had to give back note 7 so im resurrecting my note 3 thats still on mje/4.3 - Verizon Galaxy Note 3 Q&A, Help & Troubleshooting

I was wondering if someone could give me a direct answer because i cant seem to find one sifting through the forums.
I originally rooted with root master back when i got the phone. it is still on mje/4.3 stock build. things look a little more complicated then i remember, since my phone hasn't seen an update in over 3 years. I originally froze the verizon ota updates with tibackup, along with all the other bloatware.
My main questions are:
1. I would like to get a 6.0 Rom that looks like the note 7 did, can i do it all with odin and just flash a bunch of files?
2. Do I need a custom recovery like twrp or cwm?
3. I've read about an activation lock but can't find it in my menus, did it not exist yet on 4.3?
If anyone can point me in the right direction I would appreciate it, I really dont wanna brick my phone.

I'm still on MJE firmware, but using an older CM13 (temasek) ROM. So it's marshmallow but no Touchwiz or other Samsung add-ons.
Here are the MJE-specific issues:
1) You can't boot N* or O* stock kernels because of differences in the way that DTB (device tree blobs) are packed into the boot image. I've played with re-packing the boot images, but the kernels seem to run off into the weeds after a few tens of seconds.
2) TowelRoot works on MI9 through NC2(leak) but I think not thereafter - if you wanted to avoid a bootloader firmware upgrade but re-flash via Odin the MJE firmware for "starting from scratch" purposes, you have a means to re-root that does not require a PC.
3) If you retain the MJE bootloader, use the TWRP (hltevzw) -4.3 recovery; the -4.4 recovery will not boot, presumably due to issues similar to (1) above.
4) Not specific to MJE - but important - is the fact that if you want to boot either a custom kernel or custom recovery, you need to unlock your bootloader first. You can unlock your bootloader from any rooted ROM, but be aware that flashing stock firmware with Odin thereafter will re-lock the bootloader.
If you were to "start from scratch" but upgrade to more recent stock software before rooting, be aware that there is no publicly available root for NC4 or NK1; you would need to install stock OB6 or OF1, and follow that by using those "yemen" rooting tools. (Are they safe to use? I don't know frankly)
I am assuming that the N* and O* series bootloaders are backwards compatible with regard to device tree booting issues (see #1 above), because the temasek CM13 roms (having a custom kernel) boot on both OF1- and (my) MJE- bootloader phone. I guess that means it uses a "4.3" DTB packing in the boot image.
You are probably going to want to use TiBu to make important backups, and also copy everything off the phone that is important to you. You should assume that if anything goes wrong, an Odin re-install and factory reset are in the device's future.
Having said all this, I'm not sure there is such a thing as a ROM which "looks like Note7" - this is an old phone with almost no ROM developers left. There might have been more, but the bootloader unlock was achieved 2+ years after the phone's release, and most of the active developers moved on to new phones before that happened.
good luck

Related

Can't upgrade to Lollipop

I have an SM-N900V model running Android 4.4.4. When I check for system updates, I get this message: "Your Samsung SM-N900V is up to date." Is Lollipop not available for my model, or is there another way to install it? I'd also be interested in rooting and installing a custom rom, if that's yet possible for this model number.
There's aways Odin if you don't mind the backing up / restoring of the (internal, psuedo-) SDcard.
There are rooting methods for OF1 in the general forum. (Some folks find them to posses "unsavory" characteristics e.g. use of an unknown executable on a PC)
I can't remember whether towelroot works on 4.4. That might be worth a try just before committing to a full stock / wipe Odin experience.
The bootloader unlock thread is in the general forum. Read THE ENTIRE THREAD before you start in on it.
If you are able to root your current ROM, you can unlock your bootloader* and immediately flash twrp to the recovery partition which would allow you to backup your current ROM (and use "flashable" installer .zip bundles e.g. the SuperSU installer)
*Note that booting a custom kernel or recovery after bootloader unlock blows the knox warranty flag, and this has implications beyond the cosmetics; even after reverting to pure stock there is a loss of functionality relating to TrustZone behavior. (I was using an app that isn't particularly security related, and it blows up with qseecom errors even on stock roms now. Not sure why it ends up invoking TZ functionality as it doesn't do encryption nor use any auth key credentials; but there you go - unintended consequences.)
There are a ton of recent Android vuln disclosures that more than likely are exploitable, but it would appear that there are no Note3 devs looking at them.
good luck

Need help flashing ROM on I545

Hi it is the first time I am flashing Android ROM. I have done some reading already. Before I start, I still have a few questions and also want to make sure I am doing it right.
I own the Galaxy S4 Verizon I545. It is running Samsung ROM Android 4.4.2, Baseband I545VRUFNC5. My goal is to flash a new ROM with recent Android versions, hopefully 7.1.1 (but I would settle with Marshmallow if that is more stable), it can be close to AOSP, I don't need ROMs with extra features.
In my understanding, the bootloader is locked, it will only load signed kernels and recovery. And then the kernel would load the system. In order to flash the system, it is best to flash the recovery first with TWRP. TWRP is modded with loki hack so it would load with the locked bootloader.
So here are my questions:
1. Does it matter which firmware/baseband I am currently on? For some phones (LG G2) I heard newer firmware fixed the loki hack. Should I update to the latest Samsung rom or leave it at NC5?
2. I don't see many ROM posted for the i545, which one is the most recent and reasonable stable? The Cyanogen website is down, should I try LineageOS?
3. I see different instructions for flashing TWRP. Can I flash it with just Odin? Some instruction mentioned rooting the phone first with KingRoot or other root, and then use dd. Does the phone have to be rooted? (I prefer not to if it is not necessary)
4. If after I flashed recovery, it fails to boot into TWRP, what can I do to restore everything to default?
5. The kernel will be untouched in the process right? I am only flashing recovery and system ROM, and the kernel will work fine with the new system ROM?
Here are the step and software I plan to use:
0. reset the phone to factory
1. use Odin to flash TWRP 2.8.7
2. download a ROM compatible with I545 and place it on the phone
3. flash the system using TWRP
Any feedback would be appreciated.
PS: Also I have a LG G2 D801. I would flash that phone instead if it is easier. I just want to get started and learn some things along the way.
https://forum.xda-developers.com/galaxy-s4-verizon
Oh Sorry. Didn't notice there is another forum. Should I repost there?
Yes.
1. Yes, it does matter. As you said, newer firmwares have fixed the exploits which make the phone harder to hack.
2. Any ROM should support your phone. They are generally unified.
3. In the name of anything holy, do not root with KingRoot. If you want to root, then the only way to go is CF-Auto-Root.
Rooting is sometimes necessary because recovery won't always install with Odin.
4. Flash stock ROM.
5. Kernels are specific to ROMs. So no, the kernel won't be untouched.

