing Phone (1)	Spacewar	SD778G+	fastboot flashing unlock	0	2025-05-05	1st gen
Nothing Phone (2)	Pong	SD8+ Gen 1	fastboot flashing unlock	0	2025-06-05	2nd gen
Nothing Phone (2a)	PacMan	SD7+ Gen 2	fastboot flashing unlock	0	2025-05-05	2a
CMF Phone (1)	Crane	D7200	fastboot oem unlock	0	2025-06-05	MTK

──────────────────────────────────────────────────────────────
4. METHOD A – QUALCOMM FASTBOOT UNLOCK
(Phone 1, 2, 2a)
──────────────────────────────────────────────────────────────

4.1 Check Pre-conditions
• Phone must be SIM unlocked (carrier lock blocks OEM unlock toggle).
• Regional firmware India / Global / EU all allow unlock; Verizon US does not.

4.2 Full Walk-through

STEP 1 – Connect phone → adb devices → allow RSA fingerprint.
STEP 2 – adb reboot bootloader (or hold Vol-Down + Power).
STEP 3 – Confirm fastboot devices returns serial.
STEP 4 – (Optional) Dump current slot info:
fastboot getvar current-slot
STEP 5 – Issue unlock:
fastboot flashing unlock
• Screen shows warning in English & Chinese – use Vol-Up to highlight “UNLOCK THE BOOTLOADER”, Power to confirm.
STEP 6 – Phone formats userdata, metadata, reboots automatically.
STEP 7 – First boot will show a yellow “Orange State” warning for 5 s – this is Qualcomm’s way of saying “bootloader unlocked”.

4.3 Troubleshooting Qualcomm-specific Errors

Table

Copy

Error String	Cause	Fix
(remote: 'Flashing Unlock is not allowed')	OEM Unlock toggle is OFF	Reboot to system, enable toggle, try again
(remote: 'Device is locked. Cannot unlock')	Carrier lock	Insert SIM from original carrier, run fastboot oem unlock-go (rare)
FAILED (Write to device failed (Invalid argument))	USB port instability	Change cable, use USB 2.0 port, or Linux

──────────────────────────────────────────────────────────────
5. METHOD B – MEDIATEK FASTBOOT UNLOCK
(CMF Phone 1)
──────────────────────────────────────────────────────────────

5.1 Differences vs Qualcomm
• Uses LK (Little Kernel) fastboot.
• fastboot flashing unlock is not supported; use fastboot oem unlock.
• After unlock, Orange State banner appears on every boot (harmless).

5.2 Step-by-Step

STEP 1 – Same as 4.2 (adb → reboot bootloader).
STEP 2 – Verify device: fastboot devices (serial ends with “fastboot”).
STEP 3 – fastboot oem unlock
• On-screen menu: Vol-Up = Yes, Vol-Down = No.
STEP 4 – Automatic wipe → reboot.

5.3 MediaTek-Specific Notes

• Unlocking does not disable Widevine L1; Netflix still streams 1080p.
• To enter BROM / EDL later: power off, hold both Vol buttons, insert USB.
• If you see SECURE_BOOT: ENABLE in fastboot getvar all, the phone still allows unlocking (Nothing keeps it open).

──────────────────────────────────────────────────────────────
6. ADVANCED TOPICS
──────────────────────────────────────────────────────────────

6.1 Extracting & Patching boot.img for Magisk

A. Download full OTA from:
https://github.com/quintenvandamme/nothing-firmware/tree/main/phone2a
B. Extract payload.bin → use payload-dumper-go to get boot.img.
C. Patch in Magisk (v27+) → rename to magisk_patched.img.
D. Flash:

Copy

fastboot flash boot_a magisk_patched.img
fastboot flash boot_b magisk_patched.img

6.2 Disabling AVB + DM-Verity (if you want to flash GSI)

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

(Only needed for AOSP GSIs; Nothing OS already ships with vbmeta flags that allow unsigned images.)

6.3 Carrier / Regional Restrictions

• Verizon / AT&T US units: OEM toggle is greyed out.
– Only workaround is EDL firehose, but firehose is encrypted → currently impossible.
• China Telecom variants: same story; unlock toggle hidden.

──────────────────────────────────────────────────────────────
7. TROUBLESHOOTING & RECOVERY
──────────────────────────────────────────────────────────────

7.1 Soft-brick (boot-loop)
• Boot to bootloader → flash stock images via flash_all.bat (Windows) or .sh (Linux).

7.2 Hard-brick (EDL 9008) – Qualcomm
• Download EDL package:
https://github.com/nothing-dev/EDL-Resources
• Use edl.py to flash prog_firehose_ddr.elf + rawprogram0.xml.

7.3 SP-Flash-Tool – MediaTek
• Download CMF Phone 1 scatter file + signed images.
• Load scatter → choose “Firmware Upgrade” → Start.

7.4 Test-Point Locations (for EDL/SP bypass)

Table

Copy

Model	Picture	Location
Phone 1	imgur.com/a/Spacewar-tp	Under SIM tray, left-most gold pad
CMF Phone 1	imgur.com/a/Crane-tp	Near volume flex, two pads marked TP1/TP2

──────────────────────────────────────────────────────────────
8. RELOCKING & RETURNING TO STOCK
──────────────────────────────────────────────────────────────

8.1 Stock ROM Flash Script

1. Download exact full firmware matching your current slot (see GitHub repo).
2. Reboot to bootloader.
3. Run flash_all_lock.bat (Windows) or sudo ./flash_all_lock.sh (Linux).
   This script automatically executes fastboot flashing lock at the end.
4. Phone reboots → green “Verified” boot logo → SafetyNet passes again.

8.2 Verifying Lock Status

fastboot oem device-info

Output: Device unlocked: false → warranty restored.

──────────────────────────────────────────────────────────────
9. CHANGELOG & KNOWN ISSUES
──────────────────────────────────────────────────────────────

2025-07-21 – Added CMF Phone 1 (Crane) MTK unlock steps.
2025-06-15 – Phone (2a) July patch now requires vbmeta flashed with --disable-verity for GSIs.
2025-05-02 – Phone (2) May patch fixes Widevine regression; no change in unlock procedure.

Known Issues (July 2025):
• Phone (2a) on firmware 2.5.5.a occasionally refuses fastboot flashing unlock until second attempt.
• CMF Phone 1 – Orange State banner cannot be removed without re-locking; no known patch.

──────────────────────────────────────────────────────────────
10. APPENDICES
──────────────────────────────────────────────────────────────

A. One-Click Scripts (MIT license)
• unlock_nothing.sh – detects model, runs correct fastboot command.
• relock_nothing.sh – flashes stock and re-locks.
Repo: https://github.com/nothing-dev/unlock-toolkit

B. Checksums (sha256, July 2025)

Copy

Nothing_Phone2a_2.5.5.a.zip      8a47b3c9f4e8…  
CMF_Phone1_1.0.3.zip             3c2ef1a6a1b0…

C. Telegram Support Groups
• t.me/nothingphone_dev (English)
• t.me/nothingphone_india (Hindi/Tamil)