Database Users

[TUTORIAL] How to Flash Stock Motorola Fastboot files

Welcome to my first tutorial! Please make suggestions in this thread on how to improve it. I will try to be a comprehensive as possible but also as general as possible since flashing firmware to Motorola phones is a pretty consistent process.
Disclaimer:
Please note, like almost everything else on XDA-Developers.com doing this process without fully understanding it can possibly brick the phone (although if it probably already is) thus, I cannot be held liable for any damages caused by following this process.
In other words, the person performing the work performed in this post is fully responsible for their actions on this phone.
/Disclaimer
Before starting with the flashing a Motorola phone, please review the following information:
In most cases firmware versions CANNOT be downgraded
Firmware from other regions can sometimes be flashed, but not always, this is why it is always recommended to stick with the same firmware branch that is already on the phone
The phone that will be flashed should be fully charged, the fastboot flashing process only allows for phones that are over 50 or 60% to be flashed.
If the phone that is trying to be flashed is under 50 or 60%, purchase a "factory adapter" - http://shop.teamblackhat.info/Factory-Adapters-motadapt.htm or make one - http://forum.xda-developers.com/showthread.php?t=1077414
Use a USB 2.0 port that is directly connected to the motherboard of the computer (preferably on the back of a desktop, or internal ports on a laptop)
Now, prepare the computer for the flashing process
Download the latest Motorola USB & Charging Drivers from http://www.motorola.com/Support/CA-EN/Support-Home/USB-Drivers-and-PC-Charging-Drivers
Download the latest available RSD Lite software (~6mb) - As of March 4th 2013, it is 6.1.4 and can be downloaded from here : http://d-h.st/KNN
Ensure the computer can detect the phone in fastboot mode (I have seen a number of problems with different versions of Windows, if it doesn't work on one PC, try a different one). To perform the test, power off the phone completely and boot it into fastboot mode. Unfortunately since Motorola phones are all built uniquley, this tutorial cannot cover all of the different methods to boot a phone in fastboot, but the most common method is to hold the VOLUME UP button and VOLUME DOWN button while pressing POWER. A menu will most likely appear, use the VOLUME DOWN button and navigate to "AP Fastboot", now press the VOLUME UP button. The phone should say it is OK to Program like in the following screen
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, connect the USB cable to the computer, it should detect and install a driver. Check in device manager for a "Mot Single ADB Interface" under ADB Interface. If it is not listed, try to force the drivers to look in the "C:\Program Files\Common Files\Motorola Shared\Mobile Drivers\Drivers" folder.
Once the driver is loaded, open up RSD Lite and the internal codename should be listed under one of the ports. In RAZR HD (GSM) it says Fastboot VANQUISH_U S.
At this point, I would recommend to download the firmware to the computer that will be used for the flashing (once the phone is detectable in RSD Lite, that is a good indication the computer can detect the phone, navigate to http://motofirmware.center and locate the correct firmware and version that should be loaded on the phone. If the firmware is not listed there, please put a request into the firmware team (supply the default.prop and build.prop files). They are pretty good with locating firmware! The firmware files are generally large (ranging anywhere between 200mb and 1500mb) so now would be a good time to top-up that phone charge (if possible). If it isn't possible to charge the phone, don't worry, the phone will automatically turn off if it doesn't detect a flashing process after a few minutes.
Flashing Time!
Once the preparation has completed, flashing is very straightforward. Extract the downloaded firmware files to a folder on your hard disk, then use RSD Lite to load the XML file up. Power on the phone into fastboot mode again, and plug in the phone into an internal USB port on the computer, then press the start button. If everything is successful the phone should begin booting into the stock system. The flashing process usually takes 10-20 minutes depending on the size of the files and the power of the phone. If there are any failures, be sure to read the "Before getting started" section again, and hopefully someone on the forum can help recover the phone with you!

Re: [TUTORIAL] How to Flash Stock Motorola Fastboot & SBF files
danifunker said:
Welcome to my first tutorial! Please make suggestions in this thread on how to improve it. I will try to be a comprehensive as possible but also as general as possible since flashing firmware to Motorola phones is a pretty consistent process.
Disclaimer:
Please note, like almost everything else on XDA-Developers.com doing this process without fully understanding it can possibly brick the phone (although if it probably already is) thus, I cannot be held liable for any damages caused by following this process.
In other words, the person performing the work performed in this post is fully responsible for their actions on this phone.
/Disclaimer
Before starting with the flashing a Motorola phone, please review the following information:
In most cases firmware versions CANNOT be downgraded
Firmware from other regions can sometimes be flashed, but not always, this is why it is always recommended to stick with the same firmware branch that is already on the phone
The phone that will be flashed should be fully charged, the fastboot flashing process only allows for phones that are over 50 or 60% to be flashed.
If the phone that is trying to be flashed is under 50 or 60%, purchase a "factory adapter" - http://shop.teamblackhat.info/Factory-Adapters-motadapt.htm or make one - http://forum.xda-developers.com/showthread.php?t=1077414
Use a USB 2.0 port that is directly connected to the motherboard of the computer (preferably on the back of a desktop, or internal ports on a laptop)
Now, prepare the computer for the flashing process
Download the latest Motorola USB & Charging Drivers from http://www.motorola.com/Support/CA-EN/Support-Home/USB-Drivers-and-PC-Charging-Drivers
Download the latest available RSD Lite software (~6mb) - As of March 4th 2013, it is 6.1.4 and can be downloaded from here : http://d-h.st/KNN
Ensure the computer can detect the phone in fastboot mode (I have seen a number of problems with different versions of Windows, if it doesn't work on one PC, try a different one). To perform the test, power off the phone completley and boot it into fastboot mode. Unfortunatley since Motorola phones are all built uniquley, this tutorial cannot cover all of the different methods to boot a phone in fastboot, but the most common method is to hold the VOLUME UP button and VOLUME DOWN button while pressing POWER. A menu will most likley appear, use the VOLUME DOWN button and navigate to "AP Fastboot", now press the VOLUME UP button. The phone should say it is OK to Program like in the following screen
Next, connect the USB cable to the computer, it should detect and install a driver. Check in device manager for a "Mot Single ADB Interface" under ADB Interface. If it is not listed, try to force the drivers to look in the "C:\Program Files\Common Files\Motorola Shared\Mobile Drivers\Drivers" folder.
Once the driver is loaded, open up RSD Lite and the internal codename should be listed under one of the ports. In RAZR HD (GSM) it says Fastboot VANQUISH_U S.
At this point, I would recommend to download the firmware to the computer that will be used for the flashing (once the phone is detectable in RSD Lite, that is a good indication the computer can detect the phone, navigate to http://sbf.droidevelopers.org and locate the correct firmware and version that should be loaded on the phone. If the firmware is not listed there, please put a request into the firmware team (supply the default.prop and build.prop files). They are pretty good with locating firmware! The firmware files are generally large (ranging anywhere between 200mb and 1500mb) so now would be a good time to top-up that phone charge (if possible). If it isn't possible to charge the phone, don't worry, the phone will automatically turn off if it doesn't detect a flashing process after a few minutes.
Flashing Time!
Once the preperation has completed, flashing is very straightforward. Extract the downloaded firmware files to a folder on your hard disk, then use RSD Lite to load the XML or SBF file up. Power on the phone into fastboot mode again, and plug in the phone into an internal USB port on the computer, then press the start button. If everything is sucessful the phone should begin booting into the stock system. The flashing process usually takes 10-20 minutes depending on the size of the files and the power of the phone. If there are any failures, be sure to read the "Before getting started" section again, and hopefully someone on XDA can help recover the phone with you!
Click to expand...
Click to collapse
Would be best to download the files before entering the bootloader... I heard some nasty stories bout battery emptying out in BL/recovery and it messed up while flashing.
Charge up the phone before flashing and have the files ready prior to flashing.
Sent from my XT925 using xda app-developers app

