Safe ways to get 3-button combo working - Galaxy S I9000 General

Hi,
I have been looking at 100% safe ways to get 3-button combo to get to recover/download screen.
I started this by downloading as many i9000 firmwares that I could find, and comparing them with what was on my phone.
After reading many other threads, I have discovered that:
1) boot.bin is stored in /dev/bml1 and is the Primary Boot Loader.
2) Sbl.bin is stored in /dev/bml4 and is the Secondary Boot Loader.
I used the "md5sum" program found on most Linux systems to compare different "boot.bin" and "Sbl.bin".
e.g.
md5sum -b boot.bin
445491b1aec42fe35f3a2505c4e74295 *boot.bin
I have 2 i9000 phones both are network unlocked.
One has Orange firmware on it
Orange firmware (downloaded from web):
445491b1aec42fe35f3a2505c4e74295 *boot.bin (no efused)
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
Orange firmware (actually on the phone)
0ff5571ed2dd51385cb1a5303991a1aa *bml1.dump (boot.bin efused)
5e4914239bcbf6c565129e5f1475b876 *bml4.dump (Sbl.bin)
Eclair standard firmware (downloaded from the web)
445491b1aec42fe35f3a2505c4e74295 *boot.bin
754854f2e84400704b49cbe470cbd671 *Sbl.bin
Aries firmware (That comes with Froyo, and also the recommended 3-button fix firmware)
445491b1aec42fe35f3a2505c4e74295 *boot.bin
3b86755ff4b6568d48c3c8064767dba2 *Sbl.bin
So, to avoid bricking a phone, you have to have "compatible" Primary and Secondary boot loaders.
The boot loaders that come in standard firmware must be compatible.
What you can see from the above.
1) My Orange phone has efused firmware, 3-button does not work, and the only difference between that and the standard Orange firmware downloadable from the web is actually only the boot.bin
Orange firmware (actually on the phone)
0ff5571ed2dd51385cb1a5303991a1aa *bml1.dump (boot.bin efused)
5e4914239bcbf6c565129e5f1475b876 *bml4.dump (Sbl.bin)
Orange firmware (downloaded from web):
445491b1aec42fe35f3a2505c4e74295 *boot.bin (no efused)
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
So, here I should be able to flash only the second boot.bin file (4454...) and not have to do the Sbl.bin file, and this should not brick my phone because the resulting boot.bin and Sbl.bin combination is a compatible combination.
2) All the boot.bin non-efused files are identical from both Eclair and Froyo.
So, once I have the
445491b1aec42fe35f3a2505c4e74295 *boot.bin
installed, I can then select any of the following Sbl.bin files and they will be compatible.
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
754854f2e84400704b49cbe470cbd671 *Sbl.bin
3b86755ff4b6568d48c3c8064767dba2 *Sbl.bin
I can use heimdall in Linux, so I can flash individual boot.bin files quite easily.
I have not done any flashing yet, but I think this safe step by step approach to getting to a 3-button combo working solution is probably a lot safer than some other approaches found on the web.
It has the added advantage that we can document known good combinations, and thus, we can be 100% sure it will not brick the phone.
We can also allow users to check their bml1 and bml4 image currently on their phone, and then they can immediately find out if it is a known good pair of boot-loaders, or some new, unknown pair, so to be cautious as it might brick their phones.
I am waiting to get a usb micro connector so that I can make a jig with the 301K resistor, before I try to recover a 3-button combo working.
Can anyone see any flaws with my approach?

midas5 said:
Hi,
I have been looking at 100% safe ways to get 3-button combo to get to recover/download screen.
I started this by downloading as many i9000 firmwares that I could find, and comparing them with what was on my phone.
After reading many other threads, I have discovered that:
1) boot.bin is stored in /dev/bml1 and is the Primary Boot Loader.
2) Sbl.bin is stored in /dev/bml4 and is the Secondary Boot Loader.
I used the "md5sum" program found on most Linux systems to compare different "boot.bin" and "Sbl.bin".
e.g.
md5sum -b boot.bin
445491b1aec42fe35f3a2505c4e74295 *boot.bin
I have 2 i9000 phones both are network unlocked.
One has Orange firmware on it
Orange firmware (downloaded from web):
445491b1aec42fe35f3a2505c4e74295 *boot.bin (no efused)
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
Orange firmware (actually on the phone)
0ff5571ed2dd51385cb1a5303991a1aa *bml1.dump (boot.bin efused)
5e4914239bcbf6c565129e5f1475b876 *bml4.dump (Sbl.bin)
Eclair standard firmware (downloaded from the web)
445491b1aec42fe35f3a2505c4e74295 *boot.bin
754854f2e84400704b49cbe470cbd671 *Sbl.bin
Aries firmware (That comes with Froyo, and also the recommended 3-button fix firmware)
445491b1aec42fe35f3a2505c4e74295 *boot.bin
3b86755ff4b6568d48c3c8064767dba2 *Sbl.bin
So, to avoid bricking a phone, you have to have "compatible" Primary and Secondary boot loaders.
The boot loaders that come in standard firmware must be compatible.
What you can see from the above.
1) My Orange phone has efused firmware, 3-button does not work, and the only difference between that and the standard Orange firmware downloadable from the web is actually only the boot.bin
Orange firmware (actually on the phone)
0ff5571ed2dd51385cb1a5303991a1aa *bml1.dump (boot.bin efused)
5e4914239bcbf6c565129e5f1475b876 *bml4.dump (Sbl.bin)
Orange firmware (downloaded from web):
445491b1aec42fe35f3a2505c4e74295 *boot.bin (no efused)
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
So, here I should be able to flash only the second boot.bin file (4454...) and not have to do the Sbl.bin file, and this should not brick my phone because the resulting boot.bin and Sbl.bin combination is a compatible combination.
2) All the boot.bin non-efused files are identical from both Eclair and Froyo.
So, once I have the
445491b1aec42fe35f3a2505c4e74295 *boot.bin
installed, I can then select any of the following Sbl.bin files and they will be compatible.
5e4914239bcbf6c565129e5f1475b876 *Sbl.bin
754854f2e84400704b49cbe470cbd671 *Sbl.bin
3b86755ff4b6568d48c3c8064767dba2 *Sbl.bin
I can use heimdall in Linux, so I can flash individual boot.bin files quite easily.
I have not done any flashing yet, but I think this safe step by step approach to getting to a 3-button combo working solution is probably a lot safer than some other approaches found on the web.
It has the added advantage that we can document known good combinations, and thus, we can be 100% sure it will not brick the phone.
We can also allow users to check their bml1 and bml4 image currently on their phone, and then they can immediately find out if it is a known good pair of boot-loaders, or some new, unknown pair, so to be cautious as it might brick their phones.
I am waiting to get a usb micro connector so that I can make a jig with the 301K resistor, before I try to recover a 3-button combo working.
Can anyone see any flaws with my approach?
Click to expand...
Click to collapse
Why get complicated testing md5 in the first place these days ? You can't flash one bootloader via stock recovery as an update.zip, since the package is not signed and 3e will not accept it. To get back to Recovery 2e or CWM you need to be rooted and many are still afraid to do that.
Also, a JIG won't help you if you get the wrong/incompatible pair of bootloaders flashed.
I see that you are willing to use Heimdall for flashing the bootloaders .. so my advice is to flash both in a single run, in a tested combination.
See my signature thread for details.

boot.bin tests
Hi,
I tried flashing with heimdall the primary boot "boot.bin".
It turns out that there are two sections to boot.bin.
The first 16384 bytes are the IBL or Initial Boot Loader.
The rest (offset 16384 onwards) are the PBL or Primary Boot Loader.
heimdall seems to only really change the PBL and not change the IBL.
After flashing boot.bin with heimdall, some of the first 16 bytes of /dev/block/bml1 had changed, none of the bytes from 0x10 to 0x3fff changed.
All the bytes from 0x4000 to the end of bml1 had changed.
Multiple attempts to flash the same boot.bin file gave identical results.
So, this might explain some bricked phones if there is somehow a mismatch between the IBL and the PBL.
Luckily, I do not have a bricked phone yet.
I will do some tests with Sbl.bin or the Secondary Boot Loader next.
I will also do some tests with Odin, to see if it can change the IBL.
I think some work needs to be done to heimdall to permit it to write the IBL as well as the PBL.
For those interested, on my phone, the current IBL is half the size of the factory Eclair boot.bin version. I have no idea why. Does anyone know?

midas5 said:
Hi,
I tried flashing with heimdall the primary boot "boot.bin".
It turns out that there are two sections to boot.bin.
The first 16384 bytes are the IBL or Initial Boot Loader.
The rest (offset 16384 onwards) are the PBL or Primary Boot Loader.
heimdall seems to only really change the PBL and not change the IBL.
After flashing boot.bin with heimdall, some of the first 16 bytes of /dev/block/bml1 had changed, none of the bytes from 0x10 to 0x3fff changed.
All the bytes from 0x4000 to the end of bml1 had changed.
Multiple attempts to flash the same boot.bin file gave identical results.
So, this might explain some bricked phones if there is somehow a mismatch between the IBL and the PBL.
Luckily, I do not have a bricked phone yet.
I will do some tests with Sbl.bin or the Secondary Boot Loader next.
I will also do some tests with Odin, to see if it can change the IBL.
I think some work needs to be done to heimdall to permit it to write the IBL as well as the PBL.
For those interested, on my phone, the current IBL is half the size of the factory Eclair boot.bin version. I have no idea why. Does anyone know?
Click to expand...
Click to collapse
Interesting, let me know if you're able to write the IBL with Odin.

my answer . Flash bell canada firmware with bootloaders , and voila you have download mode .Also Orange Branded Galaxy S user , I flashed first via spoof kies a bell 2.1 with bootloaders , and since then I had the 3 button working . Now I am rocking on Doc Rom .

