mission inposible! - Sony Cross-Device General

. .

is there any way to flash a bootloader for example the testpoint? would be funny to build it from source

. .

munjeni said:
There is no source for our bootloaders! I not tried to flash bootloader but I think its posible using dd since I know ta flashing is possible with dd so I think bootloader is possible too. I do not know if there is a hach check for bootloader partition (case if we flash cracked bootloader) but I will see very soon! In case, if there is no hash check and or if we are able to flash cracked bootloader, than we can bypass security check by cracking bootloader!
I wanted to mmap 0x80110000 memory and see what I can see there... but seems we can not open them? Since:
Do you have idea how we can read them?
Click to expand...
Click to collapse
sorry i don't know much about that..
can't we build a lk bootloader modified for our device?

munjeni said:
There is no source for our bootloaders! I not tried to flash bootloader but I think its posible using dd since I know ta flashing is possible with dd so I think bootloader is possible too. I do not know if there is a hach check for bootloader partition (case if we flash cracked bootloader) but I will see very soon! In case, if there is no hash check and or if we are able to flash cracked bootloader, than we can bypass security check by cracking bootloader!
Click to expand...
Click to collapse
I would be very surprised if there's no signature-check for the bootloader partition, even the original (first) iPhone had a signature-check for the user-modifiable bootloader.
Perhaps a BROWN device (in SonyEricsson terms) would not have a check, but a retail device sure will.

CoolDevelopment said:
sorry i don't know much about that..
can't we build a lk bootloader modified for our device?
Click to expand...
Click to collapse
I am not sure since our phone use aboot. Did you found here on xda that somebody had luck with lk and xperia device? I not searched but maybe somebody had luck?

. .

Will have a look at it later

The qualcomm boot chain verifies each part with a signature. I think what you modified is not part of the data which is used for calculating the signature.
There was a exploit in lk which allowed overwriting the signature check in lk with a modified ramdisk offset in the kernel (this allowed booting custom kernels with locked bootloader). But this exploit is patched now (you can see in lk, it checks ramdisk offset now) (see also http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html )

. .

. .

munjeni said:
We have runing ABOOT and not LK ! Every part of an binary is part of binary! In our way s1sbl is not signature checked! I think we are ready for cracking s1sbl!
Click to expand...
Click to collapse
ABOOT is a modified LK very close to source. Try modifing actual code of the bootloader binary first. I'm still pretty sure it's signature checked.
The boot files from the firmware are only flashed if the version is different. Each configuration is read and the phone checks the 'ATTRIBUTES VALUE'. If the attributes on the phone matches the attributes in the configuration, the files from the said configuration are flashed.
For example OTP_LOCK_STATUS you can find in service menu under Service tests => Security.

Bad thing I have no flash mode and no fastboot

. .

Try flashing different commercial files and see which one lets you use fastboot and flashmode
Another thing which could be possible with a modified bootloader is using the fotakernel partition as our recovery, that would be great

. .

this might be interesting: http://forum.xda-developers.com/showthread.php?t=2147997
and after reading through the lk bootloader source it seems aboot is included in lk

Flashed now 007B30E1 comercial version (have biger size) and its boot but no flashmode, seems we need to flash booth files provided in xml file for every configuration for getting fastboot and flashmode active.

Strange thing:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/s1sbl
WTF not bricked? There is another partition similar with s1sbl with name alt_s1sbl (alternate partition), seems these partition is used if s1sbl partition is broken?

munjeni said:
On HTC phones you have right, but seems you are wrong for xperia! I have flashed it using DD command and its persistent!
Click to expand...
Click to collapse
Yes, of course.. I am talking about official firmware upgrade procedure.

