Database Users

[how to] downgrade moto x after ota camera patch update, lost root ability

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hello,
I dont have enough posts to post in dev section so I posted here and put is on my blog as well.
DISCLAIMER: I AM NOT RESPONSIBLE FOR ANYTHING THAT MIGHT OCCURE WITH YOUR DEVICE. PLEASE READ ALL ARTICLES IN FULL BEFORE ATTEMPTING.
(Only tested for Rogers, cannot guarantee this works with other firmwares but I do not see why it wouldn't)
Not sure is this was covered before but I couldnt find anything with respect to my situation. I recently discovered a way to DOWNGRADE my MOTO X after I installed the OTA camera patch that allowed rooting via JCASE's PwnMyMoto to not work. I tried using RSDLite to flash back to the original stock firmware to no avail. I was lazy and did NOT google around and didnt read JCASE's updated disclaimer on his [Root/Write Protection Bypass] MotoX (no unlock needed) post at XDA that read
"The latest OTAs patch this exploit
The "Camera patch" patches the vulnerability we use to gain system user, and pwnmymoto will no longer work on devices with this update"
All credit where credit is due, I simply discovered a flaw to undo the update OTA camera patch giving me back the ability to use JCASE root method, which involved swapping the gpt.bin file from the new stock firmware found here: http://sbf.droid-developers.org/ghost_rcica/list.php
ROGERS-CA_XT1058_4.2.2-13.9.0Q2.X-116-LCX-36_cid14_CFC_1FF.xml.zip (camera patch)
to the original
Rogers_XT1058_4.2.2-13.9.0Q2.X-116-LCX-26-34_CFC_1FF.xml.zip (no camera patch)
I then fired up RSDLite removed the necessary line from the XML to allow the flashing of the original firmware and voila!!!!!! bobs your uncle! the OTA appeared on screen asking to be installed. Ignore for now root your phone using JCASE PwnMyMoto found in the link below:
[Root/Write Protection Bypass] MotoX (no unlock needed)
If you want to apply the OTA patch I highly recommend you read both JCASE article in full and the one below as well before attempting to do this. The article below describes how to preserve root and apply the OTA camera patch.
Tutorial: How To Protect and Restore Root for an OTA Update
All credit for rooting and saving/preserveing root to JCASE and Dark9781 on XDA developers.
Thank you.

g01di3l0ck5 said:
Hello,
I dont have enough posts to post in dev section so I posted here and put is on my blog as well.
DISCLAIMER: I AM NOT RESPONSIBLE FOR ANYTHING THAT MIGHT OCCURE WITH YOUR DEVICE. PLEASE READ ALL ARTICLES IN FULL BEFORE ATTEMPTING.
(Only tested for Rogers, cannot guarantee this works with other firmwares but I do not see why it wouldn't)
Not sure is this was covered before but I couldnt find anything with respect to my situation. I recently discovered a way to DOWNGRADE my MOTO X after I installed the OTA camera patch that allowed rooting via JCASE's PwnMyMoto to not work. I tried using RSDLite to flash back to the original stock firmware to no avail. I was lazy and did NOT google around and didnt read JCASE's updated disclaimer on his [Root/Write Protection Bypass] MotoX (no unlock needed) post at XDA that read
"The latest OTAs patch this exploit
The "Camera patch" patches the vulnerability we use to gain system user, and pwnmymoto will no longer work on devices with this update"
All credit where credit is due, I simply discovered a flaw to undo the update OTA camera patch giving me back the ability to use JCASE root method, which involved swapping the gpt.bin file from the new stock firmware found here: http://sbf.droid-developers.org/ghost_rcica/list.php
ROGERS-CA_XT1058_4.2.2-13.9.0Q2.X-116-LCX-36_cid14_CFC_1FF.xml.zip (camera patch)
to the original
Rogers_XT1058_4.2.2-13.9.0Q2.X-116-LCX-26-34_CFC_1FF.xml.zip (no camera patch)
I then fired up RSDLite removed the necessary line from the XML to allow the flashing of the original firmware and voila!!!!!! bobs your uncle! the OTA appeared on screen asking to be installed. Ignore for now root your phone using JCASE PwnMyMoto found in the link below:
[Root/Write Protection Bypass] MotoX (no unlock needed)
If you want to apply the OTA patch I highly recommend you read both JCASE article in full and the one below as well before attempting to do this. The article below describes how to preserve root and apply the OTA camera patch.
Tutorial: How To Protect and Restore Root for an OTA Update
All credit for rooting and saving/preserveing root to JCASE and Dark9781 on XDA developers.
Thank you.
Click to expand...
Click to collapse
removing the necessary line from the xml I don't feel like would solve the problem. I think once you take the OTA it puts code in the bootloader that doesn't allow you to downgrade. Since bootloaders are locked for people that are actually stuck on the update (because they would just unlock the BL if they were and wanted to downgrade) I didn't think there was a way to downgrade since we can't touch the BL. Maybe rogers is different or you didn't take the full OTA but Id like to know if anyone else has success with this.

Can already verify this doesn't work with ATT. I've tried changing the same file to old/new/other carrier, didn't matter. Once you get past the GPT flash that works, the rest will still fail.

rmead01 said:
Can already verify this doesn't work with ATT. I've tried changing the same file to old/new/other carrier, didn't matter. Once you get past the GPT flash that works, the rest will still fail.
Click to expand...
Click to collapse
Try unlocking the bootloader first. Google "moto x unlock bootloader", i can't post links yet. Open motorola's link.
After that, follow what the OP said.

dliberalesso said:
Try unlocking the bootloader first. Google "moto x unlock bootloader", i can't post links yet. Open motorola's link.
After that, follow what the OP said.
Click to expand...
Click to collapse
Unlocked bootloader is necessary.

dliberalesso said:
Try unlocking the bootloader first. Google "moto x unlock bootloader", i can't post links yet. Open motorola's link.
After that, follow what the OP said.
Click to expand...
Click to collapse
ATT and VZW bootloaders are locked. This is why it won't work.

dliberalesso said:
Try unlocking the bootloader first. Google "moto x unlock bootloader", i can't post links yet. Open motorola's link.
After that, follow what the OP said.
Click to expand...
Click to collapse
The reason most people want to downgrade after an OTA is because they lost root. If they could unlock the bootloader, they could just get root again and not have to downgrade.