OmerX,
Are you able to post a copy of your bml1 and bml4, together the the boot.bin and Sbl.bin that you used when flashing the phone.
I can then compare them with other boot loader images and get a better idea as to what is going on.

I saw this on another post.
Maybe this is protecting the IBL?
Does anyone have the source code of the IBL/PBL/SBL ?
The S5PC110 manual had some discouraging information:
2.1.2.4 Authentication for Secure JTAG Operation
S5PC110 supports Secure JTAG by using authentication signal of cortexA8 and coresight system.
To set the secure JTAG mode can program Secure JTAG key e-fuse bit.
• [79:0]: Secure JTAG hash key
• [80]: Secure JTAG lock on - 0: non-protection, 1: protected by Secure JTAG
Before authentication, the debugger should access Secure JTAG module mapped in debugger register map.

On the Orange I9000, bml5 and bml8 are empty. (All 0xff)
So, it seems that the SBL2 and the RECOVERY kernel do not exist.
This could explain why bricks occur. If the download fails, the PBL is supposed to try and recover using SBL2 and the RECOVERY kernel.
As these "recover" options do not exist, it could explain the much more likely bricks occurring on Orange phones.
I think the next safest step on my Orange I9000 is to flash with heimdall to SBL2 and the RECOVERY kernel. I can then copy the bml5 and bml8 off the phone and verify that the flash is complete using md5sum -b.
Once I am happy that the SBL2 and RECOVERY kernel are in place, I can then do the risky replacement of SBL1 (bml4)
But, as I do not have the source code to PBL and SBL, I cannot be sure of the algorithm the boot code uses to choose which step to do next. I.e. How it chooses SBL or SBL2 ? How is chooses bml7 or bml8 for the kernel?
Can anyone help here?

again . Flash Bell canada 2.1 update 1 with bootloaders , and than you can flash with 3 button woring anything you want .

Related

Flashboot All Other Atrix Firmwares On ATT Atrix

hi,
I confirm it, I successfully ported retail france firmware on my att atrix, any other atrix firmwares should work also. For now eveything is working, wifi, bluetooth, lapdock and so...
Once you unlocked your bootloader with the sbf that was gracefully shared last week, you can flash any partition on the phone, you can either use flashboot to flash bootloader but I didn't tried this last one
http://forum.xda-developers.com/showthread.php?t=1136261
and I have to say that there are big difference between att and retail firmwares
tan G said:
hi,
I confirm it, I successfully ported retail france firmware on my att atrix, any other atrix firmwares should work also. For now eveything is working, wifi, bluetooth, lapdock and so...
Once you unlocked your bootloader with the sbf that was gracefully shared last week, you can flash any partition on the phone, you can either use flashboot to flash bootloader but I didn't tried this last one
http://forum.xda-developers.com/showthread.php?t=1136261
and I have to say that there are big difference between att and retail firmwares
Click to expand...
Click to collapse
Thats good, do you mean flash .CMG files?
tan G said:
hi,
I confirm it, I successfully ported retail france firmware on my att atrix, any other atrix firmwares should work also. For now eveything is working, wifi, bluetooth, lapdock and so...
Once you unlocked your bootloader with the sbf that was gracefully shared last week, you can flash any partition on the phone, you can either use flashboot to flash bootloader but I didn't tried this last one
http://forum.xda-developers.com/showthread.php?t=1136261
and I have to say that there are big difference between att and retail firmwares
Click to expand...
Click to collapse
thats great news, but care to elaborate more?? As in in what way is it better?
Got an AT&T Atrix in France and my laptop dock (Azerty) arrives tonight.
I'm up with having a guide to do the same
And the French Rom is well optimized (less laggy, more battery and MMS works)
wouldn't mind trying this, care to put up a guide of what partitions to flash/how to get a hold of them from the retail SBFs/which SBF is best for this method and why? It would be greatly appreciated
thanks in advance
-DarkRyoushii
if i flash franch rom, boatloader turn lock?
aleve1983 said:
if i flash franch rom, boatloader turn lock?
Click to expand...
Click to collapse
no it doesn't, except if you don't know what your doing
DarkRyoushii said:
wouldn't mind trying this, care to put up a guide of what partitions to flash/how to get a hold of them from the retail SBFs/which SBF is best for this method and why? It would be greatly appreciated
thanks in advance
-DarkRyoushii
Click to expand...
Click to collapse
I can't make a tutorial it is like duplicating threads
so to extract smg files
http://forum.xda-developers.com/showthread.php?t=1135811
to flash the phones once you unlocked the bootloader
http://forum.xda-developers.com/showthread.php?t=1138092
I think the most important thing is to know which SMG to flash
1) system directory ...CG57.smg
2) data & preinstall directory CG62.smg
3) osh directory CG58.smg
??
Thanks but still confused. Guess I'll wait until the2dcour posts his pre rooted and unlocked 1.8.3 fast boot files and flash when gingerbread is released officially
Sent from my MB860
According to http://forum.xda-developers.com/showthread.php?t=1059643 i must extract smg's from the french sbf and rename :
CG56.smg -> boot.img
CG57.smg -> system.img
CG58.smg -> webtop.img
And if I understand the guide, I must do :
moto-fastboot flash boot boot.img
moto-fastboot flash system system.img
moto-fastboot flash webtop webtop.img
moto-fastboot -w
moto-fastboot reboot
I think it is the way to...
If a "dev" can confirm
Edit: no webtop .. looking at the 2.3.4 the webtop is CG61... i don't understand
Gregz78 said:
According to http://forum.xda-developers.com/showthread.php?t=1059643 i must extract smg's from the french sbf and rename :
CG56.smg -> boot.img
CG57.smg -> system.img
CG58.smg -> webtop.img
And if I understand the guide, I must do :
moto-fastboot flash boot boot.img
moto-fastboot flash system system.img
moto-fastboot flash webtop webtop.img
moto-fastboot -w
moto-fastboot reboot
I think it is the way to...
If a "dev" can confirm
Edit: no webtop .. looking at the 2.3.4 the webtop is CG61... i don't understand
Click to expand...
Click to collapse
Indeed if someone can confirm which CGxx.img files to flash and in which order that would be really helpfull.
Thanks
Can this be used to help international users unlock their bootloaders?
No
It helps AT&T phones to get other Rom (in this case the french Orange Rom). You need to have unlocked bootloader to do that.
Gregz78 said:
According to http://forum.xda-developers.com/showthread.php?t=1059643 i must extract smg's from the french sbf and rename :
CG56.smg -> boot.img
CG57.smg -> system.img
CG58.smg -> webtop.img
And if I understand the guide, I must do :
moto-fastboot flash boot boot.img
moto-fastboot flash system system.img
moto-fastboot flash webtop webtop.img
moto-fastboot -w
moto-fastboot reboot
I think it is the way to...
If a "dev" can confirm
Edit: no webtop .. looking at the 2.3.4 the webtop is CG61... i don't understand
Click to expand...
Click to collapse
I Think the CG58 is the good one but maybe they are more files to flash no ?
According to this:
Code:
CG42 3072KB mostly zeros, ends at 0xff0, raw boot logo bitmap?
CG44 3072KB contains code with plain text bootloader?
CG47 262144 Microboot (Engine and Slot for hashing in microboot priv.c) (ref to rdl1.bin, ptable, CDT.BIN, BCT.bin, PT.bin, EBT.bin, MBR.bin, EBB.bin)
CG50 is 2KB of 0xFF, no content, probably used to clear a partition
CG52 same as above, (sent to mmcblk0p7 to clear misc? -optionally used to pass commands to recovery, it fed with command line for example to flash an update -)
CG53 1014KB begins with SOL: bootlog0? (mmcblk0p8)
CG54 2KB of 0xFF (possibly sent to mmcblk0p9, Kernel Panic Data)
CG55 recovery (header, ramdisk, kernel) (mmcblk0p10)
CG56 boot (header, ramdisk (/), kernel) (mmcblk0p11)
CG57 is the system image in ext3 linux format. (mmcblk0p12)
CG58 osh (webtop) system image in ext3 (mmcblk0p13)
CG59 20MB HFS, CDROM (Motorola Helper) (mmcblk0p14)
CG60 2KB of 0xFF (possibly sent to mmcblk0p15 to clear cache image)
CG61 2KB of 0xFF (sent to mmcblk0p16 to clear userdata image, tested)
CG62 preinstall image in ext3 (mmcblk0p17)
src: http://forum.xda-developers.com/showthread.php?t=1059643
Gregz78 said:
According to http://forum.xda-developers.com/showthread.php?t=1059643 i must extract smg's from the french sbf and rename :
CG56.smg -> boot.img
CG57.smg -> system.img
CG58.smg -> webtop.img
And if I understand the guide, I must do :
moto-fastboot flash boot boot.img
moto-fastboot flash system system.img
moto-fastboot flash webtop webtop.img
moto-fastboot -w
moto-fastboot reboot
I think it is the way to...
If a "dev" can confirm
Edit: no webtop .. looking at the 2.3.4 the webtop is CG61... i don't understand
Click to expand...
Click to collapse
I apologize for the late answer, too much works here.
that should be enought to make it works, flashing more partitions is useless.
reflash back again your phone with fastboot, on the motoblur setup screen you need to plug your att atrix to the lapdock for 10 to 20 secondes and see what happens, I've do that and it worked.
Could someone post a ling to those 2 files:
CG56.smg -> boot.img
CG57.smg -> system.img
The whole sbf is way too heavy to download.
Thanks.
Interresting to read.
Does it mean i can flash the rom on this phone: http://www.simplyelectronics.net/mainproduct.php?pid=13376&setcurrency=gbp
Can I flash a new EU ROM on this device. It looks like simplyelectronics is selling ATT devices with unlocked SIM but i guess it has the crappy ATT firmware.
I can buy a EU device at expansys bit it is over 100 Euro's more expensive so I thought i could buy this att version and flash EU software on it.
Also I have heard vodafone is having problems with the Atrix, somehow people say it can't connect to there 3G network. Is this issue only with the ATT firmware or all firmwares.
3ndeavour said:
Interresting to read.
Does it mean i can flash the rom on this phone: http://www.simplyelectronics.net/mainproduct.php?pid=13376&setcurrency=gbp
Can I flash a new EU ROM on this device. It looks like simplyelectronics is selling ATT devices with unlocked SIM but i guess it has the crappy ATT firmware.
I can buy a EU device at expansys bit it is over 100 Euro's more expensive so I thought i could buy this att version and flash EU software on it.
Also I have heard vodafone is having problems with the Atrix, somehow people say it can't connect to there 3G network. Is this issue only with the ATT firmware or all firmwares.
Click to expand...
Click to collapse
yes, once you unlocked your device, you can flash what you want
make sure you know how to flash your device else avoid those commands if you can
Code:
flashboot flash pds
flashboot flash bootloader

