I recently picked up a new Google Pixel 9 and Pixel 10 Pro through some carrier promos. Both phones had fantastic prices but also the classic stipulation that the phone is SIM locked to a carrier for a certain period of time – 60 days in my case.
While this SIM lock period isn’t very long, I wanted to see if there was a way to bypass the lock. Whereas bypassing the SIM lock generally isn’t possible on iPhones because of Apple’s implementation, there have historically been a number of Android phones with some sort of implementation shortcoming that makes it possible, or even trivial, to bypass a SIM lock. Google Pixels fall into this category!
Note: This method was tested in November 2025 on Android 16, build number BP3A.251105.015.
Conceptual overview
Unlike iPhones, the SIM lock state on Pixel phones isn’t really persisted anywhere. This is the aspect of Google’s implementation that we can leverage to circumvent the SIM lock. (this also means that the SIM lock status can be removed from the device through trivial software means, such as a factory reset, so it’s easy to try again in case you make a mistake and allow the phone to lock itself.)
On Pixel phones, there’s an app installed by default called Device Setup (com.google.android.apps.work.oobconfig) which implements the SIM lock. I don’t have a full picture of how this app works, but the high-level I’ve deduced looks something like this:
- com.google.android.apps.work.oobconfig is installed during Android setup
- In the background, the oobconfig app queries some database on Google’s side to see if the phone should be SIM locked
- This query does not seem happen until the device is first connected to Wi-Fi, e.g., when the user is prompted while completing Android’s first-time setup wizard. It does not appear to happen immediately if the device is connected to cellular data without Wi-Fi, but will happen eventually in this case
- The SIM lock state retrieved from Google is stored in the oobconfig app’s cache
- Whenever the user tries to install a new (e)SIM or unlock the bootloader, the SIM lock state is checked against the oobconfig app
- The (e)SIM activation or bootloader unlock are allowed or denied according to the SIM lock state
If you’re an experienced Android modder, your mind probably first went to disrupting the oobconfig app by uninstalling or disabling it. This used to be feasible, but is now difficult/impossible because Google has locked down the ability to disable or uninstall this app, both though the device settings and via ADB. As far as I know, the only way to disable/remove the oobconfig app now is using root. But root is not going to work in this case; rooting a Pixel requires the bootloader to be unlocked, which isn’t possible without allowing the oobconfig app to check the SIM lock status with Google. That will, of course, cause the phone to become SIM locked.
Without the ability to directly remove or permanently disable the oobconfig app itself, the next best thing we can do is prevent it from making that query to Google. One common method I’ve seen on XDA forums is to remove the oobconfig app’s permission to run in the background. I think this used to work but something has changed in recent Android versions such that the phone will still re-lock once connected to Wi-Fi.
Making it work
What worked for me was finding a more direct way to make the oobconfig app non-functional, namely through an app-based firewall.
I used an open-source app called NetGuard, which makes it possible to block internet access on a per-app basis. NetGuard doesn’t require root; instead, it uses a persistent localhost VPN connection to enforce the firewall rules. In NetGuard, blocking internet access for the oobconfig app is simple:
- In NetGuard’s advanced settings, make sure the option to select system apps is allowed
- Find the oobconfig app in the app list and block all internet access
- Make sure the NetGuard VPN adapter is enabled (check for the key icon in the Android status bar)
Once NetGuard is enforcing the rule, it should be safe to turn on Wi-Fi and cellular data without having the phone re-lock itself.
There are, however, a few issues I’ve noticed with this method:
- NetGuard does not work with Android’s built-in “Always On VPN” functionality. This issue isn’t well documented but it will manifest itself as a complete loss of internet connectivity if Always On VPN is enabled
- After some time, even with NetGuard in place, it won’t be possible to add any eSIMs other than those issued by the carrier to which the phone is locked. I’m not sure if physical SIMs have the same issue
- The only way to recover the ability to add eSIMs is through a factory reset. Factory resets don’t erase eSIMs by default, so doing a reset is a feasible way to install new SIMs
- Bootloader unlock is still not possible (you will see the “Bootloader unlock is unavailable on SIM-locked phones” message)
- Sometimes this method can be flaky. I had a few cases where the phone would randomly become SIM locked and disable all of my SIMs, but clearing oobconfig’s cache and rebooting seemed to fix it
- Obviously, it isn’t possible to use an actual VPN in conjunction with NetGuard. This may or may not matter to you