My sony TV KD-55A9G 。
My TV is not working properly anymore, I have removed the TV Main board。
Who has sony's Flahs programming program ?
Who can provide Sony service manual for this 55A9G ?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.
I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?
The following files are currently extracted from sony's upgrade files:
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img
I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.
Next,
Solve the modification and repackaging of bootimg... ...
I have a KD-65A1 and I need to root it , please let me have the rooted image if you can make it work
Daltonxx said:
I have a KD-65A1 and I need to root it , please let me have the rooted image if you can make it work
Click to expand...
Click to collapse
So far, Not yet successful root!!!
Can you flash the files withoute unlock the bootloader?
josonxie said:
Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.
I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?
The following files are currently extracted from sony's upgrade files:
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img
I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.
Next,
Solve the modification and repackaging of bootimg... ...
Click to expand...
Click to collapse
How did you extract these files from sony's upgrade files?
Can you please tell us how you managed to extract the files?
Sony af9 already temp rooted ?
Lefteris Fragiadakis (Frago) said:
Sony af9 already temp rooted
Click to expand...
Click to collapse
Can you tell us how can you do that? is there any further information?
enixspike said:
Can you tell us how can you do that? is there any further information?
Click to expand...
Click to collapse
Modding emmc with ufi box and root the system manual
Lefteris Fragiadakis (Frago) said:
Modding emmc with ufi box and root the system manual
Click to expand...
Click to collapse
well, thanks
Lefteris Fragiadakis (Frago) said:
Modding emmc with ufi box and root the system manual
Click to expand...
Click to collapse
BTW, I just saw some people post on a chinese forum, link below:
https://tieba.baidu.com/p/6536366728?pn=1
The poster have a SONY BRAVIA 65X8500G Chinese version(x850G in US), running Android TV 9.0 but no GSM, no youtube, no netflix,no Alexa nor Airplay2.
So they want to root the TV and add the GSM and Airplay. or even more.
The poster did not say much how he do that, but as we can see from the photo, he root it and modify the firmware with other regional firmware.
I find some resualt in his other thread that he flash different firmware on his chinese version 65X8500G hardware.
China Frimware (cna)(1603610100): boot normally, works fine
China Frimware(cna)(1603590100)(downgrade): boot normally, works fine
US Frimware(naa)(1603598100): boot normally, can't finish initial setup wizard
EU Frimware(eua)(1603598100): black screen after SONY logo,can't enter the system
Ph Frimware(laa)(1603598100): black screen after SONY logo,can't enter the system
Japan Frimware(jpa)(1603598100): black screen after SONY logo,can't enter the system
APAC (paa): no android 9 firmare yet
HK (hka): no android 9 firmare yet
TW (twa): no android 9 firmare yet
Here is how he root the tv
1. use A male -A male USB Cable physical contect the PC and TV,using adb to enter the fastboot mode, unlock bootload, there is no code needed.
after you enter the fastboot mode, all the button combinations are invalid,if anything goes wrong, noway to fix it by yourself.
1a. after unlock, disable the verify boot
1b. there is anti rollback,ab slot, you can not boot the slot with low firmware version, change the vb index, you can bypass the anti rollback
2. you can use Magisk to root it now.
3. after root the TV you can use Magisk to patch the boot,and flash it under recovery mode. Do NOT wipe data, otherwise you will have bootanimation loop.
4. do not forget set_active/setActiveBootSlot after you flash the boot, also reset retry count and unmark curent slot successful mark
I am not an Android developer, I just try to translate the Chinese into English.
Hope someone can understand this, and make it more easier for people to root their Sony bravia android TV.
enixspike said:
BTW, I just saw some people post on a chinese forum, link below:
]
The poster have a SONY BRAVIA 65X8500G Chinese version(x850G in US), running Android TV 9.0 but no GSM, no youtube, no netflix,no Alexa nor Airplay2.
So they want to root the TV and add the GSM and Airplay. or even more.
The poster did not say much how he do that, but as we can see from the photo, he root it and modify the firmware with other regional firmware.
I find some resualt in his other thread that he flash different firmware on his chinese version 65X8500G hardware.
China Frimware (cna)(1603610100): boot normally, works fine
China Frimware(cna)(1603590100)(downgrade): boot normally, works fine
US Frimware(naa)(1603598100): boot normally, can't finish initial setup wizard
EU Frimware(eua)(1603598100): black screen after SONY logo,can't enter the system
Ph Frimware(laa)(1603598100): black screen after SONY logo,can't enter the system
Japan Frimware(jpa)(1603598100): black screen after SONY logo,can't enter the system
APAC (paa): no android 9 firmare yet
HK (hka): no android 9 firmare yet
TW (twa): no android 9 firmare yet
Here is how he root the tv
1. use A male -A male USB Cable physical contect the PC and TV,using adb to enter the fastboot mode, unlock bootload, there is no code needed.
after you enter the fastboot mode, all the button combinations are invalid,if anything goes wrong, noway to fix it by yourself.
1a. after unlock, disable the verify boot
1b. there is anti rollback,ab slot, you can not boot the slot with low firmware version, change the vb index, you can bypass the anti rollback
2. you can use Magisk to root it now.
3. after root the TV you can use Magisk to patch the boot,and flash it under recovery mode. Do NOT wipe data, otherwise you will have bootanimation loop.
4. do not forget set_active/setActiveBootSlot after you flash the boot, also reset retry count and unmark curent slot successful mark
I am not an Android developer, I just try to translate the Chinese into English.
Hope someone can understand this, and make it more easier for people to root their Sony bravia android TV.
Click to expand...
Click to collapse
Hi!
I have managed to connect the TV using the adb connect "IP" Method, I can see the device when I put the adb devices in adb shell but, the problem is, when I put the TV into bootloader mode, there is nothing on the screen just a black screen. I also have only tv plugged into my PC im gonna have to get some other display and try unlocking the bootloader command after I boot into the fastboot. Did anyone root their TV already with this method? Im trying to rollback the android version on my Bravia X900F from 8 back to nougat.
Greetings fromo a newbie.
SonyBraviauser said:
Hi!
I have managed to connect the TV using the adb connect "IP" Method, I can see the device when I put the adb devices in adb shell but, the problem is, when I put the TV into bootloader mode, there is nothing on the screen just a black screen. I also have only tv plugged into my PC im gonna have to get some other display and try unlocking the bootloader command after I boot into the fastboot. Did anyone root their TV already with this method? Im trying to rollback the android version on my Bravia X900F from 8 back to nougat.
Greetings fromo a newbie.
Click to expand...
Click to collapse
I have Also figure out, if you rename the old firmware file ( nougat 7 ) to a newer firmware name, the TV will copy the files succesfully to the TV but after updating around 5 minutes, TV just restarts and boots into newest installment of Android ( 8 ) thats probably due to A/B Partitioning the chinesse guy is refering in his post, android 7'+ uses A/B partitioning for the OTA updates and is some kind of a rollback protection, so you cant instal older android. I dont have the USB cable to try and figure out the method that guy on chinese site came up with. I know its possible, just had to do some internet research and you have all the needed commands. I went ahead and bought brand new SONY XF9005 motherboard and replaced it, since those have the older android 7 on it, everything works the picture and everything but the problem is, now everytime i restart the TV, ( plugged out) at the startup there is green and red light blinking that probably due to T con board, when the firmware has been updated to the latest android 8 the T con board has been updated along, now Im thinking buying the brand new T con board if I get is cheap, so I can report here. ( I bought brand new XF90 Motherboard for around 75euros + shipping ) It was factory sealed and newer used.
Greetings from Slovenia.
Newbie.
josonxie said:
Recently, I re-ordered the motherboard from the SONY repair department. At present, I have a bad SONY 55A9G motherboard. I copied the Emmc software from the new motherboard to the mirror file. The old motherboard is currently working properly.
I am looking for methods to get root on my Sony TV KD-55A9G. Anyone have any ideas?
The following files are currently extracted from sony's upgrade files:
3rd.img
boot.img
dtbo.img
linux_rootfs.img
recipe.img
system.img
tzbp.img
upgrade.img
vbmeta.img
vendor.img
I'm looking for a way to repackage bootimg, but after I modify the boot and repackage it, most tools don't support it.
