Okay, I've seen similar problems to mine but none of the suggested solutions seem to work out the problem. This seems to be the recommended solution, but it's not getting me anywhere:
https://forum.xda-developers.com/pixel-xl/how-to/info-how-restored-to-stock-soft-t3494478
My bootloader is unlocked. I unlocked it the second I got the phone to save pain down the road. I've now hit the fork. It's an unlocked phone, not Verizon, I'm not sure what the original carrier was, it was second-hand and under no warranty. I'm on Android 10 Marlin, I updated it to the latest about a month ago. I got up to do some laundry last night and came back to a spontaneously dead phone. For detail, I was transferring a movie to my phone via USB to internal storage so I could watch it later. No idea what happened while I was up, but the phone was in the exact same position as when I left. Developer options were on, USB debugging was on.
What I have now is this: It will enter fastboot. When I prompt it to boot to recovery, it shuts down, or it will go to the unlocked bootloader warning screen, allow me to pause/continue booting, at which point it will either go directly to black, or briefly show the Google bootloader and then shut off. When I leave it on a charge, either trickle or full, it will sometimes loop through the unlocked bootloader warning, flicking that screen on and off, but sometimes it's just off. I never see the charging battery screen. I've left it to charge for hours.
Sometimes windows acknowledges a USB device is connected and that it's android, but at no point can I access storage. When working through a command line prompt, acknowledges that the device is there, but trying to flash anything fails immediately. Here is a sample of some of my results.
When trying the flash-all solution:
PHP:
Sending 'bootloader_b' (32480 KB) OKAY [ 1.779s]
Writing 'bootloader_b' FAILED (remote: 'Verify bootloader image failed on production device.')
fastboot: error: Command failed
Rebooting into bootloader OKAY [ 0.040s]
Finished. Total time: 0.044s
The device goes black. I'll bring it back up to fastboot and the command line spits this out:
PHP:
< waiting for any device >
Sending 'radio_b' (57156 KB) OKAY [ 3.785s]
Writing 'radio_b' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
Rebooting into bootloader OKAY [ 0.199s]
Finished. Total time: 0.207s
Using fastboot to try and boot factory bootloader, it says it's worked but then the phone again just goes to black and does nothing:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot boot bootloader-marlin-8996-012001-1908071822.img
< waiting for any device >
creating boot image...
creating boot image - 33261568 bytes
Sending 'boot.img' (32482 KB) OKAY [ 2.100s]
Booting OKAY [ 0.531s]
Finished. Total time: 2.944s
Flashing that factory bootloader, seems successful, again, back to black screen and nothing until going back to fastboot:
PHP:
>> PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot boot bootloader-marlin-8996-012001-1908071822.img
>> < waiting for any device >
>> creating boot image...
>> creating boot image - 33261568 bytes
>> Sending 'boot.img' (32482 KB) OKAY [ 2.100s]
>> Booting OKAY [ 0.531s]
>> Finished. Total time: 2.944s
And finally, trying to push an update image over fastboot:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot update image-marlin-qp1a.191005.007.a3.zip
--------------------------------------------
Bootloader Version...: N/A
Baseband Version.....: N/A
Serial Number........: HT6AD0202367
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product' OKAY [ 0.044s]
Checking 'version-bootloader' FAILED
Device version-bootloader is 'N/A'.
Update requires '8996-012001-1908071822'.
fastboot: error: requirements not met!
I am wondering if locking the bootloader would give this thing what it wants and let me boot into recovery, but I have a terrible feeling it would just further lock me out of saving this phone. Does anyone have any insight? Is this a shot motherboard? Sorry, I know my problem has a ton of commonalities with a lot of other people's but it seems for all my searching, reading and Googling that it's idiosyncratic to the point of every solution not working for me. Thank you so much.
Edit: For interest, I just saw the screen throw up an odd block of static, for lack of a better term. In the bottom right corner, it took up a little more than 1/4 of the screen. It looked lik there was cut off text at the top, too little showing to read. It disappeared before I could take a picture with a spare phone. It lasted maybe 5 seconds and then it was gone. It's on USB charge, not sitting on fastboot right now.
ekjean said:
Okay, I've seen similar problems to mine but none of the suggested solutions seem to work out the problem. This seems to be the recommended solution, but it's not getting me anywhere:
https://forum.xda-developers.com/pixel-xl/how-to/info-how-restored-to-stock-soft-t3494478
My bootloader is unlocked. I unlocked it the second I got the phone to save pain down the road. I've now hit the fork. It's an unlocked phone, not Verizon, I'm not sure what the original carrier was, it was second-hand and under no warranty. I'm on Android 10 Marlin, I updated it to the latest about a month ago. I got up to do some laundry last night and came back to a spontaneously dead phone. For detail, I was transferring a movie to my phone via USB to internal storage so I could watch it later. No idea what happened while I was up, but the phone was in the exact same position as when I left. Developer options were on, USB debugging was on.
