PotatoNV unlocks the bootloader on Huawei/Honor devices with HiSilicon Kirin SoCs using the testpoint (download-VCOM) method.
This is a fork of PotatoNV that adds a native Linux port (.NET 9 + Avalonia UI) plus an Arch/CachyOS
PKGBUILD. Original tool by mashed-potatoes (fork by kitsuned); Linux port and packaging by Redminote11tech. Licensed GPL-3.0-or-later.
Warning
The Linux port is experimental. It builds, runs, detects devices and drives the full flashing flow, but it has not yet been verified end-to-end on real Kirin hardware — treat it as beta and expect rough edges. See Linux port status for feature parity and caveats.
Arch / CachyOS — build and install the package:
git clone --recursive https://github.com/Redminote11tech/PotatoNV-Linux.git
cd PotatoNV-Linux
makepkg -siOther distributions — build from source with the .NET 9 SDK. See
PotatoNV.Avalonia/README.linux.md for the full guide.
After installing, activate the udev rule so the device is usable without root, then re-plug it:
sudo udevadm control --reload-rules && sudo udevadm triggerLaunch with potatonv (or from your application menu).
For Windows, use the original tool — download it from the upstream releases.
The port targets 1:1 parity with the Windows build. The unlock logic, the fastboot protocol, the serial framing and the CRC are shared code, unchanged; only the platform layers (GUI, USB enumeration, hotplug) were reimplemented for Linux.
Warning
This has not been tested against real Kirin hardware yet, so it may be unstable. The flashing handshake and the serial ACK timing in particular can only be validated on a device — please open an issue with logs if something breaks.
| Capability | Windows | Linux | Notes |
|---|---|---|---|
| GUI | ✅ WPF | ✅ Avalonia | Same layout and controls |
| Bootloader flashing (download-VCOM) | ✅ | ✅ | System.IO.Ports, /dev/ttyUSB* |
| Fastboot NV read/write & unlock | ✅ | ✅ | LibUsbDotNet 3.x / libusb-1.0 |
| Device detection | ✅ WMI | ✅ sysfs scan | VID/PID 12d1:3609 and fastboot 18d1:d00d |
| Hotplug refresh | ✅ events | 1 s poll instead of WMI device events | |
| Save logs | ✅ | ✅ | File ▸ Save logs… |
| Bundled bootloaders | ✅ | ✅ | shipped in bootloaders/ |
- USB permissions are required. Without the bundled udev rule, libusb fails
with
LIBUSB_ERROR_ACCESS. On Arch/CachyOS the device group isuucp— there is noplugdevordialoutgroup. - Serial timing — the download-mode ACK timeouts are carried over verbatim from Windows; Linux serial buffering differs slightly, so this is the most likely place to need tuning on real hardware.
- Download-mode node — assumes the kernel exposes the testpoint device as
/dev/ttyUSB*or/dev/ttyACM*; on some kernels the USB-serial driver may need to be bound manually. - Only
linux-x64is exercised; other architectures should build but are untested.
Full build/packaging details: PotatoNV.Avalonia/README.linux.md.
Follow the video guide or read the manual below.
- Are you sure you're actually using a Huawei/Honor device?
- Open the Settings → About phone. Check the CPU: it should be HiSilicon Kirin ***. If it is not your case (MediaTek, Qualcomm), then alas, your device is not supported. :(
- Okay, now you know CPU model. It should be one of these modification:
- Kirin 620
- Kirin 650
- Kirin 655
- Kirin 658
- Kirin 659
- Kirin 925
- Kirin 935
- Kirin 950
- Kirin 960
- 100% incompatible CPUs with PotatoNV: Kirin 710, 710A, 710F, 810, 970, 980, 985, 990 & newer.
- As for Kirin 710, 710F, 970 & 980, there is an alternative option — see the "Alternatives" section below.
The first step is the most difficult thing to do. You need to disassemble your device: this is necessary in order to access the contacts on the motherboard.
If you're not sure that you have enough experience to disassemble the device, then consider using paid software, that supports "software testpoint".
Warning
I strongly recommend watching video manuals for disassembling your device.
Warning
Be extremely careful with planar cables!
These cables are used in tablets, as well as in phones with a fingerprint scanner on the back cover.
You will need: a hair dryer, a guitar pick or a plastic card, conductive tweezers and maybe a screwdriver.
- Turn off the device.
- Heat the back cover evenly with a hair dryer.
- After a couple of minutes, try to stick the plastic card into the corner between case and lid, try to lift the edge and then deepen the card.
- Move around the perimeter of the back cover, peeling off glue.
- Now you can remove the back cover.
It's time to Google. You need to find the location of a special point on the motherboard – testpoint.
Note
If you are wondering why you need to do something with the unfortunate testpoint, then read the contents of the spoiler below.
To search, use the model name before the hyphen + "testpoint". For example for Honor 9 Lite (LLD-L31) you should Google "lld testpoint".
An example how a typical testpoint photo looks like.
The marks may vary:
- Only one point is marked in the photo.
- In the photo, a line is drawn between the point and the metal shield.
- In the photo, a line is drawn between two points.
Here you will need sleight of hand: try to short-circuit the point and the metal shield (in option 1 and 2), or short-circuit both points (option 3) with tweezers. Without removing the tweezers, connect the USB cable to the computer.
After 3 seconds, the tweezers can be removed.
Check that the device enumerated:
- Windows: open the "Device Manager" – you should see an unknown device named
USB SER, or Serial PortHUAWEI USB COM 1.0. - Linux: it appears as
/dev/ttyUSB*(verify withls /dev/ttyUSB*ordmesg | tail), and PotatoNV lists it automatically in the Target device dropdown.