saloums7 said:
Would be best to download the files before entering the bootloader... I heard some nasty stories bout battery emptying out in BL/recovery and it messed up while flashing.
Charge up the phone before flashing and have the files ready prior to flashing.
Sent from my XT925 using xda app-developers app
Click to expand...
Click to collapse
Yes, I understand what you're saying, but I've seen a lot of nightmare PCs out there recently, so I want to do a compatibility check before you end up downloading a large file and not being able to use it.

danifunker said:
Yes, I understand what you're saying, but I've seen a lot of nightmare PCs out there recently, so I want to do a compatibility check before you end up downloading a large file and not being able to use it.
Click to expand...
Click to collapse
Works like a charm. Thank you.

danifunker said:
Yes, I understand what you're saying, but I've seen a lot of nightmare PCs out there recently, so I want to do a compatibility check before you end up downloading a large file and not being able to use it.
Click to expand...
Click to collapse
Good point good thing I have unlimited bandwidth so that doesn't affect me too much
Sent from my XT925 using xda app-developers app

If you have "battery low" during flashing, and you can't make the phone boot, just discharge it completely and then plug the phone into charger (it will charge in "emergency mode" without booting).

Thanks for this post....after issues with CM 10 and no GPS....I flashed back to Rogers/Fido 4.1.2. very happy....here is hoping if there are any future updates this ROM will auto update. Or I can wish for a working CM 10.1 some day
Sent from my XT925 using xda app-developers app

shredrex said:
Thanks for this post....after issues with CM 10 and no GPS....I flashed back to Rogers/Fido 4.1.2. very happy....here is hoping if there are any future updates this ROM will auto update. Or I can wish for a working CM 10.1 some day
Sent from my XT925 using xda app-developers app
Click to expand...
Click to collapse
Hi shredrex, I am also having the same problems and I want to flash back to rogers/fido 4.1.2. May I know where you got your files from? I would really appreciate it!!

taeotut said:
Hi shredrex, I am also having the same problems and I want to flash back to rogers/fido 4.1.2. May I know where you got your files from? I would really appreciate it!!
Click to expand...
Click to collapse
I posted the wrong link in the original tutorial, thanks for flagging it.
Check this site : http://sbf.droid-developers.org/
Good luck!

i´m trying to install the telcel firmware and also used 2 different computers with the lastest drivers and rds lite 6.1.4
I followed all the steps and doesn´t work for me I´ve got the next error
failed flashing process. unknown fastboot command getvar
Help me please

Hi danifunker, I am new to Motorola and I have the RAZR i (XT890). I'm making two guides related to helping new people to Motorola phones here . May I link your guide here, of course giving full credit? I basically would like to recommend new users to the RAZR i to read good guides like this before they brick their phone. We get about 5 bricks a day over there!

gorefrausto said:
i´m trying to install the telcel firmware and also used 2 different computers with the lastest drivers and rds lite 6.1.4
I followed all the steps and doesn´t work for me I´ve got the next error
failed flashing process. unknown fastboot command getvar
Help me please
Click to expand...
Click to collapse
The firmware you downloaded has a .xml file in it. Remove the line with Getvar in it, and try to flash again.

elcacho said:
The firmware you downloaded has a .xml file in it. Remove the line with Getvar in it, and try to flash again.
Click to expand...
Click to collapse
Thanks, now I´m installing the firmware

elcacho said:
The firmware you downloaded has a .xml file in it. Remove the line with Getvar in it, and try to flash again.
Click to expand...
Click to collapse
Can we have this put into the tutorial please.
Also, as for the OP in general, thanks for putting this here; its not so clear elsewhere on this section of the forum and everything that is useful to a Motorola noob is specifically for the XT926... even the blog posts linked to. I had a lot of anxiety over trying this in the past because things as fundamental as this, concerning Motorola and these phones in particular as well, are scattered and disorganised in various places on the internet. Its frustrating and makes one want to shy away from trying things out for fear of not being able to return to stock or bricking their device. I come from an SGS2 which had no fastboot to worry about, for example, and even though the RAZR HD forum had few participants when I first got mine, there was still a lot to be confused about and to shy away from.