What I have now is this: It will enter fastboot. When I prompt it to boot to recovery, it shuts down, or it will go to the unlocked bootloader warning screen, allow me to pause/continue booting, at which point it will either go directly to black, or briefly show the Google bootloader and then shut off. When I leave it on a charge, either trickle or full, it will sometimes loop through the unlocked bootloader warning, flicking that screen on and off, but sometimes it's just off. I never see the charging battery screen. I've left it to charge for hours.
Sometimes windows acknowledges a USB device is connected and that it's android, but at no point can I access storage. When working through a command line prompt, acknowledges that the device is there, but trying to flash anything fails immediately. Here is a sample of some of my results.
When trying the flash-all solution:
PHP:
Sending 'bootloader_b' (32480 KB) OKAY [ 1.779s]
Writing 'bootloader_b' FAILED (remote: 'Verify bootloader image failed on production device.')
fastboot: error: Command failed
Rebooting into bootloader OKAY [ 0.040s]
Finished. Total time: 0.044s
The device goes black. I'll bring it back up to fastboot and the command line spits this out:
PHP:
< waiting for any device >
Sending 'radio_b' (57156 KB) OKAY [ 3.785s]
Writing 'radio_b' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
Rebooting into bootloader OKAY [ 0.199s]
Finished. Total time: 0.207s
Using fastboot to try and boot factory bootloader, it says it's worked but then the phone again just goes to black and does nothing:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot boot bootloader-marlin-8996-012001-1908071822.img
< waiting for any device >
creating boot image...
creating boot image - 33261568 bytes
Sending 'boot.img' (32482 KB) OKAY [ 2.100s]
Booting OKAY [ 0.531s]
Finished. Total time: 2.944s
Flashing that factory bootloader, seems successful, again, back to black screen and nothing until going back to fastboot:
PHP:
>> PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot boot bootloader-marlin-8996-012001-1908071822.img
>> < waiting for any device >
>> creating boot image...
>> creating boot image - 33261568 bytes
>> Sending 'boot.img' (32482 KB) OKAY [ 2.100s]
>> Booting OKAY [ 0.531s]
>> Finished. Total time: 2.944s
And finally, trying to push an update image over fastboot:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot update image-marlin-qp1a.191005.007.a3.zip
--------------------------------------------
Bootloader Version...: N/A
Baseband Version.....: N/A
Serial Number........: HT6AD0202367
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product' OKAY [ 0.044s]
Checking 'version-bootloader' FAILED
Device version-bootloader is 'N/A'.
Update requires '8996-012001-1908071822'.
fastboot: error: requirements not met!
I am wondering if locking the bootloader would give this thing what it wants and let me boot into recovery, but I have a terrible feeling it would just further lock me out of saving this phone. Does anyone have any insight? Is this a shot motherboard? Sorry, I know my problem has a ton of commonalities with a lot of other people's but it seems for all my searching, reading and Googling that it's idiosyncratic to the point of every solution not working for me. Thank you so much.
Edit: For interest, I just saw the screen throw up an odd block of static, for lack of a better term. In the bottom right corner, it took up a little more than 1/4 of the screen. It looked lik there was cut off text at the top, too little showing to read. It disappeared before I could take a picture with a spare phone. It lasted maybe 5 seconds and then it was gone. It's on USB charge, not sitting on fastboot right now.
Click to expand...
Click to collapse
First, do not repeat do not lock your boot loader.
Second, try this:
- Make sure you have the latest SDK Platform-tools installed on your computer r29.0.5.
There is a link for it in the guide below (Prerequisites c.).
- Make sure you plug the USB into a non charging USB port.
- Extract the boot.img (#6 in the guide brlow) from the Factory image you are currently using and flash it:
fastboot flash boot --slot all boot.img
or
fastboot flash boot boot.img --slot all
Guide
Homeboy76 said:
First, do not repeat do not lock your boot loader.
Second, try this:
- Make sure you have the latest SDK Platform-tools installed on your computer r29.0.5.
There is a link for it in the guide below (Prerequisites c.).
- Make sure you plug the USB into a non charging USB port.
- Extract the boot.img (#6 in the guide brlow) from the Factory image you are currently using and flash it:
fastboot flash boot --slot all boot.img
or
fastboot flash boot boot.img --slot all
Guide
Click to expand...
Click to collapse
Thank you thank you thank you for lending a hand. And for confirming that my temptation to lock the bootloader is a bad idea.
I have three ports on my laptop, I'm not sure any are non-charging. I'm selecting one that it wasn't attached to when the file transfer apparently went wrong.
Here goes nothing. I updated SDK tools last night during all this to be sure everything was kosher.