Most pointless thread ever. Root normally with unlocked bootloader and still have fixes. You don't need an exploit to root if your bootloader is unlocked.
Sent from my XT1055 using Tapatalk

Does anyone from rogers know if the first file name mentioned is a working Rogers with ota?
Sent from my XT1058 using Tapatalk

Instructions for root
g01di3l0ck5 said:
Hello,
I dont have enough posts to post in dev section so I posted here and put is on my blog as well.
DISCLAIMER: I AM NOT RESPONSIBLE FOR ANYTHING THAT MIGHT OCCURE WITH YOUR DEVICE. PLEASE READ ALL ARTICLES IN FULL BEFORE ATTEMPTING.
(Only tested for Rogers, cannot guarantee this works with other firmwares but I do not see why it wouldn't)
Not sure is this was covered before but I couldnt find anything with respect to my situation. I recently discovered a way to DOWNGRADE my MOTO X after I installed the OTA camera patch that allowed rooting via JCASE's PwnMyMoto to not work. I tried using RSDLite to flash back to the original stock firmware to no avail. I was lazy and did NOT google around and didnt read JCASE's updated disclaimer on his [Root/Write Protection Bypass] MotoX (no unlock needed) post at XDA that read
"The latest OTAs patch this exploit
The "Camera patch" patches the vulnerability we use to gain system user, and pwnmymoto will no longer work on devices with this update"
All credit where credit is due, I simply discovered a flaw to undo the update OTA camera patch giving me back the ability to use JCASE root method, which involved swapping the gpt.bin file from the new stock firmware found here: http://sbf.droid-developers.org/ghost_rcica/list.php
ROGERS-CA_XT1058_4.2.2-13.9.0Q2.X-116-LCX-36_cid14_CFC_1FF.xml.zip (camera patch)
to the original
Rogers_XT1058_4.2.2-13.9.0Q2.X-116-LCX-26-34_CFC_1FF.xml.zip (no camera patch)
I then fired up RSDLite removed the necessary line from the XML to allow the flashing of the original firmware and voila!!!!!! bobs your uncle! the OTA appeared on screen asking to be installed. Ignore for now root your phone using JCASE PwnMyMoto found in the link below:
[Root/Write Protection Bypass] MotoX (no unlock needed)
If you want to apply the OTA patch I highly recommend you read both JCASE article in full and the one below as well before attempting to do this. The article below describes how to preserve root and apply the OTA camera patch.
Tutorial: How To Protect and Restore Root for an OTA Update
All credit for rooting and saving/preserveing root to JCASE and Dark9781 on XDA developers.
Thank you.
Click to expand...
Click to collapse
I am new here to the forums, and I have a tmobile moto x (unlocked bootloader) running 4.4 with camera update. I just want to know your exact method on how to downgrade.
I know I download the older firmware, then is there a Mac version or equivalent to the rsdlite as I only have access to a Mac? I also do not know what to revert back to.
Any help would be appreciated.

Future of Yotaphone 2

Hi guys,
This thread is for speculation and discussion mostly. I'm wondering what the likelihood of us getting any significant android updates in the future is? Yota seems to have gone pretty quiet as regards the 2. It's pretty likely their focussing their limited resources on the Yota 3. I would say it's pretty certain that that will come out running marshmallow so it should be feasible that mm comes to the Yota 2 as well.
I'm also wondering about the 3. If it comes out with better relative specs than last time then I'm going to consider it seriously; if it's to the yota 2 what the yota 2 was to the 1 then it should be a pretty good phone.
Lastly is there any chance of some custom ROM development for this phone? Tempted to look into it myself but won't be able to for a while due to life schedule and whatnot. Could CM be ported? What features do we think we could add? Is it just too much work due to the second screen or is a custom version of the stock ROM possible?
Hope there's still some decent attention going to this. Shame about the US launch being cancelled, we could have done with the recruits .

After the US failure, I thought they would abandon YP2 pretty soon too, but they're are least still developing 5.0 further, so I think there will a nice 5.0 update soon. They have a version lined up with some candy in it: double tap to wake, new widgets, and some other stuff I can't remember. Battery life seems OK-ish too. They pathed stagefright and stagefright 2.0 bugs as well, and include a google android (security) patch level reference in the about screen.
I don't know about 5.1 or 6.0, but I think their US marketing manager has said in the past they've been testing 5.1 at least.
About custom firmware: I have made some small steps in the past (initially targetting AOSP 5.0) but I nor others have invested enough time in it to grow it into a complete firmware. Once AOSP would build nicely, CM is not that far away.
Full EPD functionality is something else though. It's been discussed before: The low-level EPD driver stuff (to draw stuff on the backscreen) is included in the kernel sources that Yota released last may, and so it would be available in a custom firmware as well. However it would not be usable by anything but custom built apps (not the current apps/widgets), that would access the EPD interface directly. The framework adaptions and SDK support that Yota did (screen mirroring, backscreen manager service to display widgets and covers etc) is not open source, so it cannot easily be ported. It might run as-is on a 5.0 custom ROM, but not likely on 5.1 or 6.0. So on top of creating a Custom ROM, there would need to be designing and coding effort to make the EPD actually usable. With the current level of interest from devs chances are pretty slim. Maybe a bounty system might work if there are enough people interested in contributing, but looking at the level activity in the Yotaphone subforum, I doubt that enough people are interested to make it worthwhile. (Or do we have a rich Russian Oil Company mogul in our midst ?
Anyway, I expect a Yota firmware update pretty soon with some nice improvements, still remaining at lollipop 5.0 though.
Edit: forgot to mention that I'm having trouble installing Xposed with newer versions, can't get it to work, hangs at boot animation. So if you're attached to Xposed, be careful when upgrading once the new firmware becomes available.