Related

Nexus 7 bootloader upgrade

Hey, I want to upgrade my N7 bootloader from 3.41.3 to a newer vesion because I want to install M kernel.
How do you upgrade it?
Daniel120201 said:
Hey, I want to upgrade my N7 bootloader from 3.41.3 to a newer vesion because I want to install M kernel.
How do you upgrade it?
Click to expand...
Click to collapse
With very considerable care!
Hi, Daniel120201...
The method I use is via fastboot... I don't know if the various toolkits that are available can flash a bootloader, as I've never used them.
So, using fastboot, the command line syntax is...
Code:
fastboot flash bootloader bootloader-grouper-4.23.img
...for flashing bootloader-grouper-4.23.img on a WiFi only 'grouper' Nexus 7.
The bootloader for the WiFi+3G Nexus 7 ('tilapia') will have a different bootloader name.
** (Edit & addendum: just checked, and as expected, it's called bootloader-tilapia-4.23.img) **
So for a WiFi & 3G Nexus 7, the bootloader flash command would be...
Code:
fastboot flash bootloader bootloader-tilapia-4.23.img
-----------------------------------------
IT'S VITALLY IMPORTANT YOU FLASH THE CORRECT BOOTLOADER FOR YOUR SPECIFIC NEXUS 7. Fastboot flashing an incorrect bootloader to the bootloader partition WILL HARDBRICK the device.
And on that note... and before you do anything... it's important you read the following first...
[WARNING][URGENT] N7 grouper (2012 WiFi) bootloader .img files from Google.
Hope this helps... and good luck.
Rgrds,
Ged.
Ty but I upgraded it before seeing this
You still deserve a thanks
GedBlake said:
With very considerable care!
Hi, Daniel120201...
The method I use is via fastboot... I don't know if the various toolkits that are available can flash a bootloader, as I've never used them.
So, using fastboot, the command line syntax is...
Code:
fastboot flash bootloader bootloader-grouper-4.23.img
...for flashing bootloader-grouper-4.23.img on a WiFi only 'grouper' Nexus 7.
The bootloader for the WiFi+3G Nexus 7 ('tilapia') will have a different bootloader name.
** (Edit & addendum: just checked, and as expected, it's called bootloader-tilapia-4.23.img) **
So for a WiFi & 3G Nexus 7, the bootloader flash command would be...
Code:
fastboot flash bootloader bootloader-tilapia-4.23.img
-----------------------------------------
IT'S VITALLY IMPORTANT YOU FLASH THE CORRECT BOOTLOADER FOR YOUR SPECIFIC NEXUS 7. Fastboot flashing an incorrect bootloader to the bootloader partition WILL HARDBRICK the device.
And on that note... and before you do anything... it's important you read the following first...
[WARNING][URGENT] N7 grouper (2012 WiFi) bootloader .img files from Google.
Hope this helps... and good luck.
Rgrds,
Ged.
Click to expand...
Click to collapse
Hi mate ,
really good information , i been looking for something like that for a while...
Where do i get the bootloader from? factory images? if so i have to unlock them and root them again.....
And besides fastboot can i use tools like NRT to flash them?
So many questions...
MAX 404 said:
Hi mate ,
really good information , i been looking for something like that for a while...
Where do i get the bootloader from? factory images? if so i have to unlock them and root them again.....
And besides fastboot can i use tools like NRT to flash them?
So many questions...
Click to expand...
Click to collapse
You download the factory image, extract it and it should be one of the files. The just fastboot flash bootloader bootloadername.img
kilometers4 said:
You download the factory image, extract it and it should be one of the files. The just fastboot flash bootloader bootloadername.img
Click to expand...
Click to collapse
Thanks.
then i should unlock it and root again? also newer is better i am on 4.21 now
MAX 404 said:
Thanks.
then i should unlock it and root again? also newer is better i am on 4.21 now
Click to expand...
Click to collapse
Is it already unlocked? If it is I'm pretty sure it will stay unlocked. But if it isn't, yes you can unlock and root it. Just keep in mind that unlocking the bootloader will wipe your data
kilometers4 said:
Is it already unlocked? If it is I'm pretty sure it will stay unlocked. But if it isn't, yes you can unlock and root it. Just keep in mind that unlocking the bootloader will wipe your data
Click to expand...
Click to collapse
It is already unlocked , thanks for the support , you are number 1.