Unfortunately this was my result from all USB ports, testing both formats of the command:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.846s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.873s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 0.936s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 0.864s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.827s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.821s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) FAILED (Write to device failed in SendBuffer() (Too many links))
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.939s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3>
ekjean said:
Thank you thank you thank you for lending a hand. And for confirming that my temptation to lock the bootloader is a bad idea.
I have three ports on my laptop, I'm not sure any are non-charging. I'm selecting one that it wasn't attached to when the file transfer apparently went wrong.
Here goes nothing. I updated SDK tools last night during all this to be sure everything was kosher.
Unfortunately this was my result from all USB ports, testing both formats of the command:
PHP:
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.846s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.873s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 0.936s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 0.864s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.827s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.821s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) FAILED (Write to device failed in SendBuffer() (Too many links))
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.939s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3>
Click to expand...
Click to collapse
Are you using SDK Platform-tools r29.0.5?
Why? When you extract it it creates a Platform-tools folder.
Put this folder in PS C:\ so you have a
PS C:\Platform-tools folder.
Not: PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3>
That folder set up may be causing the to many links
error.
Then put the boot.img in the Platform-tools folder and do #6 in the guide.
Homeboy76 said:
Are you using SDK Platform-tools r29.0.5?
Why? When you extract it it creates a Platform-tools folder.
Put this folder in PS C:\ so you have a
PS C:\Platform-tools folder.
Not: PS C:\Google\marlin-qp1a.191005.007.a3-factory-bef66533\marlin-qp1a.191005.007.a3>
That folder set up may be causing the to many links
error.
Then put the boot.img in the Platform-tools folder and do #6 in the guide.
Click to expand...
Click to collapse
I was still working from the soft-bricked guide, where I had a copy of fastboot/platform tools pasted to everthing else. Not a problem at all to move Platform tools to C:/ Thank you!
I have noticed that what I have is r29.0.6. Should I roll it back? Assuming I should have the newest, I get the same result...
PHP:
PS C:\platform-tools> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 1.729s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\platform-tools> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.788s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\platform-tools>
ekjean said:
I was still working from the soft-bricked guide, where I had a copy of fastboot/platform tools pasted to everthing else. Not a problem at all to move Platform tools to C:/ Thank you!
I have noticed that what I have is r29.0.6. Should I roll it back? Assuming I should have the newest, I get the same result...
PHP:
PS C:\platform-tools> fastboot flash boot --slot all boot.img
Sending 'boot_a' (30969 KB) OKAY [ 1.729s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\platform-tools> fastboot flash boot boot.img --slot all
Sending 'boot_a' (30969 KB) OKAY [ 0.788s]
Writing 'boot_a' FAILED (remote: 'flash write failure')
fastboot: error: Command failed
PS C:\platform-tools>
Click to expand...
Click to collapse
No, do not roll back you have the latest version.
At this point I really don't know what will fix the problem but here are three long shots that might help/work:
1. Try fastboot flash boot boot.img. If that works. Do fastboot flash boot boot.img --slot other.
2. Download the latest Pixel or Pixel XL OTA image (which ever phone you have) and sideload it.
3. Do a Factory Reset. Settings => System => Advanced => Reset options => Erase all data (factory reset)
Good luck.
If none of them work, it could be a hardwear problem. Pixel/Pixel XL are failing because of age or manufacturing. I don't know which.
Homeboy76 said:
No, do not roll back you have the latest version.
At this point I really don't know what will fix the problem but hear are three long shots that might help/work:
1. Try fastboot flash boot boot.img. If that works. Do fastboot flash boot boot.img --slot other.
2. Download the latest Pixel or Pixel XL OTA image (which ever phone you have) and sideload it.
3. Do a Factory Reset. Settings => System => Advanced => Reset options => Erase all data (factory reset)
Good luck.
If none of them work, it could be a hardwear problem. Pixel/Pixel XL are failing because of age or manufacturing. I don't know which.
Click to expand...
Click to collapse
Sadly, anything that requires ADB/recovery is cut off to me, and so is anything that requires the actual OS interface, so accessing settings and factory resetting is out, and so is sideloading. All I can work from is fastboot.
The final option you had gave me another write failure. Thank you for working with me on this - this is my favorite phone I've ever had, and it may be time to eulogize it. I appreciate all you ran me through. <3
ekjean said:
Sadly, anything that requires ADB/recovery is cut off to me, and so is anything that requires the actual OS interface, so accessing settings and factory resetting is out, and so is sideloading. All I can work from is fastboot.
The final option you had gave me another write failure. Thank you for working with me on this - this is my favorite phone I've ever had, and it may be time to eulogize it. I appreciate all you ran me through. <3
Click to expand...
