Unlocking the bootloader (bootloader) on devices with Android 4.x (including KitKat 4.4, Jelly Bean 4.1-4.3 i Ice Cream Sandwich 4.0) - a procedure that provides access to deep system configuration, installation of custom firmware and obtaining superuser rights. However, on older versions of Android, this process is fraught with unique difficulties: from the lack of official support from manufacturers to the risk of turning the device into a “brick” due to incompatibility with modern tools.

In this article we will look at all current unlocking methods for devices from 2012–2014 (for example, Samsung Galaxy S3/S4, HTC One M7, Nexus 4/5, Sony Xperia Z etc.), We will take into account the characteristics of each brand and provide checklists to minimize risks. We will pay special attention restoring IMEI and serial number to the problem that 80% of users face after unlocking on old Androids.

Why unlocking the bootloader on Android 4 is different from the new ones versions

Devices on Android 4.x work based on outdated versions bootloader (for example, LK from MediaTek or Little Kernel from Qualcomm), which have fundamental differences from modern solutions:

  • 🔧 Lack of a unified protocol: Each manufacturer used its own commands for unlocking (for example, fastboot oem unlock only worked on Nexus and Pixel, and for Samsung required Odin).
  • 🔒 Rigid binding to the hardware platform: On chips Exynos 4412 (for example, in Galaxy S3) unlocking often led to the loss of the module EFSwhere the IMEI is stored.
  • ⚠️ No rollback protection: On new Androids, locking OEM Unlock in the settings prevents accidental unlocking, but on Android 4 it could be done even without user confirmation.

In addition, many tools (for example, ADB and Fastboot) were updated to take into account new versions of Android, and their latest versions may not work correctly with older devices. For example, fastboot flash in versions higher 31.0.0 can ignore commands for Android 4.0–4.2.

📊 Which Android 4 device are you trying to unlock?
Samsung Galaxy S3/S4
HTC One M7/M8
Google Nexus 4/5
Sony Xperia Z/Z1
Other

Preparing the device: what needs to be done before unlocking

Before starting the procedure be sure to follow the following steps to avoid losing data or turning the device into a “brick”:

Make a backup copy of your data (photos, contacts, SMS) on your PC

Check the model and version of the bootloader via fastboot getvar all

Install original drivers for your device (not universal ones!)

Charge the battery to at least 70%

Download the stock firmware for your model in case of recovery-->

Pay special attention to backing up the partition EFS (for Samsung) or modemst1/modemst2 (for Qualcomm). These sections contain unique data, including IMEI. For backup you can use:

  • 📱 TWRP (if custom recovery is already installed).
  • 💻 ADB-command: 
    adb pull /dev/block/mmcblk0p3 efs_backup.img
    (path may differ!).
  • 🔧 Specialized utilities like EFS Professional (only for Samsung).
⚠️ Attention: On some devices (for example, HTC One M7 s S-ON), unlocking the bootloader resets the flag TAMPERED i RELOCKED, which may block access to official updates.

Official unlocking methods (for supported devices)

Some manufacturers provided official tools for unlocking the bootloader even on Android 4. Below are the current methods for popular brands:

Manufacturer Models (Android 4.x) Official method Link to tool
Google Nexus 4, Nexus 5, Nexus 7 (2012/2013) fastboot oem unlock Via Android SDK
HTC One M7, One M8, Desire 600 Site HTCDev (token-unlock) htcdev.com
Sony Xperia Z, Xperia Z1, Xperia T Unlock code via Sony Emma developer.sony.com
Motorola Moto X (1-gen), Moto G (2013) Code via Motorola Bootloader Unlock motorola-global-portal

For devices Google Nexus the process is as simple as possible:

  1. Enable USB debugging in Settings → For developers.
  2. Connect the device to the PC and do: 
    adb reboot bootloader

    fastboot oem unlock

  3. Confirm unlocking on the device screen (volume + power buttons).
⚠️ Attention: The HTC i Sony after unlocking may require flashing modem to restore the network. Ignoring this step results in an error No Service.

Unofficial methods: bypassing locks on unSupported devices

If your device does not support official unlocking (for example, Samsung Galaxy S3 or LG Optimus G), you will have to use alternative methods. Below are proven methods indicating the risks:

List of devices with an “unlockable” bootloader

Samsung Galaxy Note 2 (Exynos) —blocking at the hardware level.
LG G2 (D802) —requires a bypass through DirtyCow exploit.
Huawei Ascend P6 —official unlocking closed since 2015 year.
Lenovo A850 — the bootloader is locked at level Secure Boot.

Method 1: Exploits to bypass protection

For devices on chips Qualcomm (for example, Xiaomi Redmi 1S) you can use the vulnerability CVE-2016-5195 (DirtyCow):

  1. Download DirtyCow Root Exploit (version for Android 4.x).
  2. Install via ADB: 
    adb install dirtycow.apk

    adb shell am start -n com.example.dirtycow/.MainActivity

  3. After receiving the root, do: 
    su

    dd if=/dev/zero of=/dev/block/mmcblk0boot0

    (this erases the bootloader, allowing you to flash a custom one).

Method 2: Flashing a custom bootloader

For MediaTekdevices (for example, Micromax Canvas) the tool is suitable SP Flash Tool:

  1. Download DA file (Download Agent) for your model.
  2. In SP Flash Tool select Format All + Download and flash the modified preloader.bin.
  3. After this, the bootloader will be unlocked, but the device will require custom recovery firmware (TWRP).
💡

If the device does not turn on after unlocking, try flashing the stock one boot.img via fastboot flash boot boot.img. In 60% of cases, this restores functionality.

