NB1-Collision

NB1-Collision is a bootloader unlock spoofing hack found by Hikari Calyx Tech.

Why that name?
Nokia 8 is the one and only device that the bootloader unlock can be requested officially.

The unlock key itself is actually a signature of your IMEI to tell your bootloader that your phone can be unlocked properly.

Applicable devices

 * Nokia 2
 * Nokia 2.1
 * Nokia 3.1 A & C
 * Nokia 3.1 Plus C
 * Nokia 5
 * Nokia 6
 * Nokia 6.1
 * Nokia 6.1 Plus
 * Nokia 7
 * Nokia 7 Plus
 * Nokia 7.1
 * Nokia X71
 * Nokia 8 Sirocco
 * Nokia 8.1
 * Nokia 9 PureView

And the phone's bootloader service level 0x0008 or the service project code is ***1 (e.g. B2N1, A1N1).

To acknowledge that, you need to use the fastboot.exe came with OST LA and execute: fastboot oem getProjectCode If it returns ***1, then it's applicable. Devices met this condition needn't to meet the condition below.

fastboot oem getSecurityVersion If it returns 0x0008, then it's applicable. Devices met this condition needn't to meet the condition above.

How it works
To ensure NB1-Collision hack will work, we need to change the IMEI written in a specific partition to the IMEI of Nokia 8 you requested. The most possible method of hacking this partition is by using EDL mode, or FTM signature bypass hack. It's strongly recommended to backup this partition before you hack the phone. In this case, the IMEI we used is 004400152020002.

For Nokia 2, Nokia 2.1, Nokia 3.1 A & C, Nokia 3.1 Plus C, Nokia 5 and Nokia 6, it's located at deviceinfo partition, offset 0x2010, like this:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00002010  30 30 34 34 30 30 31 35 32 30 32 30 30 30 32 00  004400152020002. 00002020  xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00  xxxxxxxxxxxxxxx.

For Nokia 6.1, Nokia 6.1 Plus, Nokia 7, Nokia 7 Plus, Nokia 7.1, Nokia X71, Nokia 8 Sirocco, it's located at deviceinfo partition, offset 0x158.

On Nokia 8 Sirocco, IMEI isn't written here, so you need to add yourself.

On Nokia 6.1 Plus sold in India with 6GB RAM (DGI TA-1083), IMEI here is not your actual IMEI, but 00440015202002, so you have to change it to the actual IMEI of Nokia 8.

Like this: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000150  00 00 00 00 00 00 00 00 30 30 34 34 30 30 31 35  ........00440015 00000160  32 30 32 30 30 30 32 00 00 00 00 00 00 00 00 00  2020002......... 00000170  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

For Nokia 8.1 and Nokia 9 PureView, it's located at mfd partition, offset 0x16C. On Nokia 8.1, imei_1 here is empty, which is expected and you need to write proper IMEI yourself here, like this: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 44 66 4D 5F 00 00 00 00 09 00 00 00 73 77 69 64  DfM_........swid 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000060  70 72 6F 64 75 63 74 69 64 00 00 00 00 00 00 00  productid....... 00000070 50 4E 58 47 41 4D 30 31 32 33 34 35 36 37 38 39  PNXGAM0123456789 00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 000000A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 000000B0 10 00 00 00 62 74 5F 6D 61 63 00 00 00 00 00 00  ....bt_mac...... 000000C0 00 00 00 00 xx xx xx xx xx xx xx xx xx xx xx xx  ....xxxxxxxxxxxx 000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000100 00 00 00 00 0C 00 00 00 77 69 66 69 5F 6D 61 63  ........wifi_mac 00000110 00 00 00 00 00 00 00 00 xx xx xx xx xx xx xx xx  ........xxxxxxxx 00000120 xx xx xx xx 00 00 00 00 00 00 00 00 00 00 00 00  xxxx............ 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 00000150  00 00 00 00 00 00 00 00 0C 00 00 00 69 6D 65 69  ............imei 00000160 5F 31 00 00 00 00 00 00 00 00 00 00 30 30 34 34  _1..........0044 00000170 30 30 31 35 32 30 32 30 30 30 32 00 00 00 00 00  00152020002.....

After IMEI of this partition got hacked, you can now flash the bootloader unlock key to the phone and perform bootloader unlock, and restore the original partition back.