Click to collapse
RIP Pixel/Pixel XL!
hey bruh, try to cooling it in the freezer, my pixel xl turned on that way, give it a shot
@mateodiaz802 said:
hey bruh, try to cooling it in the freezer, my pixel xl turned on that way, give it a shot
Click to expand...
Click to collapse
Maybe I will! Did it stay on?
it will stay on the enough time to recover your data
@mateodiaz802 said:
hey bruh, try to cooling it in the freezer, my pixel xl turned on that way, give it a shot
Click to expand...
Click to collapse
I'm afraid in my case this was the death blow. Let out a few buzzes when attempting to power into fastboot, flashed a red light at the top and then nothing. She was euthanized by freezer around 5PM, 3/2/20, went quietly into that good night surrounded by friends and family at home. RIP Pixel.
did you cover the phone holes like the charging port and aux jack? I forgot to mention because I thought it was obvious
@mateodiaz802 said:
did you cover the phone holes like the charging port and aux jack? I forgot to mention because I thought it was obvious
Click to expand...
Click to collapse
I wrapped 'er in plastic wrap before putting it in. So it would've been covered. Oh well, stuff happens. Funny thing, I tried it again just to see. It started vibrating and hasn't stopped. XD
i covered the holes with tape, it's more effective, also you should try booting it with "start" optino from the bootloader
Hello I have a hardbrick that so far I cannot solve, because I want to close the bootloader, the fastboot rejects any command that I enter (including the "fastboot oem unlock") and when turning on motorola it generates the error 0xC2224571 "No valid operating system could be found. The device will not boot ". I thought about doing a "Blankflash", but I don't know what the Motorola "test point" is. Does anyone know how to do it and get to EDL mode?
seems a/b partition problem.
try fastboot flash recovery_a twrp.img
fastboot flash recovery_b twrp.img
shadowchaos said:
seems a/b partition problem.
try fastboot flash recovery_a twrp.img
fastboot flash recovery_b twrp.img
Click to expand...
Click to collapse
I already tried that of recovery_a and recovery_b, and nothing happens, that gives CMD:
1) fastboot flash recovery_a twrp-3.5.0-0-nairo.img
Sending 'recovery_a' (59392 KB) OKAY [ 1.827s]
Writing 'recovery_a' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
2) fastboot flash recovery_b twrp-3.5.0-0-nairo.img
Sending 'recovery_b' (59392 KB) OKAY [ 1.308s]
Writing 'recovery_b' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
Also, everything I try to flash ends with this message "flash (bootloader) permission denied".
supermafari2.0 said:
I already tried that of recovery_a and recovery_b, and nothing happens, that gives CMD:
1) fastboot flash recovery_a twrp-3.5.0-0-nairo.img
Sending 'recovery_a' (59392 KB) OKAY [ 1.827s]
Writing 'recovery_a' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
2) fastboot flash recovery_b twrp-3.5.0-0-nairo.img
Sending 'recovery_b' (59392 KB) OKAY [ 1.308s]
Writing 'recovery_b' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
Also, everything I try to flash ends with this message "flash (bootloader) permission denied".
Click to expand...
Click to collapse
Could you describe what moves at last time which causes this situation?
supermafari2.0 said:
I already tried that of recovery_a and recovery_b, and nothing happens, that gives CMD:
1) fastboot flash recovery_a twrp-3.5.0-0-nairo.img
Sending 'recovery_a' (59392 KB) OKAY [ 1.827s]
Writing 'recovery_a' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
2) fastboot flash recovery_b twrp-3.5.0-0-nairo.img
Sending 'recovery_b' (59392 KB) OKAY [ 1.308s]
Writing 'recovery_b' (bootloader) flash permission denied
FAILED (remote: '')
fastboot: error: Command failed
Also, everything I try to flash ends with this message "flash (bootloader) permission denied".
Click to expand...
Click to collapse
Hey, can I ask you how did you manage to unbrick it? My phone doesn't get recognized via fastboot. It seems dead but when I connect it to the pc, it gets recognized as "Qualcomm HS-USB QDLoader 9008".
What can I do next?
Try a blank flash for your phone.
Hello,
I am in a similar situation and also interested in the test point for EDL mode, so rather than opening a new thread I figured I'd reply here.
As it stands, my phone has the /e/ project ROM and recovery flashed on it, the "Allow OEM unlock" option is disabled, and the bootloader is locked. Meaning, the OS doesn't get recognized and doesn't boot, flashing is disallowed across the board, fastboot oem unlock <UNLOCK_KEY> is rejected, and fastboot boot <any recovery stock or otherwise>.img fails.
fastboot oem blankflash returns "Command Restricted" and well, subsequently tells me it failed.
So my own ignorance left myself with a rather expensive paperweight and the last resort I believe is to flash a stock ROM in EDL mode. I have found a teardown video of the device and seen a few test points there (including 3 under the large heatsinking graphite film), and I'm ready to remove the back cover on mine. It seems that the EDL test point isn't documented... If need be, I could try to find the test points myself. I just need more info to not short and break anything.