Next,
Solve the modification and repackaging of bootimg... ...
Click to expand...
Click to collapse
Whatsapp me 8826711619
Hi. I'm attempting to downgrade from android 10 to 9 mine sony tv x900h via fastboot. I don't know if it's a good idea. Got images from payload.bin as on the photo. Maybe someone could point me the correct order to manual flash/commands. It has 2 slots and "b" is active one. I want "a" to be flashed with android 9.
Sonyledlcdtv said:
Whatsapp me 8826711619
Click to expand...
Click to collapse
Hi afzal sir
hey guys..
i am interested in Sony TV rooting.. i have xf9005 device and i can go to fastboot and got some info about device..
fastboot getvar all
(bootloader) partition-size: part_63:0x00000000
(bootloader) partition-type: part_63:emmc
(bootloader) partition-size: reserved10:0x00100000
(bootloader) partition-type: reserved10:emmc
(bootloader) partition-size: reserved9:0x00100000
(bootloader) partition-type: reserved9:emmc
(bootloader) partition-size: reserved8:0x00100000
(bootloader) partition-type: reserved8:emmc
(bootloader) partition-size: reserved7:0x00100000
(bootloader) partition-type: reserved7:emmc
(bootloader) partition-size: reserved6:0x00100000
(bootloader) partition-type: reserved6:emmc
(bootloader) partition-size: reserved5:0x00100000
(bootloader) partition-type: reserved5:emmc
(bootloader) partition-size: reserved4:0x00100000
(bootloader) partition-type: reserved4:emmc
(bootloader) partition-size: reserved3:0x00100000
(bootloader) partition-type: reserved3:emmc
(bootloader) partition-size: spqc:0x00500000
(bootloader) partition-type: spqc:emmc
(bootloader) partition-size: spqd:0x00200000
(bootloader) partition-type: spqd:emmc
(bootloader) partition-size: oops:0x00100000
(bootloader) partition-type: oops:emmc
(bootloader) partition-size: version:0x00100000
(bootloader) partition-type: version:emmc
(bootloader) partition-size: data_demo:0x40000000
(bootloader) partition-type: data_demo:emmc
(bootloader) partition-size: sapost:0x00400000
(bootloader) partition-type: sapost:emmc
(bootloader) partition-size: arib_nvram:0x00100000
(bootloader) partition-type: arib_nvram:emmc
(bootloader) partition-size: udt:0x00100000
(bootloader) partition-type: udt:emmc
(bootloader) partition-size: sdcard:0x00100000
(bootloader) partition-type: sdcard:emmc
(bootloader) partition-size: cache:0x25800000
(bootloader) partition-type: cache:emmc
(bootloader) partition-size: userdata:0x1ae00000
(bootloader) partition-type: userdata:emmc
(bootloader) partition-size: system:0x70800000
(bootloader) partition-type: system:emmc
(bootloader) partition-size: recovery:0x01400000
(bootloader) partition-type: recovery:emmc
(bootloader) partition-size: misc:0x00100000
(bootloader) partition-type: misc:emmc
(bootloader) partition-size: upgrade:0x80000000
(bootloader) partition-type: upgrade:emmc
(bootloader) partition-size: bedat:0x00600000
(bootloader) partition-type: bedat:emmc
(bootloader) partition-size: minf:0x00100000
(bootloader) partition-type: minf:emmc
(bootloader) partition-size: bdix:0x00200000
(bootloader) partition-type: bdix:emmc
(bootloader) partition-size: udat:0x00100000
(bootloader) partition-type: udat:emmc
(bootloader) partition-size: fdat:0x00100000
(bootloader) partition-type: fdat:emmc
(bootloader) partition-size: ndat:0x00200000
(bootloader) partition-type: ndat:emmc
(bootloader) partition-size: bdat:0x00800000
(bootloader) partition-type: bdat:emmc
(bootloader) partition-size: pdat:0x00500000
(bootloader) partition-type: pdat:emmc
(bootloader) partition-size: dfw2:0x00100000
(bootloader) partition-type: dfw2:emmc
(bootloader) partition-size: dfw1:0x00100000
(bootloader) partition-type: dfw1:emmc
(bootloader) partition-size: mafw:0x00600000
(bootloader) partition-type: mafw:emmc
(bootloader) partition-size: ldat:0x00300000
(bootloader) partition-type: ldat:emmc
(bootloader) partition-size: mlfw:0x00100000
(bootloader) partition-type: mlfw:emmc
(bootloader) partition-size: ddri:0x00100000
(bootloader) partition-type: ddri:emmc
(bootloader) partition-size: wfdp:0x00100000
(bootloader) partition-type: wfdp:emmc
(bootloader) partition-size: reserved2:0x00100000
(bootloader) partition-type: reserved2:emmc
(bootloader) partition-size: adsp:0x00300000
(bootloader) partition-type: adsp:emmc
(bootloader) partition-size: epg:0x02600000
(bootloader) partition-type: epg:emmc
(bootloader) partition-size: ddb:0x00100000
(bootloader) partition-type: ddb:emmc
(bootloader) partition-size: svc:0x00100000
(bootloader) partition-type: svc:emmc
(bootloader) partition-size: edid:0x00100000
(bootloader) partition-type: edid:emmc
(bootloader) partition-size: ci:0x00100000
(bootloader) partition-type: ci:emmc
(bootloader) partition-size: panel:0x00100000
(bootloader) partition-type: panel:emmc
(bootloader) partition-size: 3rd_ro:0x07c00000
(bootloader) partition-type: 3rd_ro:emmc
(bootloader) partition-size: hdmi:0x00100000
(bootloader) partition-type: hdmi:emmc
(bootloader) partition-size: 3rd_rw:0x0e900000
(bootloader) partition-type: 3rd_rw:emmc
(bootloader) partition-size: basic:0x09f00000
(bootloader) partition-type: basic:emmc
(bootloader) partition-size: linux_rootfsA:0x06400000
(bootloader) partition-type: linux_rootfsA:emmc
(bootloader) partition-size: tzbp:0x00200000
(bootloader) partition-type: tzbp:emmc
(bootloader) partition-size: bootlogo:0x00400000
(bootloader) partition-type: bootlogo:emmc
(bootloader) partition-size: aq:0x00100000
(bootloader) partition-type: aq:emmc
(bootloader) partition-size: pq:0x00500000
(bootloader) partition-type: pq:emmc
(bootloader) partition-size: channelB:0x00100000
(bootloader) partition-type: channelB:emmc
(bootloader) partition-size: channelA:0x00100000
(bootloader) partition-type: channelA:emmc
(bootloader) partition-size: reserved1:0x00100000
(bootloader) partition-type: reserved1:emmc
(bootloader) partition-size: boot:0x01400000
(bootloader) partition-type: boot:emmc
(bootloader) partition-size: perm:0x00800000
(bootloader) partition-type: perm:emmc
(bootloader) partition-size: eeprom_A:0x00100000
(bootloader) partition-type: eeprom_A:emmc
(bootloader) partition-size: uboot_env:0x00200000
(bootloader) partition-type: uboot_env:emmc
(bootloader) partition-size: uboot:0x00200000
(bootloader) partition-type: uboot:emmc
(bootloader) product: amai
(bootloader) unlocked: yes
(bootloader) secure: no
(bootloader) product: board-mtxx
(bootloader) version-baseband: 2.0
(bootloader) version-bootloader: 1.1
(bootloader) serialno: 000xxxxxxxxxxxxxxx
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.837s
as u see device bootlaoder unlocked and maybe we can patch the device with Magisk.. let me try to read fw by Infinty Box...
Related
I'm a total n00b, just wanted to get that out of the way first
I have acquired an HTC Desire HD which booted very slowly when I got it, and ran ok except that sms did not work. I was told it was unlocked and rooted.
I have been trying for days to un-root or revert back to a stock rom with no success. I only half understand what I'm doing and everything I try fails at some point and I seem to have totally fuc%&d the poor thing.
Now when I switch it on, it goes to the T-Mobile splash screen and sits there forever. I can boot into H-boot and run recovery (CWM Recovery installed). I can then mount usb storage and acces it from my PC via usb.
