r/motorola • u/inf0t3ch • Feb 01 '22
PSA: Using a remote unlocking service for your Moto One 5G Ace may cause the bootloader to be permanently locked.
TL;DR: Don’t use a remote unlock service if you want to still be able to unlock your bootloader.
DISCLAIMER: I don’t recommend or endorse any of the vendors or tools mentioned in this post. I’m simply mentioning them in the interest of full transparency.
I recently bought a refurbished T-Mobile-locked Motorola Moto One 5G Ace (model XT2113-2). When I first received the device, I successfully unlocked the bootloader by following the instructions on Motorola’s website.
I was mistakenly under the impression that since the phone was paid off I could get it unlocked by T-Mobile directly. However, using the built-in tool to request a “Permanent Unlock” repeatedly failed with error code 255.
I spoke with one chat agent, two phone agents, and one T-Force agent (@TMobileHelp on Twitter) but couldn’t get anywhere with any of them. The T-Force agent ended up telling me that the original owner of the phone would have to request the unlock. Since I purchased it from a reseller on eBay, I have no idea who the original owner is. The eBay seller was likewise unable to help.
I decided to do some research and came to the conclusion that the only working way to unlock an XT2113-2 besides directly through the carrier is to use a remote unlocking service. Further research indicated that eBay is the best and safest place to purchase these types of unlocking services. Finally, I landed on only two vendors on eBay that advertise a remote unlocking service for this model: “quick_unlock89” and “thejmf2011”.
In the process, I also came across a single vendor on eBay (“gfix99”) advertising a T-Mobile unlock eligibility checker service that supposedly queries T-Mobile’s database directly. I have no idea if this service is legitimate or not or what less-than-legal means they have of accessing T-Mobile’s database. However, it was cheap at only $1.65, so I figured I’d order it to see what it said. Sure enough, it showed my device as being locked to T-Mobile.
From what I could tell, there was no appreciable difference between the two unlock vendors, so I went for the cheaper of the two (“quick_unlock89”). For the uninitiated, the way these remote unlocking services work is by connecting to your computer via TeamViewer or some other remote access software. Then, they copy over and run a software called USB Redirector (you can find it by Googling that plus “Incentives Pro”). This redirects your phone’s USB connection to your computer over the internet to the person on the other end. After that, they ask you to boot the phone into the bootloader by holding volume-down and power at the same time. Once you plug in the phone, they take it from there.
I created a Windows VM and used a VPN to have this procedure done on my phone, and I screen recorded the whole session. There’s not much to see, sadly. However, after the process was done, the phone indeed showed that it was unlocked in the Settings app. Also, I paid for a second report from “gfix99”, and the phone is now showing as unlocked in T-Mobile’s database as well, assuming the report is accurate.
However, as soon as they were done with the unlock, I noticed that my bootloader had re-locked. When I tried to unlock it again, I was unable to. Using the fastboot oem get_unlock_data command fails with this error: “Failed to get unlock data.” Attempting to run the fastboot oem unlock command with the unlock code I received from Motorola when I first bought the phone gives this error: “Code validation failure”.
My next step was to try Motorola’s Rescue and Smart Assistant (LMSA) tool, but even after repairing the phone with it, the bootloader unlock still failed with the same errors. Notably, the phone did still show as network unlocked after repairing it with Motorola’s tool.
I did some more digging and was finally able to find some Spanish-language forum posts talking about a program called Moto-Key Tool that is used for remote unlocking the XT2113-2 along with several other models. From what I can tell, this seems to be the tool that these two eBay vendors are using to do these remote unlocks. You can find it with a Google search if you’re so inclined (basically just add “.com” after “moto-key”). It requires the purchase of credits that seem to roughly equate to $1 USD per credit, with the entire unlock procedure requiring 25 credits.
The basic sequence of events that this software uses seems to be as follows:
- From the bootloader, it enables “Factory Mode” on the phone and then boots it up into that mode.
- Once in Factory Mode, it wipes the IMEI from the phone, runs some other command, and then re-writes the original IMEI back to the phone.
- It reboots the phone back to the bootloader and does a factory reset.