[FAQ] How to prepare for and take an OTA update (All Carriers)

This is a reserection of -> http://forum.xda-developers.com/moto-x/general/faq-kit-kat-how-to-prepare-carriers-t2536735 and -> http://mark.cdmaforums.com/MotoX-OTA.html
With Verizon pushing a maintenance release for their Stock 4.4.4 (which doesn't change the Android version number), I wanted to post this sooner rather than later because questions are coming up....
Whenever a new OTA comes up, there are always questions like "what do I need to do to take the OTA?" or "I got prompted to take the OTA, but xxx is happening." This thread is intended to provide that information in once place.
This information is based on the past OTA updates for the Verizon, T-Mobile, and ATT Moto X phones, and threads on various forums. It should apply to all OTA updates.
Please note: If you have tried downgrading by flashing only parts of a rom, or have mismatched files on your phone for any reason, DO NOT TAKE AN OTA or you will likely brick your phone!! First flash your phone with a full SBF of the latest ROM for your carrier before attempting to take future OTA's. For more on Downgrading and the risks associated with it, see -> [INFO/WARNING]The Risks of Downgrading, and the impacts of GPT.BIN and MOTOBOOT.IMG
These are the most common Questions and Issues we've seen in the past...
If you could NOT get your bootloader unlock code directly from Motorola and rooted by some other process, you should *WAIT* on taking an OTA update as it may patch any vulnerability being exploited to root your phone. And you may not be able to ROOT on this new version!!
If you used Sunshine, or got your Bootloader Unlock code from the China Seller or Middleman... You should BE CAUTIOUS and *WAIT* on upgrading past 4.4.4. Please see -> [LOLLIPOP WARNING]Those Who Unlocked Via Sunshine or Purchasing a Code from China
You should expect to lose root when you take an OTA.
For the Motorola X, the OTA's are incremental updates. You must be on a specific previous ROM, and "step up." To put it another way... To take the 4.4.4 OTA, your phone needs to be on 4.4.2 (or 4.4.3 depending on your model/carrier). To take the 4.4.2 OTA, your phone needs to be on 4.4. To take the 4.4 OTA, your phone needs to be on the 4.2.2 w/camera fix version. To take the 4.2.2 w/camera fix OTA, your phone needs to be on the initial shipping ROM version.
Inside the OTA is a "Pre-flash Validation Check" to ensure your phone is on the correct version BEFORE it will flash. It includes a manifest file that contains a list of files and their check sums the OTA expects to be on your phone. If the files are missing from your phone, or the check sum for a particular file doesn't match (because you've replaced or altered the file), the OTA will fall. NOTE: The more files patched by the update, the more strict the pre-flash validation will be. So an update from 4.4.4 -> 5.1 will be more strict than the recent Verizon 4.4.4 maintenance patch.
Because of #5, you must be "stock." Any bloat you deleted, needs to be put back. Any apps you froze with Titanium Backup or the like, may need to be unfrozen. Apps disabled via the phone's Settings -> Applications -> [select app] -> [disable] can remain disabled and should not impact the update. NOTE: Back in the "early days" of the 2013 X, all apps frozen with TiBu had to be unfrozen. Later updates that hasn't been much of a problem. I don't use it, so I can't say for sure.
If you have XPosed installed on your phone, it often does make changes that will cause the Pre-Flash Validation to fail. You may be able to just disable it, rather than fully removing it, and then take the OTA. (To disable Xposed, boot to TWRP and install /SDcard/Android/data/de.robv.android.xposed.installer/files/Xposed-Disable-Recovery.zip ) NOTE: There is a newer version of Xposed needed for Lollipop!!
The OTA Updates will only install via Stock Recovery. If your Root method has replaced stock recovery with something else, you will need to use mfastboot to flash stock recovery on your phone BEFORE you attempt to take the update. Not having Stock Recovery on your phone when you take the OTA can result in your phone doing a boot loop. NOTE: You can use fastboot erase cache to delete the update zip file from your phone which will stop the boot loop.
There are several options to get back to "stock" without loosing your data. (I will add them to Post #2 of this thread at a later date), some are more technical, some are more noob friendly. The one you use, depends on how much, or how little, you have modified your phone away from stock.
In some cases, using mfastboot to reflash stock Recovery.IMG and System.IMG can be enough to get you back to "Stock" and take the OTA update.
If you unlocked your bootload by getting the code from Moto, after taking the OTA you may root by following -> http://forum.xda-developers.com/moto-x/moto-x-qa/instructions-unlocking-rooting-dev-ed-t2649738 Please be sure to use the latest TWRP fastboot IMG file (Alternate Link) and Installable ZIP of SuperSU
Any tethering hacks you have done will likely need to be undone in order to take the OTA (see #5 above), and may not work after the OTA is installed.
Some FAQ's...
I've tried taking the OTA, but I'm stuck in a loop. It wants to keep rebooting. - This is usually caused by having a 3rd party recovery, like TWRP/CWM, on the phone. Re-flash the stock recovery to install the OTA update, or use fastboot erase cache to delete the update zip file from your phone which will stop the boot loop. (instructions will be added to Post #2 of this thread in the future)
I've tried putting back my bloat, and taking the OTA, but it fails. - You likely missed something the Pre-flash Validation check is looking for. If you are able to capture the OTA ZIP and use the SIDE LOAD AN OTA instructions (which will be added to post #2 of this thread in the future), you can watch progress of the OTA install. It will tell you the error, and/or what file doesn't match.
In the past we've seen error codes 252 and 410. These have been related to files on the phone not matching the OTA's pre-flash validation checks.
[NOT YET SPELL CHECKED!!!]
How to return to stock & Unrooted... (Windows options only, as I don't have a Mac) Note: Some Windows 8/8.1 users have had issues, so when possible, please use Windows 7.
The following are listed in the order I originally posted them HERE and HERE
Requirements: These are the same no matter which option you use.
To repeat what I said in the OP, Do NOT attempt to downgrade your phone!! Please be aware of the risks -> [INFO/WARNING]The Risks of Downgrading, and the impacts of GPT.BIN and MOTOBOOT.IMG
Know what version ROM is on your phone before you touch anything. Normally I would suggest BEFORE you flash away from Stock, on the phone you first go App Drawer -> Settings -> About Phone... Make note of what is listed under System Version, Android Version, and build number. Then visit one (or all) of the sites that host leaked ROMS until you find the SBF that matches and down load the file to your PC for use later.. The file name will usually contain parts or all of that info listed under settings, and possibly the carrier name, or acronym for the carrier name (Verizon might be VZW, Rogers Canada might be RCI, etc).
So for example: If your phone model is XT1058 and under about phone it reports...
android version is 4.4.4
system version is 212.44.26. ghost_row.RCI.en.ca
build nunber is KXA21.12-L1.26
That tells me you have a Rogers Canada (RCI) XT1058 with 4.4.4 ROM on it. When you look at the file factory site for your SBF, you want to look for a file that contains some/all of that info, and you'll find... XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip
(notice the parts of the "about phone" info and file name which are highlighted in Bold to help illustrate the example)
IF you are already running a CUSTOM or 3Rd party rom, like CM, system version and build number will not match STOCK Moto SBF files
You must have already installed the Motorola Drivers, ADB, Android Platform Tools, and mFastboot
mFastboot (get from the previous link). NOTE: Stock fastboot that ships with the Android SDK/Platform tools can NOT flash the SYSTEM.IMG on Moto phones!!
Download ROM/SBF files for the ROM currently on your phone!!!! from one of the sites listed HERE. Failure to use the EXACT SAME ROM/SBF that is on your phone now can cause problems!!
Your battery has an 80% or greater charge!!
MicroUSB Cable.
Know how to start your phone into the Fastboot AP/Bootloader mode...
Unplug phone
Power down phone.
Hold Volume Down and Power
After a few seconds release Power, you should be in Fastboot AP menu on phone.
The Options...
NOTE: I most often recommend option 5.
Option 1... The "Moto X Tool Kit"
This is the most newbie friendly.. But it can be a little complex to prepare and put your SBF in the right place, etc.
See -> [TOOL] Moto X Toolkit v1.4.4 [Backup/Restore,Drivers,Return to stock,Root,Bootani]
It is an "all in one" type tool that should set things up and help you too. I've not used it, but it appears to be a complete package including ADB and the drivers. The only thing it does not appear to include would be Roms for your particular phone, so, you'll likely need to download the ROM for your phone separately. As noted in the ToolKit thread, if they are available, you can get them from here -> http://sbf.droid-developers.org/ghost/list.php your "build number" or part of it, should be in the file name you are downloading.
Again, I haven't used this tool, so for install, setup and usage, I'll have to point you to that thread to ask. Two main options you'll be interested in... UNROOT (which keeps your data and apps) or FLASH BACK TO STOCK (which will likely also completely reset your phone and wipe any/all data, settings, applications, etc).
Option 2... mFastboot flashing individual parts of your phone's firmware.
This will not erase your data and apps. It is a good option if you are stuck in a boot loop.
