How to Unlock the Bootloader on the OPPO Find X9s Pro

> ⚠️ Warning: Read this before proceeding.
> Required firmware version: Before proceeding, make sure the phone is running build .306.

Requirements

You will need the following:

- Android Platform Tools
- The exploit and patched bootloader image
- The complete .306 local-update ROM package

Step 1: Prepare the Phone

1. Enable Developer Options and USB debugging: go to Settings > About device, tap the build number or version number seven times, then return to Settings and open Developer Options.
2. Connect the phone to the PC. If an authorization prompt appears, select Always allow from this computer and confirm.
3. Open a Command Prompt or PowerShell window in the Android Platform Tools folder.

Step 2: Push the Files

> ⚠️ Enter each command separately. Confirm that the files are intended specifically for the X9s Pro before continuing.

adb push x9sp /data/local/tmp

adb push x9spro.img /data/local/tmp

Step 3: Trigger the Local Update

1. Copy the complete X9s Pro .306 local-update package from the PC to the phone’s internal storage.
2. On the phone, go to Settings > System & updates > Software update, tap the three-dot menu in the upper-right corner, select Local update, and choose the copied update package.
3. When the phone displays the Restart and update prompt, do not tap Restart. Immediately lock the screen and return to the PC.

Step 4: Run the Privilege Escalation

Enter the following commands on the PC:

# Make the exploit executable
adb shell chmod 0755 /data/local/tmp/x9sp

# Run the exploit
adb shell /data/local/tmp/x9sp

If the exploit succeeds, the terminal should display a large amount of output, including a success or pass message.

Step 5: Write the Patched Partition Image

> ⚠️ Important: Write the image to the *inactive* slot. Writing to the wrong partition or using an incompatible image can brick the phone.

First, open an ADB shell:

adb shell

Then, from inside the phone’s shell, obtain su privileges:

/data/local/tmp/csu

Keep this shell session open and run all remaining commands in this section from within it.

Check the currently active slot:

getprop ro.boot.slot_suffix

If the active slot is _a, write the image to the _b partition:

dd if=/data/local/tmp/x9spro.img of=/dev/block/by-name/lk_b

If the command returns a 0+0 records error, remove write protection for that same partition:

blockdev --setrw /dev/block/by-name/lk_b

Then run the dd command again:

dd if=/data/local/tmp/x9spro.img of=/dev/block/by-name/lk_b

A successful write should display a non-zero number of records, typically followed by +0 records.

1. Return to the phone and tap Restart now.
2. After the phone boots, go to Settings > System settings > Developer options, then enable OEM unlocking.

Step 6: Unlock in Fastboot

1. Reboot the phone into bootloader mode:

adb reboot bootloader

2. Once the Fastboot screen appears, enter:

fastboot flashing unlock

3. A confirmation screen should appear on the phone. Press the Volume Up (+) button within five seconds to confirm.
4. Once the PC displays OKAY, the phone should restart automatically.

Step 7: Wipe Data

If the device boots to the language-selection screen, choose Format data or Erase all data. The phone will restart automatically after the wipe is complete.

If the phone boots directly into Android, this step is unnecessary.

Notes

- OTA updates: The device may continue to receive ColorOS OTA updates after unlocking. However, an update may block Fastboot access or overwrite modified partitions.
- Relocking: To relock the bootloader, run:

fastboot flashing lock

Relocking the bootloader also wipes all user data.

> Disclaimer: This guide is provided for technical discussion only. You are solely responsible for anything resulting from these steps.