LRX21M.5.0.0-HK1.1.66 update
I just got an OTA system update request on my phone for downloading version LRX21M.5.0.0-HK1.1.66 today. I have not installed it yet, because my phone is rooted and I'm hoping someone else will take the plunge and report results before I try. (I'd hate to lose root entirely.)
I checked the official firmware repository (ftp://fw.ydevices.com/YotaPhone2/Firmwares/) and this version hasn't appeared there yet. There seems to be a similar new one for the APC region though. (Incidentally, I'm in the US, but I bought the phone online and apparently it was HK region. Works fine for me, so I don't care.)
I took screenshots and stitched them together so I could share the complete update description. I apologize for the ridiculously large image, but I didn't want to have to type all this stuff up, and I wasn't aware of a way to copy and paste it as text.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I was considering downloading it, but I'm not sure if I can do that and not have it auto-update once the download is finished. If I could get the file, I'd be happy to post it somewhere online if it would be useful. I've got ES File Explorer and root, and I assume it will be stored in /cache, but I don't want to risk updating right now.

9
MichaelA said:
I just got an OTA system update request on my phone for downloading version LRX21M.5.0.0-HK1.1.66 today. I have not installed it yet, because my phone is rooted and I'm hoping someone else will take the plunge and report results before I try. (I'd hate to lose root entirely.)
...
I was considering downloading it, but I'm not sure if I can do that and not have it auto-update once the download is finished. If I could get the file, I'd be happy to post it somewhere online if it would be useful. I've got ES File Explorer and root, and I assume it will be stored in /cache, but I don't want to risk updating right now.
Click to expand...
Click to collapse
Nice that they included a releasenotes, I have the impression that not everything is in there (like selecting a background photo for yotahub panels). It's nice to see that they're still improving on YP2 firmware.
I tested a version close to this one (but for another region) and it had a bad bug in the touchscreen functionality: when holding the phone (and thereby touching the backscreen) the front screen would not register taps or gestures correctly anymore. Not saying that this version has that bug too, but it might be worth testing this. Yota's got versions beyond 1.66 already, which include double tap to wake (and double tap to open specific apps on the backscreen while locked)
With TWRP you can backup your phone (including system, boot and data) and try the new firmware out. You can easily restore the backup if not satisfied, you'll be on your previous version again, including root.
There's a good chance that your firmware update will fail if you're rooted (as the original files on /system are different than expected by the update). So you should probably unroot, then update, then root again by flashing supersu through (TWRP) recovery.
The firmware file you might be able to capture is probably of limited use as it will likely be an incremental update from your specific previous version to 1.66.
So, backup first then try it out!

Thanks for the suggestions! I'll try to set aside some time this weekend and do a backup/update. Once I do, I'll post my findings here. Hopefully this update doesn't have that touchscreen bug you mentioned. I haven't had any major problems with my phone on the current version, but I'm curious to try what the update has to offer.
I hadn't thought about TWRP for rolling back. I never flashed it directly to the device, but I assume I can still do it by booting up as described in the post on here. And even if rooting somehow changed or was locked down, I'm assuming I can still boot the TWRP image and re-flash my backup. My bootloader is unlocked, and I assume will stay that way.

MichaelA said:
Thanks for the suggestions! I'll try to set aside some time this weekend and do a backup/update. Once I do, I'll post my findings here. Hopefully this update doesn't have that touchscreen bug you mentioned. I haven't had any major problems with my phone on the current version, but I'm curious to try what the update has to offer.
I hadn't thought about TWRP for rolling back. I never flashed it directly to the device, but I assume I can still do it by booting up as described in the post on here. And even if rooting somehow changed or was locked down, I'm assuming I can still boot the TWRP image and re-flash my backup. My bootloader is unlocked, and I assume will stay that way.
Click to expand...
Click to collapse
Your bootloader status and TWRP recovery should be fine by this update, haven't seen attempts to mess with any of that with recent firmwares.

Which ROM is for where?
Can anyone tell me which ROM is for what area, and if possible what the differences are.
Read all the Yotaphone posts and have a pretty good idea but 1 stumps me.
CN China YD206 Best radio
APC Asia Pacific?
EU Europe YD201
HK Hong Kong 4.43 What I just bought.
Has an OTA app but no update yet.
Planning to root, TWRP then EU 5.00 with CN radio but I'd sure like to know what ME is for.
RU Russia
ME No idea since Mexico is the same as the US.

Middle East?

[really necessary][need help] BRICKED IN MARCH SECURITY PATCH LEVEL

HEY FRIENDS, I THINK I WAS IN MARCH SECURITY PATCH LEVEL WHEN I THOUGHT TO UNLOCK BOOTLOADER AND TO ROOT MY XT1643. I SUCCESSFULLY UNLOCKED BOOTLOADER AND WHILE I WAS TRYING TO ROOT BY FLASHING SUPERSU ZIP FILE I LOST MY HANDSETS SOFTWARE. AFTER THAT I FLASHED CUSTOM ROM FOR MY PHONE. I HATED CUSTOM ROM SO I DECIDED TO GET BACK TO STOCK. I FLASHED MY ROM FROM HERE https://forum.xda-developers.com/moto-g4-plus/how-to/moto-g4-plus-xt1640-43-athene-npj25-93-t3549369
I WANT TO KNOW THAT IS IT DOWNGRADED ROM??
AFTER I FLASHED THIS MY HANDSET IS SHOWING UPDATE , SO I UPDATED. WHILE INSTALLING UPDATE MY PHONE GOT BRICKED.
CAN I USE BLANK FLASH FOR MARCH SECURITY PATCH LEVEL. IF YES CAN ANYONE PROVIDE ME LINK FOR THE BLANK FLASH.
PLZZ IT'S HUMBLE REQUEST.