Second time trying to root phone and I want to make sure I've got this 100%

Alright so I apologize in advance if this thread has been posted a million times and believe me, I've spent the last 4-5 days combing through to make sure I could get every detail of this process done correctly. So I'm not just blindly asking for instructions on how to root my phone. Apologies also if I posted this in the wrong place.
For starters, I'm using Moto G4 Plus XT1641 6.0.1 Build Number MPJ24.139-23.3. My carrier is Koodo in Canada (unsure if that's important but I'll need to being it up again for another point). The files I downloaded were from a youtube tutorial and this includes ADB program, TWRP img 3.0.2.0, supersu zip 2.46 and Motorola Drivers 2.5.4, SOME of which I think may have been outdated versions.
So Saturday night I tried to root my phone with those files. I followed some more guides, I unlocked my bootloader and I think I mostly did everything right except for getting the right supersu version as I've seen up to version 2.82. I think this may have been my first mistake but maybe someone correct me if I'm wrong? My other mistake was not making a backup in TWRP. I'd read about possible wifi problems after rooting so I grabbed the elemental package and possibly even flashed that wrong. I can't even remember the steps of what I did but I'm sure it was all wrong.
Main point, after all that I didn't have ccell service, wifi, etc. The common problems that arise when you do it wrong. I ended up just taking my phone in and getting a new phone. Exact same one, same model. And this brings me to where I am now. I've downloaded some new files and I want to make sure that I've got everything right as to avoid misunderstanding some key parts to the process.
Minimal ADB and Fastboot 1.4.2, twrp-3.1.1-0-athene.img, SuperSU-v2.82-201705271822, Motorola Drivers 2.5.4, and lastly XT1641_ATHENE-TELUS_MPJ24.139-23.3_cid50_subsidy-TELUS_CFC.xml. Notice how that last one says Telus? It's the parent company of Koodo so I'm hoping I can use that as a failsafe.
I think I've covered all the key points so to sum up:
1. Did I use the wrong supersu zip version and could that be a reason why I had no wifi/cell service? Is that also possible because I may have flashed the wrong carrier athene file?
2. Are the files I have downloaded now the correct ones I need and up to date?
3. I'm following this guide. With the files I have downloaded, is it still a correct step by step process? Are there other guides that work better?(thats not a knock on the original guide I'm refering to). https://forum.xda-developers.com/moto-g4-plus/how-to/root-systemless-rooting-supersu-2-74-2-t3405772
I think I've got the right know how and tools to root my phone but I'm just nervous of doing what I did before again and would like some reassurance that I'm doing it right. I've just come from jailbreaks, the world of root is much different. I appreciate any help or tips you guys can throw me!
Hmm, that's odd how you lost radio signal when you rooted, did you obtain radio signal back after you unrooted?
A few things I noted:
1)You may wish to update your device to a newer build, you might get an OTA inviting you to update to MPJ24-139-63 (or 139-64), which was the latest Marshmallow build. Once you've rooted, you will not be able to install OTA updates until you have unrooted and restored the stock recovery (from the same build as you currently have). If you get an OTA notification for any build beginning with NPJ, that's for Nougat.
2)If you plan to stay on Marshmallow, you don't need the ElementalX kernel - a custom kernel like ElementalX is compulsory on Nougat, whereas Marshmallow is not as strict with regards to rooting.
3) I hope the carrier ROM is okay, though from other reports, flashing the incorrect ROM can corrupt device partitions, leaving with no IMEI/no service/no FP. We have possible ways of repairing that though.
The tools you've downloaded seem to be okay and Bender's guide is still okay - even though the tools they've used are out of date - so the general procedure would be (up to you if you've updated MM at this point):
Install adb on your computer.
Boot your device to the bootloader.
Flash TWRP 3.1.1 athene (either the offficial TWRP or an unofficial build from shreps or oadam11) as directed.
Reboot to recovery (to make sure the recovery sticks).
Back up all partitions on your device, make the name descriptive.
Make another backup of the boot partition - this contains your stock kernel, useful for switching root manager.
Once the backups have been made, flash SuperSU v2.82.
Wipe cache/Dalvik
Reboot.
echo92 said:
Hmm, that's odd how you lost radio signal when you rooted, did you obtain radio signal back after you unrooted?
A few things I noted:
1)You may wish to update your device to a newer build, you might get an OTA inviting you to update to MPJ24-139-63 (or 139-64), which was the latest Marshmallow build. Once you've rooted, you will not be able to install OTA updates until you have unrooted and restored the stock recovery (from the same build as you currently have). If you get an OTA notification for any build beginning with NPJ, that's for Nougat.
2)If you plan to stay on Marshmallow, you don't need the ElementalX kernel - a custom kernel like ElementalX is compulsory on Nougat, whereas Marshmallow is not as strict with regards to rooting.
3) I hope the carrier ROM is okay, though from other reports, flashing the incorrect ROM can corrupt device partitions, leaving with no IMEI/no service/no FP. We have possible ways of repairing that though.
The tools you've downloaded seem to be okay and Bender's guide is still okay - even though the tools they've used are out of date - so the general procedure would be (up to you if you've updated MM at this point):
Install adb on your computer.
Boot your device to the bootloader.
Flash TWRP 3.1.1 athene (either the offficial TWRP or an unofficial build from shreps or oadam11) as directed.
Reboot to recovery (to make sure the recovery sticks).
Back up all partitions on your device, make the name descriptive.
Make another backup of the boot partition - this contains your stock kernel, useful for switching root manager.
Once the backups have been made, flash SuperSU v2.82.
Wipe cache/Dalvik
Reboot.
Click to expand...
Click to collapse
Thanks for the reply, it helps me feel a little more confident in what I'm doing. I didn't get my cell service back as I just took my phone into Koodo and they just gave me a new one. A few questions.
Are there some clear guides on how to recover from lost wifi and cell service? I've seen a few but it appears they all have different directions so as a newcomer to Android it does seems a bit confusing to what the right way to do it is. I'm also hoping someone can chime in on the Telus carrier IMG file as that seems to be my backup in case anything goes terribly wrong again. I'd hate to have to bring my phone back again a second time. Also, is it an easy process to make a backup of the kernel in TWRP? I've figured out how to make a backup of the normal partition, just hoping backing up the kernel is just as easy.
I think I'm near ready to take the root plunge in the coming days. It's good to see such a strong community here. Totally different from the jailbreak scene.
lemonlimejones said:
Thanks for the reply, it helps me feel a little more confident in what I'm doing. I didn't get my cell service back as I just took my phone into Koodo and they just gave me a new one. A few questions.
Are there some clear guides on how to recover from lost wifi and cell service? I've seen a few but it appears they all have different directions so as a newcomer to Android it does seems a bit confusing to what the right way to do it is. I'm also hoping someone can chime in on the Telus carrier IMG file as that seems to be my backup in case anything goes terribly wrong again. I'd hate to have to bring my phone back again a second time. Also, is it an easy process to make a backup of the kernel in TWRP? I've figured out how to make a backup of the normal partition, just hoping backing up the kernel is just as easy.