Restoring IMEI and serial number after unlocking

One ​​of the most common problems after unlocking on Android 4.x is loss of IMEI (displayed as Null/Null or 00000000). This occurs due to partition damage EFS (for Samsung) or nvram (for MediaTek).

Recovery methods:

  • 📡 For Samsung: Use EFS Professional or manually restore the backup via ADB: 
    adb push efs_backup.img /dev/block/mmcblk0p3
  • 🔧 For MediaTek: Flash NVRAM via SP Flash Tool (the file is usually called NVRAM_NVDA_BIN).
  • 📱 For Qualcomm: Restore modemst1 i modemst2 from backup or via QPST.

If there is no backup, you can try to generate IMEI using the algorithm Luhn (for example, through IMEI Generator), but this illegally in most countries and can lead to blocking of the network by the operator.

⚠️ Attention: On devices with eMMC 4.41/4.5 (for example, Galaxy S3) repeated writing to a partition EFS may cause hardware memory wear. It is recommended to limit yourself to 2-3 attempts.

Common errors and their solutions

When unlocking the bootloader on Android 4.x users encounter typical problems. Below is a table of errors and how to resolve them:

Error Cause Solution
FAILED (remote: unknown command) Outdated version fastboot or incorrect command Use fastboot versions 23.0.1 or adb shell fastboot oem unlock
Device not found Missing drivers or incorrect VID:PID Install drivers via Zadig (select libusb-win32)
Secure Boot Error Damaged preloader (on MediaTek) Flash the original preloader.bin via SP Flash Tool
E:Signature verification failed Firmware signature lock (on Samsung) Disable verification c Odin (the checkbox Auto Reboot must be unchecked)

If the device after unlocking does not turn on, try the following steps:

  1. Hold Power + Vol Down 10-15 seconds to force a reboot.
  2. Connect to the PC and check if the device is detected in fastboot devices or lsusb.
  3. If the device is in mode Qualcomm HS-USB QDLoader 9008, flash the firmware via QFil.
💡

90% of the "bricks" after unlocking on Android 4.x are associated with damage to the partition aboot (for Qualcomm) or lk.bin (for MediaTek). Restoring these partitions via EDL mode solves the problem in most cases.

Alternatives to unlocking: what to do if nothing works

If unlocking the bootloader is impossible (for example, due to hardware blocking on Samsung Exynos), consider alternative ways to obtain root access or install custom firmware:

  • 🔓 Root without unlocking: Use vulnerabilities in the kernel (for example, TowelRoot for Android 4.4 or KingRoot for MediaTek).
  • 📱 Custom recovery without unlocking: On some devices (for example, LG G2) you can flash TWRP via ADB with bypassing the bootloader: 
    adb push twrp.img /data/local/tmp/

    adb shell dd if=/data/local/tmp/twr.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery

  • 🔧 Unlock emulation: On Huawei and some Lenovo can be used DC-Unlocker to temporarily bypass restrictions.

If the purpose of unlocking is to install a new version of Android, consider the option with Project Treble (for devices with Android 8+) or LineageOS (there are assemblies for Android 4.4, but with limited functionality).

FAQ: Answers to frequently asked questions

Is it possible to unlock the bootloader on a Samsung Galaxy S3 with Android 4.3 without losing the IMEI?

Theoretically yes, but in practice the risk of losing IMEI is ~70%. It is recommended to first backup the partition EFS via TWRP or ADB. If the IMEI is missing, restore it from a backup or use a patch EFS Fix for your model.

What to do if, after unlocking, the device does not see the SIM card?

This indicates damage to the partition modem or EFS. Try:

  1. Flash stock modem.bin via Odin (for Samsung) or Fastboot (for Nexus).
  2. Restore nvram from backup (for MediaTek).
  3. Check whether it has been reset Baseband in the settings (Settings → About phone).
How to unlock the bootloader on HTC One M7, if the site HTCDev is not working?

If the official service HTCDev is unavailable, use alternative methods:

  1. Get token via ADB: 
    adb reboot bootloader

    fastboot oem get_identifier_token

  2. Use third-party services like HTC Bootloader Unlock Token Generator (for example, on XDA-Developers).
  3. For devices with S-OFF you can unlock the bootloader with the command: 
    fastboot oem unlock 4321

Please note: on some versions HTC One M7 needs to be obtained first S-OFF via SunShine or Firewater.

Is it possible to return the official warranty after unlocking?

No, unlocking the bootloader on 99% of devices resets counter Flash Counter (for example, on Samsung) or sets a flag UNLOCKED (on Nexus). Even if you block the bootloader back (fastboot oem lock), service centers can determine the fact of interference from logs aboot or sbl1.

Exception - devices with hardware locking (for example, LG G3 on some regional firmware), where resetting to factory settings erases traces unlocking.

Which devices on Android 4.x cannot be unlocked?

List of devices with hardware locking (without the possibility of bypass for 2026):

  • Samsung Galaxy Note 2 (Exynos 4412) - level locking eFuse.
  • LG Optimus G (E975) - bootloader locked without possibility rollback.
  • Huawei Ascend P6 — official unlocking is closed, alternative methods require soldering work.
  • ZTE Nubia Z5 — the bootloader is signed with a unique manufacturer key.

For these models, the only option is to search for vulnerabilities in a specific firmware version (for example, an exploit for the kernel 3.4.5 on MediaTek MT6589).