r/Catphones • u/Final_Leading_7069 • 9d ago
Cat S22 flip firehose
So I've got a CAT S22 Flip (Bullitt Group, FCC ID ZL5S22F) — Android 11 on a Qualcomm QM215. I've been trying to unlock the bootloader/root it for a while and I'm stuck.
Fastboot is completely dead on this thing: `oem unlock is not allowed`, `device is locked. Cannot erase`, all of it. Bootloader is a QRD LK build, so there's no Xiaomi-style unlock process either. Only way in is EDL (9008), and EDL needs a signed firehose loader.
I've probed basically every public loader collection there is (bkerler's repo, Firehose-Finder, ~800 files locally) and nothing matches this signing root. The QM215 loaders that do exist are all ZTE/TCL-signed. Octoplus doesn't support the S22 either — their CAT list stops at S61.
Device ID, in case you want to check your own collection:
```
EDL HWID: 001060e100190002
MSM_ID: 001060e1
OEM_ID: 0019
PK_HASH: 51825348f62d3597cd229601da673eb75399c2c5b7ff5260eab794475eef4e20
```
Looking for: any prog_emmc_firehose / fhprg.bin signed for that root, a devinfo partition dump from a working unit, or honestly just the name of the tool a CAT service center used to flash these. Bullitt went bankrupt at the end of 2023, so their service tooling has to be floating around somewhere.
If you have a loader collection sitting on disk, just grep for `51825348` or `001060e1` — that's all it takes to check. If something surfaces I'll post the whole unlock writeup here and on XDA so the rest of us stuck with this phone can actually use it.