Unlock Bootloader Without Asus Unlock App for Zenfone 2 Laser

Unlock Bootloader Without Asus Unlock App for Zenfone 2 Laser

Originally By [email protected]

Yes you heard it right! It is possible to unlock bootloader of ZenFone 2 Laser without the buggy Asus Unlock App.
This method was developed by @osm0sis with @Titokhan‘s analysis and my testing. Also thanks to @MiauLightouch for his unofficial method of unlocking ZE500KL and special thanks to @shakalaca since achieving root on locked bootloader was not possible without him.


This method was tested on my rooted ZE550KL (MSM8916) and it worked like a charm!
I expect it to work on ZE600KL and ZE550KG and probably on other variants too. Currently, it’s a one-way method i.e. you can’t relock bootloader but with your help, we may be able to relock bootloader as well.
Update: This doesn’t work on ZE500KL and ZE500KG. Use MiauLightouch’s guide for unlocking these devices.

You MUST be rooted to use this method. If your phone is not rooted, follow a relevant guide listed in this thread. Or search yourself to find a proper rooting guide. Tip: Use shakalaca’s pre-rooted patched factory img.

By proceeding to this guide you agree to exempt osm0sis, Titokhan, sziraqui and xda-developers.com from any harm/damage that “may” happen to your device.

 * Your warranty is now void.
 * I am not responsible for bricked devices,
 * thermonuclear war, or you getting fired because the alarm app failed.
 * YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, I will laugh at you.


STEP 1: Create a partition dump
This will backup your critical partitions. If you skip this step, and messed up your device, don’t expect me to help you recover it.
i) From Termux (Download from playstore), type
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
adb shell

For both cases, wait to see a pop from SuperSU and grant root access. If you don’t see SuperSU pop-up even after 15 seconds, go to Auto Start Manager and “Allow” SuperSU and then try again.

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter

if [ -e /dev/block/platform/*/by-name ]; then
elif [ -e /dev/block/platform/*/*/by-name ]; then
if [ “$target” ]; then
target=`echo -n $target`;
mkdir $outdir;
for part in $target/*; do
case $part in
*/system|*/APP|*/cache|*/CAC|*/userdata|*/UDA|*/boot|*/LNX|*/recovery|*/SOS) ;;
*) dd if=$part of=$outdir/$(basename $part)-$state.img;;

[Link to original thread of above script http://forum.xda-developers.com/show…&postcount=575 ]
old script (jusfor my reference)

mkdir /sdcard/dump_locked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_locked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_locked/abootbak_locked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_locked/abootdebug_locked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_locked/ADF_locked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_locked/APD_locked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_locked/asdf_locked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_locked/asusfw_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_locked/asusgptt_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_locked/asusgpt1_locked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_locked/asusgpt2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_locked/asuskey_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_locked/auskey2_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_locked/asuskey3_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_locked/asuskey4_locked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_locked/asuskey5_locked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_locked/config_locked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_locked/DDR_locked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_locked/devinfo_locked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_locked/factory_locked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_locked/factorybak_locked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_locked/fsc_locked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_locked/fsg_locked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_locked/hyp_locked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_locked/hypbak_locked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_locked/keystore_locked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_locked/misc_locked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_locked/modem_locked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_locked/modemst1_locked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_locked/modemst2_locked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_locked/oem_locked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_locked/sdcard/persistent_locked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_locked/persist_locked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_locked/rpm_locked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_locked/rpmbak_locked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_locked/sbl1_locked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_locked/sec_locked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_locked/splash_locked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_locked/ssd_locked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_locked/tz_locked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_locked/tzbak_locked.img
echo “Finished Partition Backup!”

The script will take approx. 6 mins to complete. Be Patient. Do not close the terminal session.
You should see a folder with name “dumps-lockedbl” in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

STEP 2: Unlock your bootloader Warning: This will void your warranty
(All credits to osm0sis for this)
Now the following magical code will unlock your bootloader! Copy paste it to Termux/adb
echo -ne “\x01” | dd obs=1 count=1 seek=16 of=/dev/block/bootdevice/by-name/devinfo

To check your bootloader status, Reboot to fastboot mode. Connect it to a computer (computer should have adb and fastboot files, and assus drivers installed)On your computer, hold down shift key and right click on the folder inwhich you have adb and fastboot files. Select “Open command window here”. Type the following command and hit enter-
fastboot oem device-info

You will get the following output

(bootloader) 	Device unlocked: true
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 0
OKAY [  0.004s]

Troubleshoot:Not needed

If your output has “Device unlocked: false” then it means your bootloader is still locked. In that case, type the following code

fastboot oem adb_enable
fastboot oem adb_enable

Yes you need to type it twice. Now check status again

fastboot oem device-info

Now the output should be

(bootloader) 	Device unlocked: false
(bootloader) 	Charger screen enabled: false
(bootloader) 	Display panel: 
(bootloader) 	Adb Enable: 1
OKAY [  0.004s]