Edit: so I've gone and done it. Stabbed all visible test points, one of them scores at 1.8v, one at 1.5v, the rest at 0v. [EDIT] Some actually show something below 0.5v.
The 1.8v test point is connected to a trace going to the connector's pin. Another pad goes just beside that pin. It is very enticing right now to try and bridge them, however I'm not confident those are the EDL test points and I may short something I don't want to. I'm gonna get resistors.
The missing connector tells me it's a connector that's important for Motorola, and clearly not for the end-user. This is a cost-saving measure, don't need to run extensive tests when the device is finalized, you only need the test points to... enable EDL? Ahah. The fact the connector pads are still there is because designing the rerouting to remove them also costs money.
The 1.5v test point is between the screen and bottom daughterboard flexible flat cables connectors. Without certainty, I believe it may be a voltage for one of those or both.
Attached is the photo of the test points around the missing connector, if that helps at all.
Edit2: I found this post about trying for test points. I'm lacking resistors right now to further test. https://forum.xda-developers.com/t/phone-doesnt-boot-even-in-edl-mode.4411915/#post-87260675
Edit3: welp, bridging the points linked to the missing connector pads did nothing. What I tried is keep the phone off, bridge the points, plug the USB, but it keeps sending me to "OS not found" error or fastboot, depending on if fb_mode_set or fb_mode_clear have been used.
Hey @Awilen please keep us posted. I too want to play with this phone, but am frustrated by lack of easy access to EDL mode (to unbrick). (I want to try to roll my own GSI/AOSP build + Moto proprietary drivers, which will likely not boot the first thirty or so times I try it.)
FWIW, I tried this method and a pre-bought cable that allegedly does the same thing- no dice either.
The fact that there ARE EDL IMAGES out there gives me hope.
This repository has some other tricks to try, if you are brave enough:
Use a edl cable (Short D+ with GND) and force reboot the phone (either vol up + power pressing for more than 20 seconds or disconnect battery), works with emmc + ufs flash (this will only work if XBL/SBL isn't broken)
If emmc flash is used, remove battery, short DAT0 with gnd, connect battery, then remove short.
If a ufs flash is used, things are very much more complicated. You will need to open the ufs die and short the clk line on boot, some boards have special test points for that.
Some devices have boot config resistors, if you find the right ones you may enforce booting to sdcard instead of flash.
(I've tried #1)
FWIW, I've never had any success with any "EDL cable" on any device, but that could be entirely due to timing/incompetence on my part.
A few devices I've been able to find EDL test points.
On some non-Qualcomm devices I have gotten to ROM bootloader by using a 100 ohm resistor (for safety, instead of a dead short) from some random test point near eMMC to ground.
Hey @Renate the cable works on my OnePlus (which, also, has a key sequence to do it, making the cable superfluous), so I know that isn't the issue here. I just don't want to unglue the phone and risk breaking something just to play. Once the battery becomes useless and that's inevitable, then I'll probably become a MB-shortin'-mo-fo.
SomeRandomGuy said:
This repository has some other tricks to try, if you are brave enough:
Use a edl cable (Short D+ with GND) and force reboot the phone (either vol up + power pressing for more than 20 seconds or disconnect battery), works with emmc + ufs flash (this will only work if XBL/SBL isn't broken)
If emmc flash is used, remove battery, short DAT0 with gnd, connect battery, then remove short.
If a ufs flash is used, things are very much more complicated. You will need to open the ufs die and short the clk line on boot, some boards have special test points for that.
Some devices have boot config resistors, if you find the right ones you may enforce booting to sdcard instead of flash.
(I've tried #1)
Click to expand...
Click to collapse
Hey! I was waiting on my EDL cable. I just tried it... no dice. No dice at all. I believe I've exhausted all non-intrusive tricks in the book, the next step is cleanly desoldering the EM shield over the processor and flash/RAM combo ICs.
Since the device is out of warranty anyway, I'll try for a repair shop to desolder it, as the only powerful-enough heat source I have is a large heat gun blowing 150°C, 450°C or 600°C air. Other than that I have a 60W soldering iron, I doubt that'll be enough.
The only problem with the desoldering is that the EM shield is part of the cooling solution for the processor/RAM/Flash ICs. It will need to be reapplied.
Edit: I made a thread on the e.foundation forums listing everything I tried: https://community.e.foundation/t/bo...and-wont-boot-am-i-out-of-luck/43362?u=awilen
Awilen said:
Edit: I made a thread on the e.foundation forums listing everything I tried: https://community.e.foundation/t/bo...and-wont-boot-am-i-out-of-luck/43362?u=awilen
Click to expand...