In HBOOT or FASTBOOT I can not connect to my PC via usb (I have installed the correct drivers and it used to connect before I "fixed it"):crying:
These are the phone stats
Code:
getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 2.00.0029
(bootloader) version-baseband: 26.14.04.28_M
(bootloader) version-cpld: None
(bootloader) version-microp: 0438
(bootloader) version-main: 3.13.110.4
(bootloader) serialno: HT0CVRX10795
(bootloader) imei: 356299043105830
(bootloader) product: ace
(bootloader) platform: HBOOT-7230
(bootloader) modelid: PD9810000
(bootloader) cidnum: T-MOB005
(bootloader) battery-status: good
(bootloader) battery-voltage: 4189mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: fcef1579
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) region-id: 0
all: Done!
finished. total time: 0.003s
...
(bootloader) setup_tag addr=0xC0000100 cmdline add=0x8D0985F8
(bootloader) TAG:Ramdisk OK
(bootloader) TAG:smi ok, size = 0
(bootloader) TAG:hwid 0x0
(bootloader) TAG:skuid 0x26503
(bootloader) TAG:hero panel = 0x1
(bootloader) TAG:engineerid = 0x0
(bootloader) MCP dual-die
(bootloader) MCP dual-die
(bootloader) TAG:mono-die = 0x0
(bootloader) Device CID is not super CID
(bootloader) CID is T-MOB005
(bootloader) setting->cid::T-MOB005
(bootloader) serial number: HT0CVRX10795
(bootloader) commandline from head: no_console_suspend=1 wire.search_coun
(bootloader) t=5
(bootloader) command line length =510
(bootloader) active commandline: board_spade.disable_uart2=0 board_spade.
(bootloader) usb_h2w_sw=0 board_spade.disable_sdcard=0 diag.enabled=0 boa
(bootloader) rd_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
(bootloader) mmc=true androidboot.baseband=26.14.04.28_M androidboot.cid
(bootloader) =T-MOB005 androidboot.batt_poweron=good_battery androidboot.
(bootloader) carrier=TMUK androidboot.mid=PD9810000 androidboot.keycaps=q
(bootloader) werty androidboot.mode=normal androidboot.serialno=HT0CVRX10
(bootloader) 795 androidboot.bootloader=2.00.0029 zygote_oneshot=off kmem
(bootloader) leak=off no_console_suspend=1 wire.search_count=5
(bootloader) aARM_Partion[0].name=misc
(bootloader) aARM_Partion[1].name=recovery
(bootloader) aARM_Partion[2].name=boot
(bootloader) aARM_Partion[3].name=system
(bootloader) aARM_Partion[4].name=local
(bootloader) aARM_Partion[5].name=cache
(bootloader) aARM_Partion[6].name=userdata
(bootloader) aARM_Partion[7].name=devlog
(bootloader) aARM_Partion[8].name=pdata
(bootloader) aARM_Partion[9].name=lib
(bootloader) partition number=10
(bootloader) Valid partition num=10
(bootloader) jump_to_kernel: machine_id(2844), tags_addr(0x4000100), kern
(bootloader) el_addr(0x4008000)
(bootloader) -------------------hboot boot time:73765 msec
FAILED (status read failed (Too many links))
finished. total time: 7.544s
Any help would be greatly appreciated.
Please be gentle with me.
sup3rbird said:
I'm a total n00b, just wanted to get that out of the way first
I have acquired an HTC Desire HD which booted very slowly when I got it, and ran ok except that sms did not work. I was told it was unlocked and rooted.
I have been trying for days to un-root or revert back to a stock rom with no success. I only half understand what I'm doing and everything I try fails at some point and I seem to have totally fuc%&d the poor thing.
Now when I switch it on, it goes to the T-Mobile splash screen and sits there forever. I can boot into H-boot and run recovery (CWM Recovery installed). I can then mount usb storage and acces it from my PC via usb.
In HBOOT or FASTBOOT I can not connect to my PC via usb (I have installed the correct drivers and it used to connect before I "fixed it"):crying:
These are the phone stats
Code:
getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 2.00.0029
(bootloader) version-baseband: 26.14.04.28_M
(bootloader) version-cpld: None
(bootloader) version-microp: 0438
(bootloader) version-main: 3.13.110.4
(bootloader) serialno: HT0CVRX10795
(bootloader) imei: 356299043105830
(bootloader) product: ace
(bootloader) platform: HBOOT-7230
(bootloader) modelid: PD9810000
(bootloader) cidnum: T-MOB005
(bootloader) battery-status: good
(bootloader) battery-voltage: 4189mV
(bootloader) partition-layout: Generic
(bootloader) security: on
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: fcef1579
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) region-id: 0
all: Done!
finished. total time: 0.003s
...
(bootloader) setup_tag addr=0xC0000100 cmdline add=0x8D0985F8
(bootloader) TAG:Ramdisk OK
(bootloader) TAG:smi ok, size = 0
(bootloader) TAG:hwid 0x0
(bootloader) TAG:skuid 0x26503
(bootloader) TAG:hero panel = 0x1
(bootloader) TAG:engineerid = 0x0
(bootloader) MCP dual-die
(bootloader) MCP dual-die
(bootloader) TAG:mono-die = 0x0
(bootloader) Device CID is not super CID
(bootloader) CID is T-MOB005
(bootloader) setting->cid::T-MOB005
(bootloader) serial number: HT0CVRX10795
(bootloader) commandline from head: no_console_suspend=1 wire.search_coun
(bootloader) t=5
(bootloader) command line length =510
(bootloader) active commandline: board_spade.disable_uart2=0 board_spade.
(bootloader) usb_h2w_sw=0 board_spade.disable_sdcard=0 diag.enabled=0 boa
(bootloader) rd_spade.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
(bootloader) mmc=true androidboot.baseband=26.14.04.28_M androidboot.cid
(bootloader) =T-MOB005 androidboot.batt_poweron=good_battery androidboot.
(bootloader) carrier=TMUK androidboot.mid=PD9810000 androidboot.keycaps=q
(bootloader) werty androidboot.mode=normal androidboot.serialno=HT0CVRX10
(bootloader) 795 androidboot.bootloader=2.00.0029 zygote_oneshot=off kmem
(bootloader) leak=off no_console_suspend=1 wire.search_count=5
(bootloader) aARM_Partion[0].name=misc
(bootloader) aARM_Partion[1].name=recovery
(bootloader) aARM_Partion[2].name=boot
(bootloader) aARM_Partion[3].name=system
(bootloader) aARM_Partion[4].name=local
(bootloader) aARM_Partion[5].name=cache
(bootloader) aARM_Partion[6].name=userdata
(bootloader) aARM_Partion[7].name=devlog
(bootloader) aARM_Partion[8].name=pdata
(bootloader) aARM_Partion[9].name=lib
(bootloader) partition number=10
(bootloader) Valid partition num=10
(bootloader) jump_to_kernel: machine_id(2844), tags_addr(0x4000100), kern
(bootloader) el_addr(0x4008000)
(bootloader) -------------------hboot boot time:73765 msec
FAILED (status read failed (Too many links))
finished. total time: 7.544s
Any help would be greatly appreciated.
Please be gentle with me.
Click to expand...
Click to collapse
You could try returning to stock if that may help by extracting the PD98IMG.zip from a RUU and putting it in the root of your SD Card then booting into HBOOT
What does it say in hboot? Is your phone in fastboot (not hboot, not recovery, not system) when you try to use fastboot from the computer? What have you done so far?
thekool said:
You could try returning to stock if that may help by extracting the PD98IMG.zip from a RUU and putting it in the root of your SD Card then booting into HBOOT
Click to expand...
Click to collapse
I have tried that, but it didn't work. I'm not sure if I used a suitable RUU.
I also tried with a couple of downloaded stock PD98IMG.zip files which were recommended in various how-to posts.
When I boot into HBOOT the phone shows the following error
SD Checking........
Loading...[PD98DIAG.zip]
No image!
Loading...[PD98DIAG.nbh]
No image or wrong image!
Loading...[PD98IMG.zip]
No image!
