A warning about bootloader relocking - E 2015 General

Just a heads up to those who may attempt relocking an unlocked bootloader:
As you probably know, the new Moto E required you to enable bootloader unlocking in the Android developer options menu before you can run the fastboot oem unlock XXXXX command. Unlocking the bootloader wipes the frp partition. Wiping frp restores the default state of OEM unlock disabled. When you relock the bootloader, even if you are already running signed official firmware for your model, the phone will refuse to boot until you reflash the system image. For most models of the Moto E, official firmware has not leaked. Different carriers and regions have different CIDs, even among retail devices, so even signed builds that leak are incompatible across different carriers.
End result: If you are not careful when relocking your bootloader, there is a high risk of soft bricking your device. I made such a mistake today. I just got a new Telus Moto E today, unlocked the bootloader, then relocked it while leaving the software unchanged. Unlocking wiped userdata, disabling re-unlocking. Relocking prevented my phone from booting up till I flashed a signed image that I didn't have, and I could no longer re-unlock either. This soft bricked my phone. Stock firmware signed for my model and region has not leaked. I was able to fix my phone through other means (not available), but for most of you on XDA, your phone would be effectively bricked if you did what I did.
Morals of the story:
Don't relock unless you have a reason to
Make sure you re-enable bootloader unlocking in Android before re-locking
Make sure you have a fastboot flashable official stock image signed to work with your carrier and region before re-locking the bootloader. Currently running the official firmware is not enough.

Is your model a GSM, or CDMA? I have a Boost 4G LTE that I'm having issues unlocking. If you have any ideas on this, hit me in PM so the thread stays on topic.
Peace,
Sox

Dammit, I wish I had seen this before I tried relocking my bootloader!
I'm going to try going through Motorola Customer Service and see where it gets me. I'll keep this thread updated with status: https://forums.motorola.com/posts/dd336f32ff
I did some reverse engineering of the bootloader to try to understand the underlying issues and see if I could find a workaround. See my first post on the above thread (near the bottom of the post) for my findings. In case anyone is curious, I'm attaching the decompiled code (assembly with annotations) from the aboot image in the bootloader. I obtained this by grabbing the XT1524_RETEUALL_MOTOE2 (4G-LTE) _5.0.2_LXI22.50-13_cid7_subsidy-DEFAULT_CFC.xml firmware from here, then running the following on an Ubuntu Utopic (14.10) machine:
Code:
unzip XT1524_*.xml.zip
# The general bootloader.img file format is described here: https://android.googlesource.com/device/lge/hammerhead/+/master/releasetools.py#98
# This bootloader.img is slightly different, but I was able to find the offsets of each section by searching for "ELF" in bootloader.img, and I simply looked at the first 100 bytes or so of bootloader.img to determine the order of the sections in the file
tail -c +520705 bootloader.img > temp
head -c 1048576 temp > aboot.img
sudo apt-get install radare2
radare2 aboot.img
# Within radare:
# Set some options
# Yes, there really is an option named anal.plugin ...
e anal.plugin=arm
e asm.arch=arm
e asm.cpu=arm
e asm.parser=arm.pseudo
e asm.bits=32
# Analyze the file
# This takes a while to run and causes radare to consume over 1GB of RAM
aa
# Find the offset/length of the .text section
S
# This takes even longer to run than 'aa', but only consumes about 100MB of additional RAM
pd 0x00086ba0 @ 0x8f600140 > aboot.asm
# Quit
q

Not sure if this is already common knowledge, but ...
While digging into the bootloader code further, I stumbled across this site where Qualcomm publishes versions of AOSP that are modified to work with various Qualcomm chips: https://www.codeaurora.org/projects/all-active-projects/android-msm
The source released on that site includes bootloader code: https://www.codeaurora.org/cgit/quic/la/kernel/lk
The branches and tags in that git repo are rather cryptic, but the chipset associated with each branch/tag is listed here: https://www.codeaurora.org/xwiki/bin/QAEP/release
(The LNX.LA.* branches/tags are for the msm8916_32 chip in the 2nd gen Moto E.)
It looks like Motorola's bootloader is based on this source code from Qualcomm. Qualcomm's open source implementation of the fastboot command handler is very primitive, so Motorola has replaced it with their own implementation, and it is Motorola's implementation that contains the bugs/misfeatures that cause our re-locking issue. However, much of the code called by Motorola's fastboot implementation is available in Qualcomm's repo, so having Qualcomm's source available makes reverse engineering of Motorola's fastboot implementation much easier.

I finally found a copy of the stock firmware for my phone!
http://forum.xda-developers.com/showpost.php?p=60448421&postcount=27
Flashing the original system image got me up and running again.

Top_Quark said:
I finally found a copy of the stock firmware for my phone!
http://forum.xda-developers.com/showpost.php?p=60448421&postcount=27
Flashing the original system image got me up and running again.
Click to expand...
Click to collapse
Works for me too
MotoE 2015LTE, XT1524,Germany

fxone said:
Works for me, too.
Moto E 2015 LTE, XT1524
Click to expand...
Click to collapse
this thread invigorated my flash lust !
keep us posted, dudes !

