Unlock Bootloader Reverse Engineering - Android Software/Hacking General [Developers Only]

Hello,
I am trying to reverse engineer my phone that won't allow me to flash the partitions with an img file I took using DD. I have the following issue-
Code:
[[email protected] platform-tools]# ./fastboot flash system system.img
target reported max download size of 1073741824 bytes
Invalid sparse file format at header magi
erasing 'system'...
FAILED (remote: device is locked. Cannot erase)
finished. total time: 0.017s
[[email protected] platform-tools]#
[[email protected] platform-tools]# ./fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) Display panel:
OKAY [ 0.027s]
finished. total time: 0.027s
[[email protected] platform-tools]# ./fastboot oem unlock
...
FAILED (remote: oem unlock is not allowed)
finished. total time: 0.012s
[[email protected] platform-tools]#
The first thing I did when I set up the phone was make sure it was unlocked in developer options.
OEM unlocking
Allow the bootloader to be unlocked
(with the slider moved over to the right)
It's almost like the settings conflict with each other. Any ideas on this? It looks like even though it is on in developer options doesn't mean that it will work in ADB. The proof is in the pudding as they say.
According to the research I have done, I am also seeing that with many phones you must set the option in fastboot mode after setting this in developer options.
I tried to compare/diff the aboot image partition in a hex editor but it did not show any differences in them. To do this I started out with the option set locked and took a DD image of aboot. I then restarted the phone and set the option to unlock and took a second DD image.
I have a full backup of all partitions of the phone and could post any additional info you need.

Turns out the easier solution is using a tool to flash the phone properly rather than unlock the bootloader. I should have realized when I wasn't getting a response that I was going down the wrong track. Now to get MPRG8909.hex and 8909_msimage.mbn files........

Related

MOTO G3 Bricked

Moto G3 is Bricked,
Device is Locked Status Code:0
XT1550
Tried recovery Mode gives error:
==========
Your Status didn't startup successfully. Use the Software Repair Assistant on Computer to repair your device.
==========
Tried Fastboot it says
C:\Users\admin\Downloads\ADB\ADB and Fastboot>fastboot oem unlock
...
(bootloader) Check 'Allow OEM Unlock' in Developer Options.
FAILED (remote failure)
finished. total time: 0.048s
Please help.
radnam said:
Moto G3 is Bricked,
Device is Locked Status Code:0
XT1550
Tried recovery Mode gives error:
==========
Your Status didn't startup successfully. Use the Software Repair Assistant on Computer to repair your device.
==========
Tried Fastboot it says
C:\Users\admin\Downloads\ADB\ADB and Fastboot>fastboot oem unlock
...
(bootloader) Check 'Allow OEM Unlock' in Developer Options.
FAILED (remote failure)
finished. total time: 0.048s
Please help.
Click to expand...
Click to collapse
Flash stock firmware from here : https://forum.xda-developers.com/2015-moto-g/general/index-moto-g-factory-firmware-images-t3169639
Download links and FAQ are present in that thread.
adityak1303 said:
Flash stock firmware from here : https://forum.xda-developers.com/2015-moto-g/general/index-moto-g-factory-firmware-images-t3169639
Download links and FAQ are present in that thread.
Click to expand...
Click to collapse
I have tired doing the steps given. However it gives the following error:
C:\Users\admin\Downloads\ADB and Fastboot\ADB and Fastboot>fastboot oem fb_mode_set
...
FAILED (remote failure)
finished. total time: 0.031s
C:\Users\admin\Downloads\ADB and Fastboot\ADB and Fastboot>fastboot flash partition gpt.bin
target reported max download size of 268435456 bytes
sending 'partition' (32 KB)...
OKAY [ 0.016s]
writing 'partition'...
(bootloader) This may take a few seconds, if a
(bootloader) different partition table is being
(bootloader) flashed since we need to backup
(bootloader) and restore a few partitions
(bootloader) Flashing primary GPT image...
(bootloader) Failed to write primary GPT.
(bootloader) Failed to program partition table
FAILED (remote failure)
finished. total time: 0.459s
C:\Users\admin\Downloads\ADB and Fastboot\ADB and Fastboot>astboot flash bootloader bootloader.img
'astboot' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\admin\Downloads\ADB and Fastboot\ADB and Fastboot>fastboot flash bootloader bootloader.img
target reported max download size of 268435456 bytes
sending 'bootloader' (2546 KB)...
OKAY [ 0.094s]
writing 'bootloader'...
(bootloader) flashing sbl1 ...
(bootloader) Failed to erase partition
(bootloader) Failed to flash sbl1
FAILED (remote failure)
finished. total time: 1.424s
Just to be sure, you are running this in as an Administrator command window, correct?
It's bricked... Nothing is writing to the internal storage and everything is coming back FAILED. Seen a few of these recently​, if it was a different error we might be able to do something but doing 'fastboot oem fb_mode_set' should never give an error.
acejavelin said:
Just to be sure, you are running this in as an Administrator command window, correct?
It's bricked... Nothing is writing to the internal storage and everything is coming back FAILED. Seen a few of these recently​, if it was a different error we might be able to do something but doing 'fastboot oem fb_mode_set' should never give an error.
Click to expand...
Click to collapse
That's what I was wondering. And yes I am running Administrator Command Window.
I am just keeping my fingers crossed that someone can help me resolve the issue.

