Modern Android phones check the FRP status via the baseband processor. New tools like GSM Flasher Box and Octoplus Box use . They send a malformed USSD code ( *#0*# etc.) via the Cell antenna that forces the kernel to grant root shell access.