Related

How I upgraded my Consumer Cellular Moto G 2014 X1064 to Lollipop

Since I've been lurking all day looking for solutions, I thought I'd share my success story and instructions. I'm a new poster so I can't make links, so I'll do my best to give you an idea if you've got the right link. The fastboot instructions may be a little truncated, so look around if they seem unclear. These are the commands you need to enter, though. I wasn't able to relock my bootloader.
This is for the Consumer Cellular Moto G 2014 X1064. Starting from retail (where you have the Consumer Cellular app):
Unlock the bootloader on Moto's site at motorola-global-portal.custhelp dot com
Download Blur_Version.21.11.17.titan_retuaws.retuaws.en.US from droid-developers dot org slash phone device 36
Unzip that file into your fastboot folder
Enter Fastboot on your phone (how to: hold power and volume down until your device turns off, then hold it another 5-10 seconds, then let go and you should see a basic text screen)
Use these commands on your computer while being in the fastboot folder (I was using a Mac with the quick fastboot/ADB tools and just typed them in Terminal):
fastboot flash partition gpt.bin
fastboot flash motoboot motoboot.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot reboot
You should now be at stock Android 4.4.4 with an unlocked bootloader. No Consumer Cellular app.
Grab the torrent file from the thread titled "[OTA] Moto G 2014 XT1064 v22.11.6" on this subforum. It's on page 8, post #73
Rename that file to something simple like update.zip
Use Android File Transfer or similar (I had a Mac) to put that on the root of your device. It was at the same level as the Downloads folder. If you can see that, you're in the right place.
Reboot into fastboot mode
Select recovery mode (press volume down to highlight it, then volume up to select)
You'll now see an Android guy with a red triangle. Press volume up and power at the same time, let go, and you should be in another text menu.
Select boot from SD card (use volume down to highlight it, then power to select)
Select your update.zip
Wait 20 minutes or so while it works
Select reboot when you're finished
That was enough to get me to Android 5. Good luck everyone!
Janus Kirin said:
Since I've been lurking all day looking for solutions, I thought I'd share my success story and instructions. I'm a new poster so I can't make links, so I'll do my best to give you an idea if you've got the right link. The fastboot instructions may be a little truncated, so look around if they seem unclear. These are the commands you need to enter, though. I wasn't able to relock my bootloader.
This is for the Consumer Cellular Moto G 2014 X1064. Starting from retail (where you have the Consumer Cellular app):
Unlock the bootloader on Moto's site at motorola-global-portal.custhelp dot com
Download Blur_Version.21.11.17.titan_retuaws.retuaws.en.US from droid-developers dot org slash phone device 36
Unzip that file into your fastboot folder
Enter Fastboot on your phone (how to: hold power and volume down until your device turns off, then hold it another 5-10 seconds, then let go and you should see a basic text screen)
Use these commands on your computer while being in the fastboot folder (I was using a Mac with the quick fastboot/ADB tools and just typed them in Terminal):
fastboot flash partition gpt.bin
fastboot flash motoboot motoboot.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot reboot
You should now be at stock Android 4.4.4 with an unlocked bootloader. No Consumer Cellular app.
Grab the torrent file from the thread titled "[OTA] Moto G 2014 XT1064 v22.11.6" on this subforum. It's on page 8, post #73
Rename that file to something simple like update.zip
Use Android File Transfer or similar (I had a Mac) to put that on the root of your device. It was at the same level as the Downloads folder. If you can see that, you're in the right place.
Reboot into fastboot mode
Select recovery mode (press volume down to highlight it, then volume up to select)
You'll now see an Android guy with a red triangle. Press volume up and power at the same time, let go, and you should be in another text menu.
Select boot from SD card (use volume down to highlight it, then power to select)
Select your update.zip
Wait 20 minutes or so while it works
Select reboot when you're finished
That was enough to get me to Android 5. Good luck everyone!
Click to expand...
Click to collapse
During the first flash, did you not get System Downgrade errors? And after reboot i could still see same Consumer Cellular system version. Did you verify your system version before you updated Lollipop?
I still cant believe it worked for you as i have seen other people still having issues like me where they cannot flash 21.11.17 version because of system not permitting downgrading.
Please add any more insights or if you downloaded the ROM from somewhere else.
Thanks.
zoomingrocket said:
During the first flash, did you not get System Downgrade errors? And after reboot i could still see same Consumer Cellular system version. Did you verify your system version before you updated Lollipop?
I still cant believe it worked for you as i have seen other people still having issues like me where they cannot flash 21.11.17 version because of system not permitting downgrading.
Please add any more insights or if you downloaded the ROM from somewhere else.
Thanks.
Click to expand...
Click to collapse
I didn't get system downgrade errors, no. I unlocked first. Maybe that was it?
My system version was 21.11.23.titan_ccaws.AWSCC.en.US cc
Zoomingrocket, check out my post here: http://forum.xda-developers.com/showpost.php?p=56707918&postcount=26
Thanks for the guide, helped me to update to Lollipop after flashing the retail image. Are you able to lock your bootloader, or will I just have to live with it being unlocked?
Janus Kirin said:
I didn't get system downgrade errors, no. I unlocked first. Maybe that was it?
My system version was 21.11.23.titan_ccaws.AWSCC.en.US cc
Click to expand...
Click to collapse
That's the same version I had, and I got the same error as the person above.
chibichn said:
Zoomingrocket, check out my post here: http://forum.xda-developers.com/showpost.php?p=56707918&postcount=26
Thanks for the guide, helped me to update to Lollipop after flashing the retail image. Are you able to lock your bootloader, or will I just have to live with it being unlocked?
Click to expand...
Click to collapse
I was not able to lock the bootloader. It shows that warning for five seconds and then starts the boot animation. I'd also like to lock it, but I've decided not to press my luck.
Janus Kirin said:
I was not able to lock the bootloader. It shows that warning for five seconds and then starts the boot animation. I'd also like to lock it, but I've decided not to press my luck.
Click to expand...
Click to collapse
chibichn said:
Zoomingrocket, check out my post here: http://forum.xda-developers.com/showpost.php?p=56707918&postcount=26
Thanks for the guide, helped me to update to Lollipop after flashing the retail image. Are you able to lock your bootloader, or will I just have to live with it being unlocked?
Click to expand...
Click to collapse
Thanks a ton Janus & Chibichn, it works and i was able to downgrade and flash Lollipop via recovery!
See this post:
http://forum.xda-developers.com/showpost.php?p=56707918&postcount=26
Seems to work for me. Happily running Lollipop on my Consumer Cellular G (2014).
Other than the void warranty, any other disadvantage in unlocking the bootloader? Will we get future OTA updates or well have to flash every time?
Thanks, worked for me, for those who aren't able to downgrade, are you sure you got your bootloader unlocked?
Great tutorial, worked exactly as described. Thanks A LOT! Now to root and start restoring my TitaniumBackup.