Loading...[PD98IMG.nbh}
No image or wrong image!
and returns to the HBOOT screen
OK, first, you want a file named PD98IMG.zip, not PD98DIAG.zip. Second, what RUUs? Find one compatible with your phone's region. And I'm reiterating my questions from my earlier post.
bananagranola said:
What does it say in hboot? Is your phone in fastboot (not hboot, not recovery, not system) when you try to use fastboot from the computer? What have you done so far?
Click to expand...
Click to collapse
The phone is in fastboot when I try to connect via fastboot on my PC.
When I boot into hboot with a PD98IMG.zip file on a goldcard I get this error message
SD Checking........
Loading...[PD98DIAG.zip]
No image!
Loading...[PD98DIAG.nbh]
No image or wrong image!
Loading...[PD98IMG.zip]
No image!
Loading...[PD98IMG.nbh}
No image or wrong image!
If I try to install PD98IMG.zip file using recovery I get the following response
Finding update package...
Opening update package...
Installing update...
Installation aborted.
NB I've been continuing to fiddle with it and I am once again able to connect to the phone via usb when in fastboot mode!
I am running windows 7 x64 if that makes a difference
You can't install PD98IMGs from recovery. If you want to flash one, put it on the root of your sdcard, boot into hboot, and choose to update. Make sure it's a compatible one for DHD. However, since you have recovery apparently, why don't you just full wipe and flash a ROM from recovery? Android Revolution HD is very stable and stock-ish.
And again. What does it say in hboot? What have you done so far?
bananagranola said:
You can't install PD98IMGs from recovery. If you want to flash one, put it on the root of your sdcard, boot into hboot, and choose to update. Make sure it's a compatible one for DHD. However, since you have recovery apparently, why don't you just full wipe and flash a ROM from recovery? Android Revolution HD is very stable and stock-ish.
And again. What does it say in hboot? What have you done so far?
Click to expand...
Click to collapse
I have attached an image of the hboot screen and the image which I was trying to use. The inf says its suitable for my phone cid T-MOB005
I'v just downloaded the rom you recommended and copied it to my sd card. Wiping now.
HOLY CRAP!!!!! it's working this time and I'm not doing anything I didn't try before. I just needed someone to hold my hand for a bit:laugh:
Many Many Thanks guys, specially bananagranola for persevering with my ineptitude.
EDIT Ok, I got over-excited and spoke too soon, it went through the full install routine but on reboot it's just sitting on the t-mobile splash screen:crying:
sup3rbird said:
I have attached an image of the hboot screen and the image which I was trying to use. The inf says its suitable for my phone cid T-MOB005
I'v just downloaded the rom you recommended and copied it to my sd card. Wiping now.
HOLY CRAP!!!!! it's working this time and I'm not doing anything I didn't try before. I just needed someone to hold my hand for a bit:laugh:
Many Many Thanks guys, specially bananagranola for persevering with my ineptitude.
EDIT Ok, I got over-excited and spoke too soon, it went through the full install routine but on reboot it's just sitting on the t-mobile splash screen:crying:
Click to expand...
Click to collapse
Check that the name of the file is incorrect. It should be PD98IMG and not PB98
Sent from my ASUS Transformer Pad TF700T using xda app-developers app
Wait, so did you do the recovery thing or the hboot thing? If the recovery thing, since you're S-On unlocked, you need to flash the ROM zip's boot.img from fastboot each time you flash a ROM. "fastboot flash boot boot.img"
bananagranola said:
Wait, so did you do the recovery thing or the hboot thing? If the recovery thing, since you're S-On unlocked, you need to flash the ROM zip's boot.img from fastboot each time you flash a ROM. "fastboot flash boot boot.img"
Click to expand...
Click to collapse
Thanks for sticking with me
I tried the recovery thing.
Ok I have flashed the boot.img from the Revolution rom via fastboot. It says it was successful.
Please tell me exactly what I should do next (as if you were talking to a moron).
It's 3:30 am here and I'm getting more stupid by the minute.
Did you flash the ROM from recovery before flashing the boot? You need to do that first. Then the boot.img. Then reboot.
bananagranola said:
Did you flash the ROM from recovery before flashing the boot? You need to do that first. Then the boot.img. Then reboot.
Click to expand...
Click to collapse
I did it in the wrong order...................I'm wiping everything and starting again.
Right, I have flashed the rom from my sdcard using cwm recovery; how do I get from here to fastboot to flash the boot.img which I copied from the rom?
FYI . If I "reboot system now" from recovery I cannot go directly to fastboot. The phone will only reboot into the regular boot mode or recovery mode.
My only other available method for restarting the phone is to pull the battery as the power switch no longer works.
FINAL EDIT Got it sorted working 100%
Thanks for your help
Cannot lock my bootloader, progress is stopped by "still need signed oem/system.img"
I want to lock my bootloader, I don't want to lose my Software status: Official flag in fastboot mode
when I run fastboot getvar all this appears( IMEI and SN changed for privacy reasons)
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8937-B8.23
(bootloader) product: cedric
(bootloader) board: cedric
(bootloader) secure: yes
(bootloader) hwrev: P5
(bootloader) radio: 4
(bootloader) storage-type: emmc
(bootloader) emmc: 16GB SAMSUNG RE1BMB RV=08 PV=07 FV=000000000000000D
(bootloader) ram: 3GB SAMSUNG LP3 DIE=6Gb M5=01 M6=05 M7=00 M8=7B
(bootloader) cpu: MSM8937
(bootloader) serialno: (changed for privacy)
(bootloader) cid: 0x0032
(bootloader) channelid: 0x40
(bootloader) uid: 3415337500000000000000000000
(bootloader) securestate: flashing_unlocked
(bootloader) verity-state: enforcing
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: Reboot mode set to fastboot
(bootloader) imei: (changed for privacy)
(bootloader) meid:
(bootloader) date: 03-08-2017
(bootloader) sku: XT1676
(bootloader) battid:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Sat Jan 3 3:14:55 UTC 1970"
(bootloader) ro.build.fingerprint[0]: motorola/cedric/cedric:7.0/NPPS25.
(bootloader) ro.build.fingerprint[1]: 137-72-4/4:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.25.246.4.cedric.reta
(bootloader) ro.build.version.full[1]: il.en.US
(bootloader) ro.build.version.qcom: LA.UM.5.6.r1-01900-89xx.0
(bootloader) version-baseband: M8937_11.16.02.51R CEDRIC_EMEADSDS_CUST
(bootloader) kernel.version[0]: Linux version 3.18.31-perf-g517c70f-0010
(bootloader) kernel.version[1]: 6-g2ab6438 ([email protected]) (gcc ver
(bootloader) kernel.version[2]: sion 4.8 (GCC) ) #1 SMP PREEMPT Fri Aug
(bootloader) kernel.version[3]: 4 04:33:06 CDT 2017
(bootloader) sbl1.git: git=MBM-NG-VB8.23-0-g2cafa24
(bootloader) rpm.git: git=3f612e6-dirty
(bootloader) tz.git: git=MBM-NG-VB8.21-0-g6c4172f-dirty
(bootloader) devcfg.git: git=MBM-NG-VB8.21-0-g6c4172f-dirty
(bootloader) keymaster.git: git=MBM-NG-VB8.21-0-g6c4172f-dirty
(bootloader) cmnlib.git: git=MBM-NG-VB8.21-0-g6c4172f-dirty
(bootloader) cmnlib64.git: git=MBM-NG-VB8.21-0-g6c4172f-dirty
(bootloader) prov.git: git=MBM-NG-VB8.09-0-g1a41aff
(bootloader) aboot.git: git=MBM-NG-VB8.23-0-g8fcce1f
(bootloader) qe: qe 0/1
(bootloader) frp-state: no protection (77)
(bootloader) ro.carrier: reteu
all: listed above
and when I run
Code:
fastboot oem lock
I get
Code:
(bootloader) Still require signed system.img and/or oem.img
OKAY [ 0.014s]
finished. total time: 0.016s
Have you done
fastboot oem lock begin
flash stock firmware - all of it using fastboot commands
fastboot oem lock
You can't just do fastboot oem lock without doing the previous commands
Why do you want to lock the bootloader? There's no benefit unless you are selling the phone
Except that if I'm using stock with no root whatsoever, it's not worth having a message shaming you for unlocking your bootloader every time you boot or reboot
Also, I had issues beforehand doing the method you suggested, so that is why I'm not bothering with it
ap4ss3rby said:
Except that if I'm using stock with no root whatsoever, it's not worth having a message shaming you for unlocking your bootloader every time you boot or reboot
Also, I had issues beforehand doing the method you suggested, so that is why I'm not bothering with it
Click to expand...
