Increasing security in custom roms by re-locking bootloader - OnePlus 3 Questions & Answers

Hello, I am completely new so I apologize if this is the wrong place.
I wanted to be able to lock my bootloader but still use cyanogenmod, specifically, only allow roms that I have compiled myself and signed with my cert to work on my phone. I unpacked the stock recovery.img, and made the necessary changes to the ramdisk to replace the stock OnePlus key with my own. I then was then able to confirm that only my signed zips could be sideloaded, both official CM and OxygenOS zips failed - just as I wanted.
The issue is then that this only worked with an unlocked bootloader. When I locked it, the OP3 entered a boot cycle, with a strange graphical glitch appearing then the screen going black, again and again. I could then no longer boot to either recovery or cyanogenmod, nor could I unlock fastboot. This amazing guide got my phone working again.
I now have three questions. What prevented my phone booting after I locked it, how does the unbrick tool work, and is there anything I can alter, like certifications or hashes, lower down in the boot sequence to allow only my signed images to work (using the previous tool. I am unsure what QLoader is, some form of serial interface to the 820 to write to the storage chip?).
Thanks for any advice you can offer!

Update: I have unpacked boot.img provided in the unbrick tool. I cannot find any keys to modify in /res but I have found a file called "verify_keys". Does anyone know what I need to change in boot.img to allow my self-signed recovery and os to boot? Thanks

UPDATE 2:
From reading some Android notes it appears that instead of replacing the OEM key, you can also just use fastboot to flash keystores for self-signed recovery and roms. This still allows OEM signed images to run, but is certainly a step in the right direction. I have run into an issue with building a correct keystore. I can use keytool and import my previous certs, but "fastboot flash keystore examplename.keystore" fails. I saw "fastboot flash ssd keystore.dat" used, and it works with my current dot keystore file, but then after locking it fails to boot. I'm going to see how I can convert my .keystore to a .dat.

I've been meaning to ask this same question for a while now also, so I'm eager to see the response. I suspect the official OnePlus forums might be a good place to ask as well, since they are visited by engineers from OnePlus. For anyone else who's curious as to what's being discussed and better the understand the risks of an unlocked bootloader (and how to mitigate them), there's a brief article here as well as a paper.

It is always suggested that never re-lock the bootloader until there is valid reason to do it

JumboMan said:
It is always suggested that never re-lock the bootloader until there is valid reason to do it
Click to expand...
Click to collapse
Have you read any of the attached links in my last post? There are valid reasons for doing so.
Just to pose an oversimplified hypothetical, imagine going through immigration/customs in Saudi Arabia (or maybe even the U.S.) with a Android device that has an unlocked bootloader. The officer examines your possesions, then takes your laptop and phone into a back room. Your phone is powered down and encrypted so it's not like they can do anything, right? Wrong. They plug it into a forensics device and flash a surreptitious malware app onto /system before returning it back to you. Then, the next time you turn on your phone your encryption keys and all your data, all your communications are secretly transmitted. You never have a clue... With a locked bootloader and appropriate precautions, that would never be possible.

Update 3:
I am now following the official Android guide for creating a keystore. They show how to create a "keystore.img" not .dat, bu the error I got when trying "fastboot flash keystore ..." said something along the lines of the keystore not being a valid image. Hopefully this will work. After I get this working, I will move on to removing or damaging the OEM key, hence not even allowing OnePlus images to be sideloaded.

JumboMan said:
It is always suggested that never re-lock the bootloader until there is valid reason to do it
Click to expand...
Click to collapse
I do have a valid reason - security. An unlocked bootloader means any code can be flashed to my device. Even with encryption it is vulnerable to cold boot attacks, it makes it easier to bruteforce, and pulling encryption keys from memory.

chocol4te said:
I do have a valid reason - security. An unlocked bootloader means any code can be flashed to my device. Even with encryption it is vulnerable to cold boot attacks, it makes it easier to bruteforce, and pulling encryption keys from memory.
Click to expand...
Click to collapse
sir prefer not rooting and staying on stock ROM with locked bootloader.

emptyragnarok said:
sir prefer not rooting and staying on stock ROM with locked bootloader.
Click to expand...
Click to collapse
Look, I'm sorry, I don't need any more useless comments saying the solution to my problem is to not do anything like on every other forum I've tried. I am perfectly aware of how to lock the bootloader with a stock rom, but I don't want to use the stock rom. I want to use custom roms. From what I have done so far it appears to be possible, so don't tell me it's not, at least without a good reason.
In addition, the stock method isn't even the most secure the phone can be. OnePlus can still sign any code and run it on my device and hence requires my trust in a third party that I am unwilling to give. I only want my own code to run.

Update 4:
Using the unbrick utility, I have updated the MD5 partition with the checksums of my modified boot and recovery partitions. Unfortunately, I am now getting a checksum failed error, with both the MD5 and recovery partitions highlighted in red. So I was wrong about the checksum being compared with hashes in the MD5 partition. Does anyone know where the lowest level checksums are stored? Hopefully if I can change that, then locking the bootloader will be no issue.

chocol4te said:
Update 4:
Using the unbrick utility, I have updated the MD5 partition with the checksums of my modified boot and recovery partitions. Unfortunately, I am now getting a checksum failed error, with both the MD5 and recovery partitions highlighted in red. So I was wrong about the checksum being compared with hashes in the MD5 partition. Does anyone know where the lowest level checksums are stored? Hopefully if I can change that, then locking the bootloader will be no issue.
Click to expand...
Click to collapse
Bro I am not a prolike you but I understand your vision now,... and I am with you in that.... Open Source stuff and ANdroid as an Open source impify that only... We should have our custom code for locking and unlocking our bootloader so we can have the full control over our device.... If not and the guy that said that you can lock the bootloader with the stock rom didn't get that .. even with stock rom and recovery anyone can have the access of the phone by just unlocking the boot loader and that is simple. SO I GOT YOUR VISION AND I AM WITH YOU I WILL TRY TO UNDERSTAND THE LOCKING SYSTEM OF THE BOOT-LOADER AND I WILL TRY TO FIND THE LOCATION OF LOWER LEVEL CHECKSLUMS... WE will try and try untill we succeed.... I AM WITH YOU BRO!!!!!

indroider said:
Bro I am not a prolike you but I understand your vision now,... and I am with you in that.... Open Source stuff and ANdroid as an Open source impify that only... We should have our custom code for locking and unlocking our bootloader so we can have the full control over our device.... If not and the guy that said that you can lock the bootloader with the stock rom didn't get that .. even with stock rom and recovery anyone can have the access of the phone by just unlocking the boot loader and that is simple. SO I GOT YOUR VISION AND I AM WITH YOU I WILL TRY TO UNDERSTAND THE LOCKING SYSTEM OF THE BOOT-LOADER AND I WILL TRY TO FIND THE LOCATION OF LOWER LEVEL CHECKSLUMS... WE will try and try untill we succeed.... I AM WITH YOU BRO!!!!!
Click to expand...
Click to collapse
Thanks! I'm glad to hear it!

chocol4te said:
Thanks! I'm glad to hear it!
Click to expand...
Click to collapse
You're most welcome bro.