If you genuinely were on the March 2017 security patch before, try this: https://forum.xda-developers.com/showpost.php?p=71405834&postcount=23

echo92 said:
If you genuinely were on the March 2017 security patch before, try this: https://forum.xda-developers.com/showpost.php?p=71405834&postcount=23
Click to expand...
Click to collapse
bro , my friend have the same phone. i checked on his phone that it is in march security level.his phone is updated. i think that i m too in march security patch level.
bro i checked the above link the blank flash file they have is of npj95.93.11. but i was in newer version of march security patch level.

ADITYA_KUMAR said:
bro , my friend have the same phone. i checked on his phone that it is in march security level.his phone is updated. i think that i m too in march security patch level.
Click to expand...
Click to collapse
Well, did the blankflash work, then?
By the way, it looks like the June update should have arrived in India: https://forum.xda-developers.com/showpost.php?p=72985910&postcount=61

echo92 said:
Well, did the blankflash work, then?
Click to expand...
Click to collapse
nope bro:crying::crying:
i flashed npj25.93-14. now i need to know which version's update i installed.
sorry for bad english

echo92 said:
Well, did the blankflash work, then?
By the way, it looks like the June update should have arrived in India: https://forum.xda-developers.com/showpost.php?p=72985910&postcount=61
Click to expand...
Click to collapse
i don't think so bro. because today i checked my friends phone. it is showing march security patch level. and his system is up to date.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

ADITYA_KUMAR said:
nope bro:crying::crying:
i flashed npj25.93-14. now i need to know which version's update i installed.
sorry for bad english
Click to expand...
Click to collapse
Ah, that's a problem - we don't have another blankflash to try (and it looks like you tried all the others).
I understand you don't have much data, does look like downgrading and taking the OTA hard bricked your device unfortunately. Only resolutions are to have your device repaired (probably with a motherboard replacement) or saving up for a new device.

echo92 said:
Ah, that's a problem - we don't have another blankflash to try (and it looks like you tried all the others).
I understand you don't have much data, does look like downgrading and taking the OTA hard bricked your device unfortunately. Only resolutions are to have your device repaired (probably with a motherboard replacement) or saving up for a new device.
Click to expand...
Click to collapse
can u provide me 93.14-4 gpt.bin and bootloader.img plzz

echo92 said:
Ah, that's a problem - we don't have another blankflash to try (and it looks like you tried all the others).
I understand you don't have much data, does look like downgrading and taking the OTA hard bricked your device unfortunately. Only resolutions are to have your device repaired (probably with a motherboard replacement) or saving up for a new device.
Click to expand...
Click to collapse
I also want to know that what is the version of update that has been installed if i am in npj93.14. If the update i got is of npj93.14-4 then genuinly i am in march security patch level. plzz help

ADITYA_KUMAR said:
I also want to know that what is the version of update that has been installed if i am in npj93.14. If the update i got is of npj93.14-4 then genuinly i am in march security patch level. plzz help
Click to expand...
Click to collapse
You flashed the December 2016 update:
NPJ25.93-14: December 2016 security update, B1:03 bootloader
NPJS25.93-14-4: March 2017 security update, B1:05 bootloader
NPJS25.93-14-8: June 2017 security update, B1:06 bootloader.
I don't know how much use it'll be, but I've uploaded the NPJS25.93-14-4 bootloader and GPT to here: https://drive.google.com/drive/folders/0B-GUyOfb8OgzR1VrQ1NHWDVmWE0
Name: NPJS25_93_14_4_gpt_bootloader.zip
Extracted bootloader and gpt:
gpt.bin -
size: 32KB
md5 checksum:be97a48f5ab36009b8c5e5bd55453f1e
Bootloader -
size: 3.56 MB
md5 checksum: 2f7a44bba145811bb6cd4267d6d19805

echo92 said:
You flashed the December 2016 update:
NPJ25.93-14: December 2016 security update, B1:03 bootloader
NPJS25.93-14-4: March 2017 security update, B1:05 bootloader
NPJS25.93-14-8: June 2017 security update, B1:06 bootloader.
I don't know how much use it'll be, but I've uploaded the NPJS25.93-14-4 bootloader and GPT to here: https://drive.google.com/drive/folders/0B-GUyOfb8OgzR1VrQ1NHWDVmWE0
Name: NPJS25_93_14_4_gpt_bootloader.zip
Extracted bootloader and gpt:
gpt.bin -
size: 32KB
md5 checksum:be97a48f5ab36009b8c5e5bd55453f1e
Bootloader -
size: 3.56 MB
md5 checksum: 2f7a44bba145811bb6cd4267d6d19805
Click to expand...
Click to collapse
thnk u bro
is there anyhope of getting updated blankflash?

ADITYA_KUMAR said:
thnk u bro
is there anyhope of getting updated blankflash?
Click to expand...
Click to collapse
Unless somehow Motorola has generated a newer blankflash from one of their engineering teams, and we can get hold of said blankflash (via a leak), it's very unlikely.
As I understand it, you need a singleimage which includes the correct partition structure and key files which include the programmer. The programmer can't be altered as it needs to be signed by Motorola, presumably to ensure whatever is flashed is cryptographically signed by the right certificate, else we could flash anything to the chips. Even if we could make a new singleimage, the programmer could be checking the bootloader on your device to check if you can flash. (e.g. like here: https://forum.xda-developers.com/showpost.php?p=62191317&postcount=2112)
It could happen (though this is just speculation) that when Android O is released, Motorola generates a new blankflash (like was done for Nougat), however, that might depend on if our device is even in production at that time...
Either way, the resolution would have to come from Motorola, either a leak or a new motherboard.

echo92 said:
Unless somehow Motorola has generated a newer blankflash from one of their engineering teams, and we can get hold of said blankflash (via a leak), it's very unlikely.
As I understand it, you need a singleimage which includes the correct partition structure and key files which include the programmer. The programmer can't be altered as it needs to be signed by Motorola, presumably to ensure whatever is flashed is cryptographically signed by the right certificate, else we could flash anything to the chips. Even if we could make a new singleimage, the programmer could be checking the bootloader on your device to check if you can flash. (e.g. like here: https://forum.xda-developers.com/showpost.php?p=62191317&postcount=2112)
It could happen (though this is just speculation) that when Android O is released, Motorola generates a new blankflash (like was done for Nougat), however, that might depend on if our device is even in production at that time...
Either way, the resolution would have to come from Motorola, either a leak or a new motherboard.
Click to expand...
Click to collapse
hey @echo92, i am thinking that qboot can detect our device as qualcomm loader something. but mfastboot can't do it. can we
make qboot to directly flash gpt.bin and bootloader.img? It's just an idea of desperate mind.