I think I'm near ready to take the root plunge in the coming days. It's good to see such a strong community here. Totally different from the jailbreak scene.
Click to expand...
Click to collapse
Hmm, I'm not aware of any guides specifically dealing with lost Wi-Fi and lost mobile signal. There are a few posts where we've had some success in getting radios back, but it involves either hex editing https://forum.xda-developers.com/showpost.php?p=72340548&postcount=98 or flashing hw, modem or fsg partitions from a working device (in this case, XT1641) The instances I've seen of lost Wi-Fi/mobile signal appear to have occurred during a stock ROM fastboot flash, but hoping someone can chime in as to whether it was just flashing the wrong region firmware or something else.
If you want to back up your kernel in TWRP:
Boot to TWRP
Tap 'Backup' on the main menu
Select only the 'boot' partition - this is the partition that contains your kernel (should be stock and clean if you've not rooted).
Rename the file to remind you it's your kernel.
Swipe to back up.
If you need to revert to this kernel, unroot first (depending on your root manager, you may have to boot and then unroot. I recall SuperSU unroots via the SuperSU app settings), then boot to TWRP.
Tap 'Restore' on the main menu
Navigate to your boot backup
Flash your boot backup
You should now have a clean stock kernel, so if you wish to switch root managers, you should be able to obtain root with your new root manager. We want a clean kernel (no modifications made) since uninstalling the old root may leave traces of root on your existing kernel, and thus may cause issues if you re-root with a different manager.
Good luck in rooting
echo92 said:
Hmm, I'm not aware of any guides specifically dealing with lost Wi-Fi and lost mobile signal. There are a few posts where we've had some success in getting radios back, but it involves either hex editing https://forum.xda-developers.com/showpost.php?p=72340548&postcount=98 or flashing hw, modem or fsg partitions from a working device (in this case, XT1641) The instances I've seen of lost Wi-Fi/mobile signal appear to have occurred during a stock ROM fastboot flash, but hoping someone can chime in as to whether it was just flashing the wrong region firmware or something else.
If you want to back up your kernel in TWRP:
Boot to TWRP
Tap 'Backup' on the main menu
Select only the 'boot' partition - this is the partition that contains your kernel (should be stock and clean if you've not rooted).
Rename the file to remind you it's your kernel.
Swipe to back up.
If you need to revert to this kernel, unroot first (depending on your root manager, you may have to boot and then unroot. I recall SuperSU unroots via the SuperSU app settings), then boot to TWRP.
Tap 'Restore' on the main menu
Navigate to your boot backup
Flash your boot backup
You should now have a clean stock kernel, so if you wish to switch root managers, you should be able to obtain root with your new root manager. We want a clean kernel (no modifications made) since uninstalling the old root may leave traces of root on your existing kernel, and thus may cause issues if you re-root with a different manager.
Good luck in rooting
Click to expand...
Click to collapse
That's perfect thank you so much. Am I right to assume that if I get into a jam then I can just restore/reflash my backups and I'll be back to normal?
To be safe, flash the ElementalX kernel before rooting.
reCoded said:
To be safe, flash the ElementalX kernel before rooting.
Click to expand...
Click to collapse
See this is where I get confused, the guy above you said ElementalX isn't needed on Marshmallow but you say i should use it anyway? I've seen a few differing opinions on what should and shouldn't be done, just not sure which one is the right answer.
lemonlimejones said:
See this is where I get confused, the guy above you said ElementalX isn't needed on Marshmallow but you say i should use it anyway? I've seen a few differing opinions on what should and shouldn't be done, just not sure which one is the right answer.
Click to expand...
Click to collapse
ElementalX v0.07 is not required on Marshmallow (provided you are planning on staying on 6.0.1), you can root the stock ROM kernel. You may wish to flash the ElementalX kernel anyway as this custom kernel gives you more control and tuning options compared to the stock kernel. On stock Nougat, because the anti-rooting kernel security is much stricter and enforced (whereas on Marshmallow I don't think it's enforced), then you need ElementalX or vegito or a custom kernel to bypass the security, by in effect replacing the stock secure kernel with a kernel that doesn't have those restrictions. Without replacing the stock kernel on stock Nougat systems, you can run into a bootloop.
As an MM kernel as mentioned before has weaker security regarding rooting, it's up to you if you choose to root the stock kernel or ElementalX.
I've rooted MM (MPJ24.139-63) in the past with SuperSU (v2.79) and only used TWRP and SuperSU.
In response to your other post, the backups should get you out of a jam, since what you're doing should only affect the partitions you've backed up previously (they in theory shouldn't go anywhere near your modem, bootloader or critical firmware). Bear in mind that the TWRP backup if restored in full will revert your messages and data to that backup. You may wish to use Titanium Backup or other tools to take occasional snapshots of your apps data that you can restore should you have to roll back.
lemonlimejones said:
See this is where I get confused, the guy above you said ElementalX isn't needed on Marshmallow but you say i should use it anyway? I've seen a few differing opinions on what should and shouldn't be done, just not sure which one is the right answer.
Click to expand...
Click to collapse
If you're on Nougat, then you should use ElementalX. If you're on Marshmallow, you don't need it.
echo92 said:
ElementalX v0.07 is not required on Marshmallow (provided you are planning on staying on 6.0.1), you can root the stock ROM kernel. You may wish to flash the ElementalX kernel anyway as this custom kernel gives you more control and tuning options compared to the stock kernel. On stock Nougat, because the anti-rooting kernel security is much stricter and enforced (whereas on Marshmallow I don't think it's enforced), then you need ElementalX or vegito or a custom kernel to bypass the security, by in effect replacing the stock secure kernel with a kernel that doesn't have those restrictions. Without replacing the stock kernel on stock Nougat systems, you can run into a bootloop.
As an MM kernel as mentioned before has weaker security regarding rooting, it's up to you if you choose to root the stock kernel or ElementalX.
I've rooted MM (MPJ24.139-63) in the past with SuperSU (v2.79) and only used TWRP and SuperSU.
In response to your other post, the backups should get you out of a jam, since what you're doing should only affect the partitions you've backed up previously (they in theory shouldn't go anywhere near your modem, bootloader or critical firmware). Bear in mind that the TWRP backup if restored in full will revert your messages and data to that backup. You may wish to use Titanium Backup or other tools to take occasional snapshots of your apps data that you can restore should you have to roll back.
Click to expand...
Click to collapse
Right on, I think I feel comfortable with this now! One more question though, with newer versions of SuperSU is it still necessary to make the command echo systemless=true or was that mostly for older versions? Also if that part is needed, should I run SuperSU from the data folder in TWRP?
lemonlimejones said:
Right on, I think I feel comfortable with this now! One more question though, with newer versions of SuperSU is it still necessary to make the command echo systemless=true or was that mostly for older versions? Also if that part is needed, should I run SuperSU from the data folder in TWRP?
Click to expand...
Click to collapse
The 'echo systemless=true', as I understand it, isn't required on SuperSU 2.79 or newer, so if you're flashing 2.82, you should be able to flash as is without having to run the command too Also makes uninstalling easier!