Did I just witness a major bro-down?

Awsome thread, I'd also like to put my OP3 in a state where only ROMs I signed my self will run...

Any further development??
Sent from my Pixel XL using XDA-Developers mobile app
---------- Post added at 05:42 PM ---------- Previous post was at 05:41 PM ----------
indieross said:
Did I just witness a major bro-down?
Click to expand...
Click to collapse
Whats a bro down?
Sent from my Pixel XL using XDA-Developers mobile app

indroider said:
Any further development??
Sent from my Pixel XL using XDA-Developers mobile app
---------- Post added at 05:42 PM ---------- Previous post was at 05:41 PM ----------
Whats a bro down?
Sent from my Pixel XL using XDA-Developers mobile app
Click to expand...
Click to collapse
Sorry, other stuff came up. I am still very interested in getting this to work, but I am really stuck if I can't understand why the MD5 verification error occurs when I use Loader to flash the modified images. I looked at CopperheadOS, and in their documentation they show how to re-lock the bootloader with a custom ROM. Here is the shell script they use to upload the OS.
Code:
fastboot flash bootloader bootloader-bullhead-bhz11f.img
fastboot reboot-bootloader
sleep 5
fastboot flash radio radio-bullhead-m8994f-2.6.33.2.14.img
fastboot reboot-bootloader
sleep 5
fastboot -w update image-bullhead-nbd90z.zip
As you can see they flash two images, boot loader and radio, then update the main ROM. Then apparently it boots fine and the bootloader is OEM locked inside the OS. This was for the Nexus 5X, but I want to find out if a similar process is possible on the OP3.
I may also begin work on porting CopperheadOS to the OnePlus 3. I know it sounds unrealistic, but since OnePlus released the binaries and kernels it should make it slightly easier.

chocol4te said:
Sorry, other stuff came up. I am still very interested in getting this to work, but I am really stuck if I can't understand why the MD5 verification error occurs when I use Loader to flash the modified images. I looked at CopperheadOS, and in their documentation they show how to re-lock the bootloader with a custom ROM. Here is the shell script they use to upload the OS.
As you can see they flash two images, boot loader and radio, then update the main ROM. Then apparently it boots fine and the bootloader is OEM locked inside the OS. This was for the Nexus 5X, but I want to find out if a similar process is possible on the OP3.
I may also begin work on porting CopperheadOS to the OnePlus 3. I know it sounds unrealistic, but since OnePlus released the binaries and kernels it should make it slightly easier.
Click to expand...
Click to collapse
Ok.. Great to hear... Let me if you need any help.. I m here

chocol4te said:
Sorry, other stuff came up. I am still very interested in getting this to work ... ...
I may also begin work on porting CopperheadOS to the OnePlus 3. I know it sounds unrealistic, but since OnePlus released the binaries and kernels it should make it slightly easier.
Click to expand...
Click to collapse
This sounds exactly like what I was looking for. Have you been able to progress? Do you think that the bootloader and the radio are somehow linked in the boot verification sequence?
---------- Post added at 05:51 AM ---------- Previous post was at 05:43 AM ----------
chocol4te said:
UPDATE 2:
From reading some Android notes it appears that instead of replacing the OEM key, you can also just use fastboot to flash keystores for self-signed recovery and roms. This still allows OEM signed images to run, but is certainly a step in the right direction. I have run into an issue with building a correct keystore. I can use keytool and import my previous certs, but "fastboot flash keystore examplename.keystore" fails. I saw "fastboot flash ssd keystore.dat" used, and it works with my current dot keystore file, but then after locking it fails to boot. I'm going to see how I can convert my .keystore to a .dat.
Click to expand...
Click to collapse
Have you read this: https://mjg59.dreamwidth.org/31765.html

Related

I locked my bootloader before unrooting my Pixel XL is it hopeless?

I can get the bootloader menu to come up but it says its locked and its a Verizon version. I've done a bunch of reading. My last resort is to file for lost but if there is a way to get it working again. I will donate to Chainfire or whoever.
Why would you u unlock then lock,??? If your phone is still operational just relock your bootloader.
just use depixel8 to unlock again and then use the firmware from googles website to flash everything back which will fix whatever else you messed up
---------- Post added at 12:52 AM ---------- Previous post was at 12:51 AM ----------
use the version for Marlin that ends in P... and unlocking isn't necessary to do flash this but I figured you want unlock which is the only reason why I said to do depixel8 again
I used Chainfires method of Unlocking and then I unrooted the phone. I was tyring to play pokemon lol with my girl so I just locked the bootloader thinking it would factory reset my root automatically now it boots straight to charging weird. But aslong as I can still see the settings screen where you can START , Recovery and all that their is still a way right? I do half understand what you guys say because I used to write software in Visual Basic. Its just I haven't really dabbled into the Android / Linux stuff much.
In the bootloader(fastboot mode), while being connected to your PC, try typing fastboot format userdata and then fastboot format cache. This will wipe your device and maybe boot up. You can't flash anything now with a locked bootloader.
Sent from my Pixel XL using XDA-Developers mobile app
KrazyBrandon said:
I can get the bootloader menu to come up but it says its locked and its a Verizon version. I've done a bunch of reading. My last resort is to file for lost but if there is a way to get it working again. I will donate to Chainfire or whoever.
Click to expand...
Click to collapse
What do you mean "My last resort is to file for lost"?
I'm hoping you're not intending to commit fraud because you screwed up you're phone. Apologies if I'm misreading your statement.
@KrazyBrandon, Benjamin150 may be able to help you. I sent him a pm so be on the lookout for his advice.
Sent from my Pixel XL using XDA-Developers mobile app
Roger that I look forward to trying. I really enjoy the phone.
none of these advices are correct... unlock using depixel8 again which might fix the issue on its own if not just go to https://developers.google.com/android/images click accept and download the image for Marlin that ends in a P and extract it place your adb and fastboot binaries inside the folder that was made by extracting.... then go to the android bootloader mode hook up to computer and do fastboot flash-all.bat this will factory reset your device but you will be completely back to stock
Mike02z said:
What do you mean "My last resort is to file for lost"?
I'm hoping you're not intending to commit fraud because you screwed up you're phone. Apologies if I'm misreading your statement.
Click to expand...
Click to collapse
this is exactly what I was thinking and a reason why we pay so much for insurance and coverages. just a disgrace to read that comment. I've reported this post.
diabl0w said:
none of these advices are correct... unlock using depixel8 again which might fix the issue on its own if not just go to https://developers.google.com/android/images click accept and download the image for Marlin that ends in a P and extract it place your adb and fastboot binaries inside the folder that was made by extracting.... then go to the android bootloader mode hook up to computer and do fastboot flash-all.bat this will factory reset your device but you will be completely back to stock
Click to expand...
Click to collapse
He locked his bootloader. You can't flash IMG files with a locked bootloader.
Sent from my Pixel XL using XDA-Developers mobile app
ko0ky said:
this is exactly what I was thinking and a reason why we pay so much for insurance and coverages. just a disgrace to read that comment. I've reported this post.
Click to expand...
Click to collapse
No need for all that. I'm sure you've done some questionable things in your life. Seriously?
Moderator Warning,
I am closing this thread down, as we do not discuss insurance fraud on this site.