Now repeat step 2 again. Your bootloader will be unlocked

STEP 3: If you want to help us in relocking bootloader, then do this step
This is similar to step 1 with the difference that we are now dumping out partitions that might have changed after unlocking bootloader to folder name dump_unlocked
i) From Termux terminal emulator app (Download from playstore), type
Using adb (assuming you have enabled USB Debugging and device is connected to computer)
adb shell

ii) Now copy paste the following set of commands (all commands together) in terminal/cmd and hit enter:

if [ -e /dev/block/platform/*/by-name ]; then
elif [ -e /dev/block/platform/*/*/by-name ]; then
if [ “$target” ]; then
target=`echo -n $target`;
mkdir $outdir;
for part in $target/*; do
case $part in
*/system|*/APP|*/cache|*/CAC|*/userdata|*/UDA|*/boot|*/LNX|*/recovery|*/SOS) ;;
*) dd if=$part of=$outdir/$(basename $part)-$state.img;;

old script (just for my reference)

mkdir /sdcard/dump_unlocked
dd if=/dev/block/bootdevice/by-name/aboot of=/sdcard/dump_locked/aboot_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootbak of=/sdcard/dump_unlocked/abootbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/abootdebug of=/sdcard/dump_unlocked/abootdebug_unlocked.img
dd if=/dev/block/bootdevice/by-name/ADF of=/sdcard/dump_unlocked/ADF_unlocked.img
dd if=/dev/block/bootdevice/by-name/APD of=/sdcard/dump_unlocked/APD_unlocked.img
dd if=/dev/block/bootdevice/by-name/asdf of=/sdcard/dump_unlocked/asdf_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusfw of=/sdcard/dump_unlocked/asusfw_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt of=/sdcard/dump_unlocked/asusgptt_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt1 of=/sdcard/dump_unlocked/asusgpt1_unlocked.img
dd if=/dev/block/bootdevice/by-name/asusgpt2 of=/sdcard/dump_unlocked/asusgpt2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey of=/sdcard/dump_unlocked/asuskey_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey2 of=/sdcard/dump_unlocked/auskey2_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey3 of=/sdcard/dump_unlocked/asuskey3_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey4 of=/sdcard/dump_unlocked/asuskey4_unlocked.img
dd if=/dev/block/bootdevice/by-name/asuskey5 of=/sdcard/dump_unlocked/asuskey5_unlocked.img
dd if=/dev/block/bootdevice/by-name/config of=/sdcard/dump_unlocked/config_unlocked.img
dd if=/dev/block/bootdevice/by-name/DDR of=/sdcard/dump_unlocked/DDR_unlocked.img
dd if=/dev/block/bootdevice/by-name/devinfo of=/sdcard/dump_unlocked/devinfo_unlocked.img
dd if=/dev/block/bootdevice/by-name/factory of=sdcard/dump_unlocked/factory_unlocked.img
dd if=/dev/block/bootdevice/by-name/factorybak of=sdcard/dump_unlocked/factorybak_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsc of=/sdcard/dump_unlocked/fsc_unlocked.img
dd if=/dev/block/bootdevice/by-name/fsg of=/sdcard/dump_unlocked/fsg_unlocked.img
dd if=/dev/block/bootdevice/by-name/hyp of=/sdcard/dump_unlocked/hyp_unlocked.img
dd if=/dev/block/bootdevice/by-name/hypbak of=/sdcard/dump_unlocked/hypbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/keystore of=/sdcard/dump_unlocked/keystore_unlocked.img
dd if=/dev/block/bootdevice/by-name/misc of=/sdcard/dump_unlocked/misc_unlocked.img
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/dump_unlocked/modem_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/dump_unlocked/modemst1_unlocked.img
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/dump_unlocked/modemst2_unlocked.img
dd if=/dev/block/bootdevice/by-name/oem of=/sdcard/dump_unlocked/oem_unlocked.img
dd if=/dev/block/bootdevice/by-name/persistent of=/dump_unlocked/sdcard/persistent_unlocked.img
dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/dump_unlocked/persist_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpm of=/sdcard/dump_unlocked/rpm_unlocked.img
dd if=/dev/block/bootdevice/by-name/rpmbak of=/sdcard/dump_unlocked/rpmbak_unlocked.img
dd if=/dev/block/bootdevice/by-name/sbl1 of=/sdcard/dump_unlocked/sbl1_unlocked.img
dd if=/dev/block/bootdevice/by-name/sec of=/sdcard/dump_unlocked/sec_unlocked.img
dd if=/dev/block/bootdevice/by-name/splash of=/sdcard/dump_unlocked/splash_unlocked.img
dd if=/dev/block/bootdevice/by-name/ssd of=/sdcard/dump_unlocked/ssd_unlocked.img
dd if=/dev/block/bootdevice/by-name/tz of=/sdcard/dump_unlocked/tz_unlocked.img
dd if=/dev/block/bootdevice/by-name/tzbak of=/sdcard/dump_unlocked/tzbak_unlocked.img
echo “Finished Partition Backup!”

Again, the script will take approx. 6 mins to complete. You can close terminal seession once the script completes (i.e. ~6mins)
You should see a folder with name “dumps-unlockedbl” in your internal memory having many .img files. Copy it to external storage and also to cloud storage.

Facing issues or didn’t understand something? Here’s a video Tutorial

We may be able to relock bootloader if you send us your partition backups. So compress together “dumps-lockedbl” and “dumps-unlockedbl” folders. Zip name should be “Partitions_YourXdaUsername”. Upload to any reliable cloud storage (preferable your google drive). PM me a link to your file, DO NOT POST A LINK IN COMMENTS SINCE YOUR BACKUP CONTAINS SENSITIVE INFORMATION. Don’t worry, we won’t misuse it, you can trust me on that


Post your results in the following format-
1. Device model:
2. Soc/Chipset:
3. SKU:
4. Output of “fastboot oem device-info” or BL Status :

Source: XDA(posted by sziraqui)

Liked This Post ?

Think how much you can learn with more such posts..Get updated in your inbox right away.

Thank you for subscribing.

Something went wrong.


Please enter your comment!
Please enter your name here