Thanks for the tutorial, I am having issues on step 14 the installation aborts in recovery. I did rename the zip to update.zip. If some one can point me in the right direction that would be appreciated. Thanks.
Sent from my A0001 using XDA Free mobile app
Thanks a ton for this. Got my less than 24 hour old Moto G upgraded last night. Youre a lifesaver.
root??
work was actually really really perfect! however I noticed that when starting this root and lost without recovery. is normal in this version? because at the end she asked me to reinstall it would root.
I got the xt1064 from consumer cellular and have been trying to replicate the process but with a locked bootloader.
My cc x1064 originally came with 21.11.23.titan_ccaws.AWSCC.en.US cc. I couldn't flash an older US retail build (21.11.17.titan_retuaws.retuaws.en.US - the latest available for download at the time) because of downgrade issues. Locked bootloader wont let you downgrade, image verification issue.
As of today I was able to located the latest US retails aws rom for 21.11.23. I ended up getting it from a different faster mirror than the ones posted in another xda thread.
http://motofirmware.com/files/file/951-retuaws-xt1064-444-kxb2185-23-cid9-cfcxmlzip/
Fastboot flash of this rom was successful. No bootloader/image issues. My consumer cellular rom was removed, cc app was gone, and now my system version reads 21.11.23.titan_retuaws.retuaws.en.US cc ( build # kxb21.85-23). Don't know why the "cc" is still appended to the end of the system version. Baseband version also had CCAWS_CUST in it. Is this an indication that consumer cellular components like the baseband modem files were untouched during the US retail flash?
Anyway, tried all the tutorials on getting OTA to update via stock recovery thru "update form sd" but the update keeps failing. I keep getting message " package expect build finger print of motorola/titan_retuaws/titan_umts:4.4.4/kxb21.85-17/23:user/release-keys or motorola/titan_retuaws/titan_umts:5.0/LXB22.39-6/5:user/release-keys; this device has motorola/titan_retuaws/titan_umts:4.4.4KXB21.85-23/30:u Installation aborted."
So the phone is complaining that the package currently installed either had to be 21.85-17 (4.4.4) or lollipop 5.0, in order to flash , but found 21.85-23(4.4.4) on my phone instead, hence it fails because of version mismatch. So in order to update OTA lollipop with a locked bootloader only a currently installed build of 21.11.17 will allow you to do it? If that is the case, I can't downgrade and thus can update the OTA.
diamondjoker5 said:
I got the xt1064 from consumer cellular and have been trying to replicate the process but with a locked bootloader.
My cc x1064 originally came with 21.11.23.titan_ccaws.AWSCC.en.US cc. I couldn't flash an older US retail build (21.11.17.titan_retuaws.retuaws.en.US - the latest available for download at the time) because of downgrade issues. Locked bootloader wont let you downgrade, image verification issue.
As of today I was able to located the latest US retails aws rom for 21.11.23. I ended up getting it from a different faster mirror than the ones posted in another xda thread.
http://motofirmware.com/files/file/951-retuaws-xt1064-444-kxb2185-23-cid9-cfcxmlzip/
Fastboot flash of this rom was successful. No bootloader/image issues. My consumer cellular rom was removed, cc app was gone, and now my system version reads 21.11.23.titan_retuaws.retuaws.en.US cc ( build # kxb21.85-23). Don't know why the "cc" is still appended to the end of the system version. Baseband version also had CCAWS_CUST in it. Is this an indication that consumer cellular components like the baseband modem files were untouched during the US retail flash?
Anyway, tried all the tutorials on getting OTA to update via stock recovery thru "update form sd" but the update keeps failing. I keep getting message " package expect build finger print of motorola/titan_retuaws/titan_umts:4.4.4/kxb21.85-17/23:user/release-keys or motorola/titan_retuaws/titan_umts:5.0/LXB22.39-6/5:user/release-keys; this device has motorola/titan_retuaws/titan_umts:4.4.4KXB21.85-23/30:u Installation aborted."
So the phone is complaining that the package currently installed either had to be 21.85-17 (4.4.4) or lollipop 5.0, in order to flash , but found 21.85-23(4.4.4) on my phone instead, hence it fails because of version mismatch. So in order to update OTA lollipop with a locked bootloader only a currently installed build of 21.11.17 will allow you to do it? If that is the case, I can't downgrade and thus can update the OTA.
Click to expand...
Click to collapse
I also noticed that Base Band version stays from Consumer Cellular. Any idea if we should or can flash the Base Band to US Retail? Also as far i read, yes the lollipop update is based on top of 21.11.17 not 21.11.23. There may be a lollipop image on top of 21.11.23 but i am not sure.
^^ personally I didn't care to void the warranty since I picked it up for 75 (gift card for another 75), also the consumer cellular model. Updated it to 5.0 and using it as my spare phone for browsing and web on my secondary line, it works fine. Immediately after the update, getting back into recovery is an issue, haven't tried since but it's been working fine so I'm not complaining.
zoomingrocket said:
I also noticed that Base Band version stays from Consumer Cellular. Any idea if we should or can flash the Base Band to US Retail? Also as far i read, yes the lollipop update is based on top of 21.11.17 not 21.11.23. There may be a lollipop image on top of 21.11.23 but i am not sure.
Click to expand...
Click to collapse
I was successful with the Consumer Cellular XT1064, but I unlocked the bootloader first and left it that way. It is my understanding that this is required to downgrade, but I'm no expert.
The Lollipop *does* update the Baseband, though the CCAWS_CUST was/is appended throughout. Unsure what that is all about (or if it even relates to Consumer Cellular), but it works just fine. I'll paste the various Baseband, System, and Build numbers reported as I progressed below. Perhaps this will shed some light?
___________________________________
Consumer Cellular XT1064 - As found:
Baseband: MSM8626BP_1032.394.88.00R, CCAWS_CUST
System: 21.11.23.titan_ccaws.AWSCC.en.US.cc
Build: KXB21.85-23
___________________________________
After factory retail flash:
RETUAWS_XT1064_4.4.4_KXB21.85-17_cid9_CFC.xml.zip
Baseband: MSM8626BP_1032.394.88.00R, CCAWS_CUST
System: 21.11.17.titan_retuaws.retuaws.en.US na
Build: KXB21.85-17
___________________________________
After Lollipop update via adb sideload:
Blur_Version.21.11.17.titan_retuaws.retuaws.en.US.zip
Baseband: MSM8626BP_1032.3105.93.00R, CCAWS_CUST
System: 22.11.6.titan_retuaws.retuaws.en.US cc
Build: LBX22.39-6
___________________________________
Kinda strange that the System went from US cc, to US na, then back to US cc. ???
If someone can provide this information from another carrier or carrier-less, it would be interesting to compare. I have 2 more of these ordered and due to arrive Wednesday. I'll check back here before I alter them in case someone wants additional info. - Regards
---------- Post added at 02:48 AM ---------- Previous post was at 02:07 AM ----------
chibichn said:
Zoomingrocket, check out my post here: http://forum.xda-developers.com/showpost.php?p=56707918&postcount=26
Thanks for the guide, helped me to update to Lollipop after flashing the retail image. Are you able to lock your bootloader, or will I just have to live with it being unlocked?
Click to expand...
Click to collapse
Oh my, that bat file looks eerily familiar to me. Could be a coincidence, but I *know* Jack - very well
Recovery issue
Anyone else have issues getting back into recovery after flashing lollipop? Before I wipe mine and redownload the file, is anyone else's recovery an issue? I get stuck at the dead android logo and it won't show the recovery menu text/options.
By chance will this by default carrier unlock the device as well?