[mini-GUIDE] BRICKED / DOWNGRADE / SAME / UPGRADE - also ALTERNATIVE to RSDlite

I am not responsible for your bricked phone or pigeon poo on your toupe. Do at your own risk.
Many thanks to @SupahCookie for idea and motivation!
INTENTIONALLY DOES --NOT-- LOCK BOOTLOADER!!!
Get factory images here:
https://forum.xda-developers.com/mo...ock-images-t3736767/post75236696#post75236696
THIS GUIDE IS FOR FACTORY/STOCK ROMs - NOT YOUR AVERAGE CUSTOM ROM which may not have bootloaders!!! (thanks!!!!! @echo92 )
FIX:
IF YOU ARE ABLE TO GET TO FASTBOOT THIS SHOULD WORK.
IF YOU HAVE 8.x bootloaders AND ARE DOWNGRADING TO 7, use "Alternative to RSDlite" below.
1 boot to win - 7 or 10 works fine.
2 boot phone to fastboot, and connect phone to computer.
3 start RSDlite
pick a ROM. I believe I used a 7.1.1 rom
3Nov9-ADDISON_NPNS26.118-22-2-8_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
RSDlite installed it and fixed the problem.
- -
I was then able to use RSDlite to install @rafikowy 's signed 8.0 . - going up from 7 to 8.
- -
- -
If you are on 8.x bootloaders and want to go to 7.x bootloaders, use this (RSDlite throws an error and stops):
ALTERNATIVE TO RSDlite:
1 I used 7zip to extract that 7.1.1 zip (or any ROM zip) into a folder x,
2 add all the adb and fastboot junk to folder x,
3 add the attached file (rename it to flash.bat) to folder x.
4 boot phone to fastboot and connect to computer.
5 click on flash.bat - it throws a lot of "slot" errors but works just fine.
6 reboot your phone if it hasn't already and go through the 7.x install stuffs.
7 you will not show an IMEI if you are coming from an 8.x bootloader. However, it IS there.
NOTE: you may need to add a line to the flash.bat if there are more/less sparsechunk's in your FACTORY/STOCK ROM...
THIS IS NOT FOR CUSTOM ROMs!!!!!!!
EDIT: 3-8-19: I just did this myself to go back very briefly to 7.1 - be sure you don't flash TWRP to it if your going to take OTAs - it will brick it. boot to TWRP if you need TWRP briefly: fastboot boot twrpimg.img
----------
If you can boot to fastboot screen, you can do anything.
Never OTA a ROM if you have modified recovery (TWRP, etc) or if magisk is present.
https://forum.xda-developers.com/mo...p-flashing-t3813498/post77011495#post77011495
I changed the attached file to add pause and reboot and exit to make it slightly more automated.
I have successfully used this many times going back and forth. If you can boot to fastboot screen, you can save your phone and flash anything you want.
You may wish to advise users that if they downgrade to Nougat not to use Nougat OTA updates. The reason being that a downgraded stock Oreo device may still have the Oreo bootloader on it. Thus, attempting to use Nougat OTA updates may hard brick their device (as the bootloader is likely corrupted, meaning no fastboot).
Users could either use the Feb 2018 NPN26.118-22-2-17 firmware from your link https://mirrors.lolinet.com/firmware/moto/addison/official/RETAIL/ as that was the last Nougat firmware (and thus no Nougat OTA updates) or avoid using OTA updates whilst downgraded.
echo92 said:
You may wish to advise users that if they downgrade to Nougat not to use Nougat OTA updates. The reason being that a downgraded stock Oreo device may still have the Oreo bootloader on it. Thus, attempting to use Nougat OTA updates may hard brick their device (as the bootloader is likely corrupted, meaning no fastboot).
Users could either use the Feb 2018 NPN26.118-22-2-17 firmware from your link https://mirrors.lolinet.com/firmware/moto/addison/official/RETAIL/ as that was the last Nougat firmware (and thus no Nougat OTA updates) or avoid using OTA updates whilst downgraded.
Click to expand...
Click to collapse
Interesting. I used the above GUIDE to go up and down a number of times on my phone (about 20 total) , installing and running on both 7 and 8, and then went down to a Nov 7.1.1 and let it ota all the way up to 8.0 and that is what I am using now. I found that when i used a factory zip, and the above procedure, it corrected the bootloaders to the appropriate version that i was flashing - either RSDlite or the more manual path which ignores the errors worked for me.
Using the above procedure , you get the correct bootloaders, which are in the zip.
Please correct me if i am wrong!
KrisM22 said:
Interesting. I used the above GUIDE to go up and down a number of times on my phone (about 20 total) , installing and running on both 7 and 8, and then went down to a Nov 7.1.1 and let it ota all the way up to 8.0 and that is what I am using now. I found that when i used a factory zip, and the above procedure, it corrected the bootloaders to the appropriate version that i was flashing - either RSDlite or the more manual path which ignores the errors worked for me.
Using the above procedure , you get the correct bootloaders, which are in the zip.
Please correct me if i am wrong!
Click to expand...
Click to collapse
That's intriguing - we saw previously on Z Play that users downgrading their stock firmware (e.g. https://forum.xda-developers.com/moto-z-play/help/hard-brick-moto-z-play-patch-abril-t3782927 )and then using OTA updates hard bricked their device (hence the number of users asking for a blankflash, as fastboot no longer works). I don't know if these users hard bricked by downgrading their firmware too far and then flashed an OTA radically different to their previous firmware, or whether it's a risk that's taken by any downgrading of firmware.
When you used fastboot, did you see any 'security downgrade errors' when you flashed the bootloader, and is your bootloader version now C180, as you've flashed the Oreo OTA?
echo92 said:
That's intriguing - we saw previously on Z Play that users downgrading their stock firmware (e.g. https://forum.xda-developers.com/moto-z-play/help/hard-brick-moto-z-play-patch-abril-t3782927 )and then using OTA updates hard bricked their device (hence the number of users asking for a blankflash, as fastboot no longer works). I don't know if these users hard bricked by downgrading their firmware too far and then flashed an OTA radically different to their previous firmware, or whether it's a risk that's taken by any downgrading of firmware.
When you used fastboot, did you see any 'security downgrade errors' when you flashed the bootloader, and is your bootloader version now C180, as you've flashed the Oreo OTA?
Click to expand...
Click to collapse
YES - that's why I wrote these 3 guides - before, it was quite possible to wind up with a bootloader mix - esp depending on the zip you use! - factory/stock only!!!
I added a line to the guide saying that it is only intended to be used for the factory/stock zips as these have (I believe) the bootloaders appropriate to the ROM.
Many thanks for pursuing this! - I wonder if we'll have to exclude certain ROMs that are in the factory lists?????
echo92 said:
That's intriguing - we saw previously on Z Play that users downgrading their stock firmware (e.g. https://forum.xda-developers.com/moto-z-play/help/hard-brick-moto-z-play-patch-abril-t3782927 )and then using OTA updates hard bricked their device
Click to expand...
Click to collapse
If you have TWRP (or I assume any custom recovery) present when you try to ota, it can download just fine and then reboot to the update. I had TWRP and wound up in a situation where my phone would only boot to twrp no matter what I flashed or restored. I booted phone to fastboot, RSDlite'ed that 11-09-17 factory zip and all was well. In that particular case I did not fully install 7.x but immediately RSDlite'ed rafikowy's 8.0 signed stock and went on with my testing. Since then I always boot to TWRP rather than intalling it and do my thing. (thanks @jceballos )
When you used fastboot, did you see any 'security downgrade errors' when you flashed the bootloader, and is your bootloader version now C180, as you've flashed the Oreo OTA?
Click to expand...
Click to collapse
Sorry - since it throws a million errors I never look at it if it works.
The particular build I am on at the moment - is BL: C1.82
This one started from that Nov '17 build and ota'ed all the way to 8.0 Apr.
I root and unroot as needed per rafikowy's method but using a boot to TWRP - never an install TWRP.
I'll put up a new guide ref ota and recovery and brick.
KrisM22 said:
If you have TWRP (or I assume any custom recovery) present when you try to ota, it can download just fine and then reboot to the update. I had TWRP and wound up in a situation where my phone would only boot to twrp no matter what I flashed or restored. I booted phone to fastboot, RSDlite'ed that 11-09-17 factory zip and all was well. In that particular case I did not fully install 7.x but immediately RSDlite'ed rafikowy's 8.0 signed stock and went on with my testing. Since then I always boot to TWRP rather than intalling it and do my thing. (thanks @jceballos )
Sorry - since it throws a million errors I never look at it if it works.
The particular build I am on at the moment - is BL: C1.82
This one started from that Nov '17 build and ota'ed all the way to 8.0 Apr.
I root and unroot as needed per rafikowy's method but using a boot to TWRP - never an install TWRP.
I'll put up a new guide ref ota and recovery and brick.
Click to expand...
Click to collapse
1) If you have TWRP, then using an OTA will fail - as you've not got stock recovery (and likely other modifications, including possibly a system partition set to read-write status). As you noted, having TWRP seems to cause a bootloop when rebooting - I'm not sure if the OTA sets a boot flag to stay in recovery until the update is completed. For the G4/Plus, there's a possible solution by wiping the misc partition but I don't know if there's a similar partition for Z Play devices: https://forum.xda-developers.com/moto-g4/help/troubleshooting-twrp-boot-loop-ota-t3714325
The only other solution I've seen is a clean flash of the stock ROM to get your device booting properly.
Booting to TWRP rather than flashing would mean your stock recovery is still present on your device. The only downside is if you need to make modifications, you'd need your computer to boot to TWRP.
2)BL C1.82 seems to be the bootloader provided by the Oreo April 2018 security patch update, so your device looks to be on the right bootloader. It's still curious that the Nov 2017 firmware worked whereas countless other 'factory' stock ROMs caused hard bricks when downgraded to and then OTA updates were installed.
As you mentioned, custom ROMs don't have bootloaders and thus don't care about your bootloader version usually (though I've seen some ROMs require a certain bootloader). However, stock ROMs and stock OTA updates do have bootloaders, which is why downgrading can be risky.
echo92 said:
1) If you have TWRP, then using an OTA will fail - as you've not got stock recovery (and likely other modifications, including possibly a system partition set to read-write status). As you noted, having TWRP seems to cause a bootloop when rebooting - I'm not sure if the OTA sets a boot flag to stay in recovery until the update is completed. For the G4/Plus, there's a possible solution by wiping the misc partition but I don't know if there's a similar partition for Z Play devices: https://forum.xda-developers.com/moto-g4/help/troubleshooting-twrp-boot-loop-ota-t3714325
The only other solution I've seen is a clean flash of the stock ROM to get your device booting properly.
Booting to TWRP rather than flashing would mean your stock recovery is still present on your device. The only downside is if you need to make modifications, you'd need your computer to boot to TWRP.
2)BL C1.82 seems to be the bootloader provided by the Oreo April 2018 security patch update, so your device looks to be on the right bootloader. It's still curious that the Nov 2017 firmware worked whereas countless other 'factory' stock ROMs caused hard bricks when downgraded to and then OTA updates were installed.
As you mentioned, custom ROMs don't have bootloaders and thus don't care about your bootloader version usually (though I've seen some ROMs require a certain bootloader). However, stock ROMs and stock OTA updates do have bootloaders, which is why downgrading can be risky.
Click to expand...
Click to collapse
Downgrading is a piece of cake if you don't use RSDlite - it throws an error and stops. Using the bat file it can happily throw all the errors it wants and all I care is at the end I have what I want.
It does indeed change the entire environment when you bat file the zip contents. You can bat file to get from 8 to 7 and then use RSDlite to flash a different 7 OR 8 zip file. There is no resulting difference in whether you RSDlite it or bat file it - the bat file simply comes from the .xml file that is within the zip. There is very little or no difference between that among addison factory/stock zips. Other zips are different (custom ROMs.)
Grab any factory/stock zip for addison and expand it and you will see modems, bootloaders, indeed absolutely everything you would find on that phone if you went to a store and bought it. SupahCookie simply added a couple lock command lines because it was intended for folks who somehow thought that if phone was locked they could take it back to the store and get their money back. Or some such. I found that ATT folk didn't care if you were on CM or whatever if you just needed to swap SIMs or whatever.
I DON'T want to lock the phone as it prevents me from modifying forever. Oh yeah that reminds me I was going to post the obligatory guide (again) about how to flash a white boot logo so you don't get that message - it's still there LOL but since the font is in white, you can't see it.
I have a Moto Z2 Play and used this to get out of a rather sticky situation.. My IEMI shows 0 now and I'm curious if there's a way to fix this? Also, You say you've done OTA updates? My phone is telling my I have some, is it safe to try?
Necrowr said:
I have a Moto Z2 Play and used this to get out of a rather sticky situation.. My IEMI shows 0 now and I'm curious if there's a way to fix this? Also, You say you've done OTA updates? My phone is telling my I have some, is it safe to try?
Click to expand...
Click to collapse
Thanks for feedback and great on success.
IMEI will show zero if using oreo, It will show again if using N. Remember that if you go from O to N you need to use the "Alternative to RSD" as RSD will simply throw an error and stop.
If you have TWRP and/or Magisk you must get rid of them before ota - if twrp present you will soft brick and have to do alternative again - flash a stock recovery. Simply uninstalling/flash magisk will probably not be enough - it will likely d/l but error part way through update. If you are sitting on rafikowy's stock oreo, and haven't modified it, you should be fine. I know Apr and June are out there. I flashed his stock 8.0 and took June fine. Z2 should be no different though of course I can't guarantee it
If you have success, let us know what you have done so others looking in will know. Thanks!
KrisM22 said:
Thanks for feedback and great on success.
IMEI will show zero if using oreo, It will show again if using N. Remember that if you go from O to N you need to use the "Alternative to RSD" as RSD will simply throw an error and stop.
If you have TWRP and/or Magisk you must get rid of them before ota - if twrp present you will soft brick and have to do alternative again - flash a stock recovery. Simply uninstalling/flash magisk will probably not be enough - it will likely d/l but error part way through update. If you are sitting on rafikowy's stock oreo, and haven't modified it, you should be fine. I know Apr and June are out there. I flashed his stock 8.0 and took June fine. Z2 should be no different though of course I can't guarantee it
If you have success, let us know what you have done so others looking in will know. Thanks!
Click to expand...
Click to collapse
I actually flashed to this: ALBUS_C_7.1.1_NPS26.118-24_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip Which is a 7.1.1 variant and it is showing 0 when I check settings and when I dial *#06#. However upon connecting to the computer and running mfastboot getvar imei it returned a value. I only did the steps above which would mean I don't have TWRP or Magisk (when I fastboot and click recovery I get "no command")
****** Additional information *********
XT1710-01 Duel Sim Variant
I started your steps, only being able to access fastboot. The device would throw an error (I don't recall exactly but it ended up showing me them in the bootloader logs) whenever I tried to start it, or go to recovery. #DefinitelyThoughtItWasDead
Necrowr said:
I actually flashed to this: ALBUS_C_7.1.1_NPS26.118-24_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip Which is a 7.1.1 variant and it is showing 0 when I check settings and when I dial *#06#. However upon connecting to the computer and running mfastboot getvar imei it returned a value. I only did the steps above which would mean I don't have TWRP or Magisk (when I fastboot and click recovery I get "no command")
****** Additional information *********
XT1710-01 Duel Sim Variant
I started your steps, only being able to access fastboot. The device would throw an error (I don't recall exactly but it ended up showing me them in the bootloader logs) whenever I tried to start it, or go to recovery. #DefinitelyThoughtItWasDead
Click to expand...
Click to collapse
What rom was on phone when you got it and what have you done to it? Has it ever run 8.x?
original country of phone?
The bat file will always throw a lot of slot errors.
https://mirrors.lolinet.com/firmware/moto/albus/official/RETUS/
or
https://mirrors.lolinet.com/firmware/moto/albus/official/RETAIL/
might have some stock ROMs of interest...
KrisM22 said:
What rom was on phone when you got it and what have you done to it? Has it ever run 8.x?
original country of phone?
The bat file will always throw a lot of slot errors.
might have some stock ROMs of interest...
Click to expand...
Click to collapse
It had 7.1.1 stock. I rooted it, and then flashed Resurrection Remix (which was yes 8.1 I believe) and the upgraded bootloader. I then found out my service wouldn't work with that.. so I attempted to flash back to stock which gave me a flurry of issues.. eventually getting to nothing but fastboot working. Flashed back to working with your guide to 7.1.1
If it helps in in fastboot it tells me BL: C0.CD
Necrowr said:
It had 7.1.1 stock. I rooted it, and then flashed Resurrection Remix (which was yes 8.1 I believe) and the upgraded bootloader. I then found out my service wouldn't work with that.. so I attempted to flash back to stock which gave me a flurry of issues.. eventually getting to nothing but fastboot working. Flashed back to working with your guide to 7.1.1
If it helps in in fastboot it tells me BL: C0.CD
Click to expand...
Click to collapse
Custom ROMs won't usually update the bootloader (even if they are newer) as stock ROMs typically only have the bootloader firmware.
You could look into flashing the stock Oreo albus 8.0 ROM https://forum.xda-developers.com/z2-play/how-to/fastboot-rom-oreo-retail-via-fastboot-t3786153 or the 8.0 June 2018 firmware https://forum.xda-developers.com/z2-play/how-to/fastboot-rom-albusretail8-0-0opss27-76-t3822195 but please check that firmware has been released for your device variant.
I don't know if updating your baseband to stock Oreo formally may fix your IMEI issue.
Necrowr said:
It had 7.1.1 stock. I rooted it, and then flashed Resurrection Remix (which was yes 8.1 I believe) and the upgraded bootloader. I then found out my service wouldn't work with that.. so I attempted to flash back to stock which gave me a flurry of issues.. eventually getting to nothing but fastboot working. Flashed back to working with your guide to 7.1.1
If it helps in in fastboot it tells me BL: C0.CD
Click to expand...
Click to collapse
"BL: C0.CD" even right after flashing that albus 7.1.1 using "alternative" above?
What happens if you flash one of the oreo roms from the links I gave you above?
Yeah, RR wouldn't change bootloaders... so you upgraded bootloaders independendently?- that could easily lead to a soft brick... -
I read RR on Z2 and it says nothing about bootloaders even though it says 8.1 based, so i wonder if it needs 7.x bootloaders? I did not read entire thread...
In a reverse, I would wonder if you put an 8 on there if you wouldn't see your IMEI. (On the Z if you flash 8 You won't see the IMEI until you return to 7.)(wondering if z2 is reversed)
KrisM22 said:
"BL: C0.CD" even right after flashing that albus 7.1.1 using "alternative" above?
What happens if you flash one of the oreo roms from the links I gave you above?
Yeah, RR wouldn't change bootloaders... so you upgraded bootloaders independendently?- that could easily lead to a soft brick... -
I read RR on Z2 and it says nothing about bootloaders even though it says 8.1 based, so i wonder if it needs 7.x bootloaders? I did not read entire thread...
In a reverse, I would wonder if you put an 8 on there if you wouldn't see your IMEI. (On the Z if you flash 8 You won't see the IMEI until you return to 7.)(wondering if z2 is reversed)
Click to expand...
Click to collapse
Yes, right after flashing that is the BL that fastboot is showing me. I don't recall updating the bootloader so to speak, however RR did require an updated variant of twrp which I flashed 3.2.2 I believe to get (unsure if that would have changed the bootloader or not). I also tried flashing a stock Oreo (which you've stated stock Roms usually only have the bootloaders so maybe somewhere during this process I updated it?). I wish I had all the notes for what I did to give more precise information, but I'm in a position where I really need my phone so I kinda just panicked and started flashing things when my service wouldn't work.
I'm highly considering trying to run an OTA (though very afraid of bricking). - On a side note though, it wouldn't even tell me I had OTA's until I did the steps in the original post here (doing the different 7.1.1. and 8.0 flashes, it wouldn't ever tell me I had updates, and now it does).
*** Edit ***
Looks like I'm able to enter stock recovery, which makes me believe everything is stock at the moment.
Necrowr said:
Yes, right after flashing that is the BL that fastboot is showing me. I don't recall updating the bootloader so to speak, however RR did require an updated variant of twrp which I flashed 3.2.2 I believe to get (unsure if that would have changed the bootloader or not). I also tried flashing a stock Oreo (which you've stated stock Roms usually only have the bootloaders so maybe somewhere during this process I updated it?). I wish I had all the notes for what I did to give more precise information, but I'm in a position where I really need my phone so I kinda just panicked and started flashing things when my service wouldn't work.
I'm highly considering trying to run an OTA (though very afraid of bricking). - On a side note though, it wouldn't even tell me I had OTA's until I did the steps in the original post here (doing the different 7.1.1. and 8.0 flashes, it wouldn't ever tell me I had updates, and now it does).
*** Edit ***
Looks like I'm able to enter stock recovery, which makes me believe everything is stock at the moment.
Click to expand...
Click to collapse
If you flashed a stock O that would have changed bl to O, but doing the above with the stock 7.1.1 would have changed them back to N. No matter (other than academic) that you don't remember the path - flashing a stock anything reverts it to that point in time. However, IMEI may have been moved - don't know. It will likely show on EITHER 7.x or 8.x stock - just don't know which.
If you flash a stock 8.x from those links I gave you above, it should offer you ota, ASSUMING there are any at this point in time(Z has 2). Adding Magisk at any point seems to hose you for receiving any more ota's - don't understand why, even with magisk uninstall, so that would mean going back to the latest stock and losing what you have (which is why I try to take a TBPro and copy that backup to PC (because re-flashing 8.x stock will likely reset internal storage.).
yes, if you enter stock recovery, you are likely at stock, though you could reflash the latest 7 or 8 stock to be sure, depending on which you want to use as base. Since 8 is having security fixes released, I choose 8 and will likely have no more interest (no time!) in 7.
So, ran the OTA and it was fine running the update and staying on N. I also downloaded the OTA for Oreo, when trying to update the recovery error'd out. It looked like the error said "Error in modem unexpected results" or something similar.
Necrowr said:
So, ran the OTA and it was fine running the update and staying on N. I also downloaded the OTA for Oreo, when trying to update the recovery error'd out. It looked like the error said "Error in modem unexpected results" or something similar.
Click to expand...
Click to collapse
did it offer to let you d/l it again? you could try that.
However, there exist O stock zips in those links I gave you so you could just flash the latest...