Im trying to flash the filmware to my phone cause my camera stopped working shortly after i updated my droid razr to 4.1.2, and when i did the ap fastboot filmware update, everything comes back like it already was should i remove everything from my phone and try again?
Edit: My Safestrap is gone, and now i have no service..
Edit Again: Service restored after i removed everything, another problem tho. Camera still wont initialize now

Firmware Motorola V9 bootloader 04.C1
Dear XDA members, need firmware in Portuguese with the Motorola V9 bootloader 04.C1. I thank you.

Thanks for detailed instuctions! Worked perfectly for Motorola XT862.

Ok to program option
I have been running 4.2.2 aokp unofficial, and its been awesome.. i need to flash back to stock because im going to be selling my phone soon, when i try to use mattlgraf's utility i always get the unable to mount error message.. im going to be trying this option aswell, but I have a feeling it wont work because i dont get the "OK to program" in AP Fastboot, if you have any idea why this is happening just reply to this post, thanks for all the material guys.
---------- Post added at 11:05 AM ---------- Previous post was at 10:58 AM ----------
thetigerag said:
I have been running 4.2.2 aokp unofficial, and its been awesome.. i need to flash back to stock because im going to be selling my phone soon, when i try to use mattlgraf's utility i always get the unable to mount error message.. im going to be trying this option aswell, but I have a feeling it wont work because i dont get the "OK to program" in AP Fastboot, if you have any idea why this is happening just reply to this post, thanks for all the material guys.
Click to expand...
Click to collapse
I got an error message that said "Failed flashing process. Unknown fastboot command" im not sure if this is due to the new firmware because of running 4.2.2 or what.. any information would be appreciated - Thanks.

Use MATT's utility v1.2
Look for the v 1.2 and give it a try.
I was able to go back to stock ICS on the xt925 (Rogers)

itzik_man said:
Look for the v 1.2 and give it a try.
I was able to go back to stock ICS on the xt925 (Rogers)
Click to expand...
Click to collapse
Yes, 1.20 was the utility i originally used.
I get the error message 'fastboot' is not recognized as an internal or external command, operable program or batch file. multiple times, then it takes me back to the main screen.
---------- Post added at 10:45 PM ---------- Previous post was at 10:04 PM ----------
Got it all worked out, thanks guys.

[UNBRICKING] Research on Unbricking Method for Zenfone 2

TESTERS NEEDED
The main intention of the threat was to find a way to restore a completely bricked zenfone 2. It is apparent that we are not having a spare bricked device to test upon.
Anyone with a Bricked Zenfone 2, A PC, and willingness to devote time, please participate.
Otherwise, this thread is going no where as we people who are searching for methods do not have bricked devices(And do not want to specially brick them for testing)(Obviously!!!) and all talks are in taking us nowhere.
Click to expand...
Click to collapse
"Bricked Devices" is a regularly heard phrase on XDA. Sadly, Asus devices dont come with a dedicated PC Companion or PC Suite software which can safely unbrick a Zenfone just in case someone is able to damage fastboot.
That Said, there have been Zenfone 2's that have been Hard Bricked in the past months. Fortunately, many of them may have got replaced as the device comes with a One Year Warranty. But what after that...???
So, i wanted to do some research upon this unexplored topic.
On successfully Hard Bricking your device, you will see something like this :highfive:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
( credit to the one who bricked and clicked)
I do not have a bricked device, but if anyone can get one and test stuff, we may end up getting something concrete to restore in future.
So, i came across a page: http://www.asus-zenfone.com/2014/11/how-to-unbrick-zenfone-5-and-zenfone-6_8.html
But soon i understood that all these things are foreign to me ( So far ).
Also, The drivers for the SOC are for CloverView Plus Devices.
It would be seriously great if we can successfully recover from corrupt fastboot. As without fastboot we can do absolutely nothing.
I request senior members, Devs and all others to provide inputs and links and keep this thread productive.
Who knows, someday we may end up in a situation without warranty and with a corrupt fastboot.
I will keep on updating this thread with updates from your side
Lets Start.

So that method in the link is like the Odin for Samsung, or the NvFlash for nvidia. Except that it is for Cloverview (32 nm SOC) vs Moorfield (22nm SOC) which is what we have.

cmendonc2 said:
So that method in the link is like the Odin for Samsung, or the NvFlash for nvidia. Except that it is for Cloverview (32 nm SOC) vs Moorfield (22nm SOC) which is what we have.
Click to expand...
Click to collapse
Exactly!!. We need something that works on Moorefield

[email protected] said:
Exactly!!. We need something that works on Moorefield
Click to expand...
Click to collapse
I looked further into it and what we need is the DNX_FW, IFWI, DNX_OS, and OS files for this device. This guide has more details on the Intel Manufacturer Flasher, which seems to be a version of the xFSTK downloader? The downloader seems only to write files (or download files) to the device, not generate them or copy them from the device. Someone with more experience would have to do that.

cmendonc2 said:
I looked further into it and what we need is the DNX_FW, IFWI, DNX_OS, and OS files for this device. This guide has more details on the Intel Manufacturer Flasher, which seems to be a version of the xFSTK downloader? The downloader seems only to write files (or download files) to the device, not generate them or copy them from the device. Someone with more experience would have to do that.
Click to expand...
Click to collapse
I think we first need drivers for the moorefield SOC ( SOC Drivers) to access the partitions without fastboot support.
I havent read the PDF that you linked. Will read and revert back.