If you have made very few changes to your phone and already have ADB drivers and fastboot from the Android SDK installed and in your path, along with the Motorola drivers already installed and working, this is the quickest and easiest way to return to a state that is ready to accept an OTA without losing data/apps.
NOTE: you may need to disable and/or uninstall Xposed before doing this.(To disable Xposed, boot to TWRP and install /SDcard/Android/data/de.robv.android.xposed.installer/files/Xposed-Disable-Recovery.zip ) Keep in mind there is a newer version of Xposed needed for Lollipop!!
After you have the requirements as listed above, the steps would be as follows...
Start the phone in Fastboot AP/Bootloader mode.
Connect phone to PC via USB cable.
open command prompt file and change to the folder you unzipped the ROM file to.
type the following, pressing enter after each command, and wait for it to finish before going onto the next...
mfastboot flash boot boot.img
mfastboot flash recovery recovery.img
mfastboot flash system system.img
mfastboot reboot
phone should reboot and be back to stock and ready for the update.
NOTE: to combat a 410 ERROR while doing the update, some users have also had to also do the following
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
See -> http://forum.xda-developers.com/showpost.php?p=47639731&postcount=315 (thanks jimmydafish)
Option 3... Fully flash your phone using RSDLite while attempting to keep your data and settings
NOTE: this has the potential to erase your data if you don't edit the XML properly before flashing.
Follow this guide -> [GUIDE][VIDEO] Moto X - Return to 100% stock (using RSD Lite OR manual flash) using SBF of the ROM currently on your phone, or newer for your carrier and model. HOWEVER, before doing it, as part of STEP 4 while editing the XML file, also remove the line that says...
<step operation="erase" partition="userdata" />
Failure to remove this line will result in your data/apps/settings being erased from your phone!!
Option 4... Fully flash your phone using RSDLite
Note: this WILL ERASE YOUR USER DATA AND APPS, and put you back to a "fresh" phone.
Follow this guide -> [GUIDE][VIDEO] Moto X - Return to 100% stock (using RSD Lite OR manual flash) using the ROM from your carrier.
Option 5... Using mFastboot to manually flash your phone's firmware (without wiping data).
This is very similar to using option 3, but uses Moto fastboot instead of RSD, however it adds a few steps which aid in flashing when your GPT.BIN and MOTOBOOT.IMG are mismatched from the rest of your rom, and refuse to flash.
As written, these steps will NOT erase your data and apps. Because of this you may need to disable and/or uninstall Xposed before doing performing these steps.(To disable Xposed, boot to TWRP and install /SDcard/Android/data/de.robv.android.xposed.installer/files/Xposed-Disable-Recovery.zip ) Keep in mind there is a newer version of Xposed needed for Lollipop!!
After you have the requirements near the top of this page, the steps would be as follows...
Start the phone in Fastboot AP mode.
Connect your phone to PC via MicroUSB cable.
open a command prompt and change to the folder you unzipped the ROM/SBF file to.
type the following, pressing enter after each command, and wait for it to finish before going onto the next... NOTE: yes, there are a few commands being repeated, but this is intentional!!!
mfastboot getvar max-download-size
mfastboot flash partition gpt.bin
mfastboot flash motoboot motoboot.img
mfastboot reboot-bootloader
mfastboot flash partition gpt.bin
mfastboot flash motoboot motoboot.img
mfastboot flash logo logo.bin
mfastboot flash boot boot.img
mfastboot flash recovery recovery.img
mfastboot flash system system.img
mfastboot flash modem NON-HLOS.bin
mfastboot erase modemst1
mfastboot erase modemst2
mfastboot flash fsg fsg.mbn
mfastboot erase cache
mfastboot reboot
The phone should reboot and and be ready. (it could take a little longer than a normal reboot)
NOTE: if you wish to erase your data and apps during this process, just before the final reboot command, issue... mfastboot erase userdata
Option 6... Flash only stock recovery.
This option is useful if all you did was unlock your bootloader, flash TWRP recovery, and rooted. It can be used if you've haven't installed Xposed, or modified any stock apps, and only run rooted for apps like BigTinCan's Adaway, Root Explorer, Wifi Tether for Root, etc.
Start the phone in Fastboot AP mode.
Connect your phone to PC via MicroUSB cable.
open a command prompt and change to the folder you unzipped the ROM/SBF file to.
type the following, pressing enter after each command, and wait for it to finish before going onto the next...
mfastboot flash recovery recovery.img
mfastboot reboot-bootloader
Use the VOL DOWN Key to SCROLL to Recovery and VOL UP Key to select
The device will display the Motorola logo and then the Android in distress (logo with Exclamation mark)
Press and hold the VOL UP key for 10-15 seconds. While still holding the VOL UP key tap and release the POWER key
The device will start in Stock Recovery display additional menu options (Text will appear in BLUE)
While in Stock Recovery, use the VOL DOWN Key to scroll and the POWER Key to select the option you wish to use.
You may now use the option to reboot the phone.
{reserved}
KidJoe,
Thanks so much for this. Even though I manually returned all changes to stock, the ota still kept quitting with an error.
It was really annoying because after each error, I would have to redownload the entire ota, 696MB, which was downloading rather slowly.
Anyway, I followed option number 2 from the original post to flash boot, recovery and system and it was smooth sailing after that
Thanks again
KidJoe said:
[NOT YET SPELL CHECKED!!!]
Option 2... mFastboot flashing individual parts of your phone's firmware.
This will not erase your data and apps. It is a good option if you are stuck in a boot loop.
If you have made very few changes to your phone and already have ADB drivers and fastboot from the Android SDK installed and in your path, along with the Motorola drivers already installed and working, this is the quickest and easiest way to return to a state that is ready to accept an OTA without losing data/apps.
NOTE: you may need to disable and/or uninstall Xposed before doing this.(To disable Xposed, boot to TWRP and install /SDcard/Android/data/de.robv.android.xposed.installer/files/Xposed-Disable-Recovery.zip ) Keep in mind there is a newer version of Xposed needed for Lollipop!!
After you have the requirements as listed above, the steps would be as follows...
Start the phone in Fastboot AP/Bootloader mode.
Connect phone to PC via USB cable.
open command prompt file and change to the folder you unzipped the ROM file to.
type the following, pressing enter after each command, and wait for it to finish before going onto the next...
mfastboot flash boot boot.img
mfastboot flash recovery recovery.img
mfastboot flash system system.img
mfastboot reboot
phone should reboot and be back to stock and ready for the update.
NOTE: to combat a 410 ERROR while doing the update, some users have also had to also do the following
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
See -> http://forum.xda-developers.com/showpost.php?p=47639731&postcount=315 (thanks jimmydafish)
[/list]
Click to expand...
Click to collapse
KidJoe, thanks for the help. I have an XT1095. All I am pretty sure I did was root. I've never installed TWRP or even used root apps other than Greenify. In that state I was not able to accept the recent 5.1 OTA. I used the option in Supersu to full unroot (which also uninstalled Supersu). That did not fix the problem. I am now just finding your guide but other searching has led me to your conclusion that Option 2 should be all I need to do plus it won't wipe my phone.
The confusion I have now involves the system.img file. I requested the 5.0 download from Moto, but they never responded. I found the proper zip file elsewhere (TMO_XT1095_5.0_LXE22.46-11_cid9_CFC.xml.zip). When I unzip it, I see all the files. The recovery.img file is there but the system.img file is broken up into eight different files all named system.img_sparsechunk.0, system.img_sparsechunk.1, system.img_sparsechunk.2, etc.
Do I have the right files? Do I flash all of them individually? I'm not very experienced in this and don't want to screw this up. Any information you could provide would be greatly appreciated. Thanks.
Edit: After posting this, I found this site: http://www.usoftsmartphone.com/t279221.html that showd me how to extract the system file from all the sparse files. Step one creates a system.img file from all of them. Step two seems to unzip them. I am guessing that the file created after step 1 is the file I would need to flash?
Again, thanks for your help here!
summit15 said:
KidJoe, thanks for the help. I have an XT1095. All I am pretty sure I did was root. I've never installed TWRP or even used root apps other than Greenify. In that state I was not able to accept the recent 5.1 OTA. I used the option in Supersu to full unroot (which also uninstalled Supersu). That did not fix the problem. I am now just finding your guide but other searching has led me to your conclusion that Option 2 should be all I need to do plus it won't wipe my phone.
The confusion I have now involves the system.img file. I requested the 5.0 download from Moto, but they never responded. I found the proper zip file elsewhere (TMO_XT1095_5.0_LXE22.46-11_cid9_CFC.xml.zip). When I unzip it, I see all the files. The recovery.img file is there but the system.img file is broken up into eight different files all named system.img_sparsechunk.0, system.img_sparsechunk.1, system.img_sparsechunk.2, etc.
Do I have the right files? Do I flash all of them individually? I'm not very experienced in this and don't want to screw this up. Any information you could provide would be greatly appreciated. Thanks.
Edit: After posting this, I found this site: http://www.usoftsmartphone.com/t279221.html that showd me how to extract the system file from all the sparse files. Step one creates a system.img file from all of them. Step two seems to unzip them. I am guessing that the file created after step 1 is the file I would need to flash?