unable to install ROM after wipe

My story goes.
Had happy running TugaPower Rom
Decided to install MultiRom and Ubuntu.
Then after running for a week or so, decided to wipe and install TugaPower alone.
All has run well for a while. Decided to wipe and make a fresh install.
MultiRom I am unable to fully remove, even trying to replace with original TWRP.
When I try to flash the ROM, I get reported that this cant be installed as the model is . not bacon or A0001. error 7
I have edited the updater-script to not make a check on the model and it then installs.
When i reboot it goes straight back to the recovery!!!
I have tried reinstalling multirom and then flashing but again it keeps going to the recovery.
Ive tried to fastboot the original OS via https://forum.xda-developers.com/oneplus-one/general/guide-return-opo-to-100-stock-t2826541, but fastboot reports `FAILED (remote: Device not unlocked cannot flash or erase)`
(Full output at bottom)
The install all end with 1 and multirom could see the roms
ive tried extracting just the .img and flashing to get going
im at a loss, any help much appreciated
Code:
[email protected]:sudo fastboot oem unlock
...
OKAY [ 0.009s]
finished. total time: 0.009s
[email protected]:/home/steve/Downloads/cm# ./flash-all.sh
target reported max download size of 1073741824 bytes
sending 'modem' (57457 KB)...
OKAY [ 1.805s]
writing 'modem'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 1.806s
target reported max download size of 1073741824 bytes
sending 'sbl1' (273 KB)...
OKAY [ 0.011s]
writing 'sbl1'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.013s
target reported max download size of 1073741824 bytes
sending 'dbi' (11 KB)...
OKAY [ 0.004s]
writing 'dbi'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.006s
target reported max download size of 1073741824 bytes
sending 'aboot' (445 KB)...
OKAY [ 0.015s]
writing 'aboot'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.017s
target reported max download size of 1073741824 bytes
sending 'rpm' (186 KB)...
OKAY [ 0.008s]
writing 'rpm'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.010s
target reported max download size of 1073741824 bytes
sending 'tz' (325 KB)...
OKAY [ 0.012s]
writing 'tz'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.015s
target reported max download size of 1073741824 bytes
sending 'LOGO' (328 KB)...
OKAY [ 0.013s]
writing 'LOGO'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.015s
target reported max download size of 1073741824 bytes
sending 'oppostanvbk' (10240 KB)...
OKAY [ 0.322s]
writing 'oppostanvbk'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.323s
target reported max download size of 1073741824 bytes
sending 'recovery' (9968 KB)...
OKAY [ 0.314s]
writing 'recovery'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.315s
target reported max download size of 1073741824 bytes
erasing 'system'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.000s
target reported max download size of 1073741824 bytes
sending 'boot' (7274 KB)...
OKAY [ 0.231s]
writing 'boot'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.232s
target reported max download size of 1073741824 bytes
erasing 'cache'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.000s
target reported max download size of 1073741824 bytes
erasing 'userdata'...
FAILED (remote: Device not unlocked cannot flash or erase)
finished. total time: 0.000s
rebooting...
finished. total time: 0.050s
Boot the phone into fastboot mode and open cmd with administrative rights and go into the adb platform tools folder and enter in cmd fastboot OEM -device info
kallum7 said:
Boot the phone into fastboot mode and open cmd with administrative rights and go into the adb platform tools folder and enter in cmd fastboot OEM -device info
Click to expand...
Click to collapse
C:\Windows\system32>fastboot oem device-info
...
(bootloader) Device tampered: true
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.016s]
finished. total time: 0.016s
now run script
C:\Windows\system32>fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.016s]
finished. total time: 0.016s
