Sealing the System After Repair (Relock bootloader on Google Pixel)

You have accomplished the difficult task. Your Google Pixel, which might have been a paperweight with an IMEI 0 error or a non-functional brick, is now alive and working. This is a technical victory. However, a major vulnerability remains: The Bootloader is Unlocked.

An unlocked bootloader is a serious, open gate into the heart of your phone’s security. It means your Pixel is failing basic security checks constantly. That annoying, persistent message—“Your device is corrupt,” or “The bootloader is unlocked”—is the phone’s security system telling you the device is not safe for daily use.

Relocking the bootloader is not optional; it is the mandatory final step to complete your repair. This process is how you restore the phone to a factory-secure state, fixing all the security and functionality issues that come with an open bootloader. This single operation will restore your phone’s integrity:

• It makes all your financial applications—Google Pay, Netflix, banking apps—work again by satisfying security checks.

• It permanently removes the annoying, constant security warnings at boot-up.

• It activates Verified Boot, which is Google’s core security layer, drastically improving long-term stability and security against malware.

This comprehensive, technical guide will walk you through the precise, multi-stage process of relocking the bootloader on any modern Google Pixel. We will focus intensely on the critical steps involving the stock firmware flash, which is the only way to ensure the lock command succeeds and you avoid the common, frustrating “Invalid Android Image” error.

The Technical Necessity: Why You Must Relock Bootloader on Google Pixel

When you perform an IMEI repair or flash custom firmware, you break the security chain that Google calls Verified Boot.

• Verified Boot: This system uses cryptographic checksums to check every single partition—the bootloader, the system, the kernel, and the vendor partitions—against a signature that only Google holds. If even one file is changed (which happens when you install Magisk, a custom ROM, or use repair software), the checksum is altered.

• The Unlocked State: An unlocked bootloader allows the phone to ignore these broken checksums. This lets you run modified code (like your repair software or a custom ROM), but it also means the system’s security integrity is completely compromised.

• The App Block: Applications, especially banking apps, use the Google Play Integrity API to ask the phone: “Is the bootloader locked, and does the software match the factory signature?” When the answer is “No,” the app refuses to run. Relocking the bootloader restores all the original checksums, fixes the signatures, and allows the security check to pass. This is the only way to restore full app functionality and make your device safe for financial use again.

The Preparation Phase: Assembling Your Tools and Setting Up the Environment

Before running any commands, you must prepare your computer and your phone meticulously. Any failure in this phase guarantees a roadblock later.

Step 1: Download and Prepare Required Tools

You need three essential components. Download them and place them in a dedicated folder.

1. ADB & Fastboot (Platform Tools):

   • What it is: This is the command-line interface provided directly by Google to communicate with your Android device. We are only interested in the fastboot.exe executable. This tool talks to the phone when it is in Bootloader Mode.
   • Why it’s crucial: The final, irreversible command—fastboot flashing lock—can only be executed by this official program.
   • Action: Download the latest ZIP file and extract it to a short, simple path on your primary drive. Example: C:\platform-tools. Avoid long folder names or the Downloads folder. This ensures the command prompt can always find the executable.

2. Google USB Drivers (The Communication Bridge):

   • What it is: These are specialized drivers for Windows that allow your computer to see and talk to the Pixel in its different modes: normal mode (ADB) and the critical flashing mode (Fastboot).
   • Why it’s crucial: Many computers have generic drivers that work for charging but fail completely when the phone enters the low-level Fastboot Mode. If the driver is wrong, the fastboot devices command will show nothing, and you cannot proceed.
   • Action: Download and install the official drivers. If you have trouble, you will need to manually force the driver installation in Windows Device Manager.

3. Stock Firmware for Pixel (The Factory Blueprint):

   • What it is: This is the complete factory image (a large ZIP file) released by Google. It contains every single system file for your phone model, including the core partitions like boot.img, system.img, and the vital flash-all.bat script. Get the Fastboot Factory Firmwares from here official source
   • Why it’s crucial: You must flash this clean, signed factory software before you run the lock command. Flashing this wipes out all remnants of the repair tools or custom code, setting all those security checksums back to their original, verified state. Do not use mismatched firmware. Ensure the build number you download is the latest available for your phone model.