Click to collapse
You can get rid of that message easily
Flash this in twrp recovery
https://drive.google.com/file/d/0B4BcNVrbrBOzZko3VjhmRWtrVms/view
TheFixItMan said:
You can get rid of that message easily
Flash this in twrp recovery
https://drive.google.com/file/d/0B4BcNVrbrBOzZko3VjhmRWtrVms/view
Click to expand...
Click to collapse
Not what I intend, also NO TWRP (Software Status: official in fastboot)
ap4ss3rby said:
Not what I intend, also NO TWRP (Software Status: official in fastboot)
Click to expand...
Click to collapse
My software status is official & I have twrp
Just flash twrp
Flash the zip file given to remove unlocked bootloader warning
Flash stock recovery if you don't want twrp
TheFixItMan said:
My software status is official & I have twrp
Just flash twrp
Flash the zip file given to remove unlocked bootloader warning
Flash stock recovery if you don't want twrp
Click to expand...
Click to collapse
Oh, will download, or just extract logo.bin from the zip, and flash it using fastboot commands
ap4ss3rby said:
Oh, will download, or just extract logo.bin from the zip, and flash it using fastboot commands
Click to expand...
Click to collapse
yes you can do that
TheFixItMan said:
yes you can do that
Click to expand...
Click to collapse
Thanks, flashed your logo.bin via fastboot and bootloader warning was gone. Though it reads "bad key" displayed on top of the stock Motorola logo.
A way to get rid of that too to have clean stock look?
No_Signal said:
Thanks, flashed your logo.bin via fastboot and bootloader warning was gone. Though it reads "bad key" displayed on top of the stock Motorola logo.
A way to get rid of that too to have clean stock look?
Click to expand...
Click to collapse
See
https://forum.xda-developers.com/g5/themes/motorola-boot-logo-n-removed-t3663735/post74065607
Please browse the Moto G5 threads - much quicker looking yourself & you can see what else is available
TheFixItMan said:
See
https://forum.xda-developers.com/g5/themes/motorola-boot-logo-n-removed-t3663735/post74065607
Please browse the Moto G5 threads - much quicker looking yourself & you can see what else is available
Click to expand...
Click to collapse
Those threads are known to me as those came up after after I did a look up myself.
No_Signal said:
A way to get rid of that too to have clean stock look?
Click to expand...
Click to collapse
That's why I explicit asked for "clean stock look", no fancy boot logo but original one without the "bad key" showing up.
"bad key" showing up ain't a problem of the boot graphics afaik. I didn't got it fixed myself though correct firmware/cedric image was flashed.
Hi*guys*I*tried*to*unlock*the*bootloader*of*my*cell*phonebut*when*placing*the*bootloader*log*tells*me*that*it*doesnot*qualify*my*device
This*is*the*record*of*get-var*all
Code:
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8937-B8.12
(bootloader) product: cedric
(bootloader) board: cedric
(bootloader) secure: yes
(bootloader) hwrev: P5
(bootloader) radio: 6
(bootloader) storage-type: emmc
(bootloader) emmc: 32GB SKHYNIX HBG4a2 RV=08 PV=A5 FV=00000000000000A5
(bootloader) ram: 2GB SKHYNIX LP3 DIE=8Gb M5=06 M6=03 M7=00 M8=1F
(bootloader) cpu: MSM8937
(bootloader) serialno: ZY322FQBR2
(bootloader) cid: 0x0000
(bootloader) channelid: 0x1e
(bootloader) uid: E390CDC400000000000000000000
(bootloader) securestate: oem_locked
(bootloader) iswarrantyvoid: no
(bootloader) max-download-size: 536870912
(bootloader) reason: UTAG "bootmode" configured as fastboot
(bootloader) imei: 351864087651315
(bootloader) meid:
(bootloader) date: 03-06-2019
(bootloader) sku: XT1601
(bootloader) battid:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Thu Jan 1 0:51:34 UTC 1970"
(bootloader) ro.build.fingerprint[0]: motorola/cedric/cedric:8.1.0/OPP28
(bootloader) ro.build.fingerprint[1]: .85-16/0400:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.28.41.15.cedric.reta
(bootloader) ro.build.version.full[1]: il.en.US
(bootloader) ro.build.version.qcom: LA.UM.6.6.r1-08600-89xx.0
(bootloader) version-baseband: M8937_22.29.02.70R CEDRIC_LATAM_CUST
(bootloader) kernel.version[0]: Linux version 3.18.71-perf-g2148ea10 (hu
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.8 (GCC)
(bootloader) kernel.version[2]: ) #1 SMP PREEMPT Wed Sep 5 10:00:37 CDT
(bootloader) kernel.version[3]: 2018
(bootloader) sbl1.git: git=MBM-NG-VB8.12-0-g98be833
(bootloader) rpm.git: git=MBM-NG-VB8.12-0-gc6ac81e
(bootloader) tz.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) devcfg.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) keymaster.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) cmnlib.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) cmnlib64.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) prov.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) aboot.git: git=MBM-NG-VB8.12-0-gf2e5426
(bootloader) qe: qe 1/1
(bootloader) frp-state: no protection (144)
(bootloader) ro.carrier: retla1st
all: listed above
Gaxo said:
Hi*guys*I*tried*to*unlock*the*bootloader*of*my*cell*phonebut*when*placing*the*bootloader*log*tells*me*that*it*doesnot*qualify*my*device
This*is*the*record*of*get-var*all
Click to expand...
Click to collapse
What did you tried to unlock the bootloader?
lucki1000 said:
What did you tried to unlock the bootloader?
Click to expand...
Click to collapse
I tried from the Motorola page but it gives an error that the device does not qualify to unlock the bootloader
Gaxo said:
Hi*guys*I*tried*to*unlock*the*bootloader*of*my*cell*phonebut*when*placing*the*bootloader*log*tells*me*that*it*doesnot*qualify*my*device
This*is*the*record*of*get-var*all
Code:
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8937-B8.12
(bootloader) product: cedric
(bootloader) board: cedric
(bootloader) secure: yes
(bootloader) hwrev: P5
(bootloader) radio: 6
(bootloader) storage-type: emmc
(bootloader) emmc: 32GB SKHYNIX HBG4a2 RV=08 PV=A5 FV=00000000000000A5
(bootloader) ram: 2GB SKHYNIX LP3 DIE=8Gb M5=06 M6=03 M7=00 M8=1F
(bootloader) cpu: MSM8937
(bootloader) serialno: ZY322FQBR2
(bootloader) cid: 0x0000
(bootloader) channelid: 0x1e
(bootloader) uid: E390CDC400000000000000000000
(bootloader) securestate: oem_locked
(bootloader) iswarrantyvoid: no
(bootloader) max-download-size: 536870912
(bootloader) reason: UTAG "bootmode" configured as fastboot
(bootloader) imei: 351864087651315
(bootloader) meid:
(bootloader) date: 03-06-2019
(bootloader) sku: XT1601
(bootloader) battid:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Thu Jan 1 0:51:34 UTC 1970"
(bootloader) ro.build.fingerprint[0]: motorola/cedric/cedric:8.1.0/OPP28
(bootloader) ro.build.fingerprint[1]: .85-16/0400:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.28.41.15.cedric.reta
(bootloader) ro.build.version.full[1]: il.en.US
(bootloader) ro.build.version.qcom: LA.UM.6.6.r1-08600-89xx.0
(bootloader) version-baseband: M8937_22.29.02.70R CEDRIC_LATAM_CUST
(bootloader) kernel.version[0]: Linux version 3.18.71-perf-g2148ea10 (hu
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.8 (GCC)
(bootloader) kernel.version[2]: ) #1 SMP PREEMPT Wed Sep 5 10:00:37 CDT
(bootloader) kernel.version[3]: 2018
(bootloader) sbl1.git: git=MBM-NG-VB8.12-0-g98be833
(bootloader) rpm.git: git=MBM-NG-VB8.12-0-gc6ac81e
(bootloader) tz.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) devcfg.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) keymaster.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) cmnlib.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) cmnlib64.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) prov.git: git=MBM-NG-VB8.12-0-g09f1e7a
(bootloader) aboot.git: git=MBM-NG-VB8.12-0-gf2e5426
(bootloader) qe: qe 1/1
(bootloader) frp-state: no protection (144)
(bootloader) ro.carrier: retla1st
all: listed above
Click to expand...