Great job guys
Better be prepared now than panic later haha
Hope i can help but im totally new in this kind of stuff
This makes me want to take a course related to this stuff cause its amazing how u brainstorm with each other

tactician10 said:
Great job guys
Better be prepared now than panic later haha
Hope i can help but im totally new in this kind of stuff
This makes me want to take a course related to this stuff cause its amazing how u brainstorm with each other
Click to expand...
Click to collapse
Well, thats what XDA is here for.
Learning is a never ending process. And i have learnt a lot from others in this place.
And regarding this thread being inactive.
I have got a few things, but they seem irrelevant to me. Searching for something really solid in this regard. No point in posting irrelevant findings from my side and bumping up the thread.
I am going to get a bricked Zenfone 5 (Sure) and Zenfone 2(Hopefully) from a local repair shop.
Will try doing serious software damage to the Zenny 2 and will then try to recover. Lets See!!

i have this problem, broke my fastboot

Does your phone bootup???? Does Android bootup?
If it doesnt, you are currently out of luck
As already said by @cmendonc2 , we need someone senior to extract some files

@edit@
I solved it.
I reflashed recovery via Adb in screen selection "recovery mode/bootloader/normal"
I'm very happy

test subject..
Phone is hard bricked.. cant fastboot and on reboot it bootloops. I went into stock recovery via adb n actually data wiped n now cant adb either.. so.. tell me what u want me to try n ill let u know. Btw i already requested RMA but asus says maybe 4 weeks till i get it back.. so im hoping u guys can help me fix it before i send it in. Thanks

Seoulja said:
Phone is hard bricked.. cant fastboot and on reboot it bootloops. I went into stock recovery via adb n actually data wiped n now cant adb either.. so.. tell me what u want me to try n ill let u know. Btw i already requested RMA but asus says maybe 4 weeks till i get it back.. so im hoping u guys can help me fix it before i send it in. Thanks
Click to expand...
Click to collapse
Can you boot into Android????
What is your device model?? ZE550ML or ZE551ML??

Seoulja said:
Phone is hard bricked.. cant fastboot and on reboot it bootloops. I went into stock recovery via adb n actually data wiped n now cant adb either.. so.. tell me what u want me to try n ill let u know. Btw i already requested RMA but asus says maybe 4 weeks till i get it back.. so im hoping u guys can help me fix it before i send it in. Thanks
Click to expand...
Click to collapse
[email protected] said:
Can you boot into Android????
What is your device model?? ZE550ML or ZE551ML??
Click to expand...
Click to collapse
ZE551ML / ZOOA
It bootloops when i try to boot it. I get the usb symbol when i try to fastboot. I wanna try using intel phone flash tool but require .xml flash file within a stock Rom .zip file. I looked everywhere but i can't find a zip with .xml flash file.

moorefield driver
[email protected] said:
I think we first need drivers for the moorefield SOC ( SOC Drivers) to access the partitions without fastboot support.
I havent read the PDF that you linked. Will read and revert back.
Click to expand...
Click to collapse
Hello, if you install the Intel phone flash tool lite, the tool install also the moorefield driver. When you open the xfstk downloader the tool looks the phone but in stock rom from asus i can not found the ifwi os dnx os image files. If anyone will find the files please tell to me.
Thans for your help.

We need some experienced dev to extract these files for us
Without that, there is no option

levi1232005 said:
Hello, if you install the Intel phone flash tool lite, the tool install also the moorefield driver. When you open the xfstk downloader the tool looks the phone but in stock rom from asus i can not found the ifwi os dnx os image files. If anyone will find the files please tell to me.
Thans for your help.
Click to expand...
Click to collapse
Hey there!!
Check out this page: http://forum.xda-developers.com/general/xda-assist/intel-phone-flash-tool-t3129091. Its for Zenfone 5
The Guy has stated that he found the Necessary files by unpaking the boot.img,which can be found in the firmware zip available on Asus Support website.
Alternatively, you can get it from Here. But these are older ones. I would recommend the Asus website though.
The Intel Phone falsh tool is available at https://01.org/android-ia/downloads/intel-phone-flash-tool-lite . Try it out.
I have wiped my Linux and windows partitions as i am installing Windows 10. So this is all i can help you with. If you need any information, Just Ask. I will do my best to help.
As for extracting the boot.img, do a quick google search. XDA has a thread for that. You need either Linux or cygwin.
All the best!!!!
Disclaimer: I have not tested these things. Try at your own risk

cmendonc2 said:
I looked further into it and what we need is the DNX_FW, IFWI, DNX_OS, and OS files for this device. This guide has more details on the Intel Manufacturer Flasher, which seems to be a version of the xFSTK downloader? The downloader seems only to write files (or download files) to the device, not generate them or copy them from the device. Someone with more experience would have to do that.
Click to expand...
Click to collapse
Hey,
I just stumbled upon something.
I downloaded the latest OTA zip package (20MB) of the ze551ml
I opened the ifwi folder
And i found the bin files. DNX FW etc of various zenfone variants.
Can you throw some light on this???
P.S.
Folder screenshot attached!!

Here's some more info I found on the IFWI images:
Two special IFWI images are used for booting in this mode: _dnx_fwr.bin and _dnx_osr.bin. These comprise a simple flash tool that writes a raw image to the eMMC boot partitions and another to the main eMMC space. xFSTK is provided with paths to the IFWI image and a eMMC image. The eMMC image contains an OSIP header (location/size of U-Boot in eMMC, load address, and entry point), a partition table, and partitions with U-Boot and the U-Boot environment.
Click to expand...
Click to collapse
So the dnx_fwr.bin is probably this file:
Code:
dnx_fwr_ann_a0-mofd_v1-ze551ml.bin
The ifwi.bin is probably this file:
Code:
ifwi_ann_a0-mofd_v1-ze551ml.bin
I checked the MD5sums of the different versions and they are different. I guess we need a bricked ZF2 to test and see. Although we still don't have the OSR files. Perhaps @shakalaca can help us.

Okay right
I just had one last week. I tried everything i could. Finally i gave it back.
And Today i stumbled upon this.
Ill see if the guy still has that bricked zen.
Thanks for your reply
Sent from my ASUS_Z00AD using XDA Free mobile app

Good day sir, i was just wondering if this reseach is still going. Still unable to find any solution to my hard bricked zenfone 2 ZE200ml. Im somehow counting on this. Goodluck!