Meizu PRO 5 bootloop no recovery locked bootloader

Hi all,
I am in trouble with the PRO 5.
Actual situation:
No recovery mode available
The phone boots but when is time to go in the home screen, the screen becomes black and only the power button response so I only turn it off or restart.
Fastboot mode available but the bootloader is locked
I tried many time with the Multiupgrade tool and TestPCTool but the answer is "Token sign failed"
Could someone help me before to put the phone in the trash
Upppppp!!!!!
You could try to unlock it using "fastboot oem unlock", but if it works it probably wipes the userdata partition, and it may fail. If you manage to unlock it, just reflash the stock image, but without the bootloader.
If this doesn't work, there is a similar thread in a different forum which may help you:
https://forum.meizufans.eu/topic/5376/meizu-pro-5-have-rooted-rom-but-lost-recovery-phone-can-boot-pls-help
Daniel Abrecht said:
You could try to unlock it using "fastboot oem unlock", but if it works it probably wipes the userdata partition, and it may fail. If you manage to unlock it, just reflash the stock image, but without the bootloader.
If this doesn't work, there is a similar thread in a different forum which may help you:
https://forum.meizufans.eu/topic/53...rom-but-lost-recovery-phone-can-boot-pls-help
Click to expand...
Click to collapse
I know the italian guy of this 3D and I can tell u, "fastboot oem unlock" doesn't work unfortunately :crying:
Thanks Pycon.
He is right, no way to unlock the bootloader, at the moment
just try this. good luck man. http://forum.xda-developers.com/meizu-pro-5/how-to/meizu-customer-service-flash-tools-save-t3447678
tzzzz said:
just try this. good luck man. http://forum.xda-developers.com/meizu-pro-5/how-to/meizu-customer-service-flash-tools-save-t3447678
Click to expand...
Click to collapse
Thanks but tried many times: Token signature fail...
Have you tried flashing the whole system (20150923195421_demo_prd_stable) as described in the M86 firmware upgrade tutorial.pdf ?
st0rm77 said:
Have you tried flashing the whole system (20150923195421_demo_prd_stable) as described in the M86 firmware upgrade tutorial.pdf ?
Click to expand...
Click to collapse
Where is that tutorial?
DarginMahkum said:
Where is that tutorial?
Click to expand...
Click to collapse
It resides in the Meizu Tools post, but never mind that. I dove into the security and fastboot uses secure boot so unless there is an exploit your stuck.
Are you able to flash the boot partition ?
If so, you might be able to flash the recovery.img onto the boot (bootimg) partition. Then drop an update.zip into the root of userdata and reboot.
Good luck.
Hey Grumpy,
I extracted the kernel and ramdisk from the recovery image (flyme_5.6.1.19_daily). Unpack these files into a directory, then run
# fastboot boot kernel ramdisk
If it boots you can:
- erase to factory default
- maybe ?? flash /sdcard/update.zip ??
Good luck :good:
st0rm77 said:
Hey Grumpy,
I extracted the kernel and ramdisk from the recovery image (flyme_5.6.1.19_daily). Unpack these files into a directory, then run
# fastboot boot kernel ramdisk
If it boots you can:
- erase to factory default
- maybe ?? flash /sdcard/update.zip ??
Good luck :good:
Click to expand...
Click to collapse
Nope...
creating boot image...
creating boot image - 15699968 bytes
downloading 'boot.img'...
FAILED (remote: permission denied!)
finished. total time: 0.000s

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?