Again, thanks for your help here!
Click to expand...
Click to collapse
Keep in mind that the XT1095 is NOT a 2013 X, so its files may be different.
So I'm using a cm12 based rom and I've wanted to return to stock lately, let me see if I got this straight. Using rsd lite and erasing the line:
<step operation="erase" partition="userdata" />
Won't erase internal memory like music, photos, etc?
It's safe? I'm wondering if I'm going to have problems with the apps since they're running on ART on lollipop or if the system settings will have issues when I return to stock KitKat
OTA Accepted
For anyone who finds themselves in my same situation (all I really did to my phone was root it and install Supersu, no custom recovery or big time changes and I wanted to apply the OTA without wiping my device), I got my OTA update applied by doing the following:
Did a "Full Unroot" from within the Supersu app which then uninstalled itself.
I found the proper Moto ZIP file that contained Lollipop 5.0.
I then used mfastboot to flash the boot.img and the recovery.img
I then boot the phone up and told it to check for system updates.
It found the update, downloaded it, and then applied it.
It worked and I can move on with my life now.
NOTE: Most of my confusion in this process centered around my being told I needed to flash the system.img file. My problem was that inside the Moto ZIP file were eight different system_sparse files. I didn't know what to do with all them. I found a site in the previous link that showed me how to essentially combine all them into one system.img file. I followed those directions and it created the file. However, when I tried to flash it, I got an error that seemed to suggest that the file was corrupt.SO, this was after I had already flashed the boot and recovery files. I gave the OTA a shot just hoping it would work. Turned out it did.
Thanks again to KidJoe for this guide.
summit15 said:
For anyone who finds themselves in my same situation (all I really did to my phone was root it and install Supersu, no custom recovery or big time changes and I wanted to apply the OTA without wiping my device), I got my OTA update applied by doing the following:
Did a "Full Unroot" from within the Supersu app which then uninstalled itself.
I found the proper Moto ZIP file that contained Lollipop 5.0.
I then used mfastboot to flash the boot.img and the recovery.img
I then boot the phone up and told it to check for system updates.
It found the update, downloaded it, and then applied it.
It worked and I can move on with my life now.
NOTE: Most of my confusion in this process centered around my being told I needed to flash the system.img file. My problem was that inside the Moto ZIP file were eight different system_sparse files. I didn't know what to do with all them. I found a site in the previous link that showed me how to essentially combine all them into one system.img file. I followed those directions and it created the file. However, when I tried to flash it, I got an error that seemed to suggest that the file was corrupt.SO, this was after I had already flashed the boot and recovery files. I gave the OTA a shot just hoping it would work. Turned out it did.
Thanks again to KidJoe for this guide.
Click to expand...
Click to collapse
Again.. you have an XT1095... which is NOT a 2013 X... this guide is in the 2013 X section, so things can/will be different for a 2014 X...
But thanks for sharing.
Awsome Tutorial!!
I'm really a noob, so I still have some questions...
After that you should get the OTA update by going to setting -> about phone -> update??
because if so, I'm not.
Another thing i may done something wrong. On this step:
4. Download ROM/SBF files for the ROM currently on your phone!!!! from one of the sites listed HERE. Failure to use the EXACT SAME ROM/SBF that is on your phone now can cause problems!!
I needed to move the ROM/SBF to the phone right? At any folder? Because I didnt do that and I opened the command prompt in the pc folder that the ROM/SBF was unziped. Nothing wrong happened to my phone, apparently.
Should I remake the tutorial moving the unziped file to the sdcard folder of my phone?
sorry for so many doubts.
Malba14 said:
I'm really a noob, so I still have some questions...
After that you should get the OTA update by going to setting -> about phone -> update??
because if so, I'm not.
Click to expand...
Click to collapse
The OTA update hasn't rolled out for all phone models and carrier variants yet. So there is a VERY GOOD chance it wont be available for you yet.
Malba14 said:
Another thing i may done something wrong. On this step:
4. Download ROM/SBF files for the ROM currently on your phone!!!! from one of the sites listed HERE. Failure to use the EXACT SAME ROM/SBF that is on your phone now can cause problems!!
I needed to move the ROM/SBF to the phone right? At any folder? Because I didnt do that and I opened the command prompt in the pc folder that the ROM/SBF was unziped. Nothing wrong happened to my phone, apparently.
Should I remake the tutorial moving the unziped file to the sdcard folder of my phone?
sorry for so many doubts.
Click to expand...
Click to collapse
No, you do NOT move the SBF, or parts of it, to your phone. Leave it on your PC.
The tools to flash (RSDLite and mFastboot) are tools ON YOUR PC... they need the file to be on your pc.
In the post I talk about figuring out what file to download and use the example of the Rogers XT1058, and the correct file being XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip so sticking with that example.. you visit one of the sites (from your PC), download XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip ... and unzip it on your PC to a folder... If you are following option 2, 5 or 6 and using mFastboot, then you need to open a command prompt and change drive and directories to where you unzipped XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip to BEFORE you start entering the mfastboot commands. NOTE: you could just SHIFT-RightClick on the folder and "open command window here" as that will open a command prompt in that path/folder.
KidJoe said:
The OTA update hasn't rolled out for all phone models and carrier variants yet. So there is a VERY GOOD chance it wont be available for you yet..
Click to expand...
Click to collapse
The thing is that the update was rolled out for me before. But kept regecting it until one day that I clicked on "stop bothering me, I'll do it when I want" button and then every time I turned my phone on, after 30 seconds it rebooted to TeamWin. This kept going until I clicked on recovery or system (I dont remember - under the reboot page) and the cycle went off saying that has been some kind of problem with the update.
KidJoe said:
No, you do NOT move the SBF, or parts of it, to your phone. Leave it on your PC.
The tools to flash (RSDLite and mFastboot) are tools ON YOUR PC... they need the file to be on your pc.
In the post I talk about figuring out what file to download and use the example of the Rogers XT1058, and the correct file being XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip so sticking with that example.. you visit one of the sites (from your PC), download XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip ... and unzip it on your PC to a folder... If you are following option 2, 5 or 6 and using mFastboot, then you need to open a command prompt and change drive and directories to where you unzipped XT1058_RCI-CA_4.4.4_KXA21.12-L1.26_59_cid14_CFC_1FF.xml.zip to BEFORE you start entering the mfastboot commands. NOTE: you could just SHIFT-RightClick on the folder and "open command window here" as that will open a command prompt in that path/folder.
Click to expand...
Click to collapse
This part I did it right, i think. I fount the one that describe my phone better.
XT1058_VIVO-BR_4.4.4_KXA21.12-L1.26_59_cid12_CFC_1FF.xml
Actually I just reallized it is .xml. Is that ok? On my PC it opened with winrar just like any zip.
Malba14 said:
The thing is that the update was rolled out for me before. But kept regecting it until one day that I clicked on "stop bothering me, I'll do it when I want" button and then every time I turned my phone on, after 30 seconds it rebooted to TeamWin. This kept going until I clicked on recovery or system (I dont remember - under the reboot page) and the cycle went off saying that has been some kind of problem with the update.
Click to expand...
Click to collapse
Rebooted to TeamWin and said there was a problem with the update?? Yeah, because you need STOCK recovery on the phone. (as stated in the OP)
Malba14 said:
This part I did it right, i think. I fount the one that describe my phone better.
XT1058_VIVO-BR_4.4.4_KXA21.12-L1.26_59_cid12_CFC_1FF.xml
Actually I just reallized it is .xml. Is that ok? On my PC it opened with winrar just like any zip.
Click to expand...
Click to collapse
There maybe an XML inside the ZIP... you need to uncompress the entire file (extract all) BEFORE you can flash it, other wise RSDlite or mFastboot wont find the files you are trying to flash.
KidJoe said:
Rebooted to TeamWin and said there was a problem with the update?? Yeah, because you need STOCK recovery on the phone. (as stated in the OP)
There maybe an XML inside the ZIP... you need to uncompress the entire file (extract all) BEFORE you can flash it, other wise RSDlite or mFastboot wont find the files you are trying to flash.
Click to expand...
Click to collapse
Thanks for the help man. I'm sorry for the noob questions.
I actually did the hole tutorial before. I extracted this hole file and opened the command prompt in it and did the tutorial number 5.
Sorry if I wasnt clear before but the problem with the update was just a backgroud history to what I was aiming to know. That is: after I do the tutorial, what I have to do to get the OTA update now?
And how can I know that I did it right?
Your are awsome man!
Malba14 said:
The thing is that the update was rolled out for me before. But kept regecting it until one day that I clicked on "stop bothering me, I'll do it when I want" button....
Click to expand...
Click to collapse