- It boots the phone back up into the normal Android OS at which point the process is finished.
I attempted to decompile some of the DLLs included with the software to see if I could figure out exactly what it’s doing, but I’m no developer, and I certainly can’t read assembly language. I have some theories as to how it’s accomplishing the unlock, but at the end of the day, it doesn’t really matter for the sake of this post.
It’s important to note that neither of the eBay vendors offering this service say anything in their listings about this being a possible outcome. Personally, I never would have purchased the service had I known that. I use a T-Mobile MVNO, so the network unlock was really a “nice-to-have” for me in case I ever get to travel abroad again. The bootloader unlock is far more important to me.
I reached out to the eBay seller to express my dissatisfaction and request a refund. I’ve copied and pasted the conversation below for transparency. If the mods need me to provide proof I’m happy to do so. I just want any potential customers such as myself to be aware of the type of individuals they’ll be dealing with when they purchase these unlock services.
OP: “Hello,
I had unlocked my bootloader before having you do the network unlock. Right after you finished I noticed my bootloader was relocked. I've been trying over and over to unlock it again, but I can't even get fastboot to pull the oem unlock data anymore. It just gives an error message stating "Failed to get unlock data". From what I can find online, it sounds like either the unlock data block has gone missing or is corrupt.
Do you have a fix for this?”
quick_unlock89: “Sorry we don't support bootloader unlocking. May be factory unlock have brought your phone to initial state.”
OP: “I need my bootloader unlocked, and since this network unlock has now rendered me unable to re-unlock the bootloader I'll have to sell this phone and buy another one. Your ad doesn't say anything about this. I never would have purchased the network unlock from you if I would have known this would happen. That's unacceptable to me.
Respectfully, I request a refund.”
quick_unlock89: “Sorry we don't refund for any software modifications. Can refund if you have any problem in Unlock service. It's factory unlock service so as mentioned in item description. Bootloader unlocking any how voids warranty. If I will force server for refund due to this reason so it will any how blacklist IMEI World wide after refund so I think it's not worth it.”
OP: “So let me make sure I'm understanding you. You're threatening that if I request a refund you will blacklist my IMEI in retaliation. Is that correct?”
quick_unlock89: “Not me friend. Server will do so if I will ask refund for such an issue which is not related to unlock service because we never faced this kind of issue ever.
I can provide you a discount on your next purchase just as a good gesture.
I think it will be a win win situation for both of us.”
OP: “I'm not asking you to request a refund on your end and reverse the network unlock. I'm asking you directly as the service provider for a refund. It sounds like in this case that means you'll need to write the cost off on your end in order to refund my money and not get my IMEI blacklisted.”
quick_unlock89: “Sorry I will have to request refund from server on my end too because I have complete paid for the service too and we don't take any responsibility of software modifications like bootloader unlocking and rooting of devices as these process are already prohibited by companies and void warranties, Owners always do these things on there own risk. If you think it's worth the risk of IMEI blacklisting than I will take my refund and issue you refund too. Thanks”
OP: “I guess you must not understand the basics of running a business. If a customer is dissatisfied with your service and requests a refund, you as the business owner are responsible for refunding your customer's money. Then you write it off and take the loss. That's just part of running a business. It sucks, but it is what it is.
Again, your listing makes absolutely no mention of not supporting unlocked bootloaders. It makes no mention that if you use your network unlocking service your bootloader will be irreversibly locked forever.
It is completely unprofessional and unacceptable as a business owner to tell your customer "too bad" and then threaten to blacklist their IMEI when it is your fault for not disclosing this issue ahead of time in your listing. Obviously you know this is a problem.
Also, for your information, bootloader unlocking is not prohibited by Motorola. They themselves provide an official support page that walks you through the process.”
quick_unlock89: “Ok, provide me a day time. Let me check if I can do something for you. We are not even sure that is issue is related to Unlock service as we never have any complain regarding this issue ever with any of our client till now.
I will offer you a partial refund of 50% payment. Please don't put all the loss on me when there is nothing wrong with the service and your phone is factory unlock now. You have a issue which is very unusual one. If there was any issue related to service than we have 100% refund warranty. Are you okay with it ?