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?
*this is new thread because I started last as Q&A by mistake so first 2 pages may look off with posts and answers.
DOWNGRADING EXPERIMENT TOPIC
So as you may know , after upgrading to Marshmallow OTA, on locked bootloader there won't be any option to unlock bootloader (ever as some people say) , sunshine officially doens't support Marshmallow. The only option is to downgrade which again isn't possible on locked BL..
Or is it ?
Introduction - skip to DOWNGRADE
First of all I'm not an programmer , but have some experience with locked down motorola's bl's , firmware's ,downgrades and so on..
I'm sure when somebody says impossible, it doesn't really mean impossible, but rather not worthy to some. So in my case I bought the phone few days ago, wasn't fully up to date with infos on unlocking BL so didn't check FW version when buying , just after I checked and phone was updated on MM 1-2 days before buying it. On not unlockable BL phone will become useless to me very soon, while unlocked I would plan to have it for long period of time. It goes in Verzion's favour for me to ditch the phone and buy a new one except I'm not in USA , there are no Verzion services in my country and if there were I would never ever buy (again) anything from Verzion. Well I lived in Japan , and there is network Softbank which is well.. Imagine Verizon but on steroids when it comes to tying people down, locked bootloaders and software, insane fee's and so on.. Well that Softbank bough Verizon some time ago .. I was avoiding them at all cost, but on to the topic now.
DOWNGRADE - fastboot
I would like to invite everybody who is interested in this and who can help to participate in this. Every programmer that has time and can contribute would be greatly appreciated! In return I'm willing to sacrifice my phone and my time , even paying some reasonable donations.
While experimenting in the end I was able to flash all bootloader files from various different versions including all partitions related to it which gets upgraded. Even managed to flash XT1250 MM bootloader. Bootloader version DOES change in bootloader / fastboot ,But it doesn't mean ANYTHING. While downgrading , something else, possibly other parts of bootloader obviously search for match and there is more to it than simple bootloader , more experienced , chime on in here! SElinux enforcing? Verity?
(see attachments)
SU4TL-49 bootloader.img to motoboot flash - Successfully
SU4TL-49 manually flashing 1 by 1:
tz.mbn -[/B] Successfully
SBL1.mbn (bootloader) - [/B] Successfully
sdi.mbn - [/B] Successfully
fsg.mbn to mdm1m9kefs3 - [/B] Successfully
rpm.mbn - [/B] Successfully
emmc_appsboot.mbn to aboot - [/B] Successfully
gpt.bin to "partition" , it's the partitions info partition, people say it can't be downgraded or flashed cross versions. After some experimenting mfastboot failed but fastboot succeded, on some versions mfastboot worked - [/B] Successfully
What I can't get to downgrade / cross flash no mather which bootloader and combinations of firmware im on :
boot.img
recovery.img
system,img (sparse_chunk files)
I will go deeper, but hope that new full firmware SBF will be released soon in case of brick. Verzion is slow. I'm making my own full 6.0.1 xml.zip based on full flashable zip's , repacked system.img sparsechunks, rewrited the script but can't get to flash system files due to invalid signed image. Any help with that? It would also help already bricked guys because who knows when'll Verzion release it..
Downgrade OTA way , stock Android Recovery
While stock android recovery is pretty much useless, it can do software upgrades OTA on a fully stock system , which we on locked bootloaders and MM have.
In my opinion , the way is to trick stock recovery into thinking it's flashing ota, and that whole envieroment is like recovery is expecting it while it's actually flashing downgraded version full / close to full firmware in combination with you flashing some partitions manually through fastboot. OTA's contain only "patch" and just replaces files which get changed on new SW. Or even maybe reverse OTA downgrade?
I've made my own update.zip and signed it , but so far get footer size is wrong error so can't flash it .. Need more help here too..
That looks promising!
Marshmallow feels slower than lollipop for me and I wish I could downgrade but I just can't!
I am looking forward to see what you can do about this issue
Good luck bro!
sorry for my mistake, I do not intend to comment here
@EjđiSixo
How to remove the "signed" of system image or bypass it? Fastboot or RSD are stuck at flashing system image. Does this "sign" relate to boot, recovery, partition? Or it's simply the "sign" to prevent downgrade???
I've never succeeded with partition downgrade...
---------- Post added at 10:29 PM ---------- Previous post was at 10:19 PM ----------
when I was flashing the only system.img (3GB), it said that "wrong at header magi". But after a bit time, fastboot separated the file and began to flash. But still failed because of signed image.
I've tried to remove the code from updater-script but it could not write files to system
Not out yet!
Thanks! I think if we all try , we can do it ! For now main focus is downgrading anyhow, even to half working Lollipop just in the purpose of unlocking bootloader with sunshine.
@mr_5kool
Feel free to comment and ask / suggest, thats what this topic is for!