I forgot to mention... for the models IT has started pushing for, they were sending it out in waves... IF you missed your turn (which you eventually did by not installing), you usually need to wait until the end, when the waves are done.. Because of when the BR Xt1058 push was started, I'd say that might be in the next week, or two.
Malba14 said:
Thanks for the help man. I'm sorry for the noob questions.
I actually did the hole tutorial before. I extracted this hole file and opened the command prompt in it and did the tutorial number 5.
Sorry if I wasnt clear before but the problem with the update was just a backgroud history to what I was aiming to know. That is: after I do the tutorial, what I have to do to get the OTA update now?
And how can I know that I did it right?
Your are awsome man!
Click to expand...
Click to collapse
As long as you flashed the latest 4.4.4 rom, your bootloader is consistent with the ROM you flashed, are you 100% completely stock, you just sit and wait until the OTA becomes available to your phone again. You can manually keep checking...
OR you can see if the 5.1 SBF is available for your carrier/model in this thread -> http://forum.xda-developers.com/moto-x/general/official-collection-firmwares-fxz-sbf-t3146628 download and flash it instead, which will take you right to 5.1...
OR you can see if the official OTA zip has been posted, download the zip to the /SDCard of your phone, and follow the SIDE LOAD section of -> http://forum.xda-developers.com/moto-x/general/ref-return-to-stock-recovery-rooted-t3027079
KidJoe said:
I forgot to mention... for the models IT has started pushing for, they were sending it out in waves... IF you missed your turn (which you eventually did by not installing), you usually need to wait until the end, when the waves are done.. Because of when the BR Xt1058 push was started, I'd say that might be in the next week, or two.
As long as you flashed the latest 4.4.4 rom, your bootloader is consistent with the ROM you flashed, are you 100% completely stock, you just sit and wait until the OTA becomes available to your phone again. You can manually keep checking...
OR you can see if the 5.1 SBF is available for your carrier/model in this thread -> http://forum.xda-developers.com/moto-x/general/official-collection-firmwares-fxz-sbf-t3146628 download and flash it instead, which will take you right to 5.1...
OR you can see if the official OTA zip has been posted, download the zip to the /SDCard of your phone, and follow the SIDE LOAD section of -> http://forum.xda-developers.com/moto-x/general/ref-return-to-stock-recovery-rooted-t3027079
Click to expand...
Click to collapse
Thanks a lot!!!
KidJoe said:
Option 5... Using mFastboot to manually flash your phone's firmware (without wiping data).
This is very similar to using option 3, but uses Moto fastboot instead of RSD, however it adds a few steps which aid in flashing when your GPT.BIN and MOTOBOOT.IMG are mismatched from the rest of your rom, and refuse to flash.
As written, these steps will NOT erase your data and apps. Because of this you may need to disable and/or uninstall Xposed before doing performing these steps.(To disable Xposed, boot to TWRP and install /SDcard/Android/data/de.robv.android.xposed.installer/files/Xposed-Disable-Recovery.zip ) Keep in mind there is a newer version of Xposed needed for Lollipop!!
After you have the requirements near the top of this page, the steps would be as follows...
Start the phone in Fastboot AP mode.
Connect your phone to PC via MicroUSB cable.
open a command prompt and change to the folder you unzipped the ROM/SBF file to.
type the following, pressing enter after each command, and wait for it to finish before going onto the next... NOTE: yes, there are a few commands being repeated, but this is intentional!!!
mfastboot getvar max-download-size
mfastboot flash partition gpt.bin
mfastboot flash motoboot motoboot.img
mfastboot reboot-bootloader
mfastboot flash partition gpt.bin
mfastboot flash motoboot motoboot.img
mfastboot flash logo logo.bin
mfastboot flash boot boot.img
mfastboot flash recovery recovery.img
mfastboot flash system system.img
mfastboot flash modem NON-HLOS.bin
mfastboot erase modemst1
mfastboot erase modemst2
mfastboot flash fsg fsg.mbn
mfastboot erase cache
mfastboot reboot
The phone should reboot and and be ready. (it could take a little longer than a normal reboot)
NOTE: if you wish to erase your data and apps during this process, just before the final reboot command, issue... mfastboot erase userdata
Click to expand...
Click to collapse
Hey.
I wanted to return to stock by flashing the parts manually.
I followed your steps but when i executed the command a message popped out saying 'Variable not supported' and it continued the execution.
I did not find any change in the system when I checked after the whole process was completed.
The message I mentioned earlier was shown for every step.
Example Code:
Code:
mfastboot flash partition gpt.bin
(bootloader) Variable not supported!
target reported max download size of 805306368 bytes
sending 'partition' (32 KB)...
OKAY [ 0.280s]
writing 'partition'...
(bootloader) This may take a few seconds, if a
(bootloader) different partition table is being
(bootloader) flashed since we need to backup
(bootloader) and restore a few partitions
OKAY [ 0.534s]
finished. total time: 0.819s
I also flashed boot, logo, system and the others parts.
But the same message was shown every time.
And after the process was complete I restarted the phone but the 'Bootloader Unlocked Warning' screen appeared.
I hadn't removed this after I rooted the phone.
I thought it would be removed when I flashed motoboot, boot and logo.
Phone Details:
Current Android Version: 4.4.4
System Version: 212.44.26.ghost_row.AsiaRetail.en.03
Build Number: KXA21.12-L1.26
Kernel Version: 3.4.42-g50861a7
I used this image:
Drive Link:
https://docs.google.com/file/d/0B5XNxZ2OcfKtdDROTk5kb21ObU0/edit?pli=1
File Factory Link:
http://www.filefactory.com/file/3qr..._4.4.4_KXA21.12-L1.26_18_cid7_CFC_1FF.xml.zip
I desperately need your help.
What should I so to flash the stock image properly?
Thanks in advance.
RohanAditya said:
Hey.
I wanted to return to stock by flashing the parts manually.
I followed your steps but when i executed the command a message popped out saying 'Variable not supported' and it continued the execution.
I did not find any change in the system when I checked after the whole process was completed.
The message I mentioned earlier was shown for every step.
Example Code:
Code:
mfastboot flash partition gpt.bin
(bootloader) Variable not supported!
target reported max download size of 805306368 bytes
sending 'partition' (32 KB)...
OKAY [ 0.280s]
writing 'partition'...
(bootloader) This may take a few seconds, if a
(bootloader) different partition table is being
(bootloader) flashed since we need to backup
(bootloader) and restore a few partitions
OKAY [ 0.534s]
finished. total time: 0.819s
I also flashed boot, logo, system and the others parts.
But the same message was shown every time.
And after the process was complete I restarted the phone but the 'Bootloader Unlocked Warning' screen appeared.
I hadn't removed this after I rooted the phone.
I thought it would be removed when I flashed motoboot, boot and logo.
Phone Details:
Current Android Version: 4.4.4
System Version: 212.44.26.ghost_row.AsiaRetail.en.03
Build Number: KXA21.12-L1.26
Kernel Version: 3.4.42-g50861a7
I used this image:
Drive Link:
https://docs.google.com/file/d/0B5XNxZ2OcfKtdDROTk5kb21ObU0/edit?pli=1
File Factory Link:
http://www.filefactory.com/file/3qr..._4.4.4_KXA21.12-L1.26_18_cid7_CFC_1FF.xml.zip
I desperately need your help.
What should I so to flash the stock image properly?
Thanks in advance.
Click to expand...
Click to collapse
Based on what you posted, I'm not completely sure of your question. I mean if you think you are not stock because you still have the unlocked bootloader warning message after flashing, that is normal if you've ever unlocked your bootloader.
Out of box LOCKED bootloader shows Locked Status 0... After unlocking, it shows Unlocked Status 3. If you attempt to relock it, it will show as Locked Status 2. We don't have a way to get back to Locked Status 0. That being said... If the status is NOT 0, you'll always get the Unlocked Bootloader Warning when using the stock/standard LOGO.BIN.
KidJoe said:
Based on what you posted, I'm not completely sure of your question. I mean if you think you are not stock because you still have the unlocked bootloader warning message after flashing, that is normal if you've ever unlocked your bootloader.
Out of box LOCKED bootloader shows Locked Status 0... After unlocking, it shows Unlocked Status 3. If you attempt to relock it, it will show as Locked Status 2. We don't have a way to get back to Locked Status 0. That being said... If the status is NOT 0, you'll always get the Unlocked Bootloader Warning when using the stock/standard LOGO.BIN.
Click to expand...
Click to collapse
Okay I unlocked it. The code is 3.
Thanks
But how do I know if I'm ready to receive the OTA?
Is there a way to find out if I can receive it without it resulting in a brick?
And is the Variable not supported message normal?
Or have I done something wrong?
Thanks in advance
RohanAditya said:
Okay I unlocked it. The code is 3.
Thanks
But how do I know if I'm ready to receive the OTA?
Is there a way to find out if I can receive it without it resulting in a brick?
And is the Variable not supported message normal?
Or have I done something wrong?
Thanks in advance
Click to expand...
Click to collapse
Variable not supported is normal and nothing to worry about.
Because each OTA is different and looks at different aspects of the phone (based on what it will upgrade, or not), there is no way to tell you exactly what should be checked.
If you returned to stock by flashing the COMPLETE STOCK ROM (all parts of SBF) for your carrier/model with mFastboot, and received no errors (other than variable not supported), and your bootloader version is consistent with the ROM on your phone (i.e. you didn't attempt to downgrade), then you should be ready for the OTA...