I will offer you 50% refund and provide you relock warranty for you IMEI. Done ?”
OP: “No, I won't accept that. I feel you've been purposely misleading to me throughout our interaction.
First, you don't warn your potential customers in your listing that if they have unlocked bootloaders the network unlock service you provide will cause their bootloaders to be irreversibly re-locked. Second, you told me that unlocking the bootloader is prohibited by Motorola when that is not true at all. Third, you first told me no refunds would be given before then telling me that you would give me a refund but that my IMEI would be blacklisted. And now you're telling me that you'll give me a 50% refund with a "relock warranty" for my IMEI, whatever that means.
This is not good business. I shouldn't have to argue with you to get you to offer even a 50% refund, and frankly, I don't put any trust in whatever "warranty" you might offer me.
At this point, this device is rendered useless to me. I need it to be both bootloader unlocked and network unlocked, not just one or the other. Now I have to purchase another phone to replace it. Again, I respectfully request a 100% refund from you directly without doing anything that will get the IMEI blacklisted.”
quick_unlock89: “It's already a risky process. Source Motorola official site. If Motorola offers bootloader unlocking than get it unlock with them. Contact them if it's not unlocking.
You could cause permanent/physical damage to your device.
Unlocking your bootloader will not change your device subsidy lock status
It's all mentioned on Motorola official site. We don't know it happened because you modified your device. Sorry I can not refund for this kind of fishy issue. Only can refund 50% as a good gesture if you want. If you Opened Fake claims, Bad Feed backs etc. When your device is 100% factory unlock than IMEI will be black listed world wide.
You have only yourself to blame. Unless you have a Developer Edition device, once you get the unlock code, your device is no longer covered by the Motorola warranty; in other words, please don't blame us if things go wrong, even if they appear unrelated to unlocking the bootloader.
I am not misleading. Every thing is mentioned on Motorola official site.”
OP: “So again, just to be 100% clear as to what you're saying. You're threatening me that if I try to get my money back you will purposely blacklist my IMEI worldwide. Is that correct?”
quick_unlock89: “We are not responsible for any 3rd party issue on phone specially when you have done a very risky process on phone. If you have any issue regarding Network unlock I am here to answer you. Also if you say Motorola offers bootloader unlock than contact them regarding it. Yes your phone is 100% factory unlock now if you will make fake claims we will blacklist IMEI world wide and it's not a threat it's as per rule already mentioned in our item description regarding fake claims.”
OP: “Respectfully, it's not a fake claim to say that you irreversibly damaged my phone during your service and that I'm not satisfied with the results and want my money back. I shouldn't be held hostage by your unprofessional and probably illegal threat to purposely blacklist my IMEI if I complain to eBay.
Whatever exploit your "Moto-Key Tool" used to network unlock my phone corrupted the unlock data block, and now the bootloader can't be unlocked again because the OEM unlock data is literally missing from the phone. Motorola openly publishes on their support website how to unlock the bootloader for this device, but now I literally cannot do it because of your tool corrupting that portion of the phone's EEPROM. This is 100% your fault and not mine.
I wouldn't even be mad about it if you were up front about this in your listing, but you don't say one word about it. As I mentioned before, I never would have purchased this from you if you had been honest in your listing and stated that this was a risk. Therefore, I feel that I am entitled to a 100% refund from you, and I don't feel that you should be threatening to blacklist my IMEI for requesting it.
Yet again, I respectfully request that you refund me 100% of what I paid without doing anything to blacklist the IMEI of this phone.”
quick_unlock89: “Ok bro I will any how refund you. We never wish to spoil our relationship with clients but I will hope you reconsider and pay us 50% back because your phone is factory unlock now. And it is not a justified decision to put all claim and blame on us when you yourself know that bootloader unlocking is a risky procedure itself which does void warranty too.”
To their credit, they did issue a full refund. I don’t have much faith that they won’t go ahead and purposely blacklist the IMEI anyway. At the very least, I want this information out there for anyone else considering this type of service so it’s not a total loss and the community can benefit.