Made a complete ZVA dump

So after following some basic instructions that i still managed to mess up
i made a complete dump on zva. which means a debrick image can be made.
if we had the needed firehose.bin we could possibly fix hard-bricks in qfil in qpst.
I'm uploading said dump to my google drive but kinda reluctant to share it in fear if u used my dump then u might also get my iemi. so once i figure that one out i will make it available to all

So i was looking around in a few of the files in my hex editor and noticed. Id have to pull it up on i think bootloader backup. That user debug is set to 0. Wonder if its modifiable to set to 1 and enable a debug bootloader

Any idea how to dump the PRL? QPST 2.7.460 crashes when I try to read the info from the phone. LGUP might be able to do it with the proper LS992 DLL, but I can't find one that works.

Hai Karate said:
Any idea how to dump the PRL? QPST 2.7.460 crashes when I try to read the info from the phone. LGUP might be able to do it with the proper LS992 DLL, but I can't find one that works.
Click to expand...
Click to collapse
ive never had to dump a prl before every cdma phone i get i gsm unlock
ive read the prl on my g4 i use 2.7.402 and its never failed me

TheMadScientist420 said:
So after following some basic instructions that i still managed to mess up
i made a complete dump on zva. which means a debrick image can be made.
if we had the needed firehose.bin we could possibly fix hard-bricks in qfil in qpst.
I'm uploading said dump to my google drive but kinda reluctant to share it in fear if u used my dump then u might also get my iemi. so once i figure that one out i will make it available to all
Click to expand...
Click to collapse
Kinda a long shot but could we inject root into the system after boot using the sd card method of loading a dump?

thjubeck said:
Kinda a long shot but could we inject root into the system after boot using the sd card method of loading a dump?
Click to expand...
Click to collapse
I dont know rite now
my g5 is down

thjubeck said:
Kinda a long shot but could we inject root into the system after boot using the sd card method of loading a dump?
Click to expand...
Click to collapse
Interesting idea, have a link or can you go more into detail about loading a dump via SD? This is my first LG and I'm still trying to figure some things out. My Samsungs were so easy to root, flash TWRP in Odin, flash SuperSU, done.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

bilgerryan said:
Interesting idea, have a link or can you go more into detail about loading a dump via SD? This is my first LG and I'm still trying to figure some things out. My Samsungs were so easy to root, flash TWRP in Odin, flash SuperSU, done.
Click to expand...
Click to collapse
Ive been doin lgs for some time now, It sounds like he is describing the rooted system injection like on sprint g4 with the dd commands.

bilgerryan said:
Interesting idea, have a link or can you go more into detail about loading a dump via SD? This is my first LG and I'm still trying to figure some things out. My Samsungs were so easy to root, flash TWRP in Odin, flash SuperSU, done.
Click to expand...
Click to collapse
I originally had the root shell from December but it was useless and I ended up flashing a newer KDZ file and have not been able to downgrade yet so for me that method is out and was not working and I have been looking for other options.
So far have two options. https://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586
UPDATE: The send_command.exe does find the phone so testing to see what happens here
UPDATE 2: Que the haters LAF got me forgot about that guys sorry. So looks like LGUP may be the only option if we can figure out how to convince it to work.
UPDATE 3: Purposely bricking your phone gets you into LAF mode. You have to stop it at 10% on a KDZ update and it will allow you to use LAF mode again.
My other option is use the "expanded" version of LGUP and flash the system partition.I have tried extracting the system partition and flashing but having trouble getting LGUP to flash .img to the system. Seems to only let you choose where to put the partition if you are using a .dz or .kdz file.
As for the SD method, I read a post about using the SD card with a dump of the phone to recover from a hardbrick. Not completely sure of the details on that.
The G5 is not currently my daily driver so am able to experiment some with it.
P.S. Disclaimer to anyone who comes across this reply looking for root. I know some about what is possible with this phone but do not quote me as fact as I can and have been wrong before

thjubeck said:
I originally had the root shell from December but it was useless and I ended up flashing a newer KDZ file and have not been able to downgrade yet so for me that method is out and was not working and I have been looking for other options.
So far have two options. https://forum.xda-developers.com/g4/general/lg-g4-100-root-success-directives-root-t3180586
UPDATE: The send_command.exe does find the phone so testing to see what happens here
UPDATE 2: Que the haters LAF got me forgot about that guys sorry. So looks like LGUP may be the only option if we can figure out how to convince it to work.
My other option is use the "expanded" version of LGUP and flash the system partition.I have tried extracting the system partition and flashing but having trouble getting LGUP to flash .img to the system. Seems to only let you choose where to put the partition if you are using a .dz or .kdz file.
As for the SD method, I read a post about using the SD card with a dump of the phone to recover from a hardbrick. Not completely sure of the details on that.
The G5 is not currently my daily driver so am able to experiment some with it.
P.S. Disclaimer to anyone who comes across this reply looking for root. I know some about what is possible with this phone but do not quote me as fact as I can and have been wrong before
Click to expand...
Click to collapse
I saw a post somewhere about making your own kdz, let me see if I can find it again. We were able to get a downgrade working as far back as ZV8.

bilgerryan said:
I saw a post somewhere about making your own kdz, let me see if I can find it again. We were able to get a downgrade working as far back as ZV8.
Click to expand...
Click to collapse
Not getting anywhere on the custom kdz. Found some tools and have got the kdz extracted but recompiling seems to be the issue here.

This might help you for kdz
https://forum.xda-developers.com/showthread.php?t=2215929

Hello, I need urgent help, I tried an unlocking service for my G5 and the person using the remote server bricked my phone. It is not stuck on download mode, I cannot even get into recovery. I don't know how to reflash this phone, I think if I had the correct .dll for the LG flash tool it would help me greatly as I could at least try to flash it. Thank you for your consideration.

Kevovaz said:
Hello, I need urgent help, I tried an unlocking service for my G5 and the person using the remote server bricked my phone. It is not stuck on download mode, I cannot even get into recovery. I don't know how to reflash this phone, I think if I had the correct .dll for the LG flash tool it would help me greatly as I could at least try to flash it. Thank you for your consideration.
Click to expand...
Click to collapse
Already answered you in the unlocking thread.

majedalanni said:
This might help you for kdz
https://forum.xda-developers.com/showthread.php?t=2215929
Click to expand...
Click to collapse
The first tool looks promising but since google code went to archive mode seems that it can't be found.