Click to collapse
TIL “fastboot oem qcom-on” and “fastboot oem qcom-off” are a thing.
For my part, to this day I cannot find a way to access this mode, I still have my theories, since on one page I found "official" diagrams of this motorola and the phrase "EDL" is indicated at various points, but I don't really know how to interpret them on the motherboard, I'll leave the link in case someone wants to review it, it's from a Brazilian page:
Motorola_Moto_G_5G XT2075 - LEMCELL.COM.BR.zip
drive.google.com
In that one there are several files, with more technical specifications, in case someone wants to review it and see what they find useful out there, to see if it is possible to reach EDL mode on this model.
The missing connector I shot in my photos is a JTAG connector. Make of that what you will.
I have desoldered the EMI shield above the SoC/eMCP area and there's no dice there either. The traces are hidden, the parts are BGAs, there's no "pin" to short there. The schematics may or may not have confirmed my suspicion the physical trace for the clock signal to the eMCP is unreachable, making reaching EDL mode through "PBL panic from not being able to access the flash" impossible.
The SMDs around the eMCP may or may not seem to all be related to power delivery smoothing, and shorting those is blue smoke waiting to happen. I'll resolder the shield later, I don't think there's any point in desoldering it in the future for the purpose of reaching EDL mode.
There are official blankflash utilities freely available. I have no doubt EDL mode is accessible. This connector must be just how.
BREAKTHROUGH TIME! I GOT INTO QCOM 9008 MODE!
In the attached photo are the EDL pads. Happy flashing!
Edit: now I'm getting some progress, but nothing is working. Here's the two logs I get, the first just after connecting, the second after having tried once already:
Code:
$ sudo ./qcom blank-flash
**** Log buffer [000001] 2022-12-02_19:02:50 ****
[ 0.000] Opening device: /dev/ttyUSB0
[ 0.000] Detecting device
[ 5.889] ERROR: sahara_greet_device()->change_mode()->do_hello()->Invalid command received in current state
[ 5.889] Check qboot_log.txt for more details
[ 5.889] Total time: 5.889s
[ 5.889]
[ 5.889] qboot version 3.86
[ 5.889]
[ 5.889] DEVICE {
[ 5.889] name = "/dev/ttyUSB0",
[ 5.889] flags = "0x60",
[ 5.889] addr = "0xFECAF690",
[ 5.889] serial_nix.device_pathname = "/sys/bus/usb/devices/1-3.2/1-3.2:1.0/ttyUSB0",
[ 5.889] api.bnr = "0x1FE4210",
[ 5.889] }
[ 5.889]
[ 5.889]
[ 5.889] Backup & Restore {
[ 5.889] num_entries = 0,
[ 5.889] restoring = "false",
[ 5.889] backup_error = "not started",
[ 5.889] restore_error = "not started",
[ 5.889] }
[ 5.889]
Code:
$ sudo ./qcom blank-flash
**** Log buffer [000001] 2022-12-02_19:03:50 ****
[ 0.000] Opening device: /dev/ttyUSB0
[ 0.343] Detecting device
[ 34.920] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 34.920] Check qboot_log.txt for more details
[ 34.920] Total time: 34.920s
[ 34.920]
[ 34.920] qboot version 3.86
[ 34.920]
[ 34.920] DEVICE {
[ 34.920] name = "/dev/ttyUSB0",
[ 34.920] flags = "0x60",
[ 34.920] addr = "0xAEF35240",
[ 34.920] serial_nix.device_pathname = "/sys/bus/usb/devices/1-3.2/1-3.2:1.0/ttyUSB0",
[ 34.920] api.bnr = "0x21BC210",
[ 34.920] }
[ 34.920]
[ 34.920]
[ 34.920] Backup & Restore {
[ 34.920] num_entries = 0,
[ 34.920] restoring = "false",
[ 34.920] backup_error = "not started",
[ 34.920] restore_error = "not started",
[ 34.920] }
[ 34.920]
Edit 2: I got a blankflash to work! Now I don't know... This is what I got:
Code:
D:\blankflash>.\qboot.exe blank-flash
Motorola qboot utility version 3.86
[ -0.000] Opening device: \\.\COM3
[ -0.000] Detecting device
[ -0.000] ...cpu.id = 286 (0x11e)
[ -0.000] ...cpu.sn = 3786473903 (0xe1b101af)
[ -0.000] Opening singleimage
[ -0.000] Loading package
[ -0.000] ...filename = pkg.xml
[ -0.000] Loading programmer
[ -0.000] ...filename = programmer.elf
[ -0.000] Sending programmer
[ 0.109] Handling things over to programmer
[ 0.109] Identifying CPU version
[ 0.109] Waiting for firehose to get ready
[ 3.220] ReadFile() failed, GetLastError()=0
[ 3.330] ...SM_SAIPAN 2.0
[ 3.330] Determining target secure state
[ 3.330] ...secure = yes
[ 3.377] Configuring device...