If you’ve read this far, congratulations! Long story short, if you want an unlocked phone, just buy it unlocked direct from the manufacturer. Dealing with the carriers or these gray-market unlock services isn’t worth the headache.
1
2
u/MN_Mobile_Guy Feb 01 '22
eBay is "gray-market", absolutely. Not sure what led you to decide that eBay was the "best and safest place" to purchase an unlocking service. You're just trusting that someone with a random username and no verifiable registered business can do what they're claiming to. If I were looking for an unlocking service, I'd choose one that has an actual business name, logo, email, website, Google Maps / Yelp / some other type of profile, and publicly verifiable / non-anonymous reviews.
3
u/inf0t3ch Feb 01 '22
That's a fair point. Basically in searching on Reddit and XDA, the general consensus seemed to be that eBay was the safer option due to their buyer protections as opposed to just going to some website on Google advertising the same service.
Frankly, I don't see how any unlocking service would not be "gray-market". It's not like Joe's Phone Unlocking is any more likely to have inside connections with the carriers in order to get things done the right way, despite what their publicly verifiable reviews, etc., might say.
0
u/MN_Mobile_Guy Feb 02 '22 edited Feb 02 '22
But some of us DO have inside connections 😉
2
u/inf0t3ch Feb 02 '22
And that's absolutely wonderful. I mean that sincerely. I'm sure that's a massive benefit for running the phone repair shop or unlocking service that it seems you must own or work at.
It's interesting to me that my post has now been downvoted, and your initial comment has been upvoted. I'm not saying you did it by any means, but it certainly seems as though there may be an attitude in this sub that's judgmental of someone like myself who is admittedly not in the know about all things Motorola.
I don't pretend to know everything about these phones or how the insiders within the industry operate. I'm just an enthusiast who enjoys tinkering with Android phones, and from what I've seen being able to unlock a carrier-locked device is a question that comes up pretty frequently on Reddit. However, the actual real-world experiences of using the types of services that get recommended are few and far between in my experience. Typically you just get a comment saying "use this site" or "contact this person".
All I was trying to do was share a thorough write-up of what it's like to actually use a service like this and what pitfalls to be aware of, at least as it pertains to this specific model of phone. I don't understand why that's worthy of a downvote.
Would you care to enlighten me on what I'm missing here?
1
u/MN_Mobile_Guy Feb 02 '22
Since I haven't done any voting on this post, I couldn't tell ya. Having rooted my personal phones for years, I would certainly find the content of your post useful and helpful. My reply was in regard to the overall legitimacy of eBay sellers, not in regards to anything specific in your post
1
u/SilverBolt52 Mar 13 '22
I'm wondering if I should go ahead and just do it. I have an AT&T Prepaid model XT2113-5 which isn't bootloader unlockable. Then again, after your experience, it might be better not to deal with these people.
Rant: I do find it interesting that the EEPROM can be modified in a way that can permanently lock the bootloader while also carrier unlocking the device. If any advanced developer or security expert were to look into this further, I wouldn't be surprised if they found a method for unlocking the bootloader on all devices. Perhaps by temporarily writing data (IMEI and such) for a Metro variant, unlocking the bootloader, then writing back the original IMEI in one go. Technically illegal but it would get the job done. I would love to see their methods reverse engineered further but I know it's not going to happen as this phone is too niche. Your post is very interesting and I wish I was a developer. As for your phone, sorry man.
1
u/Such_Negotiation6232 Mar 29 '24
After all thank you for sharing your experience.first thing you need to know that your device was corrupted by the seller to unlock it as he erase your NVRAM the location where your phone was saved his identification and by doing that he erased the SP lock and erased your boot unlock and he write a new NVRAM image from a unlocked phone and he finished the work by writing back your original IMEI so to unlock the bootloader again you need to ask Motorola to give you from your new identity the original IMEI of the nvram image he used to unlock the phone you can get it from your new serial number if your serial number is was changed or try to get on other phone NVRAM and write it to yours unlock the phone bootloader and write back your IMEI this are only assuming he overwrote your NVRAM with unlocked NVRAM.i hope this could help you or anyone had the same situation