Bootloader updates for Android 6+ on an S5 Dev Edition: needed, or not?

Hi there,
I have a rooted Verizon S5 Developer Edition (CID 15, if it matters) running Android 4.4.4 (NK2, bootloader NCG). I am trying to get this phone up-to-date, with root, on at least the newest VZW stock Android release for now, and probably LineageOS in the future.
I’ve been spending hours searching through the forums trying to understand what is the deal with the bootloader requirements for these newer Android versions, and I’m stumped. In this QL1 thread it’s said that the bootloader doesn’t ever need to be changed to install a newer OS version, and LineageOS doesn’t mention anything about needing to do bootloader updates in its installation instructions. However, the ROMs from jrkruse with full installation instructions, like their QA1 ROM, clearly state that the bootloader “MUST BE ON PD1+”.
Can someone please clarify this apparent contradiction for me, so I know the correct way to proceed? I’ve tried reading through the hundreds of pages of comments on those threads as well as the bootloader unlocking thread, and there’s so much noise that I’ve been unable to find the answer, if it already exists.
Also, I know this is kind of an academic point, but if it’s true that the bootloader does need updating, is there a way to get an updated bootloader without changing the phone’s CID, since it is already an unlocked Dev Edition phone? (Search results are absolutely overwhelmed with people talking about “make your S5 a Dev Edition S5” so I have been unable to find any information about the actual Dev Edition phones.) The SamsungCID code seems to append a hard-coded blob of data onto the end of any bootloader; is this really all that needs to be done? The extra data at the end of my original NCG bootloader is 668 bytes, not 256 bytes, so it’s not obvious to me if it really is enough to just copy it straight over.
Thank you!
1CDT said:
Hi there, I have a rooted Verizon S5 Developer Edition (CID 15, if it matters) running Android 4.4.4 (NK2, bootloader NCG)..........
Click to expand...
Click to collapse
Since you've got a G900V device, with a CID15, you are able to unlock the bootloader. The following threads OP provides the instructions for unlocking the bootloader.
https://forum.xda-developers.com/showthread.php?t=3561529
From there you will be able to install TWRP Recovery and thus install a Custom Firmware like LineageOS.
Regarding the updates, the G900V is the only GS5 variant that doesn't require the Bootloader to be updated. Regarding the Firmware Baseband Modem Updates, the following thread provides them all that you can flash via Odin.
https://forum.xda-developers.com/showthread.php?t=3926673
Good Luck!
~~~~~~~~~~~~~~~
Unless asked to do so, PLEASE don't PM me regarding support. Sent using The ClaRetoX2 Forum App on my Sanyo Juno device.
Hi Ibuprophen,
Thank you for your help!
Ibuprophen said:
Since you've got a G900V device, with a CID15, you are able to unlock the bootloader. The following threads OP provides the instructions for unlocking the bootloader. […]
Click to expand...
Click to collapse
The phone already has a TWRP recovery installed, and is a Dev Edition phone so the bootloader is factory unlocked. As such, my understanding is that those unlocking instructions don’t apply unless I need a newer bootloader. Is this correct?
Ibuprophen said:
Regarding the updates, the G900V is the only GS5 variant that doesn't require the Bootloader to be updated. […]
Click to expand...
Click to collapse
It’s interesting to hear that the G900V is the only variant which doesn’t require the bootloader to be updated along with the system and baseband software, since the other threads I linked with the bootloader requirement are also G900V-specific. Do you know it’s not the case because you’ve personally used an Android 6+ ROM with a pre-PD1 bootloader? I know I could just flash the new ROM to Try It And See, but I’m hoping to avoid wasting time and energy on something that other experienced people know won’t work.
Thanks again!
1CDT said:
Hi Ibuprophen, Thank you for your help! The phone already has a TWRP recovery installed, and is a Dev Edition phone so the bootloader is factory unlocked..........
Click to expand...
Click to collapse
I only stated that the Bootloader doesn't have to be updated for the G900V device.
The Baseband Modem Firmware does require updates (as their released).
Though, it's not harmful to this device to flash the Bootloader, it won't do anything different and you'll actually end up locking the bootloader again and have to go through the process of unlocking it.
The Verizon variant just passes on the same Bootloader image from one Firmware to the next one. This is just a Verizon thing and they don't make sense for allot of what they do.
If you want to update the Bootloader, that's, of course, up to you...
~~~~~~~~~~~~~~~
Unless asked to do so, PLEASE don't PM me regarding support. Sent using The ClaRetoX2 Forum App on my Sanyo Juno device.
So I will keep working on this, but I can’t currently verify that the bootloader doesn’t need to be updated on SM-G900V, based on the work I did today. So far I can only verify that LineageOS will boot and work with an NCG bootloader, except for some bug where it destroys data in the EFS partition which I suppose is not actually bootloader-related
First, after backing everything up in TWRP, I started with the baseband modem and firmware updates to QL1. The steps for this were:
1. Boot into download mode (vol dn + home + power)
2. Run heimdall flash --RECOVERY recovery.img --BOOT boot.img --no-reboot using the files from the stock QL1 image (any of them will do)
3. Hold power button to turn off phone
4. Pull battery
5. Boot into download mode
6. Verify that “Current Binary” is ”Samsung Official”
7. Run heimdall flash --MODEM modem.bin --APNHLOS NON-HLOS.bin --RPM rpm.mbn --SBL1 sbl1.mbn --DBI sdi.mbn --TZ tz.mbn using the files from the stock QL1 image (or from the baseband firmware thread, they are the same)
8. Hold power button to turn off phone
9. Pull battery
10. Boot phone back into download mode
11. Run heimdall flash --RECOVERY twrp.img to reinstall TWRP
12. Hold power button to turn off phone
13. Boot into recovery (vol up + home + power) to verify the flash and to ensure it doesn’t get erased
14. Reboot to system
This caused every application to crash on boot in the already-installed NK2 system ROM. I don’t know if I did something wrong, or if they are just incompatible; I did wipe cache and dalvik cache from TWRP, but that didn’t make things work. (I had the same problem when I had to roll back everything later; more on that in a bit.)
Since everything suddenly was broken, I assumed that the baseband update must have been successful (I later verified in LineageOS that it was indeed successful), so I followed the LineageOS instructions to sideload LineageOS and Open GApps from TWRP. This was successful and the OS installed and booted to the setup wizard.
The first problem I encountered at this point was that the mobile network wasn’t connecting during the setup wizard. I skipped this step of the wizard and continued on to configuring the OS settings. Eventually the mobile network connected while I was doing that.