Click to collapse
I'm confused
Your product device is listed as cedric (moto g5) but your sku is listed as XT1601 (moto g4 play)
Play device or amazon prime devices may not always be eligible for bootloader unlock
Gaxo said:
I tried from the Motorola page but it gives an error that the device does not qualify to unlock the bootloader
Click to expand...
Click to collapse
Did you allowed unlock bootloader in developer options?
Gaxo said:
I tried from the Motorola page but it gives an error that the device does not qualify to unlock the bootloader
Click to expand...
Click to collapse
TheFixItMan said:
I'm confused
Your product device is listed as cedric (moto g5) but your sku is listed as XT1601 (moto g4 play)
Play device or amazon prime devices may not always be eligible for bootloader unlock
Click to expand...
Click to collapse
here you have the solution :victory:
TheFixItMan said:
Hi*guys*I*tried*to*unlock*the*bootloader*of*my*cell*phonebut*when*placing*the*bootloader*log*tells*me*that*it*doesnot*qualify*my*device
This*is*the*record*of*get-var*all
I'm confused
Your product device is listed as cedric (moto g5) but your sku is listed as XT1601 (moto g4 play)
Play device or amazon prime devices may not always be eligible for bootloader unlock
Click to expand...
Click to collapse
Ok, this is weird. When I bought the second-hand device, the cell phone came with the bootloader unlocked. I had a report when I bought it, so I ordered it removed. I guess they changed the sku to unlock it. Is there a solution to change sku? As for example installing the original firmware by fastboot
Gaxo said:
Ok, this is weird. When I bought the second-hand device, the cell phone came with the bootloader unlocked. I had a report when I bought it, so I ordered it removed. I guess they changed the sku to unlock it. Is there a solution to change sku? As for example installing the original firmware by fastboot
Click to expand...
Click to collapse
You could try flashing stock firmware as long as it is actually a moto g5 (check the label under the battery)
You would need to flash gpt & bootloader to repartition
Firmware can be found
https://mirrors.lolinet.com/firmware/moto/cedric/official/
Code:
fastboot oem fb_mode_set
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash dsp adspso.bin
fastboot flash oem oem.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase userdata
fastboot oem fb_mode_clear
fastboot reboot
If you get security downgrade error when trying to flash gpt/bootloader the firmware you are trying to flash is too old
TheFixItMan said:
You could try flashing stock firmware as long as it is actually a moto g5 (check the label under the battery)
You would need to flash gpt & bootloader to repartition
Firmware can be found
https://mirrors.lolinet.com/firmware/moto/cedric/official/
If you get security downgrade error when trying to flash gpt/bootloader the firmware you are trying to flash is too old
Click to expand...
Click to collapse
I will try to flash the stock rom that is here, Since I was in Nougat and update to Oreo with the last published revision Give more details when you unlock it
It did not work, I have tried with the rom that you have given me and with all the stocks in this forum it still does not change the SKU
Gaxo said:
It did not work, I have tried with the rom that you have given me and with all the stocks in this forum it still does not change the SKU
Click to expand...
Click to collapse
Sounds to me like it could have possibly been a bricked phone and they have used some software/hardware to flash an image back onto it giving it that sku (which is odd as I worked with others to make a totally safe way to unbrick this device)
If after enabling adb debugging and enabling oem unlock if available if its saying your device is not eligible for unlock (assuming all codes have been entered correctly on the Motorola website) then there's not anything you can do
If I were you I'd contact the seller and question why your device displays the sku of a moto g4 play & obtain a refund for dodgy practices
I have a small idea, If I try to use the SD method with the Firmware that you have put in another thread and try to fully flash the cell phone including Bootllader (Since this cell phone is updated to 8.1 and I have flashed the bootloader of the rom) I may recover your Original Sku, right?
Gaxo said:
I have a small idea, If I try to use the SD method with the Firmware that you have put in another thread and try to fully flash the cell phone including Bootllader (Since this cell phone is updated to 8.1 and I have flashed the bootloader of the rom) I may recover your Original Sku, right?
Click to expand...
Click to collapse
The image tricks the phone into booting the bootloader from the sd card so a user without an accessable bootloader can then flash gpt which repartitions the device and then flash the bootloader back
I don't know how they changed the sku (probably by JTAG)
So the sd card probably wouldn't help if you have flashed gpt and bootloader from the latest firmware
You could always create the sd card and see if it gives you a different sku when it's inserted
TheFixItMan said:
Sounds to me like it could have possibly been a bricked phone and they have used some software/hardware to flash an image back onto it giving it that sku (which is odd as I worked with others to make a totally safe way to unbrick this device)
If after enabling adb debugging and enabling oem unlock if available if its saying your device is not eligible for unlock (assuming all codes have been entered correctly on the Motorola website) then there's not anything you can do
If I were you I'd contact the seller and question why your device displays the sku of a moto g4 play & obtain a refund for dodgy practices
Click to expand...
Click to collapse
Man, I'm already busting my head to unlock the boorloader of this thing, I'll leave it so I really don't have another G5 to test, It's intregant somehow how the hell they changed the sku to the cell phone Anyway, even so thanks for the help friend
Gaxo said:
Man, I'm already busting my head to unlock the boorloader of this thing, I'll leave it so I really don't have another G5 to test, It's intregant somehow how the hell they changed the sku to the cell phone Anyway, even so thanks for the help friend
Click to expand...
Click to collapse
My best guess is they used a JTAG and modified moto g4 play unbrick files to be able to flash the bootloader back to the G5 but who knows
I take it when you have typed
oem get_unlock_data
It gives you a key and you have copied this key into a text document and then removed all the spaces
The key is normally on about 4 lines so you need to remove all the spaces so it's just on one whole line then copy that very long string into the Motorola website
My wifes Pixel XL bricked tonight. Out of the blue it started rebooting, while she was using it. It started up, but then froze shortly after entering into the OS.
I went into recovery mode and performed a factory reset, it started up normally but half way through the setup guide is froze again, and went into a bootloop. And that's where I'm at now.
I have performed two more factory resets, but it never even boots into the setup guide anymore. Just straight to bootloop. The vast majority of times I can't even get into recovery mode anymore, when I try to it just gets into the bootloop. If I leave it turned off for a while, sometimes I can get it into recovery mode though.
Fastboot works, but the bootloader is locked and usb debugging isn't activated (I assume) so I can't flash anything through there or unlock the bootloader.
Considering how it started, and that the bootloop returned like 5 minutes after the first factory reset, I assume there is hardware problems, right? But is there anything more I can do, if we suppose that it's just soft bricked somehow?
Same issue here, would love to see if we could put our heads together with some folks. I have been wrestling with a Google Pixel XL on and off since August that has been doing roughly the same thing. Pixel is the direct-from-Google version (NOT Verizon), bootloader is locked, OEM unlocking is not enabled.
- Began rebooting consistently
- Would boot into OS for a limited amount of time then freeze and reboot, or freeze on G logo w/ loading bar then reboot
- I had been systematically uninstalling apps and downloading data to "cross them off my checklist" (probably a dumb idea in hindsight, if storage is corrupted)
- sometimes being left alone would allow the device to boot, seemed to only work within certain range of battery charge, perhaps until it heated up a certain amount?
- Will consistently boot into bootloader w/ Vol Down button
- Used to be able to consistently boot into Recovery from bootloader, but now choosing Recovery Mode will load Google logo and begin bootlooping.
- On one instance that Recovery Mode successfully booted, attempted to update via ADB. ADB seemed to install the update to 94% in PowerShell, and showed "success = 0" or something similar, which I take to be a failure lol.
- Much functionally in fastboot other than showing devices, rebooting, and getvar seems to require the bootloader to be unlocked, which I cannot do without access to the OS.