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?
*this is new thread because I started last as Q&A by mistake so first 2 pages may look off with posts and answers.
DOWNGRADING EXPERIMENT TOPIC
So as you may know , after upgrading to Marshmallow OTA, on locked bootloader there won't be any option to unlock bootloader (ever as some people say) , sunshine officially doens't support Marshmallow. The only option is to downgrade which again isn't possible on locked BL..
Or is it ?
Introduction - skip to DOWNGRADE
First of all I'm not an programmer , but have some experience with locked down motorola's bl's , firmware's ,downgrades and so on..
I'm sure when somebody says impossible, it doesn't really mean impossible, but rather not worthy to some. So in my case I bought the phone few days ago, wasn't fully up to date with infos on unlocking BL so didn't check FW version when buying , just after I checked and phone was updated on MM 1-2 days before buying it. On not unlockable BL phone will become useless to me very soon, while unlocked I would plan to have it for long period of time. It goes in Verzion's favour for me to ditch the phone and buy a new one except I'm not in USA , there are no Verzion services in my country and if there were I would never ever buy (again) anything from Verzion. Well I lived in Japan , and there is network Softbank which is well.. Imagine Verizon but on steroids when it comes to tying people down, locked bootloaders and software, insane fee's and so on.. Well that Softbank bough Verizon some time ago .. I was avoiding them at all cost, but on to the topic now.
DOWNGRADE - fastboot
I would like to invite everybody who is interested in this and who can help to participate in this. Every programmer that has time and can contribute would be greatly appreciated! In return I'm willing to sacrifice my phone and my time , even paying some reasonable donations.
While experimenting in the end I was able to flash all bootloader files from various different versions including all partitions related to it which gets upgraded. Even managed to flash XT1250 MM bootloader. Bootloader version DOES change in bootloader / fastboot ,But it doesn't mean ANYTHING. While downgrading , something else, possibly other parts of bootloader obviously search for match and there is more to it than simple bootloader , more experienced , chime on in here! SElinux enforcing? Verity?
(see attachments)
SU4TL-49 bootloader.img to motoboot flash - Successfully
SU4TL-49 manually flashing 1 by 1:
tz.mbn -[/B] Successfully
SBL1.mbn (bootloader) - [/B] Successfully
sdi.mbn - [/B] Successfully
fsg.mbn to mdm1m9kefs3 - [/B] Successfully
rpm.mbn - [/B] Successfully
emmc_appsboot.mbn to aboot - [/B] Successfully
gpt.bin to "partition" , it's the partitions info partition, people say it can't be downgraded or flashed cross versions. After some experimenting mfastboot failed but fastboot succeded, on some versions mfastboot worked - [/B] Successfully
What I can't get to downgrade / cross flash no mather which bootloader and combinations of firmware im on :
boot.img
recovery.img
system,img (sparse_chunk files)
I will go deeper, but hope that new full firmware SBF will be released soon in case of brick. Verzion is slow. I'm making my own full 6.0.1 xml.zip based on full flashable zip's , repacked system.img sparsechunks, rewrited the script but can't get to flash system files due to invalid signed image. Any help with that? It would also help already bricked guys because who knows when'll Verzion release it..
Downgrade OTA way , stock Android Recovery
While stock android recovery is pretty much useless, it can do software upgrades OTA on a fully stock system , which we on locked bootloaders and MM have.
In my opinion , the way is to trick stock recovery into thinking it's flashing ota, and that whole envieroment is like recovery is expecting it while it's actually flashing downgraded version full / close to full firmware in combination with you flashing some partitions manually through fastboot. OTA's contain only "patch" and just replaces files which get changed on new SW. Or even maybe reverse OTA downgrade?
I've made my own update.zip and signed it , but so far get footer size is wrong error so can't flash it .. Need more help here too..
That looks promising!
Marshmallow feels slower than lollipop for me and I wish I could downgrade but I just can't!
I am looking forward to see what you can do about this issue
Good luck bro!
sorry for my mistake, I do not intend to comment here
@EjđiSixo
How to remove the "signed" of system image or bypass it? Fastboot or RSD are stuck at flashing system image. Does this "sign" relate to boot, recovery, partition? Or it's simply the "sign" to prevent downgrade???
I've never succeeded with partition downgrade...
---------- Post added at 10:29 PM ---------- Previous post was at 10:19 PM ----------
when I was flashing the only system.img (3GB), it said that "wrong at header magi". But after a bit time, fastboot separated the file and began to flash. But still failed because of signed image.
I've tried to remove the code from updater-script but it could not write files to system
Not out yet!
Thanks! I think if we all try , we can do it ! For now main focus is downgrading anyhow, even to half working Lollipop just in the purpose of unlocking bootloader with sunshine.
@mr_5kool
Feel free to comment and ask / suggest, thats what this topic is for!
Unforutenately thats the part I haven't yet figured out myself. It is a " permissions" to prevent the downgrade , bootloader and possibly something else checks current version / keys / properly signed image and then flashes. With other bootloader I'm still not able to flash it because it's obviously locked. Motorola probably signs their images differently.
You can't flash 3GB image because when flashing, phone recieve's partition first to ram so max download size is set to 255mb per file. You have to repack system.img to sparse chunks. But you don't have to bother with it , I already repacked system.img which I found at fully stock flashable MCG24.251-5 . It again failed due to invalid signed image . If we could figure out what is exactly signed and how , that would open a lot more possibilities. Possibly even flashing prerooted roms on locked bootloader. There are more possibilities , who knows..
Currently the only thing notices downgrade when flashing is recovery. In bootloader log says I tried to downgrade. Even with downgraded bootloader (kind of, there is sbl2 and sbl3 but they don't get upgraded )
Anyway, I tried something just for the "gags" . Flashed all partitions of XT1250 bootloader. Got to Motorola's site, posted "unlock bootloader data". It returned it's not unlockable of course.. The first sequence of numbers in data is your imei , it starts with 99 and it's verzion's specific imei.
My theory is that motorola ties unlock bootloader data to every phone and imei and stores it in database ( please confirm) . So even with moto maxx bootloader I can't unlock because :
1 it reads my verzion imei
2 it doesn't find alltogether data in the database..
I don't know what are other numbers in the data you get from fastboot, possibly some serial numbers and so on, haven't really checked it .. That's why i think this method is not possible at all for now. Manipulating that data in your phone and running it through motorola's site knowing that exact same code works for some device might be possible, but I think there is really way too much impossible messing involved. If somebody can share more about this?
lol
http://forum.xda-developers.com/dro...ficial-marshmallow-build-mcg24-t3512813/page2
I've renamed it like suggested in the post #11
Download link is at 1st page. It's just a OTA.
Yes I just renamed it.
IT DOESN'T WORK WITH ADB AND YOU CAN'T FLASH IT AGAIN THROUGH RECOVERY. ITS OTA.
EDIT: The post that I was responding to has been removed.
The method to downgrade from Lollipop to Kitkat is the same with what I've done. It may be possible. Some said that "impossible to downgrade with locked bootloader on vrz". So the system image may be signed with bootloader (or imei, serial or something else, god know).
The unlock method of Sunshine takes place in Trustzone (sbl2). They cannot get unlock code.
You succesfully downgraded LL to KK on droid? There is partition for trust zone alone "tz.mbn" , downgradable without any problem. I only see sbl1 get's upgraded on droid turbo , never saw in any firmware sbl2 or 3 yet.. So I'm little confused.. I remember I saw some PDF regarding that..
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Finally managed to *Brick my devices while trying to make latest sbf firmware (what an irony ) because used some of files from that stupid OTA . Tried flashing all possible firmware I have but it doesn't fix it so system got corrupted probably and for now didn't succed flashing any of the available systems. Flashing MM recovery doesn't help. It's a " recovery loop".
Basically phone starts , vibrates , goes into recovery, it says "erasing" , it does the factory reset then restarts and over and over again erasing restarting loop.
I'll continue exploring downgrade options but top priority now is making working marshmallow sbf or waiting for stupid Verzion to release it already. Just checked with SUA and it still doesn't show repair so firmware isn't available still.
Biggest problem is signed system images which are probably signed by RSA and I need help with that..
I have same problem erasing
Can't flash SU4TL gpt.bin anymore , so success was definitely connected to experiment and steps I did so I'll investigate more.
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
side note, I hate this Q&A format. Not sure why XDA even has it. You can't even format URL links correctly.
Click to expand...
Click to collapse
mr_5kool said:
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
Click to expand...
Click to collapse
I wonder if there is any way to force Verizon to release firmware. This is really low of the lowest, it says 1 week after OTA , now it's almost 1 month. Until somebody forces them , it can be months as far as they are considered. No help from developers / programmers either on any of 2 subjects so don't see my method of full MM SBF working.
god know
:v
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Click to expand...
Click to collapse
Exactly brother .
I solved my problem .
I can downgrade from Marshmallow to lollipop is very easy for my ..
But first step is unlocked bootloader from lollipop..
Sent from my XT1254 using XDA Free mobile app
Yeah people , we all know everything can be done with unlocked bootloader. It's a GOD mode. Nothing strange about downgrading with unlocked BL. This topic is for people stuck on locked BL like myself to try to odowngrade on lollipop only in purpose of UNLOCKING BL. So let's for now focus on locked BL's.