Swift 2 Plus won't boot, stuck with locked bootloader

Please don't ask why (the answer will be: "because I'm stupid"), but I relocked my bootloader and now my Swift 2 Plus won't boot anymore. When turning it on, it vibrates and the Wileyfox logo flashes for less than a second. After that the screen stays black and nothing happens. Same thing when I try to boot into recovery. I can only boot into the bootloader but I can't flash any images or unlock it again ("FAILED (remote: oem unlock is not allowed)").
Is there any way I can revive my phone or is it lost?
I think your only way is to flash twrp again with fastboot install method :
//twrp.me/devices/wileyfoxswift2.html
And then flash the stock rom :
//cyngn.com/support
hope it will helps you!
---------- Post added at 02:07 PM ---------- Previous post was at 02:05 PM ----------
Sorry, I'm a new user so I can't post link, you've just have to ad "https" at the beginning of the line.
Thanks for answering, but I can't do that, because the bootloader is locked and protected from unlocking. I guess the only thing I can do is ask the support if they can provide the mbn and xml files that are needed for unbricking with QFIL (I can boot into edl mode as I recently found out). They probably won't but it's worth a shot.
If you use the signed zip ( not the fastboot image) the default recovery should be able to install it.
It doesn't boot to recovery. Only fastboot and edl mode work.
You could try flashing fastboot image from http://cyngn.com/support
Sent from my Swift 2 using XDA-Developers mobile app
Thanks, but that doesn't work with a locked bootloader (already tried).
It seems like the only way to revive it is with QFIL, but for doing that it needs the matching mbn and xml files that aren't included in the factory images. Wileyfox support wasn't helpful, either.
xrmnx said:
Thanks, but that doesn't work with a locked bootloader (already tried).
Click to expand...
Click to collapse
Can't we put the dirty cow bug to a use now? It should work on the phone unless it has the latest security patches, right? And with root privileges you should be able to flash a new recovery or reset the phone.:fingers-crossed:
I'm actually not sure, if I still have root privileges. It could be that I turned it off inside the SuperSU app.
I tried to flash the stock rom and that didn't work, though. Do I have to do something different than usually to flash with root privileges?
boa05 said:
Can't we put the dirty cow bug to a use now? It should work on the phone unless it has the latest security patches, right? And with root privileges you should be able to flash a new recovery or reset the phone.:fingers-crossed:
Click to expand...
Click to collapse
I read a little about dirty cow, now (didn't know much about it before), but if I understand it right, I need adb to upload files onto the phone, right? Sadly, adb doesn't work. Only fastboot :/
Hmmm, there is a similar thread for the Nexus 5X. You might want to check it out if you haven't already ( http://forum.xda-developers.com/nexus-5x/help/nexus-5x-permanently-bricked-locked-t3232105/page2 ).
A few of the suggestions were to try with:
Code:
fastboot flashing unlock
or
Code:
fastboot format userdata
fastboot format cache
I don't know if it will be of any help but it is worth a shot.
You could try to flash individual portions of the stock image like the recovery or the userdata but I doubt that it will be successful.
PS: From the thread above, for some reason removing the SIM card allowed them to enter recovery.
Thanks, but none of these solutions works. Already tried all of them a couple of times....
Hmmm, how about you try to trick it then?
Grab the official signed firmware, place it on SD Card and try with:
Code:
fastboot update <path/to/zip>
or this one to try to wipe the device? (dunno if the command is still in use, though)
Code:
fastboot -w
If this doesn't work as well, I guess it will be a waiting game for QFIL files.
Pak0St said:
Hmmm, how about you try to trick it then?
Grab the official signed firmware, place it on SD Card and try with:
or this one to try to wipe the device? (dunno if the command is still in use, though)
If this doesn't work as well, I guess it will be a waiting game for QFIL files.
Click to expand...
Click to collapse
I tried to flash/update every official rom (with and without -w) there is, but I never put it on an SD-card. Does that make a difference? If so, this might be one ofhe stupidest mistakes I ever made :/
I'll try in a few days. Not much time, at the moment...
Yes... Waiting for QFIL files is what I'm prepared for...
The idea with the SDCard is just a random thought. There is a slight chance to trigger the allowed update policies.
Usually you place the update.zip through adb (not possible in this situation) but placing it on the sdcard is possible.
Still, QFIL is the safest bet once someone uploads the files.
Pak0St said:
Still, QFIL is the safest bet once someone uploads the files.
Click to expand...
Click to collapse
That's what I thought. Since I couldn't find any (yet), is there a way to extract the QFIL files from a working phone (I bought another one since I needed a phone)? I don't think so, but I hope I'm wrong...
xrmnx said:
That's what I thought. Since I couldn't find any (yet), is there a way to extract the QFIL files from a working phone (I bought another one since I needed a phone)? I don't think so, but I hope I'm wrong...
Click to expand...
Click to collapse
I'm in the same boat here, same phone and same issue. Did you find a way to fix it? already searched all internet for a fix. Thanks a lot
Sorry, but for some reason I never saw your answer... I never found a solution either, though
how to unlock bootloader
Use fast boot to unlock the bootloader again.
connect your Swift 2 to your PC and in a command prompt type the following "fastboot oem unlock"
When you press enter, check the phone and using the volume keys you need to select yes and then press power to execute.
Your bootloader should then be unlocked again. Good Luck.