Step 2: Preparing the Phone – Developer Options and USB Debugging

We need to make sure the software side of your Pixel is ready to accept commands from the PC.

1. Enable Developer Options:

   • Go to Settings > About Phone.
   • Scroll down to the Build Number entry.
   • Tap this entry rapidly 7 times until a small message confirms: “You are now a developer!” This unlocks the hidden menu we need.

2. Access Developer Options and Toggles:

   • Go back to Settings > System > Developer Options. This is the secret control panel you just unlocked.

3. Enable USB Debugging:

   • Find the USB Debugging toggle and switch it ON. This allows your PC to send ADB commands while the phone is booted. While we will primarily use Fastboot, enabling this is a developer best practice and can help with early connection tests.

4. Confirm OEM Unlocking Status:

   • Look at the OEM Unlocking toggle. Since your bootloader is currently unlocked, this option will be greyed out and should be set to the “enabled” position. If it were disabled, the phone would have blocked the original unlock process. We simply confirm it is in the correct state for the final lock command.

Step 3: Entering the Critical State – Fastboot Mode and PC Setup

This step moves the phone into the low-level state where the PC can perform the required flashing commands.

1. Power Off Completely: Do not just reboot. Press the Power button and select Power Off. The device must be shut down fully before entering the Bootloader.

2. Boot into Fastboot Mode: This requires a physical key combination.

   • Press and hold the Volume Down button.
   • While holding Volume Down, press and hold the Power button.
   • Continue holding both keys until the black/white screen with the Android logo appears. This is the Fastboot Mode (also called the Bootloader).

3. Connect and Open Command Line:

   • Connect your Pixel directly to the PC using a known good USB cable (avoiding hubs).
   • On your PC, open your C:\platform-tools folder.
   • Click in the folder’s address bar at the very top, type CMD, and hit Enter. This opens the command prompt window exactly in the required directory.

4. Verify Connection: Before you do anything else, you must prove the PC can see the phone.

   • In the command prompt, type: fastboot devices
   • Expected Output: You must see a serial number followed by the word fastboot (e.g., 987654321 fastboot). If you see a serial number, you are good to go. If the command returns nothing or says 'fastboot' is not recognized..., you failed Step 1 (the driver/path is wrong), and you must stop and fix that issue immediately.

The Execution Phase: Flashing Clean Firmware and Relocking

This is the main action. We are running a mandatory cleaning step before the final lock command. Do not skip Step 4.

Step 4: Mandatory Clean-Up – Flashing Stock Firmware

This step is the absolute key to success. You must use the official flash-all.bat script to restore the factory checksums to the partitions. If you skip this, the lock command will fail with the “Invalid Android Image” error.

1. Extract the Firmware Package: Take the large Stock Firmware ZIP file you downloaded and extract its full contents directly into your C:\platform-tools folder. Your folder will now contain the fastboot.exe, the flash-all.bat script, and all the system image files (like boot.img, system.img, etc.).

2. Understanding flash-all.bat: This is a simple script that automates a long series of fastboot flash commands. It writes clean data to the boot, vendor, and system partitions. However, by default, it includes one dangerous flag we must remove.

3. Critical Modification: Removing the Data Wipe Flag:

   • Right-click on the flash-all.bat file in your folder and open it with a simple text editor like Notepad.
   • Look at the very last line of the script. It usually contains the command that actually installs the software. This line will contain the argument -w.
   • The -w flag stands for “Wipe data.” It forces a factory reset on the /data partition. We want to clean the system without wiping your precious user data (photos, apps, settings) if possible.
   • Action: Find the -w in the last line of the script and delete it completely. Save the flash-all.bat file and close Notepad.
   • Technical Note: Because the system partitions (boot, system) are clean, the phone will not force an immediate data wipe. However, the final fastboot flashing lock command will still force a data wipe for security reasons. By removing the -w here, you avoid two data wipes.

