About / Unbolt Inc.
A small independent lab. We root our own Android hardware, publish the tools we use, and write down what actually happened — including the parts that did not work.
what unbolt is
Unbolt Inc. is a research outfit, not a store. We take retail Android phones — the ones with the bootloader locked and the interesting parts hidden — and work out how they boot, what signs what, and where the locks actually live. Then we build the tools that make that knowledge usable: firmware downloaders, a rooting toolkit, a theming suite, a launcher.
The work started with one phone: a Galaxy Z Fold 6 (SM-F956B, q6q, Snapdragon 8 Gen 3)
whose OEM-unlock toggle vanished after an update. Rather than repeat forum folklore, we dumped the
boot chain — xbl, abl, TrustZone, vbmeta — and read it. That
turned into a device wiki of 274 device pages across 16 brands (5 lab-verified), a reference map of the
Android boot chain, and four shipping tools plus one in progress.
Everything we publish is free and GPL-3.0. There is no account, no paid tier, no “pro” build, and no support contract. If a page here helps you open a phone you already own, it did its job.
the tools
One job each, no overlap by accident. Full artifacts, sizes and hashes on downloads.
| tool | what it does | current | where |
|---|---|---|---|
| Orbit | Samsung firmware straight from FUS — full speed, no login, per-partition extraction and decrypt. | 2.1.4 | download · docs |
| RootForge | Profiles the connected phone and ranks every rooting route for that exact build, then fetches the right files. | 2.4.7 | download |
| PolyQon | One UI theming without a custom ROM: colour slots, quick settings, clock, battery, edge lighting, boot animations. | 0.2.21 · module 0.3.5 | download · docs |
| Unbolt Hub | The control panel: device dashboard, tool launcher, update checks and PolyQon accent sync in one app. | 0.6.6 | download |
| Unbolt Home | A launcher with One UI feel and Nova depth, built on Launcher3. 0.13.3 is release-signed and running on our Fold 6. | 0.13.3 · beta | download · docs |
principles
We root hardware we own or have written permission to touch. We do not unlock someone else's phone, bypass a lock you cannot prove is yours, or run a remote-unlock service. The second Fold 6 in the lab is a read-only donor: firmware and partition dumps, never a flash.
Every tool is GPL-3.0-or-later, including Unbolt Home; its upstream Launcher3/Lawnchair parts keep their Apache-2.0 notices and full source is published for each tag. Ports and ideas are attributed on the credits page — if we missed you, it gets fixed.
No analytics SDK, no crash reporter, no advertising ID, no account. The apps make exactly the calls you can see: an update check against this site's manifest, a firmware download you start, and the Hub's public view counter. This site sets no cookies.
Nothing here is sponsored, gated, or “free for now”. There is a donate page if you want to keep the lab running; it buys nothing and unlocks nothing.
Too many Android rooting tools take public exploits or leaked Qualcomm loaders, wrap them in encrypted containers, and charge a rental fee to use them. We got tired of hitting paywalls while trying to root our own Fold 6, so we started writing our own GPL-3.0 tools and publishing our notes for free.
What we are not: an unlocking service, a repair shop, a ROM kitchen, or a source of pre-rooted firmware for someone else's device. If a request needs a phone we cannot hold, we say no.
how we test
A release is not “done” because it compiles. The order is always the same:
- Real hardware first. Every build is installed on the lab Fold 6 — daily driver, bit 4, bootloader locked — before it is published. No emulator-only releases.
- State the risk, then the recovery. Before a step that can brick or wipe, the recovery path is written down and tested: which partition image, which mode, which command.
- Verify the claim. If a page says a flag changed, we show the before/after dump.
If a tool says root is active, it runs
suand shows the uid. Screenshots come from the device, not a mockup. - Second device for reads. The bit-2 Fold 6 is used to compare firmware and partition dumps against the bit-4 phone — read-only, no writes, no leftover files.
- Cloud coverage. UI and compatibility runs go through TestingBot (Android 13–17) and Samsung Remote Test Lab (One UI 9) when a physical device is not available.
- Publish the receipt. Every artifact ships with its byte size and MD5 in versions.json, and the same numbers are printed on the download card.
the device lab
The lab is deliberately small: two phones, a Linux workstation, and a lot of logs.
| role | hardware | state |
|---|---|---|
| exploit test state | Galaxy Z Fold 6 SM-F956B · q6q · Snapdragon 8 Gen 3 · F956BXXS4DZI1 (Sept 2026 patch, bit 4) |
bootloader locked · active per-boot root via CVE-2026-43499 + KernelSU-Next (0x400 slab stride build) |
| firmware analysis image | Galaxy Z Fold 6 SM-F956B · F956BXXU4EZIH (One UI 8.5 / bit 4) |
offline abl.elf UEFI decompression, partition diffing, PolyQon One UI 8.5 verification |
| read-only donor | Galaxy Z Fold 6 SM-F956B · bit 2 firmware |
stock, unmodified — dumps and comparisons only |
| workstation | Linux · adb, fastboot, Heimdall, Odin, lz4, Ghidra | builds, packages, signs, hashes |
The Fold 6 story is the whole reason this site exists. Samsung shipped the phone with an OEM-unlock
toggle, then an update hid it. The common answer was “Samsung removed the unlock code”. That is
wrong: the code is still in the bit-4 abl. A single boot flag,
androidboot.other.locked=1, hides the row. With temporary root,
resetprop -n ro.boot.other.locked 0 brings it back — and tapping it really does set the
unlock request. It still does not unlock the phone: Download Mode refuses, because the decision is a
one-way QFPROM fuse written in TrustZone. The full map, the dumps and the dead ends are in
the Android reference and on the live status page.
That is also why root here is temporary: KernelSU-Next through a kernel exploit, re-applied after each reboot, with the bootloader still locked. It is honest about what it is, and it is enough to do real work.
timeline
The reference goes up
The Android boot-chain map, the unlock-gate anatomy, the partition tables and the hashed artifacts from our own phone are published as one reference. The device wiki passes 274 device pages across 16 brands (5 lab-verified).
Orbit, RootForge and PolyQon ship quietly
First public builds: a FUS firmware downloader, a rooting toolkit, and a One UI theming
suite. Linux .deb and Windows .exe, no installer tricks, no
bundled offers.
The OEM-unlock row comes back — the gate does not
On the bit-4 Fold 6 the hidden Developer-options row is restored with temporary root and the unlock request is set. Download Mode still refuses and the bootloader stays locked; the write-up names the fuse, the TrustZone call and the KnoxGuard state as the remaining gate. Same day: Unbolt Home enters production.
Tool refresh and a rebuilt downloads page
RootForge 2.4.5, PolyQon 0.2.19 with module 0.3.5, and Unbolt Hub 0.6.3 (release-signed APK). The downloads page is rebuilt around per-tool cards with screenshots, sizes and hashes.
Unbolt Home, in public
The launcher is at 0.10 internally — One UI preset, vertical drawer, dock pages, PolyQon theme sync. It ships when it is stable on the Fold 6, not before. Follow the log.
contact & community
Questions, corrections, a device we are missing, or a credit we got wrong: getbackyahroots@gmail.com. Bug reports are fastest with the model, build, region, the exact command, and the exact error.
The unlock state of the lab phone, the current build, and what changed last — updated as we go.
Open the status page →XDA, Reddit and the build-log threads — links and ground rules in one place.
Open the community page →Documented a device we are missing? Send the model, build and what worked.
Submit a device →feedback
Spotted a bug, or got a feature you want? Leave a note — it drops straight into our inbox.