Droid Turbo XT1254 Marshmallow->Lollipop downgrade (unlocking bootloader)COMING SOON?
*this is new thread because I started last as Q&A by mistake so first 2 pages may look off with posts and answers.
DOWNGRADING EXPERIMENT TOPIC
So as you may know , after upgrading to Marshmallow OTA, on locked bootloader there won't be any option to unlock bootloader (ever as some people say) , sunshine officially doens't support Marshmallow. The only option is to downgrade which again isn't possible on locked BL..
Or is it ?
Introduction - skip to DOWNGRADE
First of all I'm not an programmer , but have some experience with locked down motorola's bl's , firmware's ,downgrades and so on..
I'm sure when somebody says impossible, it doesn't really mean impossible, but rather not worthy to some. So in my case I bought the phone few days ago, wasn't fully up to date with infos on unlocking BL so didn't check FW version when buying , just after I checked and phone was updated on MM 1-2 days before buying it. On not unlockable BL phone will become useless to me very soon, while unlocked I would plan to have it for long period of time. It goes in Verzion's favour for me to ditch the phone and buy a new one except I'm not in USA , there are no Verzion services in my country and if there were I would never ever buy (again) anything from Verzion. Well I lived in Japan , and there is network Softbank which is well.. Imagine Verizon but on steroids when it comes to tying people down, locked bootloaders and software, insane fee's and so on.. Well that Softbank bough Verizon some time ago .. I was avoiding them at all cost, but on to the topic now.
DOWNGRADE - fastboot
I would like to invite everybody who is interested in this and who can help to participate in this. Every programmer that has time and can contribute would be greatly appreciated! In return I'm willing to sacrifice my phone and my time , even paying some reasonable donations.
While experimenting in the end I was able to flash all bootloader files from various different versions including all partitions related to it which gets upgraded. Even managed to flash XT1250 MM bootloader. Bootloader version DOES change in bootloader / fastboot ,But it doesn't mean ANYTHING. While downgrading , something else, possibly other parts of bootloader obviously search for match and there is more to it than simple bootloader , more experienced , chime on in here! SElinux enforcing? Verity?
(see attachments)
SU4TL-49 bootloader.img to motoboot flash - Successfully
SU4TL-49 manually flashing 1 by 1:
tz.mbn -[/B] Successfully
SBL1.mbn (bootloader) - [/B] Successfully
sdi.mbn - [/B] Successfully
fsg.mbn to mdm1m9kefs3 - [/B] Successfully
rpm.mbn - [/B] Successfully
emmc_appsboot.mbn to aboot - [/B] Successfully
gpt.bin to "partition" , it's the partitions info partition, people say it can't be downgraded or flashed cross versions. After some experimenting mfastboot failed but fastboot succeded, on some versions mfastboot worked - [/B] Successfully
What I can't get to downgrade / cross flash no mather which bootloader and combinations of firmware im on :
boot.img
recovery.img
system,img (sparse_chunk files)
I will go deeper, but hope that new full firmware SBF will be released soon in case of brick. Verzion is slow. I'm making my own full 6.0.1 xml.zip based on full flashable zip's , repacked system.img sparsechunks, rewrited the script but can't get to flash system files due to invalid signed image. Any help with that? It would also help already bricked guys because who knows when'll Verzion release it..
Downgrade OTA way , stock Android Recovery
While stock android recovery is pretty much useless, it can do software upgrades OTA on a fully stock system , which we on locked bootloaders and MM have.
In my opinion , the way is to trick stock recovery into thinking it's flashing ota, and that whole envieroment is like recovery is expecting it while it's actually flashing downgraded version full / close to full firmware in combination with you flashing some partitions manually through fastboot. OTA's contain only "patch" and just replaces files which get changed on new SW. Or even maybe reverse OTA downgrade?
I've made my own update.zip and signed it , but so far get footer size is wrong error so can't flash it .. Need more help here too..
That looks promising!
Marshmallow feels slower than lollipop for me and I wish I could downgrade but I just can't!
I am looking forward to see what you can do about this issue
Good luck bro!
sorry for my mistake, I do not intend to comment here
@EjđiSixo
How to remove the "signed" of system image or bypass it? Fastboot or RSD are stuck at flashing system image. Does this "sign" relate to boot, recovery, partition? Or it's simply the "sign" to prevent downgrade???
I've never succeeded with partition downgrade...
---------- Post added at 10:29 PM ---------- Previous post was at 10:19 PM ----------
when I was flashing the only system.img (3GB), it said that "wrong at header magi". But after a bit time, fastboot separated the file and began to flash. But still failed because of signed image.
I've tried to remove the code from updater-script but it could not write files to system
Not out yet!
Thanks! I think if we all try , we can do it ! For now main focus is downgrading anyhow, even to half working Lollipop just in the purpose of unlocking bootloader with sunshine.
@mr_5kool
Feel free to comment and ask / suggest, thats what this topic is for!
Unforutenately thats the part I haven't yet figured out myself. It is a " permissions" to prevent the downgrade , bootloader and possibly something else checks current version / keys / properly signed image and then flashes. With other bootloader I'm still not able to flash it because it's obviously locked. Motorola probably signs their images differently.
