$Id: a07cf90837a3c4373b82d6724b97593810766af7 $
I handed the phone back to the customer the next morning. His eyes widened as he swiped through the setup. "No password?" he asked. "No lock," I replied. "But tell your daughter: never lose her passwords again. And don’t update the software."
That’s when I stumbled upon a post in a forgotten GSM forum. The title read: "AQM-LX1 Huawei ID Remove – No Box, No Auth, 100% Tested." The author, a user named Mediatek_Hacker , had posted a strange tool with a generic icon: "HuaweiID_Remover_AQM_v2.0.exe." Aqm-lx1 Huawei Id Remove Unlock Tool
My heart raced. I downloaded the tool—only 8 MB. My antivirus screamed "Trojan! Delete now!" But I paused the protection. This was the dance of the repair technician: risk vs. reward. I handed the phone back to the customer the next morning
He paid $40 and left happy.
I took the device. The screen was flawless, but the setup screen read: "This device is locked. Please log in with the original Huawei ID to continue." I knew the AQM-LX1 (also known as the Huawei Y6p or similar entry-level model) was a stubborn beast. It ran on a MediaTek chipset, which was good news—MediaTek devices often had backdoor engineering ports. But Huawei’s ID lock? That was a fortress. "No lock," I replied
The tool had done what expensive boxes (like the Easy JTAG or Octopus Box) could do, but for free. It exploited a known vulnerability in the AQM-LX1’s bootloader where the Huawei ID credentials were stored in an unprotected user partition. The tool simply overwrote those bytes with zeros, then tricked the phone into thinking the ID was never set.
Yes, I broke it on purpose for this demonstation!↩︎