ADITYA_KUMAR said:
hey @echo92, i am thinking that qboot can detect our device as qualcomm loader something. but mfastboot can't do it. can we
make qboot to directly flash gpt.bin and bootloader.img? It's just an idea of desperate mind.
Click to expand...
Click to collapse
The fact fastboot can't detect further supports the idea the bootloader is corrupted (as I understand it, fastboot communicates directly with the bootloader). From what I've been reading, looks like you'd need to use the sahara protocol - possibly within qboot? - to communicate (https://github.com/openpst/sahara) and valid, signed programmer files for the hard coded primary bootloader to accept a flash (http://vm1.duckdns.org/Public/Qualcomm-Secure-Boot/Qualcomm-Secure-Boot.htm). Unfortunately, the blankflash we have, even though it appears to fulfil both those criteria, isn't accepted (maybe because the programmer is detecting the bootloader is newer than the expected version)

echo92 said:
The fact fastboot can't detect further supports the idea the bootloader is corrupted (as I understand it, fastboot communicates directly with the bootloader). From what I've been reading, looks like you'd need to use the sahara protocol - possibly within qboot? - to communicate (https://github.com/openpst/sahara) and valid, signed programmer files for the hard coded primary bootloader to accept a flash (http://vm1.duckdns.org/Public/Qualcomm-Secure-Boot/Qualcomm-Secure-Boot.htm). Unfortunately, the blankflash we have, even though it appears to fulfil both those criteria, isn't accepted (maybe because the programmer is detecting the bootloader is newer than the expected version)
Click to expand...
Click to collapse
Bro, i want to know more about programmer.mbn ,where can i find about it? Can we upgade the programmer version(by taking help from new rom) without affecting the signature and certificate. I am new to programming and all this, so sorry for silly talks

ADITYA_KUMAR said:
Bro, i want to know more about programmer.mbn ,where can i find about it? Can we upgade the programmer version(by taking help from new rom) without affecting the signature and certificate. I am new to programming and all this, so sorry for silly talks
Click to expand...
Click to collapse
I'm not sure where to find more info about the programmer.mbn, you could have a look at the other Moto forums where they've had similar hard bricks occur and have tried/trying the same things as us: https://forum.xda-developers.com/moto-z-play/how-to/guide-unbrick-moto-z-play-t3618492 https://forum.xda-developers.com/moto-g/general/generating-singleimage-bin-t3008047
But as far as I understand it, you cannot change anything within the programmer without affecting the signature (others have tried in the other unbricking thread that's running: https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016/page17 ). We'd likely need an updated programmer.mbn/blankflash straight from Motorola, and as we're not supposed to have these tools, Motorola will likely say no to any request, unfortunately, and just refer you to a service centre for repairs.

echo92 said:
I'm not sure where to find more info about the programmer.mbn, you could have a look at the other Moto forums where they've had similar hard bricks occur and have tried/trying the same things as us: https://forum.xda-developers.com/moto-z-play/how-to/guide-unbrick-moto-z-play-t3618492 https://forum.xda-developers.com/moto-g/general/generating-singleimage-bin-t3008047
But as far as I understand it, you cannot change anything within the programmer without affecting the signature (others have tried in the other unbricking thread that's running: https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016/page17 ). We'd likely need an updated programmer.mbn/blankflash straight from Motorola, and as we're not supposed to have these tools, Motorola will likely say no to any request, unfortunately, and just refer you to a service centre for repairs.
Click to expand...
Click to collapse
Bro, may i use qpst tool or mtk tool for flashing stock rom directly.

ADITYA_KUMAR said:
Bro, may i use qpst tool or mtk tool for flashing stock rom directly.
Click to expand...
Click to collapse
No idea onto how to use those tools, sorry. I only know a little bit when it comes to unbricking devices and the fact that there's a lot of old/unhelpful information around regarding unbricking doesn't help.

echo92 said:
No idea onto how to use those tools, sorry. I only know a little bit when it comes to unbricking devices and the fact that there's a lot of old/unhelpful information around regarding unbricking doesn't help.
Click to expand...
Click to collapse
Thank you bhai(hindi for brother), i think you are a genius :good: . i have only one phone and have a low budget so i am going to repair it. plzz keep posting me with updates regarding unbricking. Again thanku so much brother.

How to upgrade to .67 version ?

Hi ! I was using custom roms on my phone then I switched back to stock nd also I relocked my bootloader but after that I cant update it to .67 version I am on .35 version. I am from India and everyone has received OTA for .67 version but mine doesnt shows any update. Any help ?
Sent from my Moto G (5) Plus using Tapatalk

deepu28792 said:
Hi ! I was using custom roms on my phone then I switched back to stock nd also I relocked my bootloader but after that I cant update it to .67 version I am on .35 version. I am from India and everyone has received OTA for .67 version but mine doesnt shows any update. Any help ?
Click to expand...
Click to collapse
Same problem here.