[SOLVED] PLEASE HELP - HardBricked my OnePlus 5T

Dear Community,
I just searched the past 2 days for a solution but I've not been lucky
Therefore I'd like to ask for help in this forum and hope there is some additional hint or hack I could try...:
So here's the situation:
OnePlus 5T (8/128) with a non booting or not "useful" OS (see last point what I've tried)
No TWRP or CWM
Stock Recovery present
Bootloader Locked
Allow Bootloader to be unlocked = FALSE
What I've already tried yet:
Flashing TWRP --> Not possible Bootloader Locked
Flashing regarding any other kinds like "update" or "flash all" as provided with TOOL_ALL_IN_ONE
ADB Sideload any available ROMS (Original "full" OP5T / FreedomOS / Omni8) --> ADB stops at 47% in Stock Recovery regardless of size of the ZIP file
Tried different versions of ADB (32 & 64 Bit / older & new / also with the LargeAddressAware approach / and on multiple PC's) --> Always same error (47%)
Stumbled upon the possibility to EmergencyDownload a factory flash due to Qualcomm chipset using the MSM-Download-Tool --> Only OnePlus 5 ROM available (no "T")
Mentioned EDL procedure works and OS is booting BUT neither Touchscreen nor USB OTG (for external mouse support) is working --> So I can't navigate and allow Bootloader to be unlocked again
Unfortunately I'm now stuck and have no more idea how to unbrick my phone again
What would help:
Any source to MSM-Download-Tool packed with a correct ROM for the OnePlus 5T
A Workaround to just flash TWRP via MSM-Download-Tool or Qualcomm's QFIL application in EDL mode
Some "hack" to bypass the locked Bootloader situation
Every appreciated Input you might have that I'm currently not aware of...
So PLEASE let me know of any approach that I could try or if you might have found a link or something else to a solution that might help me out of this disaster...
Many thanks in advance!
Tryouts due to your feedback:
@dreinulldrei - "fastboot boot recovery.img" tried with the original 5T Recovery.img also with blu_spark TWRP --> no luck...
SOLVED SOLUTION:
As the EDL factory flash ROM is currently not (or will never officially be) available public getting in contact with the OnePlus support team is required.
They have such a recovery tool (MSM-Download-Tool) with an appropriate ROM and are able to flash the device during a remote support session conducted via chat.
So by starting a chat on the OnePlus Support page and describing your situation will lead to scheduled time slot where a Level-2 technician will do all required steps remotely.
(All files are password protected and the technician ensures they are deleted at the end of the session so I'm unfortunately not able to provide the sources for DIY purposes...)
Following. I would think there would be some way to flash some sort of signed image via fastboot...
U flashed a 5 os to it, using the msmtool try to extract those files from 5t os, I will do it when I get home and so u can try it, i can't guarantee anything though, would u like me to do that for u
Bradl79 said:
U flashed a 5 os to it, using the msmtool try to extract those files from 5t os, I will do it when I get home and so u can try it, i can't guarantee anything though, would u like me to do that for u
Click to expand...
Click to collapse
Thanks for your input - I'm really not aware of how to generate such *.ops ROM files as this is what the MSM Tool expects...
But if there is a way and you are able to extract and produce a MSM flashable file I would be very happy to try!
I would recommend trying to boot a OP5T recovery, you might have flashed some OP5 rom including OP5 recovery. Just go into fastboot (power on with volume up pressed down), then via cmd:
fastboot boot recovery.img
Since OP does not offer the recovery to be downloaded, it will need to be downloaded from a working device. Lacking the cable right where I am, but I am sure someone else can help out.
crakerjac said:
Following. I would think there would be some way to flash some sort of signed image via fastboot...
Click to expand...
Click to collapse
Thanks for the input - I forgot to mention I also tried the 2 original available OP5T "full" ZIP ROM's (think they should be signed...)
Will add this to the initial Post but I assume also no chance here...
dreinulldrei said:
I would recommend trying to boot a OP5T recovery, you might have flashed some OP5 rom including OP5 recovery. Just go into fastboot (power on with volume up pressed down), then via cmd:
fastboot boot recovery.img
Since OP does not offer the recovery to be downloaded, it will need to be downloaded from a working device. Lacking the cable right where I am, but I am sure someone else can help out.
Click to expand...
Click to collapse
Ohhh good point - I also think there is the "wrong" recovery (from 5) currently on my phone (because also there the touchscreen behaves unexpectedly...)
But unfortunately with your command I get the "Your device is corrupted. It can't be trusted and will not boot" message.
Tried this with the original 5T Recovery.img I managed to obtain and also with the blu_spark TWRP - no luck...
Edit: Ignore, misread previous post.
U may have to make a call to oneplus so they can restore for u
Submit a ticket to One Plus
You are going to have to submit a ticket, they will arrange a time to help you by unbricking the phone remotely.
I just had to do this myself this week, and it got done today.
I do have the 5t unbricking files but I cannot access the archive because it's password protected.
One important this you didn't mention is how this happened.
OnePlus may be able to help with this one, but all root guides explicitly include the phrase "at your own risk."
blackknightavalon said:
OnePlus may be able to help with this one, but all root guides explicitly include the phrase "at your own risk."
Click to expand...
Click to collapse
Bradl79 said:
U may have to make a call to oneplus so they can restore for u
Click to expand...
Click to collapse
WMerkens said:
You are going to have to submit a ticket, they will arrange a time to help you by unbricking the phone remotely.
I just had to do this myself this week, and it got done today.
I do have the 5t unbricking files but I cannot access the archive because it's password protected.
Click to expand...
Click to collapse
Thanks for all your advice - so I will arrange a support chat/ticket as soon as possible and inform about the result in this thread.