When I started installing apps, I noticed that it took a very long time to receive SMS from the network. Upon investigation I discovered that LineageOS was using legacy CDMA for voice and SMS. I did research and discovered that LineageOS does not, and apparently never will, support VoLTE on klte. Since this is a non-starter for me (Verizon will be LTE-only by the end of next year, so I have no idea how LineageOS klte will exist at that point) I opted to wipe and load stock QL1.
While preparing to load stock QL1, I restarted the phone accidentally, and noticed that I’d permanently lost mobile network connectivity. I tried restoring my EFS backup from TWRP; this didn’t seem to fix the problem. I was going to install stock QL1 system anyway due to the VoLTE problem so I didn’t think about it any more.
At this point I followed these steps to flash stock QL1:
1. Boot to download mode
2. Run heimdall --BOOT boot.img --SYSTEM system.img --no-reboot using files from the stock QL1 image
3. Turn off phone
4. Reboot to recovery
5. Wipe data, cache, dalvik cache
6. Reboot to system
After 15 minutes at the Verizon logo while the dalvik cache was built, the setup wizard started and mobile network connection was working and I was able to complete initial setup for stock QL1. However, the system was not OK:
1. Wifi would not enable
2. The back and menu buttons did not work
3. When the phone locked, after a while, the notification LED turned red and the phone wouldn’t respond to any button presses (I had to pull the battery; this happened multiple times)
At this point I needed a working phone, so I found an NK2 stock image (this was difficult because all the links on xda-developers are dead and sammobile wants money for these old versions, so someone might want to reupload these!) and ran these steps to roll back:
1. The same steps above for installing the baseband modem and firmware, except using NK2 images and firmware
2. Boot to recovery
3. Wipe data, cache, dalvik cache
4. Restore NK2 TWRP backups of System, Boot, Data, EFS
5. Reboot to system
Instead of being fully restored, every app was crashing on boot again, like when I had updated the QL1 firmware and rebooted into the old NK2 system. I was finally able to get my full backup restored successfully by following these extra steps:
1. Boot to TWRP
2. Wipe Data
3. Reboot to system, until the setup wizard starts
4. Turn off the phone without running the wizard
5. Boot to TWRP
6. Restore Data
7. Reboot to system, everything is OK now
The hard buttons and wifi problem are noted by @jrkruse on the unlocking the bootloader thread. I had to get my phone back in a working state for tomorrow so I didn’t try the instructions to reflash the PD1 boot+recovery+firmware. I’m not actually sure if it’s correct today to reflash PD1 firmware instead of QL1 firmware; clarity here would be helpful. If anyone also sees a clear mistake in the steps I outlined above, I would be grateful to know that.
If I can’t get stock QL1 to not be broken, and it’s due to the bootloader requirement, then I guess I am stuck unless I start messing with the bootloader (given the “We still are unsure if changing the CID causes app store, verification, activation, provision, or other issues, everything you do is at your own risk!” warning, this means me trying to transplant my dev signature onto the EMMC 15 bootloaders even though my signature is a different size). I’m pretty terrified of doing that since there’s conflicting information about whether it’s possible to flash an old bootloader once you’ve upgraded past certain versions, and I haven’t learned yet how bricked the phone becomes if a bad bootloader is flashed. I know it’s not possible to flash old bootloaders on a retail device; is that true on Dev Edition devices too?
Thanks again for your help! I wish I had more positive news.
1CDT said:
Hi there,
I have a rooted Verizon S5 Developer Edition (CID 15, if it matters) running Android 4.4.4 (NK2, bootloader NCG). I am trying to get this phone up-to-date, with root, on at least the newest VZW stock Android release for now, and probably LineageOS in the future.
I’ve been spending hours searching through the forums trying to understand what is the deal with the bootloader requirements for these newer Android versions, and I’m stumped. In this QL1 thread it’s said that the bootloader doesn’t ever need to be changed to install a newer OS version, and LineageOS doesn’t mention anything about needing to do bootloader updates in its installation instructions. However, the ROMs from jrkruse with full installation instructions, like their QA1 ROM, clearly state that the bootloader “MUST BE ON PD1+”.
Can someone please clarify this apparent contradiction for me, so I know the correct way to proceed? I’ve tried reading through the hundreds of pages of comments on those threads as well as the bootloader unlocking thread, and there’s so much noise that I’ve been unable to find the answer, if it already exists.
Also, I know this is kind of an academic point, but if it’s true that the bootloader does need updating, is there a way to get an updated bootloader without changing the phone’s CID, since it is already an unlocked Dev Edition phone? (Search results are absolutely overwhelmed with people talking about “make your S5 a Dev Edition S5” so I have been unable to find any information about the actual Dev Edition phones.) The SamsungCID code seems to append a hard-coded blob of data onto the end of any bootloader; is this really all that needs to be done? The extra data at the end of my original NCG bootloader is 668 bytes, not 256 bytes, so it’s not obvious to me if it really is enough to just copy it straight over.
Thank you!
Click to expand...
Click to collapse
Hi, I'm the guy who did the bootloader unlock. It's kind of a complicated situation, upgrading bootloaders after having an unlocked retail bootloader. The issue is that once you have a dev device (CID + matching RSA signature, the extra 256 bytes), the bootloader write-protects the eMMC where aboot lives. Normally, if we wanted to upgrade the bootloader and maintain our unlocked bootloader, we'd grab the new bootloader, append our dev blob/signature, and just flash to the aboot partition.
The only way to get the newest bootloader is to flash the latest stock ROM (which locks your bootloader), and then unlock it again by rooting and appending the dev blob. I'm not sure if the latest ROMs can be rooted or not since I don't play with my S5 very often. You don't have to change the CID ever again. If you have a real dev device (you purchased it from Samsung as unlocked, not using our exploit), you will want to back up your device signature by just making a copy of the aboot partition. If this is the case for you, you can feel free to send me your aboot partition, and I'll carve out the signature that you need.
It's more so a limitation of the bootloader trying to prevent people from accidentally re-locking the bootloader. When Samsung signs the real dev device bootloaders, the dev blob/sig is apart of the code being signed, which means we can flash that in Odin while retaining your unlocked bootloader. We don't want to use an ancient bootloader, so this isn't useful. You can PM me if you want and I can walk you through the process, but it's pretty complicated so I feel better not posting the whole process and having people possibly brick their devices.
TL;DR
Just send me a PM and I'll walk you through everything. Don't flash or change anything if you have Developer Edition device that you purchased directly from Samsung. We want to preserve your device-unique "key".

Categories

Resources