If you have an Android phone that has a screen lock code set, you can bypass the PIN, password, or gesture, and unlock the phone by following these simple steps.
Bypassing the unlock code
Phone has USB debugging enabled
- Install the Android SDK on your Windows, Mac OS X, or Linux computer.
- Plug your phone into the USB port
- Locate the adb binary in your SDK
- adb shell cat /dev/null > /data/system/password.key
- adb shell cat /dev/null > /data/system/gesture.key
Phone has USB debugging disabled (default)
- Get the software from your phone manufacturer for flashing (Heimdall/Odin on Samsung phones)
- Put phone into download mode
- Install a custom recovery console like ClockworkMod (CWM)
- Use the recovery console to overwrite the files from steps 4 & 5 in the above procedure
Device data security tips
- Don’t leave USB debugging on
- Don’t install a recovery console that isn’t password protected
- Use a strong screen lock password
- Encrypt the contents of your SD card (and phone if possible)
- Don’t install any apps you don’t trust
- Set a credential storage password if credentials are stored
- Install a device recovery app
- Don’t let me near your device
This isn’t meant to be an exhaustive article. I was challenged last week by my girlfriend to bypass the unlock code on her phone. It would have been easy if she had USB debugging enabled. It was only slightly more difficult that she didn’t have it enabled, because she had a custom recovery console that was not password protected that allowed me to update files. If your phone has not been rooted and doesn’t have a custom recovery console, this will be more difficult.
This was tested on Android 2.2.1 where an empty password or gesture file results in a successful auth check.