Didn't thought that OnePlus Support Team would even care about such bricks (no warranty / own risk / "playing" with root / etc...)
But as indeed they seem to help like @WMerkens experienced I would be very happy to have a working device again
CodeXter said:
Thanks for all your advice - so I will arrange a support chat/ticket as soon as possible and inform about the result in this thread.
Didn't thought that OnePlus Support Team would even care about such bricks (no warranty / own risk / "playing" with root / etc...)
But as indeed they seem to help like @WMerkens experienced I would be very happy to have a working device again
Click to expand...
Click to collapse
don't know why you would think that OP wouldn't help...they have said from day one that unlocking/rooting does not void your warranty. Heck they encourage it. I assume you are the same person on the OP forum w/ this problem. Hopefully after you get this resolved you will have learned to NEVER EVER RELOCK your phone unless you do the whole factory image qualcomm recovery tool bit. and experienced OP folks on this forum know any claims of a "hardbricked" OP phone is ALWAYS not true.
Yeah oneplus used to be good about and does a remote session to restore, this was back in the one plus one days though, but I think they still do it
---------- Post added at 03:25 AM ---------- Previous post was at 02:54 AM ----------
WMerkens said:
You are going to have to submit a ticket, they will arrange a time to help you by unbricking the phone remotely.
I just had to do this myself this week, and it got done today.
I do have the 5t unbricking files but I cannot access the archive because it's password protected.
Click to expand...
Click to collapse
Awwww I wish we could get them, do they use the msmtool too?
How I bricked a 5t
I got the phone and I had installed twrp, that went fine. I was looking at magick systemless rooter when the phone then kicked in with a OTA update, I chose to ignore it the first time. It occurred again a few minutes and in my haste I let it do it's job but it did not complete correctly. I rebooted and the phone complained about corruption to the OS, I got in again but made the dumb mistake of re enabling the OEM lock and because I thought that might be causing the problem. I rebooted again but now I could not boot any more into the OS, it complained I was corrupted and go to google to see what to do.
So I was left with a bricked phone.
I could do bootloader but not recovery and I could not unlock the bootloader.
I could not get in via adb usb debug, So after much research I download the OnePlus 5 unbricking pack and learned a whole lot about qualicom and EDL mode, plus I learned a lot about the QFIL tools and restoring a phone. I did the 5 unbrick but my screen ended up upside down but the touch was right side up, which resulted in a very hard to use phone.
I tried the QFIL method but I was missing a mdb file to be able to talk to the phone.
So I gave up submitted a ticket and after much bad co-ordination on their part got a level 2 tech to debrick the phone remotely.
They do a reverse VPN and connect to your computer, they tell you to have 2 files archive ready in a folder on your desktop (they supply the links). They install the EDL driver and unpack the debrick archive. The archives are password protected, they run the tool and restore the phone
back to factory.
They erase the unpacked archives after they are done.
jerrywmilton said:
don't know why you would think that OP wouldn't help...they have said from day one that unlocking/rooting does not void your warranty. Heck they encourage it. I assume you are the same person on the OP forum w/ this problem. Hopefully after you get this resolved you will have learned to NEVER EVER RELOCK your phone unless you do the whole factory image qualcomm recovery tool bit. and experienced OP folks on this forum know any claims of a "hardbricked" OP phone is ALWAYS not true.
Click to expand...
Click to collapse
Oh yes I've learned my lesson on this :angel: --> Never ever set OEM to be unlocked to NO again
Obviously I do not exactly know what wrong procedure made me stuck in this situation but I just wanted to revert every single step back one by one to see which element brings me back to a valid SafetyNet situation...
I've been with the OnePlus "family" since the OP1 but never needed any direct support from the vendor - so every time there's a first time and so for me now...
Thus I really didn't know OP staff is actively doing remote support for their devices - but thumbs up for that! :good:
(BTW: I'm not the guy from the OP forum)
Bradl79 said:
Yeah oneplus used to be good about and does a remote session to restore, this was back in the one plus one days though, but I think they still do it
---------- Post added at 03:25 AM ---------- Previous post was at 02:54 AM ----------
Awwww I wish we could get them, do they use the msmtool too?
Click to expand...
Click to collapse
Yes basically it's the same archive as the 5 unbrick pack but it's for 5t, OnePlus 5T OxygenOS 4.7.2-171116.zip is the archive and you can look in it and you see the ops file is for dumpling not cheesburger, which is the code name for 5t. I saw the MsmDownloadTool is 4.0.8
Bradl79 said:
Yeah oneplus used to be good about and does a remote session to restore, this was back in the one plus one days though, but I think they still do it
---------- Post added at 03:25 AM ---------- Previous post was at 02:54 AM ----------
Awwww I wish we could get them, do they use the msmtool too?
Click to expand...
Click to collapse
I just had a chat with them before and got mailed a link to the MSMTool incl. ROM for the OP5T (dumpling)
But unfortunatley support files from OnePlus are password protected Nevertheless here the original vendor link:
https://onepluscn-my.sharepoint.com/personal/sheva_liu_oneplus_net/_layouts/15/guestaccess.aspx?docid=0fde9596c72744b4fb9c073ca5d87edbe&authkey=AQPXKRi7pdIzZX-5WH_pwWg&e=1030aa0046da4d1aa9189020027d9c93
So I have to wait for my remote support schedule on Saturday to have the L2 technician entering the password and do the rest.
Would be able to do this myself but OnePlus obviously wants to protect their sources what I have to accept, respect and be patient for...
So, never turn off the OEM Unlocking?