If the device has not been detected, make sure you are using a good cable, the tweezers are not a dielectric, and you are shorting the desired point.
On Windows:
- Install HiSuite.
- Install Huawei Testpoint Drivers.
- Download the latest release of PotatoNV and start it.
On Linux:
- No HiSuite or vendor drivers are required — the kernel exposes the device directly.
- Install PotatoNV (see Download & install) and run
potatonv.
Note
All bootloaders are flashing to RAM, so an incorrect bootloader cannot harm the device.
Note
Disable FBLOCKcheckbox disables a special security check. That modification allows you to flash/erase secure partitions or execute oem commands, that are not available with normal unlocking by unlock code [USERLOCK].
Warning
FBLOCKunlocking works correctly only on devices with Kirin 960 or Kirin 65x. Disabling this option can cause serious problems on legacy devices.
Okay, now refer to this table and select the appropriate bootloader.
Press the Start button. 🪄
The procedure will take no more than a minute. The program should write a new unlock code, keep it in a safe place.
Reboot your device to fastboot mode and execute following command on the host machine:
fastboot oem unlock YOUR_CODE_HEREhave fun.
Details
Even before creating PotatoNV, @TishSerg discovered that unlock key can be rewritten with the SHA256 hash of the desired key to the USRKEY property. However, to access NVME (a raw partition that stores stuff like serial number, device traits, etc.), a user should flash custom recovery or gain temporary root privileges. But both methods are complex and are not guaranteed to work. After researching the legacy bootloader of some Huawei devices, I've found a nve command, which allows to read or write any property in the NVME partition. Of course, this command requires an unlocked bootloader.
So it remains to find a way to quickly unlock the bootloader. The way out is quite simple - use the bootloader from the board software.
The program uploads a special "USB bootloader" (exported from the board software) through the DOWNLOAD_VCOM mode. VCOM is smth like EDL on Qualcomm devices: it can be triggered by a system failure or by shorting testpoint.
After uploading the bootloader, the device should switch to the fastboot mode. The "USB bootloader" has an important trait: it's unlocked out-of-the-box, so it allows to execute any command.
So, we're just going to send a command through the USB bulk interface to write SHA256 hash to USRKEY and reboot the device.
That's it.
| Device | Model | Bootloader |
|---|---|---|
| Huawei P8 Lite (2015) | ALE |
Kirin 620 |
| Huawei Y6II | CAM |
Kirin 620 |
| Honor 5C / 7 Lite | NEM |
Kirin 65x (A) |
| Honor 6X | BLN |
Kirin 65x (A) |
| Honor 7X | BND |
Kirin 65x (A) |
| Honor 9 Lite | LLD |
Kirin 65x (A) |
| Huawei MediaPad T5 | AGS2 |
Kirin 65x (A) |
| Huawei Nova 2 | PIC |
Kirin 65x (A) |
| Huawei P10 Lite | WAS |
Kirin 65x (A) |
| Huawei P20 Lite / Nova 3e | ANE |
Kirin 65x (A) |
| Huawei P8 Lite (2017) | PRA |
Kirin 65x (A) |
| Huawei P9 Lite | VNS |
Kirin 65x (A) |
| Huawei Y9 (2018) | FLA |
Kirin 65x (A) |
| Huawei MediaPad M5 Lite | BAH2 |
Kirin 65x (B) |
| Huawei Nova 2i / Mate 10 Lite | RNE |
Kirin 65x (B) |
| Huawei P Smart 2018 | FIG |
Kirin 65x (B) |
| Honor 6 Plus | PE |
Kirin 925 |
| Honor 7 | PLK |
Kirin 935 |
| Huawei P8 | GRA |
Kirin 935 |
| Honor 8 Pro / V9 | DUK |
Kirin 950 |
| Honor 8 | FRD |
Kirin 950 |
| Huawei P9 Standart | EVA |
Kirin 950 |
| Honor 9 | STF |
Kirin 960 |
| Huawei Mate 9 Pro | LON |
Kirin 960 |
| Huawei Mate 9 | MHA |
Kirin 960 |
| Huawei MediaPad M5 | CMR |
Kirin 960 |
| Huawei Nova 2s | HWI |
Kirin 960 |
| Huawei P10 | VTR |
Kirin 960 |
Kirin-Tool is a tool capable of unlocking the bootloader on the following devices:
- Kirin 710 / 710F
- Kirin 970
- Kirin 980
It is available free of charge. Supports additional features such as free rebranding for Kirin 980 devices.
Only works on EMUI 9.1 and below.
- Website: https://kirintool.cfd
- Support: https://t.me/kirintoolsupport
Supports a wide range of devices across multiple chipsets (Kirin, MediaTek, and Qualcomm) released up to 2021. The product is no longer actively updated, but it still performs reliably.
The most affordable license plan provides 3 days of access for €19.
See supported models by HCU Client here.
Note
Timed licenses locked to first used PC for two days. Therefore, it would be problematic to use such a license on more than one phone.
Disclaimer: I am not affiliated, associated, authorized, endorsed by, or in any way officially connected with UAB Digiteka, or any of its subsidiaries or its affiliates, including DC-Phoenix and HCU Client.
Logo by Icons8.
All bootloaders are Huawei Technologies Co., Ltd. property.
This project is not affiliated with Huawei.
Bootloader unlock tool for Huawei devices on Kirin SoC. Copyright (C) 2019-2020 mashed-potatoes
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.
Thank you, Martin, Moisés, Tibor, Emanuele & all those I've forgotten (sorry!).