Unforutenately thats the part I haven't yet figured out myself. It is a " permissions" to prevent the downgrade , bootloader and possibly something else checks current version / keys / properly signed image and then flashes. With other bootloader I'm still not able to flash it because it's obviously locked. Motorola probably signs their images differently.
You can't flash 3GB image because when flashing, phone recieve's partition first to ram so max download size is set to 255mb per file. You have to repack system.img to sparse chunks. But you don't have to bother with it , I already repacked system.img which I found at fully stock flashable MCG24.251-5 . It again failed due to invalid signed image . If we could figure out what is exactly signed and how , that would open a lot more possibilities. Possibly even flashing prerooted roms on locked bootloader. There are more possibilities , who knows..
Currently the only thing notices downgrade when flashing is recovery. In bootloader log says I tried to downgrade. Even with downgraded bootloader (kind of, there is sbl2 and sbl3 but they don't get upgraded )
Anyway, I tried something just for the "gags" . Flashed all partitions of XT1250 bootloader. Got to Motorola's site, posted "unlock bootloader data". It returned it's not unlockable of course.. The first sequence of numbers in data is your imei , it starts with 99 and it's verzion's specific imei.
My theory is that motorola ties unlock bootloader data to every phone and imei and stores it in database ( please confirm) . So even with moto maxx bootloader I can't unlock because :
1 it reads my verzion imei
2 it doesn't find alltogether data in the database..
I don't know what are other numbers in the data you get from fastboot, possibly some serial numbers and so on, haven't really checked it .. That's why i think this method is not possible at all for now. Manipulating that data in your phone and running it through motorola's site knowing that exact same code works for some device might be possible, but I think there is really way too much impossible messing involved. If somebody can share more about this?
lol
http://forum.xda-developers.com/dro...ficial-marshmallow-build-mcg24-t3512813/page2
I've renamed it like suggested in the post #11
Download link is at 1st page. It's just a OTA.
Yes I just renamed it.
IT DOESN'T WORK WITH ADB AND YOU CAN'T FLASH IT AGAIN THROUGH RECOVERY. ITS OTA.
EDIT: The post that I was responding to has been removed.
The method to downgrade from Lollipop to Kitkat is the same with what I've done. It may be possible. Some said that "impossible to downgrade with locked bootloader on vrz". So the system image may be signed with bootloader (or imei, serial or something else, god know).
The unlock method of Sunshine takes place in Trustzone (sbl2). They cannot get unlock code.
You succesfully downgraded LL to KK on droid? There is partition for trust zone alone "tz.mbn" , downgradable without any problem. I only see sbl1 get's upgraded on droid turbo , never saw in any firmware sbl2 or 3 yet.. So I'm little confused.. I remember I saw some PDF regarding that..
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Finally managed to *Brick my devices while trying to make latest sbf firmware (what an irony ) because used some of files from that stupid OTA . Tried flashing all possible firmware I have but it doesn't fix it so system got corrupted probably and for now didn't succed flashing any of the available systems. Flashing MM recovery doesn't help. It's a " recovery loop".
Basically phone starts , vibrates , goes into recovery, it says "erasing" , it does the factory reset then restarts and over and over again erasing restarting loop.
I'll continue exploring downgrade options but top priority now is making working marshmallow sbf or waiting for stupid Verzion to release it already. Just checked with SUA and it still doesn't show repair so firmware isn't available still.
Biggest problem is signed system images which are probably signed by RSA and I need help with that..
I have same problem erasing
Can't flash SU4TL gpt.bin anymore , so success was definitely connected to experiment and steps I did so I'll investigate more.
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
side note, I hate this Q&A format. Not sure why XDA even has it. You can't even format URL links correctly.
Click to expand...
Click to collapse
mr_5kool said:
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
Click to expand...
Click to collapse
I wonder if there is any way to force Verizon to release firmware. This is really low of the lowest, it says 1 week after OTA , now it's almost 1 month. Until somebody forces them , it can be months as far as they are considered. No help from developers / programmers either on any of 2 subjects so don't see my method of full MM SBF working.
god know
:v
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Click to expand...
Click to collapse
Exactly brother .
I solved my problem .
I can downgrade from Marshmallow to lollipop is very easy for my ..
But first step is unlocked bootloader from lollipop..
Sent from my XT1254 using XDA Free mobile app
Yeah people , we all know everything can be done with unlocked bootloader. It's a GOD mode. Nothing strange about downgrading with unlocked BL. This topic is for people stuck on locked BL like myself to try to odowngrade on lollipop only in purpose of UNLOCKING BL. So let's for now focus on locked BL's.