Things I've tried:
- sideloading update via ADB (failed the one time I was able to get recovery to load)
- unlocking bootloader via fastboot (requires oem unlocking in OS, so not successful)
- changing a/b partition via fastboot (unlocked bootloader required)
Here's a dump of getvar, seems like maybe one of the partitions is shot:
(bootloader) version:0.5
(bootloader) hw-revisionVT
(bootloader) mid:G-2PW2100
(bootloader) version-main:0.12.999.1
(bootloader) imei:[redacted]
(bootloader) ramdump-mode:false
(bootloader) boot-mode:FASTBOOT
(bootloader) has-slot:radio:yes
(bootloader) has-slot:bootloader:yes
(bootloader) has-slot:reserve5:no
(bootloader) has-slot:devinfo:no
(bootloader) has-slot:fsg:no
(bootloader) has-slot:mfg:no
(bootloader) has-slot:board_info:no
(bootloader) has-slot:reserve4:no
(bootloader) has-slot:metadata:no
(bootloader) has-slotg2fs:no
(bootloader) has-slotg1fs:no
(bootloader) has-slot:ramdump:no
(bootloader) has-slot:frp:no
(bootloader) has-slot:reserve3:no
(bootloader) has-slot:cdt:no
(bootloader) has-slot:ddr:no
(bootloader) has-slot:modemst2:no
(bootloader) has-slot:modemst1:no
(bootloader) has-slot:fsc:no
(bootloader) has-slot:dip:no
(bootloader) has-slot:dpo:no
(bootloader) has-slot:devinfobak:no
(bootloader) has-slot:sec:no
(bootloader) has-slotersist:no
(bootloader) has-slot:ssd:no
(bootloader) has-slot:misc:no
(bootloader) has-slot:xbl:yes
(bootloader) has-slot:reserve0:no
(bootloader) has-slot:userdata:no
(bootloader) has-slot:system:yes
(bootloader) has-slot:vendor:yes
(bootloader) has-slot:apdp:yes
(bootloader) has-slot:msadp:yes
(bootloader) has-slot:modem:yes
(bootloader) has-slot:devcfg:yes
(bootloader) has-slot:hosd:yes
(bootloader) has-slot:boot:yes
(bootloader) has-slot:aboot:yes
(bootloader) has-slot:cmnlib64:yes
(bootloader) has-slot:cmnlib32:yes
(bootloader) has-slot:hyp:yes
(bootloader) has-slotmic:yes
(bootloader) has-slot:rpm:yes
(bootloader) has-slot:tz:yes
(bootloader) has-slot:keymaster:yes
(bootloader) has-slot:bootlocker:yes
(bootloader) slot-count:2
(bootloader) current-slot:b
(bootloader) slot-retry-count:b:2
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:yes
(bootloader) slot-retry-count:a:0
(bootloader) slot-unbootable:a:yes
(bootloader) slot-successful:a:no
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:4240000
(bootloader) variant:US
(bootloader) secure:yes
(bootloader) unlocked:no
(bootloader) version-baseband:8996-130361-1905270421
(bootloader) version-bootloader:8996-012001-1908071822
(bootloader) off-mode-charge:1
(bootloader) charger-screen-enabled:1
(bootloader) max-download-size: 0x20000000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x1c8d800000
(bootloader) partition-type:system_b:ext4
(bootloader) partition-size:system_b: 0x80000000
(bootloader) partition-type:system_a:ext4
(bootloader) partition-size:system_a: 0x80000000
(bootloader) partition-type:vendor_b:ext4
(bootloader) partition-size:vendor_b: 0x12c00000
(bootloader) partition-type:vendor_a:ext4
(bootloader) partition-size:vendor_a: 0x12c00000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x2000000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x2000000
(bootloader) serialno:[redacted]
(bootloader) kernel:lk
(bootloader) product:marlin
Edit 4:
I've pretty much given up on this. I'm too busy to tinker with it at the moment. I switched to the Pixel 5 just after this happened, and I had a backup from December (about 5 months worth of data lost). Oh well
---
Yesterday, my phone was acting kinda sluggish, so I rebooted it... And it never came back up.
I force booted into fastboot and was greeted with this [screenshot below]
Now, booting to Recovery and Rescue from the bootloader just goes to black screen (Start goes back to the bootloader), and booting normally also just goes to black screen.
Trying to do most things via fastboot cli just results in the error message FAILED (remote: 'error getting device locked state Protocol Error')
I've tried:
setting the active slot
flashing the bootloader
erasing system_a and boot_a
flashing boot.img
flashing stock boot.img
fastboot booting into boot.img or twrp.img
fastboot update stock.zip (it fails at setting the slot)
letting the battery die over night
using a different charger
using a script to reboot repeatedly
removing the sim and booting
disconnecting the battery
putting it in the freezer (yes)
a new battery
I'm also going to try taking it apart and disconnecting the battery
This is the output of `fastboot getvar all`
Spoiler: fastboot variables
Code:
(bootloader) product:crosshatch
(bootloader) serialno:<redacted>
(bootloader) variant:SDM UFS
(bootloader) max-download-size:0x10000000
(bootloader) slot-suffixes:_a,_b
(bootloader) version-bootloader:b1c1-0.3-6623201
(bootloader) version-baseband:g845-00107-200702-B-6648703
(bootloader) secure-boot:PRODUCTION
(bootloader) secure:yes
(bootloader) hw-revision:MP1.0
(bootloader) is-userspace:no
(bootloader) slot-count:2
(bootloader) current-slot:a
(bootloader) unlocked:error
(bootloader) nos-production:error
(bootloader) off-mode-charge:1
(bootloader) slot-retry-count:a:0
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-retry-count:b:1
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:no
(bootloader) battery-voltage:3781
(bootloader) battery-soc-ok:yes
(bootloader) snapshot-update-status:none
(bootloader) storage-vendor:MICRON
(bootloader) storage-model:128GB-UFS-MT
(bootloader) storage-rev:9QSN
(bootloader) citadel-fw:error
(bootloader) auto-shutdown:0
(bootloader) partition-type:ssd:raw
(bootloader) partition-size:ssd:0x2000
(bootloader) partition-type:misc:raw
(bootloader) partition-size:misc:0x100000
(bootloader) partition-type:keystore:raw
(bootloader) partition-size:keystore:0x80000
(bootloader) partition-type:frp:raw
(bootloader) partition-size:frp:0x80000
(bootloader) partition-type:system_a:raw
(bootloader) partition-size:system_a:0xB0000000
(bootloader) partition-type:system_b:raw
(bootloader) partition-size:system_b:0xB0000000
(bootloader) partition-type:product_a:raw
(bootloader) partition-size:product_a:0x12C00000
(bootloader) partition-type:product_b:raw
(bootloader) partition-size:product_b:0x12C00000
(bootloader) partition-type:vendor_a:raw
(bootloader) partition-size:vendor_a:0x30000000
(bootloader) partition-type:vendor_b:raw
(bootloader) partition-size:vendor_b:0x30000000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a:0x4000000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b:0x4000000
(bootloader) partition-type:modem_a:raw
(bootloader) partition-size:modem_a:0x5000000
(bootloader) partition-type:modem_b:raw
(bootloader) partition-size:modem_b:0x5000000
(bootloader) partition-type:apdp_a:raw
(bootloader) partition-size:apdp_a:0x40000
(bootloader) partition-type:apdp_b:raw
(bootloader) partition-size:apdp_b:0x40000
(bootloader) partition-type:msadp_a:raw
(bootloader) partition-size:msadp_a:0x40000
(bootloader) partition-type:msadp_b:raw
(bootloader) partition-size:msadp_b:0x40000
(bootloader) partition-type:klog:raw
(bootloader) partition-size:klog:0x400000
(bootloader) partition-type:metadata:raw
(bootloader) partition-size:metadata:0x1000000
(bootloader) partition-type:userdata:raw
(bootloader) partition-size:userdata:0x1BCA7FB000
(bootloader) partition-type:xbl_a:raw
(bootloader) partition-size:xbl_a:0x380000
(bootloader) partition-type:xbl_config_a:raw
(bootloader) partition-size:xbl_config_a:0x20000
(bootloader) partition-type:xbl_b:raw
(bootloader) partition-size:xbl_b:0x380000
(bootloader) partition-type:xbl_config_b:raw
(bootloader) partition-size:xbl_config_b:0x20000
(bootloader) partition-type:ALIGN_TO_128K_1:raw
(bootloader) partition-size:ALIGN_TO_128K_1:0x1A000