You'd have to be on the NPN25.137-15 firmware to have received the .67 update - if you're on the retin software channel, I think the .35 version is the incorrect one for your channel (.35 is for US devices, if I recall). Therefore, you'll likely not get any updates, and if you were to flash the NPNS25.137-35-5 update, may mean you cannot downgrade in future.
If you're on the retin channel and want the .67 update, then unfortunately you'll likely have to unlock your bootloader (wiping your device) then attempt to flash NPN25.137-15 (do your research first and ensure this does not brick your device), then you should be able to update to NPN25.137-67. As far as I know, there is no fastboot ROM currently for NPN25.137-67 so re-locking the bootloader is not possible at the moment.

echo92 said:
You'd have to be on the NPN25.137-15 firmware to have received the .67 update - if you're on the retin software channel, I think the .35 version is the incorrect one for your channel (.35 is for US devices, if I recall). Therefore, you'll likely not get any updates, and if you were to flash the NPNS25.137-35-5 update, may mean you cannot downgrade in future.
If you're on the retin channel and want the .67 update, then unfortunately you'll likely have to unlock your bootloader (wiping your device) then attempt to flash NPN25.137-15 (do your research first and ensure this does not brick your device), then you should be able to update to NPN25.137-67. As far as I know, there is no fastboot ROM currently for NPN25.137-67 so re-locking the bootloader is not possible at the moment.
Click to expand...
Click to collapse
I downgraded my phone from .35 to .15 version and now I have received OTA and have successfully updated to .67 version.
Sent from my Moto G (5) Plus using Tapatalk

deepu28792 said:
I downgraded my phone from .35 to .15 version and now I have received OTA and have successfully updated to .67 version.
Sent from my Moto G (5) Plus using Tapatalk
Click to expand...
Click to collapse
Please provide instructions for this, I am unable to downgrade.

earlycray said:
Please provide instructions for this, I am unable to downgrade.
Click to expand...
Click to collapse
Its really simple. Just download the firmware .15 from the link below and flash it. If you have already re-locked ur bootloader thn flash the full firmware and if not yet unlocked use the commands provide in the thread. The .15 version shows for Brazil but it works with our Indian version too. Try it I did the same.
https://forum.xda-developers.com/showthread.php?t=3638835
Press thanks if I helped you.

deepu28792 said:
Its really simple. Just download the firmware .15 from the link below and flash it. If you have already re-locked ur bootloader thn flash the full firmware and if not yet unlocked use the commands provide in the thread. The .15 version shows for Brazil but it works with our Indian version too. Try it I did the same.
https://forum.xda-developers.com/showthread.php?t=3638835
Press thanks if I helped you.
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I am receiving this error. I was previously on NPNS25.137-35-5.

earlycray said:
I am receiving this error. I was previously on NPNS25.137-35-5.
Click to expand...
Click to collapse
then you cant downgrade. I thought you were on .35, I have read it somewhere that if u r on .35-5 then you cannot downgrade
Sent from my Moto G (5) Plus using Tapatalk

deepu28792 said:
then you cant downgrade. I thought you were on .35, I have read it somewhere that if u r on .35-5 then you cannot downgrade
Sent from my Moto G (5) Plus using Tapatalk
Click to expand...
Click to collapse
I will have to wait for full image of -67 to upgrade, correct ?

earlycray said:
I will have to wait for full image of -67 to upgrade, correct ?
Click to expand...
Click to collapse
I'm not even sure if you can flash the NPN25.137-67 image even, MarckozZ downgraded from NPNS25.137-35-5 to NPN25.137-15 and attempted to take the OTA to NPN25.137-67, which hard bricked their device. https://forum.xda-developers.com/showpost.php?p=73029820&postcount=70
Though they were able to recover their device, it looks like updating is very risky/not possible after the recovery: https://forum.xda-developers.com/g5-plus/help/moto-g5-plus-hard-bricked-recognized-t3636457
Now, the fastboot of NPN25.137-67 might not let you flash the GPT and bootloader over the NPNS25.137-35-5 and let you flash the rest of the OS, but that's asking for trouble when an OTA arrives - hopefully the OTA scripts would check for a bootloader/GPT mismatch, but they may not and you could run into a hard brick.

echo92 said:
the fastboot of NPN25.137-67 might not let you flash the GPT and bootloader over the NPNS25.137-35-5
Click to expand...
Click to collapse
Wow. I dun goofed. What are my options at this point? Also, could you kindly please explain the above ?

earlycray said:
Wow. I've done goofed. What are my options at this point? Also, could you kindly please explain the above ?
Click to expand...
Click to collapse
As I understand it, fastboot has checks built in that communicate with the bootloader and verify whether the GPT/bootloader of the firmware you're attempting to flash can be flashed. If you have a newer bootloader on your device, then your bootloader may refuse to permit the flash of the older bootloader (especially with the NPNS25.137-35-5 update, which appears to have a critical security bug fixed in the May 2017 patch, so downgrading would allow you to re-open that bug, which Motorola wouldn't want).
Now, you can get around this, in theory, by omitting GPT and bootloader from your fastboot flash, so fastboot may flash the rest of your system. However, now you'll have a NPN25.137-67 system, but a GPT/bootloader from NPNS25.137-35-5. Though this should run, it becomes very risky if you choose to install an OTA and forget you have this mismatch; the OTA will think you have the NPN25.137-67 firmware and patch accordingly, which may seriously corrupt your bootloader. In that case, you'll have to use a blankflash to recover your device (if it works) and be unable to recover your data, unless it was held on a SD card mounted in portable storage. I've seen similar scenarios occur with the Moto G4 (luckily we've just got a new blankflash to recover from the June 2017 security patch) and with the Moto Z Play.
In summary, you could flash the NPN25.137-67 firmware when it comes out, but the mismatch makes updates very risky - I personally wouldn't use the fastboot updates in this situation. You might wish to look into the TWRP flashables of the NPN25.137-67, as they'll update the system side of things (and most if not all the functions of your device should work as though you were still on stock NPN25.137-67), but without the risk of bricking your device. Granted, you'll have to unlock and flash TWRP in this situation though, and you will no longer be able to flash OTA updates, though hopefully the TWRP flashable maintainer will update the TWRP flash file to the newest OTA.
I'm not aware of other options besides keeping an eye out for NPNS25.137-35-5 updates, unfortunately, as your device is off the official update path Later on, Motorola may unify firmware updates into one global file, but for the time being, just be careful (and also be aware that the patch situation is a bit confusing!). On the other hand, at least you've got a May security patch