Remove "Unlocked Bootloader warning" message at the start

Hi, i am new to rooting and modding and i want to get away the warning message on my oneplus5t that remember me everrytime i turn it on i have a unlocked bootloader.
Is there a way to do it? I want to change also the boot animation becouse is cool but with this message is horrible, i want to remove it before changing the boot animation.
Can someone help me to find a solution? I searched and i found is not removable yet i just wanted to make sure is 100% impossible to do it
I know, it's horrible but impossible to remove ...
asnachan said:
Hi, i am new to rooting and modding and i want to get away the warning message on my oneplus5t that remember me everrytime i turn it on i have a unlocked bootloader.
Is there a way to do it? I want to change also the boot animation becouse is cool but with this message is horrible, i want to remove it before changing the boot animation.
Can someone help me to find a solution? I searched and i found is not removable yet i just wanted to make sure is 100% impossible to do it
Click to expand...
Click to collapse
You should use the Questions & Answers section. This is for original development only
There is no way as the bootloader is locked down. There was some guy claiming to be able to do this but it was just a hoax or a developer not knowing enough on this topic.
For the bootanimation there should be a bootanimation.zip in /system/media. That needs to be replaced.
Thanks and sorry if i putted this topic here
I will have always this **** when i boot it up so, damn oneplus
Silvio Scarani said:
I know, it's horrible but impossible to remove ...
Click to expand...
Click to collapse
un altro italiano
Macusercom said:
You should use the Questions & Answers section. This is for original development only
There is no way as the bootloader is locked down. There was some guy claiming to be able to do this but it was just a hoax or a developer not knowing enough on this topic.
For the bootanimation there should be a bootanimation.zip in /system/media. That needs to be replaced.
Click to expand...
Click to collapse
What are you talking about, at the top of the site it says;
xda-developers > OnePlus 5T > OnePlus 5T Questions & Answers.
I just got the OnePlus 5T, my understanding is it's the same on this phone as some others, the boot loader message is low level, more like in the boot image, and the bootanimation.zip is just the splash images.
DoR3M3 said:
What are you talking about, at the top of the site it says;
xda-developers > OnePlus 5T > OnePlus 5T Questions & Answers.
I just got the OnePlus 5T, my understanding is it's the same on this phone as some others, the boot loader message is low level, more like in the boot image, and the bootanimation.zip is just the splash images.
Click to expand...
Click to collapse
It was moved to this section by a mod.
Macusercom said:
It was moved to this section by a mod.
Click to expand...
Click to collapse
Ahh my bad...
You have to sign boot.img and recovery.img to remove the warning.
I have managed to eliminate it by signing those two images.
In my oneplus 5 and 5t I have twrp installed and with rom lineageos without warning.
Who wants to try to send me your boot and recovery and return it for you to try.
Remember that you have to close the bootloader whereby the phone will be wipe
Process:
fastboot oem unlock
unlock bootloader
You have to go back to fastboot mode
fastboot flash boot boot.img
fastboot recovery recovery_name.img
fastboot oem lock
Wuala
It can be done in any rom from firmware 5.1.5
superatmel said:
You have to sign boot.img and recovery.img to remove the warning.
I have managed to eliminate it by signing those two images.
In my oneplus 5 and 5t I have twrp installed and with rom lineageos without warning.
Who wants to try to send me your boot and recovery and return it for you to try.
Remember that you have to close the bootloader whereby the phone will be wipe
Process:
fastboot oem unlock
unlock bootloader
You have to go back to fastboot mode
fastboot flash boot boot.img
fastboot recovery recovery_name.img
fastboot oem lock
Wuala
It can be done in any rom from firmware 5.1.5
Click to expand...
Click to collapse
Although the above procedure may work, I wouldn't suggest locking the bootloader after making changes like this.
xocomaox said:
Although the above procedure may work, I wouldn't suggest locking the bootloader after making changes like this.
Click to expand...
Click to collapse
Because no, you avoid the annoying message, you enjoy your own kernel and the recovery you want, do you mean that you are going to send some malicious files?
I've been with Android for many years to get my reputation for it. : =
---------- Post added at 09:13 PM ---------- Previous post was at 09:12 PM ----------
[ro.boot.verifiedbootstate]: [green]
[ro.boot.veritymode]: [enforcing]
[ro.bootimage.build.date]: [Fri Sep 28 02:08:12 CEST 2018]
[ro.bootimage.build.date.utc]: [1538093292]
[ro.bootimage.build.fingerprint]: [OnePlus/OnePlus5T/OnePlus5T:8.1.0/OPM1.171019.011/1808081927:user/release-keys]
[ro.bootloader]: [unknown]
[ro.bootmode]: [normal]
[ro.build.date.utc]: [1538093292]
[ro.build.description]: [OnePlus5T-user 8.1.0 OPM1.171019.011 1808081927 release-keys]
[ro.build.display.id]: [superteam_dumpling-userdebug 8.1.0 OPM6.171019.030.K1 b8192e9518 test-keys]
[ro.build.expect.firmware]: [5.1.5]
[ro.build.expect.modem]: [2018-08-08 20:13:31]
[ro.build.fingerprint]: [OnePlus/OnePlus5T/OnePlus5T:8.1.0/OPM1.171019.011/1808081927:user/release-keys]
[ro.build.flavor]: [superteam_dumpling-userdebug]
[ro.build.host]: [Asus-Rog]
[ro.build.id]: [OPM6.171019.030.K1]
[ro.build.product]: [OnePlus5T]
[ro.build.selinux]: [0]
[ro.build.selinux.enforce]: [0]
[ro.build.tags]: [test-keys]
[ro.build.type]: [userdebug]
[ro.build.user]: [superatmel]
[ro.build.version.all_codenames]: [REL]
[ro.build.version.base_os]: []
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [b8192e9518]
[ro.build.version.preview_sdk]: [0]
[ro.build.version.release]: [8.1.0]
[ro.build.version.sdk]: [27]
[ro.build.version.security_patch]: [2018-09-05]
---------- Post added at 09:27 PM ---------- Previous post was at 09:13 PM ----------
In this post it is asked how to eliminate the warning in the boot, I have offered to help to remove it nothing more, since in my terminals it eliminates it.
No words are needed
https://www.youtube.com/watch?v=Bzfd-dKgpes&feature=youtu.be
superatmel said:
No words are needed
https://www.youtube.com/watch?v=Bzfd-dKgpes&feature=youtu.be
Click to expand...
Click to collapse
You're locking the bootloader...
3:58 in Video; fastboot oem lock.
Not exactly the solution people are looking for.
DoR3M3 said:
You're locking the bootloader...
3:58 in Video; fastboot oem lock.
Not exactly the solution people are looking for.
Click to expand...
Click to collapse
Of course, that's the idea of ​​locking the bootloader again to avoid the message.
Try locking it with a boot.img or recovery that is not signed to see what happens
my getprop
[ro.boot.verifiedbootstate]: [green]
bootloader locked+boot signed NO WARNING MESSAGE
[ro.boot.verifiedbootstate]: [orange]
bootloader unlocked+boot unsigned WARNING MESSAGE
[ro.boot.verifiedbootstate]: [red]
bootloader locked+boot unsigned SYSTEM CORRUPT, NOT BOOT
So you need to have the bootloader unlocked if you have already put any rom, any boot or any recovery on your phone?
The bootloader can not be edited but to avoid the warning message if boots and recoverys can be signed