You can't flash 3GB image because when flashing, phone recieve's partition first to ram so max download size is set to 255mb per file. You have to repack system.img to sparse chunks. But you don't have to bother with it , I already repacked system.img which I found at fully stock flashable MCG24.251-5 . It again failed due to invalid signed image . If we could figure out what is exactly signed and how , that would open a lot more possibilities. Possibly even flashing prerooted roms on locked bootloader. There are more possibilities , who knows..
Currently the only thing notices downgrade when flashing is recovery. In bootloader log says I tried to downgrade. Even with downgraded bootloader (kind of, there is sbl2 and sbl3 but they don't get upgraded )
Anyway, I tried something just for the "gags" . Flashed all partitions of XT1250 bootloader. Got to Motorola's site, posted "unlock bootloader data". It returned it's not unlockable of course.. The first sequence of numbers in data is your imei , it starts with 99 and it's verzion's specific imei.
My theory is that motorola ties unlock bootloader data to every phone and imei and stores it in database ( please confirm) . So even with moto maxx bootloader I can't unlock because :
1 it reads my verzion imei
2 it doesn't find alltogether data in the database..
I don't know what are other numbers in the data you get from fastboot, possibly some serial numbers and so on, haven't really checked it .. That's why i think this method is not possible at all for now. Manipulating that data in your phone and running it through motorola's site knowing that exact same code works for some device might be possible, but I think there is really way too much impossible messing involved. If somebody can share more about this?
lol
http://forum.xda-developers.com/dro...ficial-marshmallow-build-mcg24-t3512813/page2
I've renamed it like suggested in the post #11
Download link is at 1st page. It's just a OTA.
Yes I just renamed it.
IT DOESN'T WORK WITH ADB AND YOU CAN'T FLASH IT AGAIN THROUGH RECOVERY. ITS OTA.
EDIT: The post that I was responding to has been removed.
The method to downgrade from Lollipop to Kitkat is the same with what I've done. It may be possible. Some said that "impossible to downgrade with locked bootloader on vrz". So the system image may be signed with bootloader (or imei, serial or something else, god know).
The unlock method of Sunshine takes place in Trustzone (sbl2). They cannot get unlock code.
You succesfully downgraded LL to KK on droid? There is partition for trust zone alone "tz.mbn" , downgradable without any problem. I only see sbl1 get's upgraded on droid turbo , never saw in any firmware sbl2 or 3 yet.. So I'm little confused.. I remember I saw some PDF regarding that..
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Finally managed to *Brick my devices while trying to make latest sbf firmware (what an irony ) because used some of files from that stupid OTA . Tried flashing all possible firmware I have but it doesn't fix it so system got corrupted probably and for now didn't succed flashing any of the available systems. Flashing MM recovery doesn't help. It's a " recovery loop".
Basically phone starts , vibrates , goes into recovery, it says "erasing" , it does the factory reset then restarts and over and over again erasing restarting loop.
I'll continue exploring downgrade options but top priority now is making working marshmallow sbf or waiting for stupid Verzion to release it already. Just checked with SUA and it still doesn't show repair so firmware isn't available still.
Biggest problem is signed system images which are probably signed by RSA and I need help with that..
I have same problem erasing
Can't flash SU4TL gpt.bin anymore , so success was definitely connected to experiment and steps I did so I'll investigate more.
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
side note, I hate this Q&A format. Not sure why XDA even has it. You can't even format URL links correctly.
Click to expand...
Click to collapse
mr_5kool said:
@EjđiSixo
I have never tried before. My Moto X2013 failed to downgrade from LL to KK, too. So, it's the common problem of Verizon Motorola Devices.
If you have problem with "erasing", just enter recovery by "hold power button for a while then fast press volume up button". Phone will enter recovery and do the factory reset. But when rebooting the system, "erasing" appear again.
If partition is dead, flash the higher version, commonly gpt and tz.
PS: still waiting for the official xml firmware
Click to expand...
Click to collapse
I wonder if there is any way to force Verizon to release firmware. This is really low of the lowest, it says 1 week after OTA , now it's almost 1 month. Until somebody forces them , it can be months as far as they are considered. No help from developers / programmers either on any of 2 subjects so don't see my method of full MM SBF working.
god know
:v
ChazzMatt said:
Yes, successfully downgraded 5.1 to 4.4.4 on Droid Turbo but with unlocked bootloader. I helped this guy.
http://forum.xda-developers.com/droid-turbo/help/solved-problem-downgrade-install-ota-t3497791
http://forum.xda-developers.com/droid-turbo/help/how-to-downgrade-lollipop-5-1-to-kitkat-t3494459
Click to expand...
Click to collapse
Exactly brother .
I solved my problem .
I can downgrade from Marshmallow to lollipop is very easy for my ..
But first step is unlocked bootloader from lollipop..
Sent from my XT1254 using XDA Free mobile app
Yeah people , we all know everything can be done with unlocked bootloader. It's a GOD mode. Nothing strange about downgrading with unlocked BL. This topic is for people stuck on locked BL like myself to try to odowngrade on lollipop only in purpose of UNLOCKING BL. So let's for now focus on locked BL's.