Flashing newest 'gpt.bin'

Will I brick a device if I only flash a newest 'gpt.bin'? Just one single file.
Code:
fastboot flash partition gpt.bin
WITHOUT flashing 'bootloader.img'
It's possible you may be able to flash gpt.bin and not have your device brick, I suspect however you may be setting your device up for a later hard brick, e.g. if you were to take an OTA. Previous hard bricks on Moto devices have likely been caused by a mismatch between the GPT/bootloader and the system (especially when taking OTA updates that may not have as stringent checks as the fastboot). https://forum.xda-developers.com/moto-x-2014/general/warning-downgrade-bootloader-partition-t3105147 for what could happen.
What are you attempting to achieve by simply just flashing the GPT?
echo92 said:
What are you attempting to achieve by simply just flashing the GPT?
Click to expand...
Click to collapse
Well, ideally, I want the newest bootloader 81.0C, as I explained in my another post Bootloader 81.0C (sha-7ca0393, 2017-03-20)
.
I beleive LineageOS is better off with BL 81.0C
Specifically, "Advanced Restart" works better with BL 81.0C.
While with older bootloaders, the following happens:
Hang up/freeze on "Advanced Restart"
rybshik said:
Well, ideally, I want the newest bootloader 81.0C, as I explained in my another post Bootloader 81.0C (sha-7ca0393, 2017-03-20)
.
I beleive LineageOS is better off with BL 81.0C
Specifically, "Advanced Restart" works better with BL 81.0C.
While with older bootloaders, the following happens:
Hang up/freeze on "Advanced Restart"
Click to expand...
Click to collapse
In your subsequent post, however, you appear to have concluded the custom logo.bin was the issue causing the restart hang? https://forum.xda-developers.com/showpost.php?p=73292757&postcount=449
As was explained in another reply to your queries, the bootloader isn't one partition, but a lot of individual partitions (e.g. tz, aboot sbl). Although in theory you could dd those partitions from another device, as you proposed, I do not know if there are any verification checks unique to each device.
Perhaps the safest approach is to wait for the 7.1.1 actual release/the 7.1.1 fastboot firmware, to formally update your device to the latest bootloader.