superatmel said:
No words are needed
https://www.youtube.com/watch?v=Bzfd-dKgpes&feature=youtu.be
Click to expand...
Click to collapse
superatmel said:
Of course, that's the idea of ​​locking the bootloader again to avoid the message.
Try locking it with a boot.img or recovery that is not signed to see what happens
my getprop
[ro.boot.verifiedbootstate]: [green]
bootloader locked+boot signed NO WARNING MESSAGE
[ro.boot.verifiedbootstate]: [orange]
bootloader unlocked+boot unsigned WARNING MESSAGE
[ro.boot.verifiedbootstate]: [red]
bootloader locked+boot unsigned SYSTEM CORRUPT, NOT BOOT
So you need to have the bootloader unlocked if you have already put any rom, any boot or any recovery on your phone?
The bootloader can not be edited but to avoid the warning message if boots and recoverys can be signed
Click to expand...
Click to collapse
I understand these things, but are you asking, or telling?
People want to keep the bootloader unlocked to hack on their phones, and locking it defeats this purpose.
The post is about trying to keep the bootloader unlocked and remove the message, but as I mentioned before, it's my understanding it's deep within the bootloader process, not an easy thing to get at, hack away. Also it seems, because of some Google Policy it's pushing on the phone manufacturers to have, as a requirement to their agreement with Google, at least it's what I've come to understand.
DoR3M3 said:
I understand these things, but are you asking, or telling?
People want to keep the bootloader unlocked to hack on their phones, and locking it defeats this purpose.
The post is about trying to keep the bootloader unlocked and remove the message, but as I mentioned before, it's my understanding it's deep within the bootloader process, not an easy thing to get at, hack away. Also it seems, because of some Google Policy it's pushing on the phone manufacturers to have, as a requirement to their agreement with Google, at least it's what I've come to understand.
Click to expand...
Click to collapse
I am saying.
But people do not need to have the bootloader unlocked to hack their phones. In fact I do not want to be hacked, but I do want to modify my boots to add things to the system. and also get not having the message at the start of the system
An example that for example I want
I would like to have the kernel blur but if I put it I have the warning message.
Solution:
I sign the blur kernel, I install it I close the bootloader and I have the kernel working and I do not have a warning message
Does not it help you to autopirate your phone?
---------- Post added at 01:32 AM ---------- Previous post was at 01:28 AM ----------
I could now have oxygen os 5.1.5 or higher with modified kernel, recovery twrp, add xposed modules and closed bootloader.
It's not useful?
superatmel said:
I am saying.
But people do not need to have the bootloader unlocked to hack their phones. In fact I do not want to be hacked, but I do want to modify my boots to add things to the system. and also get not having the message at the start of the system
An example that for example I want
I would like to have the kernel blur but if I put it I have the warning message.
Solution:
I sign the blur kernel, I install it I close the bootloader and I have the kernel working and I do not have a warning message
Does not it help you to autopirate your phone?
---------- Post added at 01:32 AM ---------- Previous post was at 01:28 AM ----------
I could now have oxygen os 5.1.5 or higher with modified kernel, recovery twrp, add xposed modules and closed bootloader.
It's not useful?
Click to expand...
Click to collapse
Well, it's always been my understanding, that if someone is always tinkering, playing with their phone, constantly flashing roms, kernels, etc., then keeping the bootloader unlocked is simpler.
I personally just got the OnePlus 5T, so I don't know if it's doing something different here over other devices, where you can simply lock it on a custom rom and have it boot ok.
It's suppose to be from my understanding that some devices you can lock it, and everything works ok, and other devices, where if you lock it, it wipes all data and encrypts it over, then the rom boots up all wiped, and I'm talking Internal Storage all gone, everything wiped, not a situation good. Locking bootloader on some devices means, loose all data.
So the safest route amongst all devices is to simply leave it unclocked, and getting hacked by someone with an unlocked bootloader, isn't very likely to happen.
DoR3M3 said:
Well, it's always been my understanding, that if someone is always tinkering, playing with their phone, constantly flashing roms, kernels, etc., then keeping the bootloader unlocked is simpler.
I personally just got the OnePlus 5T, so I don't know if it's doing something different here over other devices, where you can simply lock it on a custom rom and have it boot ok.
It's suppose to be from my understanding that some devices you can lock it, and everything works ok, and other devices, where if you lock it, it wipes all data and encrypts it over, then the rom boots up all wiped, and I'm talking Internal Storage all gone, everything wiped, not a situation good. Locking bootloader on some devices means, loose all data.
So the safest route amongst all devices is to simply leave it unclocked, and getting hacked by someone with an unlocked bootloader, isn't very likely to happen.
Click to expand...
Click to collapse
Sorry but I think you do not understand.
Your unlocked bootloader phone is vulnerable since it is ready for any option.
Mine to have it closed my data is safe because if someone opens it is completely deleted.
My phone with a oneplus recovery stock signed by me and a custom boot plus system modifications and closed bootloader is completely safe.
superatmel said:
Sorry but I think you do not understand.
Your unlocked bootloader phone is vulnerable since it is ready for any option.
Mine to have it closed my data is safe because if someone opens it is completely deleted.
My phone with a oneplus recovery stock signed by me and a custom boot plus system modifications and closed bootloader is completely safe.
Click to expand...
Click to collapse
Sorry for any misunderstanding, I understand about the bootloader.
My mistake, I wasn't paying attention that you signed your own image. Did you sign both the recovery and boot?
Now you signed the images, but you locked the bootloader and it's my understanding that if signed, you could get rid of the message and still leave it unlocked. So with your signed images, can you leave it unlocked and the message is gone?
DoR3M3 said:
Sorry for any misunderstanding, I understand about the bootloader.
My mistake, I wasn't paying attention that you signed your own image. Did you sign both the recovery and boot?
Now you signed the images, but you locked the bootloader and it's my understanding that if signed, you could get rid of the message and still leave it unlocked. So with your signed images, can you leave it unlocked and the message is gone?
Click to expand...
Click to collapse
Exactly, now you understand it. I sign boot.img and recovery.img and with that I can close the bootloader and the message disappears. That's what you see in the video.
Install twrp signed by me, lineageos latest version, extract by boot.img and sign it, so at the end of the whole I integrate the boot.img and then I close the bootloader
I have put lineageos to put something, but I create my own systems