Getting rid of the unlocked bootloader warning message

The way to get rid of the warning caused by unlocking the bootloader on other phones would be to flash the proper bootloader logo in fastboot using:
Code:
fastboot flash logo logo.bin
This is how I did it on my old LG Nexus 5X.
Does anyone have the correct logo for the V20? Has anyone tried this on the V20?
It's not a logo file. It's located in aboot and you can't change it.
androiddiego said:
It's not a logo file. It's located in aboot and you can't change it.
Click to expand...
Click to collapse
That wasn't true on the 5X: https://forum.xda-developers.com/ne...-change-bootlogo-images-imgdata-tool-t3240052
Are you positive that it's different now?
Sizzlechest said:
That wasn't true on the 5X: https://forum.xda-developers.com/ne...-change-bootlogo-images-imgdata-tool-t3240052
Are you positive that it's different now?
Click to expand...
Click to collapse
Here is the tool that might be useful to search for and dump the relevant partition, mount it and investigate the source of the picture and text warning:
Partitions Backup & Restore
https://play.google.com/store/apps/details?id=ma.wanam.partitions
In the best case scenario, even use reverse engineering to skip the warning and its delay altogether, anyone?
Or is aboot non-writable?
You modify aboot in any way / shape / or form, and you better open a ticket with LG. When you unlock your bootloader, that stops aboot from verifying the signature of boot, laf, and recovery. XBL still very much does verification of all the other pieces of firmware. One of the first things it checks is the signature of aboot. If aboot has been modified, or wasn't signed with the same RSA cert that matches the RSA key that is in your model's QFPROM, then the phone goes into 9008 mode. At this time, there is no fixing that -- except sending it back to LG (and there may never be now that LG uses UFS nand in their phones).
-- Brian
I've personally looked into this and looks like it can't be changed.
I'm pretty sure the images is in the *raw_resources* partition. Look here.
It must be very hard to modify though considering LG use it for (all?) many models, since I've only found a single development thread for it, and as you'll see that didn't go very far.
@askermk2000 You are correct. Every single boot, charging, download mode, etc image is on that partition, and it isn't signed / checked, so modify away with no risk of bricking your phone.
There is an index with offsets for each image, but the format of the images isn't immediately obvious.
-- Brian
runningnak3d said:
@askermk2000 You are correct. Every single boot, charging, download mode, etc image is on that partition, and it isn't signed / checked, so modify away with no risk of bricking your phone.
There is an index with offsets for each image, but the format of the images isn't immediately obvious.
-- Brian
Click to expand...
Click to collapse
so it is indeed possible to change the unlocked bootloader warning?
Security wise, there is no reason that you can't change them. It looks like LG is using RLE encoding, so finding the start and end of an image is going to be interesting. There are offsets in the index, but they don't seem to align.
Also, while I don't think having a corrupt raw_resources partition would give you a 9008 brick, you might want to have a backup ready to flash if you decide to modify it. But, (and there is always a but), since aboot loads this, if aboot pukes and doesn't load, that WILL give you a 9008 brick.
If I were you, I would buy a used V10 off of eBay, and test on that since you can recover from a 9008 with an SD card.
-- Brian

FYI: recovered G5 XT 1676 to stock and updated. :)