Need to Re-Lock Bootloader on my friends XT1572

So the only thing that has been done with this phone, is that the bootloader has been unlocked, officially with a code from Motorola. No custom recovery, ROM, or anything were installed on it.
I need to re-lock the bootloader so he can return it to warranty as his screen sometimes goes crazy and starts clicking everywhere. So I just download the latest firmware for Vodafone Australia, which I believe is:
XT1572_CLARK_RETASIA_6.0_MPHS24.49-20-8_cid7_subsidy-DEFAULT_CFC.xml
from:
https://firmware.center/firmware/Motorola/Moto%20X%20Style/Stock/XT1572/
And then follow the commands from this thread in the OP for the XT1575 (*should be the same codes, right?*).
https://forum.xda-developers.com/moto-x-style/general/guide-return-to-stock-relock-bootloader-t3489110
Also one final note, is the firmware I posted above the latest one for vodafone Australia? Just for confirmation, I am not sure, but according to this guide, it belongs to vodafone Australia:
https://forum.xda-developers.com/moto-x-style/general/australian-xt1572-guide-to-restore-t3292794
Qustion is what firmware on phone do you have?
Relock is possible by flashing the same or upper version only. @Blackfyre
dzidexx said:
Qustion is what firmware on phone do you have?
Relock is possible by flashing the same or upper version only. @Blackfyre
Click to expand...
Click to collapse
In the Bootloader it says:
Baseband: M8992_1255331.29.01.88.07R CLARK_APAC_CUST
Product/Variant: clark XT1572 32GB PC3
In the Phone Settings:
Build Number: NPH25.200-15
Any way to find out exactly if that's the same firmware as in the OP?
EDIT: His phone is running Nougat, I can't find a Nougat ROM for Clark ASIA or APAC (at all) from the link of firmwares above.
Blackfyre said:
In the Bootloader it says:
Baseband: M8992_1255331.29.01.88.07R CLARK_APAC_CUST
Product/Variant: clark XT1572 32GB PC3
In the Phone Settings:
Build Number: NPH25.200-15
Any way to find out exactly if that's the same firmware as in the OP?
EDIT: His phone is running Nougat, I can't find a Nougat ROM for Clark ASIA or APAC (at all) from the link of firmwares above.
Click to expand...
Click to collapse
There is no Nougat factory firmware image available, or even the "latest" Marshmallow version. Sorry, but without those it is no possible to lock the booloader. In order to lock the bootloader, you must flash a complete, signed image that is the same or a newer version than what you have.
Remember that relocking the bootloader will NOT remove the Unlocked Bootloader boot splash screen, nor will it hide the device has ever been unlocked (it is still plainly visibile on the bootloader screen and in a getvar all).
TBH, I have doubts we will ever see more factory firmware images... relocking the bootloader will probably never be possible.
@Blackfyre
This is Nougat, no flashable firmware.
Flash modified logo.bin and try warranty repair.
@acejavelin and @dzidexx
Thank you for the replies. I have a few questions.
If I root the device, can I install an old ROM on it, then update to the latest firmware available that is above, then lock OEM?
Would doing that result in Software = Modified? Because currently it's still Unmodified.
Flashing the modified logo.bin you mentioned above I am guessing will remove that warning that shows up at boot stating that the bootloader has been unlocked. Would flashing this .bin file result in Software = Modified or not?
And if not, then where can I find this modified logo.bin?
Thank you guys again for your help and replies.
https://forum.xda-developers.com/mo...e-unlocked-bootloader-warning-t3201141/page22
fastboot flash logo NameOfFile.bin
If after flashing still will be unmodified you can try relock:
fastboot oem lock begin
fastboot erase userdata
fastboot erase cache
fastboot oem lock @Blackfyre
dzidexx said:
https://forum.xda-developers.com/mo...e-unlocked-bootloader-warning-t3201141/page22
fastboot flash logo NameOfFile.bin
If after flashing still will be unmodified you can try relock:
fastboot oem lock begin
fastboot erase userdata
fastboot erase cache
fastboot oem lock @Blackfyre
Click to expand...
Click to collapse
Does that work though without flashing full firmware images?
quakeaz said:
Does that work though without flashing full firmware images?
Click to expand...
Click to collapse
No, you must flash a full, signed image... In some newer Moto devices you can get by with flashing only the signed system sparce_chunks and wiping data, in 3rd gen and older devices flashing a full signed image, even if already stock, is required.
acejavelin said:
No, you must flash a full, signed image... In some newer Moto devices you can get by with flashing only the signed system sparce_chunks and wiping data, in 3rd gen and older devices flashing a full signed image, even if already stock, is required.
Click to expand...
Click to collapse
Previous post - It was only my hope.
In Europe, Moto/Lenovo can not refuse to repair the components for two years.
dzidexx said:
Previous post - It was only my hope.
In Europe, Moto/Lenovo can not refuse to repair the components for two years.
Click to expand...
Click to collapse
Eh... Yeah, they can and do, often saying that what was done while unlocked is the cause of the problem... And then you have to fight it, by the time it's all said and done many people just give up as the process can take many months.

Super Stucked, Nothing Helps now.