4. Executing the Flash Script:

   • Ensure your Pixel is in Fastboot Mode and connected.
   • Ensure your command prompt is open in the C:\platform-tools folder.
   • Type the command to execute the flashing sequence: flash-all.bat
   • Wait for the Process: The script will now run for several minutes. Do not touch your phone or the USB cable. You will see a lot of text fly by in the command prompt, showing which partition is being erased and then rewritten (flashing boot, flashing system, etc.).

5. Automatic Reboot and Re-entering Fastboot:

   • When the script completes successfully, it will automatically reboot the phone.
   • Wait for the phone to completely boot up to the Android setup screen (to confirm it is working).
   • Immediately shut the phone down again.
   • Boot it back into Fastboot Mode (Volume Down + Power). This is the clean, stable state we need for the final lock command.

Step 5: The Final Act – Relock Bootloader on Google Pixel

Your phone now contains 100% clean, factory-signed software. The system checksums are correct, and the device is ready to be sealed.

1. Verify Connection (Final Check): Run fastboot devices one last time to ensure the connection is stable.

2. Run the Lock Command: This command is the final step that flips the security switch back to “Locked.” fastboot flashing lock

3. Confirm the Lock on Your Pixel:

   • Look at your phone screen. The bootloader is now doing its final integrity check, and it will present you with a severe warning.
   • The prompt will ask you to confirm that you want to Lock the Bootloader. This is your final confirmation that you understand the lock is permanent until you manually unlock it again, and that it will trigger a security wipe.
   • Use the Volume buttons to select the option that says “Lock the Bootloader” (or the corresponding confirmation option).
   • Press the Power button to execute the lock.

4. Wait for Final Reboot: The device will now perform the final security wipe (the mandatory data wipe associated with the lock command), seal the bootloader, and then reboot. The first boot after the relock can be lengthy, as the phone is setting up all its factory security parameters again.

Step 6: Confirming Success – Verification Command

Once your phone boots up and you have completed the initial setup (or restored a backup), you must verify that the lock was successful.

1. Enter Fastboot Mode: Shut the phone down and boot it back into Fastboot Mode (Volume Down + Power).

2. Run the Verification Command: This command asks the bootloader for its current status. fastboot oem device-info

3. Check the Output: You are looking for a clear confirmation message:

   • Success: The output must clearly show a line that says Device unlocked: false (or Device state: locked). This confirms the bootloader is now sealed, and your Pixel is factory-secure.
   • Failure: If it still shows true (or unlocked), the lock command failed, and you must troubleshoot using the next section.

Video Tutorial

Relock Bootloader Requirements & Tools

Common Error Solutions

This Guide Solves Your Biggest Problems

This step-by-step guide is the final fix for system integrity, security, and app problems after a repair or modification. When you search for any of the issues below, this article has the direct answer and the solution.

This complete guide shows you how to use fastboot flashing lock to fix the following critical problems on your Google Pixel:

• Fix Banking Apps: Stops financial apps (Google Pay, PayPal, bank apps) from blocking you because the bootloader is unlocked.
• Remove Security Warnings: Gets rid of the constant, annoying “Your device is corrupt” and “Bootloader unlocked” messages during startup.
• Resolve Flashing Errors: Provides the full, correct steps to bypass the frustrating “Failed (Remote: ‘Invalid Android Image, Skip Locking’)” error that blocks the relock process.
• Restore Play Integrity: Fixes your Pixel’s security status so it can pass the tough Google Play Integrity API checks (which replaced SafetyNet).
• Restore Full OTA Updates: Allows your phone to receive and install future official OTA system updates directly from Google again.
• Seal the System: Relocks the bootloader on models like the Pixel 8 Pro and Pixel 7 after IMEI repair or any deep firmware flash.
• Wipe Custom Traces: Cleans up leftover files from root tools (like Magisk) or custom ROMs that prevent the device from being secured.
• Verify Lock Status: Shows you the exact command to confirm the relock worked and your device is now safe: Device unlocked: false.

Disclaimer

This guide provides detailed technical instructions. While care has been taken to ensure accuracy, any software modification carries minimal risk. By proceeding, you acknowledge that you are solely responsible for the security and integrity of your device and data. Always back up critical information before any flashing or locking operation.