TheMadScientist said:
So after following some basic instructions that i still managed to mess up
i made a complete dump on zva. which means a debrick image can be made.
if we had the needed firehose.bin we could possibly fix hard-bricks in qfil in qpst.
I'm uploading said dump to my google drive but kinda reluctant to share it in fear if u used my dump then u might also get my iemi. so once i figure that one out i will make it available to all
Click to expand...
Click to collapse
Just wondering about this but is the reason the original tool posted by unmentionable names removed because it involves purposely bricking your phone? I found a forum post on the G4 about this and tried it with the G5 and I can get into LAF mode although limited on the newest bootloader version.

thjubeck said:
Just wondering about this but is the reason the original tool posted by unmentionable names removed because it involves purposely bricking your phone? I found a forum post on the G4 about this and tried it with the G5 and I can get into LAF mode although limited on the newest bootloader version.
Click to expand...
Click to collapse
Yea i bricked mine but a diffrent reason and no fix cause g5 uses .elf not firehose.bin

TheMadScientist said:
Yea i bricked mine but a diffrent reason and no fix cause g5 uses .elf not firehose.bin
Click to expand...
Click to collapse
Okay. I posted on another forum and asked one of developers of that tool if they'd be willing to let someone try it who doesn't really care about the fact that you could brick your phone so here's hoping they'll let someone else try to finish the tool and get something working. Didn't get anywhere with the kdz method so thought I'd try stirring up the hornets nest again by asking.

thjubeck said:
Okay. I posted on another forum and asked one of developers of that tool if they'd be willing to let someone try it who doesn't really care about the fact that you could brick your phone so here's hoping they'll let someone else try to finish the tool and get something working. Didn't get anywhere with the kdz method so thought I'd try stirring up the hornets nest again by asking.
Click to expand...
Click to collapse
Wheres that at i might poke at that nest too. I hate to think my g5 is truly dead.

TheMadScientist said:
Wheres that at i might poke at that nest too. I hate to think my g5 is truly dead.
Click to expand...
Click to collapse
https://forum.xda-developers.com/tmobile-lg-g5/help/jcase-beaups-lg-tool-t3357312/page3
I replied to jcase at the end of this post on the tmobile forum. Thought about PMing him but its supposedly taboo to ask about the tool they posted so I figured I'd see if he would reply. Any other ideas let me know. I really want to know how they got root working and if it was full root or just user debug as the full root is helpful but userdebug was not as useful.
Really hate it that someone was stupid and released it early and got them ticked off about it.

No possible way of getting into download mode. Please help. LG V20 H918 T-Mobile

I was able to root my phone and use it for a while but then it started reboot for no reason. It is currently running Oreo, H91820h.
I tried to restore to different earlier back up but same issue and a whole bunch of apps complain and terminate itself. Tried to flash Lineage OS and same problem.
So I tried to use LGUP to restore it to stock image but cannot get the phone into download mode.
When I hold the volume down button and plug in the USB cable, I get the fastboot screen.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
When I hold the volume up button and plug in the USB cable, I get the "Download Mode" icon for about 2 second and then it switches to TWRP screen.
I remember when I first tried to install TWRP, it was version 3.2.1-3. Then I tried to flash twrp version 3.3.1-0 but for some reason, sometime it boots up with version 3.3.1-0 and sometime it boots up with version 3.2.1-3.
I cannot flash anything in fastboot or adb since it always come back with "FAILED (remote: 'unknown command')".
I have tried for over a week, read everything I could on the internet and tried everything but without success in getting into download mode to reload the stock image with LGUP.
Could anybody provide any suggestion or an alternate way of restoring the stock image without requiring going to download mode? May be re-flash with a different twrp version or remove twrp completely so it doesn't show up when I press volume up and plug in the USB cable.
Please, I am desperate. I can even send you the phone if you think you can fix it.
Thanks.

bqbase said:
I was able to root my phone and use it for a while but then it started reboot for no reason. It is currently running Oreo, H91820h.
I tried to restore to different earlier back up but same issue and a whole bunch of apps complain and terminate itself. Tried to flash Lineage OS and same problem.
So I tried to use LGUP to restore it to stock image but cannot get the phone into download mode.
When I hold the volume down button and plug in the USB cable, I get the fastboot screen.
When I hold the volume up button and plug in the USB cable, I get the "Download Mode" icon for about 2 second and then it switches to TWRP screen.
I remember when I first tried to install TWRP, it was version 3.2.1-3. Then I tried to flash twrp version 3.3.1-0 but for some reason, sometime it boots up with version 3.3.1-0 and sometime it boots up with version 3.2.1-3.
I cannot flash anything in fastboot or adb since it always come back with "FAILED (remote: 'unknown command')".
I have tried for over a week, read everything I could on the internet and tried everything but without success in getting into download mode to reload the stock image with LGUP.
Could anybody provide any suggestion or an alternate way of restoring the stock image without requiring going to download mode? May be re-flash with a different twrp version or remove twrp completely so it doesn't show up when I press volume up and plug in the USB cable.
Please, I am desperate. I can even send you the phone if you think you can fix it.
Thanks.
Click to expand...
Click to collapse
I'm not that familiar with the 918 ( I have 2 H910 )
But from the symptoms you described
I would guess that your MB is shot.
Even if you do manage to get into download mode you'll likely have errors flashing anything. I can look at the phone but it sounds like you need a replacement MB.
Sent from my Mi MIX 2S using Tapatalk

clsA said:
I'm not that familiar with the 918 ( I have 2 H910 )
But from the symptoms you described
I would guess that your MB is shot.
Even if you do manage to get into download mode you'll likely have errors flashing anything. I can look at the phone but it sounds like you need a replacement MB.
Sent from my Mi MIX 2S using Tapatalk
Click to expand...
Click to collapse
Not sure what you mean by "MB". I don't think it means "motherboard" so my best guess is "master boot".
Where can I get a replacement MB and how to replace it?