Just an FYI type thing that may save people a bit of digging around sometime.
I tried to get the update that just came out, but as i had TWRP as recovery, no good. Anyhow, in my trying i completely bollixed the phone. Would start, but always booted to TWRP and had various conniptions. Could not even get a TWRP backup to load. Strange not encountered before by me stuff............
Anyhow, recovered by the following method to stock and am back in business.
Boot into bootloader fastboot mode.
Extract .xml.zip format firmware file:
eg: CEDRIC_NPP25.137-15_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
to a folder on c drive of the PC that has the ADB and fastboot files in it.
In command prompt cd\ to that directory.
fastboot flash the following in sequence.
fastboot flash partition gpt.bin
fastboot flash motoboot motoboot.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk1
fastboot flash system system.img_sparsechunk2
fastboot flash system system.img_sparsechunk3
fastboot flash system system.img_sparsechunk4
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase userdata
fastboot reboot
boots to stock .
Not my own work, adapted from this thread by t-bon3
https://forum.xda-developers.com/showthread.php?t=2542219
which I found thanks to eens post18 at this thread
https://forum.xda-developers.com/g5/how-to/npp25-137-33-stock-firmware-moto-g5-t3577084/page2
After this, Motorola system update installed. On Australian XT1676 is build number NPP25.137-15-7
Patch level 1-May-2017
Still get the I cant be trusted page on power up as have unlocked bootloader.
Many thanks to all at XDA, its a resource that can certainly get you into trouble, but then out of it again.
where do you get the stock firmware?
Think I worked out what I did wrong. Somehow, I changed the format of the data partition. Fat fingers at some point??
TWRP backups didn’t like that and would not mount or write to the data partition as it was not f2fs format that the backup had been made in??
Anyway, restored data from a TWRP backup after going to ....wipe…format data. All good.
That gave me the passcode lockout issue at next reboot which can deal with.
stock Firmware? http://www.filefactory.com/folder/c6cdedc45a775d27/?sort=created&order=DESC&show=25
for me stock the phone came with is: CEDRIC_NPP25.137-15_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
Worked on my XT1676 dual sim, but CHECK if its appropriate for your model. There are files on that page that wont be and flashing some of their components (particularly bootloader), can i have read, be unrecoverable disastrous. Be warned.
Slow, but got it. At first i thought it was corrupt as TWRP wouldn't flash it. My gumby. The .xml.zips apparently need to be extracted and flashed file by file.
We're you able to revert to a locked bootloader after this, I am looking forward to do so
We're you able to revert to a locked bootloader after this, I am looking forward to do so
Click to expand...
Click to collapse
didnt try, didnt need to for taking take the update.
And, from my reading there is no way so far to relock the bootloader. I got it to stock, with stock recovery, and that was enough for me.
astmacca said:
didnt try, didnt need to for taking take the update.
And, from my reading there is no way so far to relock the bootloader. I got it to stock, with stock recovery, and that was enough for me.
Click to expand...
Click to collapse
I can confirm what you said, but I am asking because I am sick of the warning before the device starts
ap4ss3rby said:
I can confirm what you said, but I am asking because I am sick of the warning before the device starts
Click to expand...
Click to collapse
You can get rid of that easily
Put phone in fastboot mode
Download logo from link below
Enter the following in a windows command prompt where you have fastboot files & the logo file
Code:
fastboot.exe flash logo logo-g5-fix.bin
http://drive.google.com/file/d/0B-idWfPYugGvREJaR3B0UFIxUkU/view?usp=sharing
TheFixItMan said:
You can get rid of that easily
Put phone in fastboot mode
Download logo from link below
Enter the following in a windows command prompt where you have fastboot files & the logo file
Code:
fastboot.exe flash logo logo-g5-fix.bin
http://drive.google.com/file/d/0B-idWfPYugGvREJaR3B0UFIxUkU/view?usp=sharing
Click to expand...
Click to collapse
Thanks, but this is why I made a Google pixel themed logo.bin and used a matching boot animation to go with it some time earlier
downgrade
thanks for the guide
- can i use this method to downgrade to this version?
- can i do this without unlocking the bootloader
- if it goes wrong can i unlock the bootloader later (i have an unlock code)
- is there a reason why we don't flash sparsechunk.0 ?
thanks in advance
distclean said:
thanks for the guide
- can i use this method to downgrade to this version?
- can i do this without unlocking the bootloader
- if it goes wrong can i unlock the bootloader later (i have an unlock code)
- is there a reason why we don't flash sparsechunk.0 ?
thanks in advance
Click to expand...
Click to collapse
No you cannot downgrade (same firmware version or newer required)
Yes - unlocked bootloader not required
As long as your phone still goes into the bootloader
You should flash all sparsechunks in number order
Thanks a bunch,
So to be absolutely clear, my phone shipped with NPP25.137-15-7 i can't install the stock rom linked, and the same version isn't out yet,
if i unlock the bootloader, would i be able to downgrade ?
Is the software channel setting preserved across this method?
distclean said:
Thanks a bunch,
So to be absolutely clear, my phone shipped with NPP25.137-15-7 i can't install the stock rom linked, and the same version isn't out yet,
if i unlock the bootloader, would i be able to downgrade ?