If I simply stuck to the current firmware, what would happen? The NFC chip appears to be working even tho this is the us? Model.

earlycray said:
If I simply stuck to the current firmware, what would happen? The NFC chip appears to be working even tho this is the us? Model.
Click to expand...
Click to collapse
Hang on, which model of the Moto G5 Plus are you using?
Cause depending on the model, you might actually be on the right firmware and not need the -67 update (which is usually only for retin, Indian retail) devices...
To clarify, as far as I know:
retin (I think retla too?) devices should be on NPN25.137-67 (March 2017 security patch)
retus devices should be on NPNS25.137-33-5 (May), NPNS25.137-35-5 (May) or NPN25.137-43-5 (Verizon specific, March)
reteu devices should be on NPNS25.137-33-5 (May)
From your previous posts you've got a XT1685?

That is correct. However it was purchased in Australia. And judging by some Australian tech forums the latest fw is -67.

[Help Me] Moto G5 Plus Hard Bricked & Solved

Hello All,
Recently my device Moto G5 Plus Hard Bricked and was not opening. When I plug data cable to laptop or Charger LED light was blinking. I have searched many threads on this Forum but finally, somehow I managed to recover my Device. (This thread Helped me to recover my device https://forum.xda-developers.com/showpost.php?p=73268905) And the thing is BlankFlash (@vache) for POTTER was not working on my device and I have searched thread and got to know that I have downgraded update and due to this my device has eaten up my bootloader. So now one of the members of this forum (@Rakesh1b) helped me to recover my device as he said "Now I need to blank flash (ALBUS) with Moto Z2 Bootloader (it has worked with many members and me too) on Moto G5 Plus and it worked fine and I cannot Install Stock ROM on POTTER rather I have to install Stock ROM which STOCK TOM DEODEXED DEBLOATED" then I can Install any Custom ROM on it! You can see the picture I have attached to this thread.
Now my actual problem is "I want to go back to my STOCK ROM (I need OTA Updates though) with Relock Bootloader" Can anyone help me to figure out these problems which I am facing now.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Bro sorry to say this that until we get an updated blankflash which has an updated bootloader and gpt version of potter which has either the same or higher version that we had in our mobile when they're bricked i.e mostly after May or June or same as April version of bootloader we cannot get back to stock room because you know that the bootloader and gpt are of motoz so obviously the ROM won't bootup due to mismatch so let's hope and wait for the developers or any member until they release a leaked Motorola blankflash with updated blankflash there is nothing we can do until then but just wait in xda for motog4 also same happened when many had updated through OTA to take nougat and they had downgraded before that and they had waited for 4 to 6 months till and updated blankflash is leaked but in our case we are very lucky that Albus blankflash worked and we are able to use our phones ,potter blankflash will work for them who had not updated bootloader when flashing different ROMs the npns35-5,npns33-3,.67 OTA had updated bootloader and gpt if we have not tried any of these then vaches blankflash will work.
I am confident that an updated blankflash with the bootloader and gpt of the updated version will be released but we have to wait till then we can only hope that vache sees our problem then there is chance because the current blankflash is even provided by him thanks a ton vache without your help many potters would have been in coma.
Guys first don't hardbrick your mobile read everything carefully then flash if they're safe. That they won't mess with your bootloader.
Caution:
* Don't take OTA after downgrading ROM.
* Flash any stock ROMs through fastboot only.
And there is not much problem with custom ROMs which are twrp flashable.

Bhai, suppose if vache releases updated Blank Flash for Moto G5 plus with updated bootloader then can we Install NPN137.15 then get OTA directly to NPN137. 67??? Is this possible if he releases the updated one???
Also please inform me if vache releases updated version of Blank Flash. Because badly I'm in need of this. Hope you understand my pain !!!

If vache releases an updated blankflash with updated bootloader and gpt then you can flash npn15 through fastboot ROM but if you again try to take OTA then what happens is if the bootloader version in OTA is old compared to bldr version in blankflash then you will again successfully hardbrick your mobile now same blankflash can be used again to revive it back but the solution is when an updated blankflash comes then whatever stock ROMs we flash we have to just flash them using fastboot method in this method if we are on a latest available ROM and we try to downgrade to old version of ROM then fastboot will safely don't allow us to flash the old rom saying downgrade error or even it flashes it will leave the bootloader and gpt with the updated version and only flashes system images and you could boot up your downgraded ROM the thing is fastboot verifies and keeps us in safe zone but in the case of OTA it doesn't check all that but only checks if it is on the correct default ROM for which the OTA is released and patches the ROM with all the contents in it so we are risking taking the OTA so safe method is to flash only fastboot stock ROMs that will be released and stay with them if we are clear about the versions of bootloader gpt then we can take OTA there is no problem but many don't know that and they try and bricked their devices.
Hope you understood.

Dear posters... 3 things:
1. Please do NOT keep quoting the previous post - there's no point and it just slows page loads down.
2. Do NOT keep "mentioning" other members in your posts. This REALLY annoys those you have mentioned as their inbox gets full of repeated childish demands for attention. And guess what? They ignore them... and you.
3. Questions must be asked in the Q and A Forum. So moved.

If anyone finds the Blank Flash updated version for Moto g5+ with updated bootloader please let me know through this thread. I'll be thankful.

Can anyone help me to get a better camera quality on custom ROM

anthonyqwe said:
Can anyone help me to get a better camera quality on custom ROM
Click to expand...
Click to collapse
No Chance Bro, only on stock you can achieve...

@Rakesh1b Bro, as you know I'm using Albus bootloader in my potter. So can I use albus stock ROM in my potter??