bqbase said:
Not sure what you mean by "MB". I don't think it means "motherboard" so my best guess is "master boot".
Where can I get a replacement MB and how to replace it?
Click to expand...
Click to collapse
Yes you need a motherboard
Or another phone
Sent from my Mi MIX 2S using Tapatalk

clsA said:
I'm not that familiar with the 918 ( I have 2 H910 )
But from the symptoms you described
I would guess that your MB is shot.
Even if you do manage to get into download mode you'll likely have errors flashing anything. I can look at the phone but it sounds like you need a replacement MB.
Sent from my Mi MIX 2S using Tapatalk
Click to expand...
Click to collapse
bqbase said:
Not sure what you mean by "MB". I don't think it means "motherboard" so my best guess is "master boot".
Where can I get a replacement MB and how to replace it?
Click to expand...
Click to collapse
Hold the phone here, the H918 can NEVER use fastboot to flash, thats why the lafsploit is used to replace download mode with a copy of twrp, leading many H918 users to have two different twrp installs.
To get download mode back flash this from the original lafsploit thread.
Rebooting for no reason is a bad sign (maybe see about replacing your battery if its the original one). Everything else (fastboot not working, download mode replaced by twrp)? Normal.

Phoenix591 said:
Hold the phone here, the H918 can NEVER use fastboot to flash, thats why the lafsploit is used to replace download mode with a copy of twrp, leading many H918 users to have two different twrp installs.
To get download mode back flash this from the original lafsploit thread.
Rebooting for no reason is a bad sign (maybe see about replacing your battery if its the original one). Everything else (fastboot not working, download mode replaced by twrp)? Normal.
Click to expand...
Click to collapse
OMG, OMG, OMG, I got my download mode back. I am so appreciate your help. I wish I can send you a beer.
I must have gone through this lafsploit thread a hundred times but never paid attention to this "OPTIONAL" note and I wasted sooo much time refusing to post a question on this forum thinking I can find the answer just buy combing through the internet.
I believe you are dead on with reboot issue too. I got more than a few times with the phone complaining that wrong battery was inserted and need to shutdown. But I thought my un-experienced flashing of all the junks I did on the phone are causing it.
"OPTIONAL
If you would like to restore download mode onto your laf partition AFTER you have installed TWRP onto recovery:
Boot to TWRP that is on recovery
Flash this zip: laf_restore.zip
This can be done at any time after you are rooted. About the only reason you would want to flash laf back is if you use LG Backup.
TWRP has the ability to backup your phone, so I am not sure why someone would want this (maybe you are more comfortable with it?).
Also, flashing back to 100% unrooted stock can be accomplished by flashing a zip in TWRP, you don't NEED to flash a KDZ, but again, maybe you are more comfortable doing it that way.
The bottom line is TWRP on both laf and recovery is FAR FAR more useful than flashing laf back. You can test new versions of TWRP while keeping your old known working version (for example)."

clsA said:
I'm not that familiar with the 918 ( I have 2 H910 )
But from the symptoms you described
I would guess that your MB is shot.
Even if you do manage to get into download mode you'll likely have errors flashing anything. I can look at the phone but it sounds like you need a replacement MB.
Sent from my Mi MIX 2S using Tapatalk
Click to expand...
Click to collapse
I just want to say thank you to clsA and Phoenix591 for the help. I found the answer and was able to successfully restore my phone to 100% stock. I know it's hard to pinpoint the issue while trying to understand all the craps that people post on their question. Hit or miss, right or wrong, work or not, I really appreciate all the effort that you did to help me figure out the solution.

bqbase said:
I just want to say thank you to clsA and Phoenix591 for the help. I found the answer and was able to successfully restore my phone to 100% stock. I know it's hard to pinpoint the issue while trying to understand all the craps that people post on their question. Hit or miss, right or wrong, work or not, I really appreciate all the effort that you did to help me figure out the solution.
Click to expand...
Click to collapse
Guess I missed it on this one
V20 does have a lot of motherboard issue over the years. Apps crashing and phone rebooting randomly are 2 of them.
Glad you got it sorted and back to stock
Sent from my Mi MIX 2S using Tapatalk

Phoenix591 said:
Hold the phone here, the H918 can NEVER use fastboot to flash, thats why the lafsploit is used to replace download mode with a copy of twrp, leading many H918 users to have two different twrp installs.
To get download mode back flash this from the original lafsploit thread.
Rebooting for no reason is a bad sign (maybe see about replacing your battery if its the original one). Everything else (fastboot not working, download mode replaced by twrp)? Normal.
Click to expand...
Click to collapse
Thank you very much, i can Relock and unroot my device with this, thank you so much

Phoenix591 said:
Hold the phone here, the H918 can NEVER use fastboot to flash, thats why the lafsploit is used to replace download mode with a copy of twrp, leading many H918 users to have two different twrp installs.
To get download mode back flash this from the original lafsploit thread.
Rebooting for no reason is a bad sign (maybe see about replacing your battery if its the original one). Everything else (fastboot not working, download mode replaced by twrp)? Normal.
Click to expand...
Click to collapse
Hi I've happened to run into the same mistake however the link is broken. If you still have the file I would really appreciate the help.
I'm usually very careful when it comes to flashing but I made the mistake of trusting someone to unlock my V20 for global use, vendor told me they didn't know if they could do it since it was rooted and their unlocking software detected the root. He needed to remove the root and charge me extra. I trusted him into removing the root and pushed back the agreed upon date like three times. He kept saying he could not remove twrp. Long story short he told me he wasn't able to do it and gave me a discount, he said he was able to unlock it but was not able to power it on as it was bootlooping. I assume it was because he locked the bootloader and once I unlocked it again when I try to go into download mode to restore into LGUP it boots me into twrp instantly. Thanks in advance

Question How I can obtain a firmware file for this device?

Hello all!
I have a question concerning a device, I have a Cricket Dream 5G and the device is completely bootloader unlocked. However, I'm trying to figure out how I can obtain a firmware file for the device seeing as the Carrier or manufacturer hasn't released one. It is a MediaTek device running the MT6833 and efforts to make a scatter file in order to read with SP Flash tools have been unsuccessful,
I've also attempted to download an OTA update and see if it saved the file locally, as well as packet dump the update process via Wireshark. No Cigar.. it appears to be in the Cache partition which isn't accessible without root (which cannot be obtained without running TWRP with the device being Android 11). does anyone have any suggestions on how I might be able to get a copy of the system image or boot images for the use of making a working TWRP?
Thanks a lot!

