How to Unlock the Bootloader on the OPPO Find X9s Pro> ⚠️
Warning: Read this before proceeding. >
Required firmware version: Before proceeding, make sure the phone is running build
.306.
RequirementsYou will need the following:
- Android Platform Tools
- The exploit and patched bootloader image
- The complete
.306 local-update ROM package
Step 1: Prepare the Phone1. Enable
Developer Options and
USB debugging: go to
Settings > About device, tap the build number or version number seven times, then return to Settings and open
Developer Options.
2. Connect the phone to the PC. If an authorization prompt appears, select
Always allow from this computer and confirm.
3. Open a Command Prompt or PowerShell window in the Android Platform Tools folder.
Step 2: Push the Files> ⚠️ Enter each command separately. Confirm that the files are intended specifically for the X9s Pro before continuing.
adb push x9sp /data/local/tmp
adb push x9spro.img /data/local/tmp
Step 3: Trigger the Local Update1. Copy the complete X9s Pro
.306 local-update package from the PC to the phone’s internal storage.
2. On the phone, go to
Settings > System & updates > Software update, tap the three-dot menu in the upper-right corner, select
Local update, and choose the copied update package.
3. When the phone displays the
Restart and update prompt,
do not tap Restart. Immediately lock the screen and return to the PC.
Step 4: Run the Privilege EscalationEnter the following commands on the PC:
# Make the exploit executable
adb shell chmod 0755 /data/local/tmp/x9sp
# Run the exploit
adb shell /data/local/tmp/x9sp
If the exploit succeeds, the terminal should display a large amount of output, including a success or
pass message.
Step 5: Write the Patched Partition Image> ⚠️
Important: Write the image to the *inactive* slot. Writing to the wrong partition or using an incompatible image can brick the phone.
First, open an ADB shell:
adb shell
Then, from inside the phone’s shell, obtain
su privileges:
/data/local/tmp/csu
Keep this shell session open and run all remaining commands in this section from within it.
Check the currently active slot:
getprop ro.boot.slot_suffix
If the active slot is
_a, write the image to the
_b partition:
dd if=/data/local/tmp/x9spro.img of=/dev/block/by-name/lk_b
If the command returns a
0+0 records error, remove write protection for that same partition:
blockdev --setrw /dev/block/by-name/lk_b
Then run the
dd command again:
dd if=/data/local/tmp/x9spro.img of=/dev/block/by-name/lk_b
A successful write should display a non-zero number of records, typically followed by
+0 records.
1. Return to the phone and tap
Restart now.
2. After the phone boots, go to
Settings > System settings > Developer options, then enable
OEM unlocking.
Step 6: Unlock in Fastboot1. Reboot the phone into bootloader mode:
adb reboot bootloader
2. Once the Fastboot screen appears, enter:
fastboot flashing unlock
3. A confirmation screen should appear on the phone. Press the
Volume Up (+) button within five seconds to confirm.
4. Once the PC displays
OKAY, the phone should restart automatically.
Step 7: Wipe DataIf the device boots to the language-selection screen, choose
Format data or
Erase all data. The phone will restart automatically after the wipe is complete.
If the phone boots directly into Android, this step is unnecessary.
Notes-
OTA updates: The device may continue to receive ColorOS OTA updates after unlocking. However, an update may block Fastboot access or overwrite modified partitions.
-
Relocking: To relock the bootloader, run:
fastboot flashing lock
Relocking the bootloader also wipes all user data.
>
Disclaimer: This guide is provided for technical discussion only. You are solely responsible for anything resulting from these steps.