Moto G7 Play bootloader unlock issues - "bad key", not OTA, no way to roll back?

Moto G7 Play bootloader unlock issues - "bad key", not OTA, no way to roll back?
My plan was to unlock the bootloader before configuring the new phone - just in case I might need it later, then use the phone as out-of-box. I unlocked the bootloader for the new Moto G7 Play, following the official procedure via the Motorola Accounts page, resulting in:
- Fastboot page shows: "flashing unlocked"
- When booting up, I see a black page with the words "bad key", then the phone boots
- The updater sais that the phone is corrupt and no (OTA) updates can be done
- I could not try TWRP, as there is no TWRP for the G7 Play yet (so not sure if flashing would work)
My concerns now are that I will not be able to update the phone, and that the "bad key" issue might cause other problems.
So my plan would be to roll back and lock the phone again, to use it as out-of-box (not worrying about warranty loss that might already have happened - I did accept these terms). However, that does not work, too:
- Locking bootloader requires factory images, which are not available for the G7 Play
- Locking bootloader with fastboot OEM lock will not work without complete images
Any suggestions how bring the phone back to normal? I am disappointed by Motorola, as they officially offer the unlock procedure - which then does not produce the expected outcome, breaks updating, and provides no way to go back? Mind you, I did not apply any "hacks", nothing but the official Motorola unlocking steps.
Thanks for advice
I have the same problem and i cannot fix it.
I tried to get advice from Motorola support - but replies are very generic, referring to the bootloader unlock page (we obviously found that) or to the Motorola Forum (where the answer isn't). Will now just live with the unlocked phone and hope for the opportunity to OTA / update in a while
CoffeeMachineSwitch said:
- When booting up, I see a black page with the words "bad key", then the phone boots
- The updater sais that the phone is corrupt and no (OTA) updates can be done
Click to expand...
Click to collapse
Unlocking any Motorola bootloader will cause the bootscreen to display "Bad Key". This is normal. It is a warning that the bootloader has been unlocked and the phone may not be "safe". Once you root a Motorola phone, it will display "N/A" instead of "Bad Key". Again, this is normal behavior. There are image makers that can replace the "splash" image and "hide" the "N/A", but since this phone doesn't have TWRP yet, you'll have to live with it for now.
As far as not being able to receive OTA updates, I have no knowledge. In my opinion it shouldn't matter that the bootloader has been unlocked...only if you've modified or deleted system files. I've never worried about system updates as I've always rooted and run custom ROMs, or Xposed (which negates eligibility for OTA).
mn1968 said:
Unlocking any
As far as not being able to receive OTA updates, I have no knowledge. In my opinion it shouldn't matter that the bootloader has been unlocked...only if you've modified or deleted system files. I've never worried about system updates as I've always rooted and run custom ROMs, or Xposed (which negates eligibility for OTA).
Click to expand...
Click to collapse
Thanks for clarifying. And yes, learnt from Moto Support that OTA was disabled for 7 generation
CoffeeMachineSwitch said:
Thanks for clarifying. And yes, learnt from Moto Support that OTA was disabled for 7 generation
Click to expand...
Click to collapse
That would be an unfortunate change if true. Prior devices could be unlocked and still get OTA updates. They won't install if certain changes are made but still get notified of updates.
You still can install full ROM using fastboot commands and regain root by patching boot.img from updated ROM
I did it on both G6 and G7
Where did you get the ROM images from. I understand there are no officials?
CoffeeMachineSwitch said:
Where did you get the ROM images from. I understand there are no officials?
Click to expand...
Click to collapse
Have you tried the LMSA tool? It's a tool you download from Motorola. There is a discussion here about it. It has a rescue button with which, I understand that you can download stock images directly from Motorola, but I haven't used it myself.
umbrisle said:
Have you tried the LMSA tool? ....
Click to expand...
Click to collapse
Yes I have - the last time I tried, however, it said that it would not support the G7 (Play) and did not provide any images/ROMs
CoffeeMachineSwitch said:
Yes I have - the last time I tried, however, it said that it would not support the G7 (Play) and did not provide any images/ROMs
Click to expand...
Click to collapse
I was thinking of buying a G7 Play myself, but I am now leaning more towards a G6 Play, because there are more tools available like a working TWRP.
Should've read the thread here before i go buy g7 play, not my phone get softbricked.
Unblocked bootloader successfully following the official doc but failed to install magisk by copying the wrong build number of boot.img of OTA from here mirrors.lolinet.com/firmware/moto
now my g7 says
Code:
failed to load kernel, no Bootable A/B slot,
Failed to book Linux
falling back to fastboot.
I downloaded `RIVER_RETAIL_9.0_PPO29.80-61_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC` which i think this is the right build number when i see error like
Code:
river/retail corrupted
(can't remember exactly, but it's RETAIL not RETUS)
and make my own version of fastboot command stemming from servicefile.xml, still with unlucky.
there is no recovery.img and google has limited resource to make g7 play back to stock orm, i'd like to see if community has any idea or i have to give it to moto to fix it.
========================update=================================
update: i finally get the correct stock ORM which is exactly matching my build number "XT1952-4_CHANNEL_AMZ_9.0_PPY29.105-36_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC" i was an idiot thinking that mismatch one letter or two will be find, but turns out this is very strict, "second time rooting in my life".
not i has flash all of the original orm into my phone then fastboot reboot works, it give me the original error like
Android Recovery
motorola/channel_retail/channel9/PPY29.105-36/d7abeuser/release-keys
Use volum up/down and power
can't load Android system. Your data may be corrupt.
If you continue to get this message, you may need to perform a factory data
reset and erase all user data stored on this device
=====
Try again
Factory data reset
Click to expand...
Click to collapse
now i need to figure out what to do next
===============update=========
lol, turns out just press Factory data reset will bring the brick back to life!!!!!
just want to post my process for anyone having my issue.
the key point to find the correct build number
umbrisle said:
I was thinking of buying a G7 Play myself, but I am now leaning more towards a G6 Play, because there are more tools available like a working TWRP.
Click to expand...
Click to collapse
.
The G6 Play is really slow, at least the Boost one. I was kind of sorry I bought one to put on Sprint's free unlimited plan. At least Sprint unlocked it for me after 60 days.
Give the G7Play some time, it just came out.
As for you guys complaining of no updates once unlocked, it's not the only phone to require flashing the stock boot.img and relocking to get OTAs.
gedster314 said:
.
As for you guys complaining of no updates once unlocked, it's not the only phone to require flashing the stock boot.img and relocking to get OTAs.
Click to expand...
Click to collapse
Yeah, but there is inconsistency in Motorolas communication, they actively offer the option to unlock the bootloader (with T&C and all) incl. a link to a rollback feature. Which then does not work. So in a scenario where a developer buys the device because it actively offers this features, they dont get what they paid for. Mind you, we are not discussing hacking a device here or jailbraking - we are discussing features that Motorola actively promotes with a dedicated webpage.
wallace_mu said:
was an idiot thinking that mismatch one letter or two will be find, but turns out this is very strict
Click to expand...
Click to collapse
You completely missed the wrong code name "river" in RIVER_RETAIL_9.0_PPO29.80-61_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC it is for another device, while "channel" is the right one
Where did you get the correct Rom from? Thanks
I don't own Moto G7 Play and can not confirm, however this one worked for wallace_mu
wallace_mu said:
XT1952-4_CHANNEL_AMZ_9.0_PPY29.105-36_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC
Click to expand...
Click to collapse
I could successfully lock / unlock / lock the bootloader...
Unlock: fastboot oem unlock [CODE FROM MOTOROLA]
Lock it down:
* first I have to reflash the 'boot.img' from the correct firmware file - fastboot flash boot boot.img
* then I can lock the bootloader clean again with 'fastboot oem lock'. "bad key" is gone, SafetyNet test passed and OTA is working again.
Unlocking / locking again works by the way also. Maybe this will help?
realsine said:
I could successfully lock / unlock / lock the bootloader...
Unlock: fastboot oem unlock [CODE FROM MOTOROLA]
Lock it down:
* first I have to reflash the 'boot.img' from the correct firmware file - fastboot flash boot boot.img
* then I can lock the bootloader clean again with 'fastboot oem lock'. "bad key" is gone, SafetyNet test passed and OTA is working again.
Unlocking / locking again works by the way also. Maybe this will help?
Click to expand...
Click to collapse
yes it does! was waiting for this. 2 quick questions:
- will lock/unlock require factory reset / data loss?
- where to get the (official?) boot.img from (am always careful to flash img from the wild)
thanks!
CoffeeMachineSwitch said:
yes it does! was waiting for this. 2 quick questions:
- will lock/unlock require factory reset / data loss?
- where to get the (official?) boot.img from (am always careful to flash img from the wild)
thanks!
Click to expand...
Click to collapse
Hello,
I'm glad to read that I could help.
I have "my" image of 'https :// mirrors.lolinet.com/firmware/moto/channel/official/RETEU/'. There are also some others - just have a look. And please remove the spaces around '://'. I'm currently not allowed to post (external) links, so this way.
* Every 'LOCK' deletes all data and the system is "clean" again.
* The same applies (unfortunately) to EVERY 'UNLOCK'.
I don't care at the moment because I haven't set up my smartphone yet. But it's not nice.
Best regards

Categories

Resources