Josephdbrewer25 said:
Hello all!
I have a question concerning a device, I have a Cricket Dream 5G and the device is completely bootloader unlocked. However, I'm trying to figure out how I can obtain a firmware file for the device seeing as the Carrier or manufacturer hasn't released one. It is a MediaTek device running the MT6833 and efforts to make a scatter file in order to read with SP Flash tools have been unsuccessful,
I've also attempted to download an OTA update and see if it saved the file locally, as well as packet dump the update process via Wireshark. No Cigar.. it appears to be in the Cache partition which isn't accessible without root (which cannot be obtained without running TWRP with the device being Android 11). does anyone have any suggestions on how I might be able to get a copy of the system image or boot images for the use of making a working TWRP?
Thanks a lot!
Click to expand...
Click to collapse
It works for most of newer MediaTek devices, you could back up any partition from it https://github.com/bkerler/mtkclient eventually you could root it too.
As per a TWRP for your device, you should try to build it from source or porting it from a similar device (system image not needed though) or wait for some developer to do it.

SubwayChamp said:
It works for most of newer MediaTek devices, you could back up any partition from it https://github.com/bkerler/mtkclient eventually you could root it too.
As per a TWRP for your device, you should try to build it from source or porting it from a similar device (system image not needed though) or wait for some developer to do it.
Click to expand...
Click to collapse
I've successfully backed up the device and gained root access. Thank you so much for recommending this tool. It worked, just voided my warranty lol. Had to disconnect the battery which requires taking apart the device

SubwayChamp said:
It works for most of newer MediaTek devices, you could back up any partition from it https://github.com/bkerler/mtkclient eventually you could root it too.
As per a TWRP for your device, you should try to build it from source or porting it from a similar device (system image not needed though) or wait for some developer to do it.
Click to expand...
Click to collapse
Also do you know where the stock recovery is located. I can't seem to find it anywhere, like it doesn't even exist.

Josephdbrewer25 said:
I've successfully backed up the device and gained root access. Thank you so much for recommending this tool. It worked, just voided my warranty lol. Had to disconnect the battery which requires taking apart the device
Click to expand...
Click to collapse
Usually when a device's software had been modified, it may lose the warranty, or not, depending on what the "small" letters on a contract says, anyway, you could restore to its original state at any time, as you see in the need to claim it.
Normally, this tool works only installing the USDK64 drivers, and connecting device when power off, pressing the two volume buttons, I never need to open the back cover as MediaTek devices have the preloader mode, that it used by this tool to bypass the DA/SLAA protection, it does in the first stage the same thing that this tool does https://www.xda-developers.com/bypass-mediatek-sp-flash-tool-authentication-requirement/ but without the need to use SP Flash tool but reading/writing directly onto the device.
Josephdbrewer25 said:
Also do you know where the stock recovery is located. I can't seem to find it anywhere, like it doesn't even exist.
Click to expand...
Click to collapse
Newer devices doesn't have a dedicated recovery partition.

SubwayChamp said:
Usually when a device's software had been modified, it may lose the warranty, or not, depending on what the "small" letters on a contract says, anyway, you could restore to its original state at any time, as you see in the need to claim it.
Normally, this tool works only installing the USDK64 drivers, and connecting device when power off, pressing the two volume buttons, I never need to open the back cover as MediaTek devices have the preloader mode, that it used by this tool to bypass the DA/SLAA protection, it does in the first stage the same thing that this tool does https://www.xda-developers.com/bypass-mediatek-sp-flash-tool-authentication-requirement/ but without the need to use SP Flash tool but reading/writing directly onto the device.
Newer devices doesn't have a dedicated recovery partition.
Click to expand...
Click to collapse
It wouldn't stay in preloader mode, after a few minutes it would just reboot. Disconnecting the battery worked.
As for the recovery, I know it doesn't have a partition but it's gotta be somewhere, right? I can boot into recovery. It's been awhile since I've dabbled in this. My last phone I rooted was the Moto X 1st gen but to build twrp I need the stock recovery, right? I've seen on the net it's in the boot.img but I've yet to see it.

Josephdbrewer25 said:
It wouldn't stay in preloader mode, after a few minutes it would just reboot. Disconnecting the battery worked.
As for the recovery, I know it doesn't have a partition but it's gotta be somewhere, right? I can boot into recovery. It's been awhile since I've dabbled in this. My last phone I rooted was the Moto X 1st gen but to build twrp I need the stock recovery, right? I've seen on the net it's in the boot.img but I've yet to see it.
Click to expand...
Click to collapse
My device is the Cricket Dream 5G EC211001. It's weird

Josephdbrewer25 said:
It wouldn't stay in preloader mode, after a few minutes it would just reboot. Disconnecting the battery worked.
As for the recovery, I know it doesn't have a partition but it's gotta be somewhere, right? I can boot into recovery. It's been awhile since I've dabbled in this. My last phone I rooted was the Moto X 1st gen but to build twrp I need the stock recovery, right? I've seen on the net it's in the boot.img but I've yet to see it.
Click to expand...
Click to collapse
It doesn't really need to stay in preloader, this is the whole purpose of this tool, preloader is, actually, useless for flashing, when you press the two volume buttons, the device enters to preloader mode
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
if you installed correctly the drivers, then, mtkclient detects the device, in the short time, and make it return to BROM mode through a handshake, to bypass the DA/SLAA authorization,
BROM mode is disabled by OEMs, similarly to EDL point, without this kind of tool, no more remedy that opening the back cover.
Moto 1st gen, it's a long time ago. It is placed in a tiny portion of the ramdisk, but you don't need to find where’s located.
If you think to port it, actually is not as easy due to newer implementations, A/B slots, virtual slots, a way to fix it permanently, etc., but basically what you need is in the boot image