I had hardbricked my devices while installing an OTA update and the device was Hardbricked .
I blank flashed the device and it booted and bootloader.
Now the problem starts here.
I flashed the OEM_Lock.bat as I wanted to relock the bootloader. I'm not sure what went wrong but the flash didn't complete and stuck in middle.
The problem remains here is it shows
Fastboot Reason: Failed to initialize partition table
I am unable to flash anything now. Recovery.img fails, bootloader.img fails, twrp flashing fails.
Nothing flashes as Bootloader is locked.
I went to Motorola Service Centre. They also couldn't do anything and simply said that their software doesnt read the phone.
Is there anyone whoe can really help me out with anything left to do?
Any method to force flash recovery, even twrp?
Phone is detected as Fastboot athene_16mp S in computer. It doesnt detect as "Qualcomm HS-USB QDLoader 9008".
What firmware are you attempting to flash?
Your device looks like it's still on the blank flash provided bootloader, which means you have to flash at least the GPT and bootloader. The lack of a serial number and the generic identifier implies you have not been able to flash an actual GPT and bootloader. Also, OEM_locked is normal until you get an actual bootloader flashed over the blank flash bootloader, which usually means trying to flash a GPT and bootloader at least as new as the latest version you had on your device (regardless of downgrades).
I'd suggest downloading the latest Nougat stock ROM we have from here. Do not use any of the scripts at this time.
https://forum.xda-developers.com/moto-g4-plus/how-to/stock-rom-npjs25-93-14-4-march-1-t3608138
Unzip the file, delete any old stock ROMs from your ADB folder and copy over the new stock ROM. Try to flash just the GPT and bootloader then reboot to fastboot. See if you reboot into a fastboot screen with details.
If you do, I would proceed to flash the rest of the new ROM without locking your bootloader. If your device boots then, then you can reflash with the locking commands.
Edit - also, this post probably is better suited to the Q and A section...
echo92 said:
What firmware are you attempting to flash?
https://forum.xda-developers.com/moto-g4-plus/how-to/stock-rom-npjs25-93-14-4-march-1-t3608138
Unzip the file, delete any old stock ROMs from your ADB folder and copy over the new stock ROM. Try to flash just the GPT and bootloader then reboot to fastboot. See if you reboot into a fastboot screen with details.
If you do, I would proceed to flash the rest of the new ROM without locking your bootloader. If your device boots then, then you can reflash with the locking commands.
Click to expand...
Click to collapse
The files in mentioned firmware did the trick. It flashed GPT and Bootloader and showed the needed info.:highfive: After that I flashed the same firmware via fastboot commands and device has booted to the stock 7.0 - Bootloader Unlocked. How crazy was I to ignore the proper files to flash? I probably tried 100 times to flash files (wrong once for sure). Thanks alot though for providing the link and instructions. :silly:
Now one last thing, should I flash OEM_Lock file to lock the bootloader so that I can get the lastest Oreo update? I might even think fo selling the device after locking the bootloader. Need your genuine opinion on this as well.
mysteryno46 said:
The files in mentioned firmware did the trick. It flashed GPT and Bootloader and showed the needed info.:highfive: After that I flashed the same firmware via fastboot commands and device has booted to the stock 7.0 - Bootloader Unlocked. How crazy was I to ignore the proper files to flash? I probably tried 100 times to flash files (wrong once for sure). Thanks alot though for providing the link and instructions. :silly:
Now one last thing, should I flash OEM_Lock file to lock the bootloader so that I can get the lastest Oreo update? I might even think fo selling the device after locking the bootloader. Need your genuine opinion on this as well.
Click to expand...
Click to collapse
Eh, you live and learn. Besides, you've now got your device running now!
Honestly, it's up to you. Having a locked or unlocked bootloader will not affect your ability to receive OTA updates - you should still receive updates so long as your firmware matches your software channel (and since your device was XT1643, the NPJS25.93-14-18 April 2018 security update should be the correct firmware). At this moment in time, you'll have to use the NPJS25.93-14-18 firmware to re-lock your bootloader - we don't have the stock Oreo firmware at this time. Thus, if you update to stock Oreo, you will not be able to re-lock your bootloader until you can get a leak of the Oreo firmware.
If you're selling, I'd choose to re-lock the bootloader. Else, a potential buyer who is not used to flashing custom ROMs might wonder if there's any tampering with the device (the bootloader unlocked warning, to someone not used to flashing custom firmware, might scare off potential buyers).
Back to Locked Bootloader, complete stock.
echo92 said:
Eh, you live and learn. Besides, you've now got your device running now!
If you're selling, I'd choose to re-lock the bootloader. Else, a potential buyer who is not used to flashing custom ROMs might wonder if there's any tampering with the device (the bootloader unlocked warning, to someone not used to flashing custom firmware, might scare off potential buyers).
Click to expand...
Click to collapse
I am back to Locked Bootloader as feel the same as you said that anyone buying might get scared by looking the warning sign. Thanks for helping out. :highfive:
Oreo Update via OTA has already started rolling out as per the news I've been reading. I just wanted to see the oreo 8.1 before I sell the phone.
Anyways I got a new device now, Realme C1, 3|32GB as my smartphone usage has declined a lot recently and might remain similar. This device will suffice my requirements.
Thanks for the help and support. :victory:

Categories

Resources