[XT1642][Baseband:EMEA][Channel:RETEU (Retail Europe)][dd images]

Hello everyone,
These are XT1642 Baseband EMEA Channel Retail Europe dd images.All 48 "by-name" partitions, including modem, modemst1 and modemst2.
I was unfortunately going by my own, trying to restore IMEI code and modem functionality of my first XT1642. I bought a typical phone and made dd images of all partitions.
I then engaged into trying to change IMEI code of my failed set. The best try was done by EFS_Professional_2.1.80_BETA, which I downloaded here from XDA, but I got the error NV_ERR_BAD_SECURITY_MODE.
I then resorted to flashing the dd images. Thinking out of focus as I did (I should have tested only modem images: modem, modemst1,modemst2 and fsg) I flashed images one by one in TWRP, until I felt something went wrong (sure it had to), so I rebooted to find I locked myself out at bootloader.
Bootloader says "oem_locked" and yet fails to boot in any mode: recovery, reset or other.
So this is the inevitable end: I was supposed to leave the phone set dead until a toolbox or a hardware hack come out, since I already tried at repair shops and non exist for Athene.
Now to the juicy parts: I promised myself I post these dd images, not just for modem issues, but for anyone wishing to manipulate XT1642 EMEA RETEU. Maybe these could just help.
The images are taken off MPJ24.23-4.
dd images: Google Drive and MediaFire
EFS Professional 2.1.80 Beta: Google Drive and MediaFire
"Manipulating" the IEMI is illegal.
And wrong because it will hurt another person's phone too, that has that IEMI.
SoNic67 said:
"Manipulating" the IEMI is illegal.
And wrong because it will hurt another person's phone too, that has that IEMI.
Click to expand...
Click to collapse
The partitions described don't contain an IMEI. I guess there is no problem here.

Will a FOTA update restore the LAF partition? (AT&T M255)

I tried a bunch of things in an attempt to root AT&T's LG K20 (the LGM255), to no avail.
After unlocking bootloader (so says in the options, I don't think it actually did), I tried fiddling with Lekensteyn's LGLAF tool and various forks of it by steadfasterX and others. Tried pushing a TWRP image I made after being able to extract boot/recovery images using the aforementioned tool. LAF did not pushing that image but was fine with deleting partitions from the phone.
I took the risk of deleting the LAF partition in order to get access to fastboot. While it did, just my luck, the lk variant of fastboot on the phone is stripped of essentially all functionally except for get-var and devices. Meaning I cannot flash anything, or modify any variables.
Have no means to restore the LAF partition (well, there is one way I know of possibly, but want to save it as a last resort cause the probability it would work is low and risks bricking completely).
Now there is an lafbak partition, but cant do anything with it.
Theres some background, but here is my real question:
If I were to accept an FOTA update from AT&T, although it would update the firmware to a new version, would it restore or possibly flash a new LAF partition so that I could go into its LAF/Factory Reset mode again?

Categories

Resources