?? bro I could understand your desperation there is no other way other than using twrp based stock ROMs or any custom ROMs for us u had been using debloated stock ROM since I bricked it is much more faster and stable than Moto stock images don't try any other ROMs which are not meant for motog5plus plus because there kernel source varies and configuration varies so don't try any other ROM and mess your potter u will make it totally unusable if even the current blankflash fails to work after installing any other ROM.
Hope you understood.
Be cool just enjoy your potter till new blankflash is released.
Bye..

@vache please help!!!

the best option we have since i also hardbricked and returned thanks to albus, is to wait for the release of Oreo, rather than using new blank flash, with oreo stock rom image (around 1.5 gb) and flashing it through fastboot we'll be able to return to stock since will have new updated recovery gpt and whatever is needed. by the monent as Rakesh1b said debloated is better than stock faster cleaner etc and the otas.......not necesary really i have installes lineage 14.1 (nougat based) and works awesome, maybe ill move to 15 once more stable and may be even before the offic( oreo based) ial release of oreo.

LLegion said:
the best option we have since i also hardbricked and returned thanks to albus, is to wait for the release of Oreo, rather than using new blank flash, with oreo stock rom image (around 1.5 gb) and flashing it through fastboot we'll be able to return to stock since will have new updated recovery gpt and whatever is needed. by the monent as Rakesh1b said debloated is better than stock faster cleaner etc and the otas.......not necesary really i have installes lineage 14.1 (nougat based) and works awesome, maybe ill move to 15 once more stable and may be even before the offic( oreo based) ial release of oreo.
Click to expand...
Click to collapse
Gpt and bootloader from Oreo won't be enough. Since they're using albus bootloader and partitions, overwriting gpt and bootloader from Oreo, will simply throw errors. Definitely will be needed a blankflash specifically for potter; then any Oreo firmware will work for flashing.

Moto G5s Hard bricked blankflash files and loader.img required.

Rakesh1b said:
bro I could understand your desperation there is no other way other than using twrp based stock ROMs or any custom ROMs for us u had been using debloated stock ROM since I bricked it is much more faster and stable than Moto stock images don't try any other ROMs which are not meant for motog5plus plus because there kernel source varies and configuration varies so don't try any other ROM and mess your potter u will make it totally unusable if even the current blankflash fails to work after installing any other ROM.
Hope you understood.
Be cool just enjoy your potter till new blankflash is released.
Bye..
Click to expand...
Click to collapse
Did Vache realesed Potter BlankFlash? I have find something in potter folder http://cloud.vache-android.com/Moto/potter/blankflash/ is this the original blank flash of potter?

mohammadsharfuddin said:
Did Vache realesed Potter BlankFlash? I have find something in potter folder http://cloud.vache-android.com/Moto/potter/blankflash/ is this the original blank flash of potter?
Click to expand...
Click to collapse
Nope, it's the one that he developed. There's no official one yet.

thedr34m13 said:
Nope, it's the one that he developed. There's no official one yet.
Click to expand...
Click to collapse
I thought that blankflash, with the April 2017 timestamp on it, was the original potter one, as it looked to be leaked with the original factory image? Regardless, we can't make blankflashes sadly (needing to be signed by Motorola, as I understand it) and that potter blankflash is far too old to be used in most cases.
If we're really lucky, perhaps a factory Oreo stock ROM might be leaked which may have an original Oreo potter blankflash. If not (i.e. it's just a standard fastboot ROM) then we'd have to wait for a leak or spend money on a new motherboard.

echo92 said:
I thought that blankflash, with the April 2017 timestamp on it, was the original potter one, as it looked to be leaked with the original factory image? Regardless, we can't make blankflashes sadly (needing to be signed by Motorola, as I understand it) and that potter blankflash is far too old to be used in most cases.
If we're really lucky, perhaps a factory Oreo stock ROM might be leaked which may have an original Oreo potter blankflash. If not (i.e. it's just a standard fastboot ROM) then we'd have to wait for a leak or spend money on a new motherboard.
Click to expand...
Click to collapse
It it's an original one then I heard wrong, but like you said it's outdated. I'm really hoping that stock Oreo fixes all the imei issues and such.
How does the pixel series do in terms of going back to stock? Google does have full firmware images online, but do they completely restore the phone?

thedr34m13 said:
It it's an original one then I heard wrong, but like you said it's outdated. I'm really hoping that stock Oreo fixes all the imei issues and such.
How does the pixel series do in terms of going back to stock? Google does have full firmware images online, but do they completely restore the phone?
Click to expand...
Click to collapse
Yeah, depends on what we'll get when the Oreo fastboot ROMs come out. I still am not entirely sure what causes the loss of IMEI (would be nice to know to prevent a future repeat), though like you I hope that the updated modems fix those unfortunate IMEI issues.
I think the fastboot images for Pixel devices do let you restore back to stock without wiping data (unless you're coming from a custom ROM, then general advice seems to be a full wipe). Like with our Moto devices, you can do the equivalent of omitting 'fastboot erase userdata' with removing -w in the flashing script: https://forum.xda-developers.com/pixel-xl/how-to/info-how-restored-to-stock-soft-t3494478
I guess the provision of updated firmware makes it less likely that a user flashes old firmware and then gets hard bricked by an old OTA flashing over a newer bootloader, and also Google appears to prevent you from flashing older firmware anyway: https://forum.xda-developers.com/pixel-2-xl/how-to/guide-unlock-flash-root-pixel-2-xl-t3702418
That being said, there appear to be some Pixels that have been hard bricked (though looks like hardware failure than flashing something the Pixel didn't like: https://forum.xda-developers.com/pixel/help/pixel-bricked-replaced-phone-returned-t3776752

Stuck in bootloop
I blankflashed the albus bootloader on my potter. But when i flash the stock potter rom, it doesn't boot up and goes into boot loop . Only shows the unlocked bootloader warning again and again. Also i am unable to flash the twrp of either potter or albus. It says unsigned bootloader.
Can u provide the link of the stock rom that u flashed?