I have been sent a couple Motorola store demo device that where legally purchased by a refurbishing company that are still locked by the demo mode MDM device alive software. This lock creates a bunch of problems that prevent the refurbishing of the device.

Security on MDM locked Motorola Phone

• Can not factory reset the device from stock Android recovery
• Can not turn on developer options and usb debugging. Note: some times.
• Can not set a lock screen password Note: kind of true.
• Stuck displaying the demo software on the screen constantly.

Steps to get more access

1. Let the device completely die while powered on.
2. Once dead charge it back up without power it on.
3. On first boot as fast as you can get into settings and turn on developer options.
4. Tapping on developer options in about phone will enable developer options.
5. Once enabled also as fast as you can go into developer options and turn on usb debugging.

Basically you can trying to gain usb debugging before the MDM can load up the policies on the device and block you out. I have had good success with using these methods to again a ADB shell on the device but it does not always work. I have also tested this on Android 11 and 12 Motorola devices.

The fun stuff

Plug the device into your PC and open a adb shell session. All of the following commands are sent from a adb shell session.

pm commands

• pm list packages = (list all apk package names on the device.)
• pm uninstall -k –user 0 com.motorola.ccc.devicemanagement = (uninstall apk)
• pm uninstall -k –user 0 com.hereplusnow.att.da.service = (uninstall apk)
• pm disable -k –user 0 com.hereplusnow.att.da.service = (disable apk)
• pm clear -k –user 0 com.hereplusnow.att.da.service = (clear cache for app)

am commands

• am start -a com.android.settings.SETUP_LOCK_SCREEN = (set lockscreen password.)
• am start -S “com.android.settings/.Settings\$DeviceAdminSettingsActivity” = (open device management screen.)
• am broadcast -a android.intent.action.MASTER_CLEAR = (removes different locks.)
• content insert –uri content://settings/global –bind name:s:device_provisioned –bind value:s:0 = (Tells the device that it has completed provisioning. )

Fastboot commands blocked by administrator

You can flash new firmware to the device but the userdata will not be changed. If you can not get developer options turned on try to flash new firmware and then on first boot repeat the process to turn on developer options and USB debugging.

• fastboot erase userdata
• fastboot erase metadata
• fastboot -w
• fastboot format userdata

After running these commands on some device I am able to then boot to stock Android recovery and the factory reset options has returned. Some device I am able to uninstall apps once that are disable with the pm command. Truly I need more device to test on to really iron out all the bugs but I figured I would put my research out for anyone that might be looking for a solution. Here is a helpful link that you will want to look at for Motorola devices.

If you are able to factory reset the device but it is still locked to FRP then Phonlab is the right place for you. we have lots of methods to clean up this final security problem and get that device fully back to stock firmware.

Any questions please leave a comment below

Rootjunky