[ 3.377] Skipping UFS provsioning as target is secure
[ 3.377] Configuring device...
[ 3.470] Flashing GPT...
[ 3.470] Flashing partition with gpt.bin
[ 3.470] Initializing storage
[ 3.517] ...blksz = 4096
[ 3.580] ReadFile() failed, GetLastError()=0
[ 4.049] Re-initializing storage...
[ 4.049] Initializing storage
[ 4.361] Flashing bootloader...
[ 4.361] Wiping ddr
[ 4.392] Flashing abl_a with abl.elf
[ 4.439] Flashing aop_a with aop.mbn
[ 4.486] Flashing qupfw_a with qupfw.elf
[ 4.517] Flashing tz_a with tz.mbn
[ 4.783] Flashing hyp_a with hyp.mbn
[ 4.839] Flashing devcfg_a with devcfg.mbn
[ 4.854] Flashing keymaster_a with keymaster.mbn
[ 4.901] Flashing storsec_a with storsec.mbn
[ 4.933] Flashing uefisecapp_a with uefi_sec.mbn
[ 5.089] Flashing prov_a with prov64.mbn
[ 5.104] Flashing xbl_config_a with xbl_config.elf
[ 5.151] Flashing xbl_a with xbl.elf
[ 5.649] Rebooting to fastboot
[ 5.665] Total time: 5.665s
Somehow it worked, I got to flash another phone's blankflash (a "Racer" codenamed phone apparently) on it and the ABL (the thing that tells me it won't boot because it didn't find a valid system) changed visually. Now I'll try to unlock the bootloader, or flash a system on it.
Edit 3: Mmh. After clearing that EDL mode flashing worked, the system is still flashing-locked, secured, and fastboot oem unlock <unique_key> isn't working.
so you activated the qcom, but it is not responding to the blankflash? at least it's an advance, maybe it's a blankflash problem or do you think it's some kind of board protection?
Later I will try on my own on my board
Congrats on your quest. Were you literally shorting them, or did you use a resistor? You had to touch all three together?
I guess I still am confused how there is a blankflash out there for this phone, but no way to trigger EDL without a hardware kit. I just ran through all the key combinations (V+,V-, PWR) and USB in/out just to make sure I didn't miss something... no dice to EDL.
supermafari2.0 said:
so you activated the qcom, but it is not responding to the blankflash? at least it's an advance, maybe it's a blankflash problem or do you think it's some kind of board protection?
Later I will try on my own on my board
Click to expand...
Click to collapse
I am confident EDL mode flashing worked. I used a different phone's blankflash that had the same SoC and it worked, giving me a visually different "No OS found" error screen. I posted the log of the blanking process. The "Allow OEM Unlock" bit is still set to "disabled" after blanking, such that I still can't use "fastboot oem unlock" successfully.
There's this line that makes me think the system is still intact: "Skipping UFS provsioning as target is secure", meaning the UFS filesystem might have not been actually blanked. Since singleimage.bin is a signed binary, there's no way to force UFS provisioning or modify it in any other way. I think the only way in will be with a firehose and QFIL... Except I haven't found one for this SoC. The programmer.elf is the firehose, but again that needs to be signed to be useful after getting extracted.
SomeRandomGuy said:
Congrats on your quest. Were you literally shorting them, or did you use a resistor? You had to touch all three together?
I guess I still am confused how there is a blankflash out there for this phone, but no way to trigger EDL without a hardware kit. I just ran through all the key combinations (V+,V-, PWR) and USB in/out just to make sure I didn't miss something... no dice to EDL.
Click to expand...
Click to collapse
I marked two pads of the missing connector with a green rectangle (I reused the photo I posted earlier on which I had already marked the test points' voltages, disregard the test points). I shorted them with only one voltmeter probe.
The idea is that the EDL pads I marked in green are connected to a 1.8V supply and a pin on the SoC with "infinite resistance", so there's no need for an additional resistor. You are not at risk of shorting anything and cause a major disaster on pins on the row of the green rectangle. The connector is very small, so stab confidently in the middle of the row of pads!
The (V+, PWR) combination may be available in development units, and be disabled in production units at the hardware level (missing components).
(Keep in mind I'm talking in hypotheticals at times to keep up plausible deniability regarding the files posted earlier by supermafari2.0... Those are surely under copyright.)
Layers of security upon layers of security just to get a stock firmware on an empty filesystem on my own device... This is getting old...
Edit: I have, out of boredom, decomposed the singleimage.bin into its various files. Here is the file format:
Code:
* SINGLE_N_LONELY Header [256 bytes]
* FILE:
Header:
* file name: 248 bytes (name + "\0" padding)
* file size: 8 bytes, little-endian
Data:
* data: file size in bytes
* 0xA0 padding if (file size % 4096) != 0 : file size + 4096 - (file size % 4096) bytes
[* FILE...]