Is the software channel setting preserved across this method?
Click to expand...
Click to collapse
You maybe able to - there are different variants of the same phone
As long as the firmware is the same or newer (as in the bootloader and API version) it may flash
It will either flash or error out
There's only one way to find out - if your phone is dead anyway it's not going to make alot of difference
No - generally you can never downgrade firmware - doing so would be dangerous and you may loose the bootloader for good
thanks again,
motoboot.img is the bootloader you talk about? is the partition layout described somewhere? would custom roms use a different one here?
do tell me by the way if i should get this information elsewhere/if i should read something to get started in the whole moto g world.
distclean said:
thanks again,
motoboot.img is the bootloader you talk about? is the partition layout described somewhere? would custom roms use a different one here?
do tell me by the way if i should get this information elsewhere/if i should read something to get started in the whole moto g world.
Click to expand...
Click to collapse
You can write in adb
Code:
adb shell
cat /proc
cat /proc/partitions
Hello,
Does anyone know where can I download the latest firmware for Moto G5 XT1676 baseband Version: m8937_ 8000.122.02.40 R
Thanks
astmacca said:
Boot into bootloader fastboot mode.
Extract .xml.zip format firmware file:
eg: CEDRIC_NPP25.137-15_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
to a folder on c drive of the PC that has the ADB and fastboot files in it.
In command prompt cd\ to that directory.
fastboot flash the following in sequence.
fastboot flash partition gpt.bin
fastboot flash motoboot motoboot.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk1
fastboot flash system system.img_sparsechunk2
fastboot flash system system.img_sparsechunk3
fastboot flash system system.img_sparsechunk4
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase userdata
fastboot reboot
boots to stock .
Click to expand...
Click to collapse
You're partially right. These commands won't work for our files. You have to flash the firmware according to the instructions contained within the "flashfile.xml" file within the archive. For example we have no "motoboot" partition
I've flashed every stock package available now (4 I think) and haven't been offered an update once. I've ran a couple of custom ROMs but they're just not right in one way or another. Might be time to move on.
distclean said:
Thanks a bunch,
So to be absolutely clear, my phone shipped with NPP25.137-15-7 i can't install the stock rom linked, and the same version isn't out yet,
if i unlock the bootloader, would i be able to downgrade ?
Is the software channel setting preserved across this method?
Click to expand...
Click to collapse
I upgraded to this and since then can't downgrade the phone to the stock roms available online. From memory trying to flash gpt.bin gave a "Security version downgrade" error. So I wouldn't assume you'll be able to downgrade and until there is a copy of this particular firmware, you won't be able to flash back or relock the bootloader
astmacca said:
Think I worked out what I did wrong. Somehow, I changed the format of the data partition. Fat fingers at some point??
TWRP backups didn’t like that and would not mount or write to the data partition as it was not f2fs format that the backup had been made in??
Anyway, restored data from a TWRP backup after going to ....wipe…format data. All good.
That gave me the passcode lockout issue at next reboot which can deal with.
stock Firmware? http://www.filefactory.com/folder/c6cdedc45a775d27/?sort=created&order=DESC&show=25
for me stock the phone came with is: CEDRIC_NPP25.137-15_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
Worked on my XT1676 dual sim, but CHECK if its appropriate for your model. There are files on that page that wont be and flashing some of their components (particularly bootloader), can i have read, be unrecoverable disastrous. Be warned.
Slow, but got it. At first i thought it was corrupt as TWRP wouldn't flash it. My gumby. The .xml.zips apparently need to be extracted and flashed file by file.
Click to expand...
Click to collapse
Is this ROM is good to my XT1676 Baseband: M8937_11.16.02.51R ?
astmacca said:
Think I worked out what I did wrong. Somehow, I changed the format of the data partition. Fat fingers at some point??
TWRP backups didn’t like that and would not mount or write to the data partition as it was not f2fs format that the backup had been made in??
Anyway, restored data from a TWRP backup after going to ....wipe…format data. All good.
That gave me the passcode lockout issue at next reboot which can deal with.
stock Firmware? http://www.filefactory.com/folder/c6cdedc45a775d27/?sort=created&order=DESC&show=25
for me stock the phone came with is: CEDRIC_NPP25.137-15_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
Worked on my XT1676 dual sim, but CHECK if its appropriate for your model. There are files on that page that wont be and flashing some of their components (particularly bootloader), can i have read, be unrecoverable disastrous. Be warned.
Slow, but got it. At first i thought it was corrupt as TWRP wouldn't flash it. My gumby. The .xml.zips apparently need to be extracted and flashed file by file.
Click to expand...
Click to collapse
Hi, i own the same model of moto g5, i do this in fastboot window
fastboot erase userdata
now the phone only boot in twrp and show a message "failed to mount /data". i think that delete my userdata partition, how could i fix it?
once i can avoid this loop in twrp, i follow these steps to flash stock rom
thanks in advance
juan

Categories

Resources