Publication Date: October 2023 Subject: Mobile Device Security / Forensic Access Device Under Test: HUAWEI Mate 20 Pro (Model LYA-L09, LYA-L29, EMUI 9.1 – 12) Abstract Factory Reset Protection (FRP) is a security feature introduced with Android 5.1 (Lollipop) designed to prevent unauthorized device access after a factory reset. On the HUAWEI Mate 20 Pro, FRP is deeply integrated into Huawei’s EMUI framework. This paper examines the theoretical underpinnings of FRP, documents known vulnerabilities affecting the Mate 20 Pro, and provides a structured methodology for legally bypassing FRP for legitimate purposes (e.g., forensic data recovery, owner credential recovery). All methods discussed require physical device access and are contingent on device software version. 1. Introduction The HUAWEI Mate 20 Pro, powered by the Kirin 980 chipset, shipped with Android 9 (Pie) and EMUI 9.1, later upgradeable to EMUI 12 (Android 10). When a user performs a factory reset from recovery mode or via the settings menu without first removing their Google account, the device re-enters setup and requests the previous account credentials. This lock prevents a thief from using a stolen device. However, legitimate owners may forget their credentials, creating a need for authorized bypass. 2. How FRP Works on EMUI (Huawei Implementation) On the Mate 20 Pro, FRP state is stored in the persistent data partition ( /persist ), specifically within frp.db or frpstate files. The bootloader, upon detecting a factory reset, checks this partition. If a Google account was active pre-reset, the Setup Wizard ( SetupWizard.apk ) enforces credential verification.

| Tool Name | Method | EMUI Version Support | Cost | |-----------|--------|----------------------|------| | | Direct partition write via testpoint (EOM) | EMUI 9–12 | $15/credit | | Octopus Box | Bootloader engineering boot | EMUI 9–11 | $200+ hardware | | GSM Flasher (SST) | Exploit via fastboot oem unlock bypass | EMUI 9–10 | Subscription |

Unlike stock Android, Huawei’s EMUI adds proprietary account checks via integration, though FRP primarily locks to the last synchronized Google account. 3. Legal and Ethical Disclaimer Important: The methods described are for educational purposes, authorized forensic analysis, or legitimate device recovery by the original owner. Unauthorized bypass of FRP on a device you do not own may violate local laws, including the Computer Fraud and Abuse Act (CFAA) in the US and similar legislation globally. The author assumes no liability for misuse. 4. Bypass Methodologies for HUAWEI Mate 20 Pro The effectiveness of each method depends on the EMUI version and security patch date. 4.1. Dialer Code Method (EMUI 9.1 – early 10.0, patch pre-2020) Vulnerability: Setup Wizard does not fully disable the emergency dialer’s accessibility service hook.