(bootloader) partition-type:cdt:raw
(bootloader) partition-size:cdt:0x20000
(bootloader) partition-type:ddr:raw
(bootloader) partition-size:ddr:0x100000
(bootloader) partition-type:modemcal:raw
(bootloader) partition-size:modemcal:0x200000
(bootloader) partition-type:uefivar:raw
(bootloader) partition-size:uefivar:0x100000
(bootloader) partition-type:sec:raw
(bootloader) partition-size:sec:0x4000
(bootloader) partition-type:aop_a:raw
(bootloader) partition-size:aop_a:0x80000
(bootloader) partition-type:tz_a:raw
(bootloader) partition-size:tz_a:0x200000
(bootloader) partition-type:hyp_a:raw
(bootloader) partition-size:hyp_a:0x80000
(bootloader) partition-type:abl_a:raw
(bootloader) partition-size:abl_a:0x200000
(bootloader) partition-type:keymaster_a:raw
(bootloader) partition-size:keymaster_a:0x80000
(bootloader) partition-type:cmnlib_a:raw
(bootloader) partition-size:cmnlib_a:0x80000
(bootloader) partition-type:cmnlib64_a:raw
(bootloader) partition-size:cmnlib64_a:0x80000
(bootloader) partition-type:devcfg_a:raw
(bootloader) partition-size:devcfg_a:0x20000
(bootloader) partition-type:qupfw_a:raw
(bootloader) partition-size:qupfw_a:0x10000
(bootloader) partition-type:vbmeta_a:raw
(bootloader) partition-size:vbmeta_a:0x10000
(bootloader) partition-type:dtbo_a:raw
(bootloader) partition-size:dtbo_a:0x800000
(bootloader) partition-type:storsec_a:raw
(bootloader) partition-size:storsec_a:0x20000
(bootloader) partition-type:aop_b:raw
(bootloader) partition-size:aop_b:0x80000
(bootloader) partition-type:tz_b:raw
(bootloader) partition-size:tz_b:0x200000
(bootloader) partition-type:hyp_b:raw
(bootloader) partition-size:hyp_b:0x80000
(bootloader) partition-type:abl_b:raw
(bootloader) partition-size:abl_b:0x200000
(bootloader) partition-type:keymaster_b:raw
(bootloader) partition-size:keymaster_b:0x80000
(bootloader) partition-type:cmnlib_b:raw
(bootloader) partition-size:cmnlib_b:0x80000
(bootloader) partition-type:cmnlib64_b:raw
(bootloader) partition-size:cmnlib64_b:0x80000
(bootloader) partition-type:devcfg_b:raw
(bootloader) partition-size:devcfg_b:0x20000
(bootloader) partition-type:qupfw_b:raw
(bootloader) partition-size:qupfw_b:0x10000
(bootloader) partition-type:vbmeta_b:raw
(bootloader) partition-size:vbmeta_b:0x10000
(bootloader) partition-type:dtbo_b:raw
(bootloader) partition-size:dtbo_b:0x800000
(bootloader) partition-type:storsec_b:raw
(bootloader) partition-size:storsec_b:0x20000
(bootloader) partition-type:ALIGN_TO_128K_2:raw
(bootloader) partition-size:ALIGN_TO_128K_2:0x1A000
(bootloader) partition-type:persist:raw
(bootloader) partition-size:persist:0x2800000
(bootloader) partition-type:modemst1:raw
(bootloader) partition-size:modemst1:0x200000
(bootloader) partition-type:modemst2:raw
(bootloader) partition-size:modemst2:0x200000
(bootloader) partition-type:fsg:raw
(bootloader) partition-size:fsg:0x200000
(bootloader) partition-type:fsc:raw
(bootloader) partition-size:fsc:0x20000
(bootloader) partition-type:devinfo:raw
(bootloader) partition-size:devinfo:0x1000
(bootloader) partition-type:dip:raw
(bootloader) partition-size:dip:0x100000
(bootloader) partition-type:spunvm:raw
(bootloader) partition-size:spunvm:0x800000
(bootloader) partition-type:limits:raw
(bootloader) partition-size:limits:0x1000
(bootloader) partition-type:toolsfv:raw
(bootloader) partition-size:toolsfv:0x100000
(bootloader) partition-type:logfs:raw
(bootloader) partition-size:logfs:0x800000
(bootloader) partition-type:sti:raw
(bootloader) partition-size:sti:0x200000
(bootloader) partition-type:ImageFv:raw
(bootloader) partition-size:ImageFv:0x200000
(bootloader) partition-type:splash:raw
(bootloader) partition-size:splash:0x4000
all:
I'm running Dirty Unicorns 14.7-20200913-1623 with Magisk (probably the latest)
I know I've installed Youtube Vanced, Adaway, and Universal SafetyNet Fix
I did NOT have Xposed or others installed, and I don't remember if the device fingerprint was still being spoofed (I don't think it was)
If anyone happened to have the EDL / QPST files, that would be handy as well
*sigh* I have 0 idea how this happened. Could even be an eMMC hardware failure, which would not be nice
Spoiler: Screenshot
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Edit:
After shattering the back glass pannel, and accidentally pulling off the fingerprint sensor connector, I can confirm that detaching the battery does NOT work. The phone still boots into fastboot, which is good.
At this point, I'm just interested in data recovery
Edit 2:
I just ordered new battery. The old one seems flaky and acting like it's not holding a charge (and a new one is inexpensive). I'm also going to try to leave the battery disconnected overnight (I'm hoping there's some volatile storage or capacitor that'll be discharged and refreshed in the morning)
Edit 3:
The new battery did not help. ugh.
At this point QPST would make matters worse by formatting userdata. Your only hope for recovering the data might be to reboot the phone to edl with fastboot using fastboot reboot emergency and then flashing the exact same system and boot image that you were using. You might need to convert the system.new.dat.br file to system.img. Flash it with the adb edl command and then try to reboot.
But before you do that try changing your slot to B then reboot and try switching to A and reboot again
muhammad42620 said:
But before you do that try changing your slot to B then reboot and try switching to A and reboot again
Click to expand...
Click to collapse
I did. No fastboot commands will work because they check for "locked" state beforehand, which cannot be determined (that's also why an fastboot update update.zip won't work either).
My best hope is a new battery might help.
If not, I may have to do a little hacking, myself
muhammad42620 said:
... reboot the phone to edl with fastboot using fastboot reboot emergency
Click to expand...
Click to collapse
I tried fastboot oem reboot-edl and variants, but I'll try that when I get home (at work currently)
Although, it seems like google's bootloader won't allow you to boot into EDL
I tried fastboot reboot emergency, which didn't work ("no" reboot target 'emergency'')
But fastboot oem reboot-edl gave back error getting device locked state Protocol Error. So that may be a valid command, but due to the reason for needing it, I can't use it.
However, I've got the back panel off the phone. If i can find the EDL short points, I might still be able to go that route
Welp
In my disassembly of the phone, I just broke the side buttons (power + vol) ribbon connector.
So, unless a new battery works (or i can find the EDL test points), I might be SOL
(I could probably buy a busted 3XL off ebay and swap the mobo's. But it's not looking good)
I found the EDL test points! But nobody's gonna like where they are.
They're on the underside of the motherboard, the left 2 of a cluster of 3 just under one of the mounting holes.
Unplug the battery, plug it back in, use something to bridge the two contacts, and plug in the usb power
@lightfire228 Hello. Are you able to fix your phone?
Godwin.L said:
@lightfire228 Hello. Are you able to fix your phone?
Click to expand...
Click to collapse
I haven't tried anything since finding the EDL test points.
I'm still waiting on a replacement battery. If that works, then I'm just going to transfer the data to my new phone.
If not, I'll look into prodding the EDL. But, since I've not had a lot of time to research that particular route, nor have I done any sort of reverse-engineering like that, I don't how feasible that will be
This looks useful for EDL
My pixel 3 reboot and deid The charger from pixelbook go helped me. He does not see other charges