* LONELY_N_SINGLE Footer [256 bytes]
Do note the 4096 magic number is the flash sector size, thus is device-dependant. In singleimage.bin, there was gpt.bin which also follows the same format. Among the files is programmer.elf, a strong candidate to be a firehose, I'll try to use with QFIL tomorrow. I do take note of Motorola's attempt at psychological warfare.
So I tried the programmer I found in the singleimage.bin file, it's indeed capable of programming through QFIL! (Do note I needed to get QFIL through QPST to get it to work.) However now I'm faced with this as I'm trying to flash recovery.img to get to recovery and get recovery to reinstall a working system:
Code:
INFO: TARGET SAID: 'ERROR: range restricted: lun=5, start_sector=142688, num_sectors=25600'
I guess the programmer checks for the flash being in a locked state, so it's time to try to patch the programmer to force the flash, if at all possible...
Edit: guessed right. The programmer has a routine that does various checks. It isn't encrypted, but I found data that could indicate the file is signed. I didn't see either the PEEK or POKE strings in there, meaning these primitives weren't included in the programmer, so there's no way to manually poke any image by hand, or just enable that blasted "Allow OEM unlock" bit (the fact I don't know where it is not withstanding.)
I think that's the end of the line for my device. At this point the only way it will ever work again will be either getting a patched and signed firehose (unlikely), or getting Motorola to reflash a stock image internally (even more unlikely) or just changing the motherboard (which defeats the purpose of searching how to get the device back in working order after messing up!)
Hello,
I'm a beginner in the field of flasing custom roms but I would really like to abandon using google on my phone and find your work here really awesome. So yeah, I hope my question doesn't sound stupid but I'm seriously stuck and hope I didn't completely break my phone.
I am using a Redmi Note 8 (2021) and wanted to flash lineageOS. So I unlocked the bootloader via my mi account, booted into fastboot mode (usb-debugging was of course enabled) and tried to flash twrp to recovery using the cmd-window via platform-tools.
This didn't work because when I typed:
./fastboot flash recovery twrp.img
I got the reply:
Sending 'recovery' (65536 KB) OKAY [ 1.743s]
Writing 'recovery' FAILED (remote: 'This partition doesn't exist')
fastboot: error: Command failed
I therefore started googling and found a threat on xda where someone had solved the problem by replacing 'recovery' with 'boot':
./fastboot flash boot twrp.img
What I got was:
Sending 'boot_a' (65536 KB) OKAY [ 1.818s]
Writing 'boot_a' OKAY [ 0.827s]
Finished. Total time: 2.681s
After that my phone was bricked. I cannot enter recovery mode anymore and even fastboot mode appears a bit different (I don't see the bunny anymore, all I see is the word 'fastboot' in orange letters on a black screen). When I enter fastboot mode, the device is detected by my computer - the only sign that still gives me an inch of hope. When I'm not in fastboot mode my phone keeps vibrating and then turning of, then suddenly it vibrates again and turns on, the logo 'redmi' appears and then it suddenly turns off again - and it just keeps repeating this procedure.
I downloaded the mi flash tool and tried to flash the Xiaomi ROM, but that didn't work either - after about five minutes of waiting I get an error. I tried different versions of MIUI but keep getting errors. When I try to flash the Xiaomi ROM via cmd-window, as suggested here ( https://www.droidwin.com/unbrick-redmi-note-8-fastboot-commands/ ) I get this:
fastboot flash xbl xbl.elf
Sending 'xbl' (3449 KB) OKAY [ 0.105s]
Writing 'xbl' FAILED (remote: 'This partition doesn't exist')
fastboot: error: Command failed
Is there anything left for me to do or should I give up and save money for a new phone? I am also wondering why the command-window keeps talking about 'boot_a'. Is there a 'boot-b' also? And should I write something onto it? When I try to boot the twrp.img by typing:
fastboot boot twrp.img
I get:
Sending 'boot.img' (65536 KB) OKAY [ 1.592s]
Booting FAILED (Status read failed (Too many links))
fastboot: error: Command failed
I would be very, very grateful for help
Try this
https://www.getdroidtips.com/twrp-recovery-redmi-note-8-2021-root/
I guess you have used a wrong recovery file, maybe one for another device
The problem is that the command 'flash recovery' does not work, because it says th partition does not exist....
Norah1838 said:
I am using a Redmi Note 8 (2021)
Click to expand...
Click to collapse
wrong forum ! , see Biloba forum
on some devices, boot+recovery are on the same partition, but not for Biloba
boot partition (+dtbo on some cases) is the kernel
i think you should look for official install of miui rom since it has IMG of most partitions ...