C:\Windows\system32>fastboot boot C:\Users\Steve\Downloads\twrp-3.2.3-0-bacon.img
downloading 'boot.img'...
OKAY [ 0.438s]
booting...
FAILED (remote: Device not unlocked cannot boot)
finished. total time: 0.438s
C:\Windows\system32>fastboot oem unlock
...
OKAY [ 0.016s]
finished. total time: 0.016s
C:\Windows\system32>fastboot boot C:\Users\Steve\Downloads\twrp-3.2.3-0-bacon.img
< waiting for device >
downloading 'boot.img'...
OKAY [ 0.438s]
booting...
FAILED (remote: Device not unlocked cannot boot)
finished. total time: 0.438s
C:\Windows\system32>fastboot oem device-info
...
(bootloader) Device tampered: false
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.016s]
finished. total time: 0.016s
Try another USB micro cable
Thank you for your reply.
I have tried two other cables I have and still having the same issues
Are you using Linux or windows
kallum7 said:
Are you using Linux or windows
Click to expand...
Click to collapse
I have both available,
I am trying each OS at each new try
Ran all three of the files on here to get the triggers to true / true
https://forum.xda-developers.com/oneplus-one/development/mod-reset-unlock-tamper-bit-t2820912
I then ran `fastboot boot twrp.img`
This gave me twrp and i then installed a rom as normal...
im back up and running
thanks for all your patience and help
stevieag said:
Ran all three of the files on here to get the triggers to true / true
https://forum.xda-developers.com/oneplus-one/development/mod-reset-unlock-tamper-bit-t2820912
I then ran `fastboot boot twrp.img`
This gave me twrp and i then installed a rom as normal...
im back up and running
thanks for all your patience and help
Click to expand...
Click to collapse
Im having problems again..
OTA lineage update came up..
i clicked to install.
Phone restarted and immediately went to the multirom twrp screen.
I have had this in the past and have needed to install from this screen but i couldnt find the file to install
So on phone restart it loops back to the multirom twrp
I can still adb and fastboot see below
Code:
(bootloader) Device tampered: true
(bootloader) Device unlocked: true
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.006s]
finished. total time: 0.006s
on fastboot boot twrp.img
it seems to restart but sits on fastboot screen
story:
on fastboot
send command
fastboot screen goes brighter
Any ideas
I have tried windows and linux plus 2 cables
What would be ideal would to completely clear multirom from my phone and get back to stock or stock twrp so i can flash as normal
stevieag said:
Im having problems again..
OTA lineage update came up..
i clicked to install.
Phone restarted and immediately went to the multirom twrp screen.
I have had this in the past and have needed to install from this screen but i couldnt find the file to install
So on phone restart it loops back to the multirom twrp
I can still adb and fastboot see below
Code:
(bootloader) Device tampered: true
(bootloader) Device unlocked: true
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.006s]
finished. total time: 0.006s
on fastboot boot twrp.img
it seems to restart but sits on fastboot screen
story:
on fastboot
send command
fastboot screen goes brighter
Any ideas
I have tried windows and linux plus 2 cables
What would be ideal would to completely clear multirom from my phone and get back to stock or stock twrp so i can flash as normal
Click to expand...
Click to collapse
sorted
https://forum.xda-developers.com/oneplus-one/general/tool-oneplus-one-return-to-stock-t2970390
Ultimate fix
Right, i ended with a boot loop i couldnt sort
so
i downloaded - cm-13.1.2-ZNH2KAS3P0-bacon-signed-fastboot.zip (to big for upload)
This contains all the files you need including os
Once in fastboot
volume up and power or in recovery
Code:
adb reboot bootloader
In windows in a terminal (search next to start menu for cmd, right click on the pop up cmd and choose open as admin)
Run each of these
Code:
fastboot flash aboot emmc_appsboot.mbn
fastboot flash LOGO logo.bin
fastboot flash modem NON-HLOS.bin
fastboot flash rpm rpm.mbn
fastboot flash sbl1 sbl1.mbn
fastboot flash dbi sdi.mbn
fastboot flash oppostanvbk static_nvbk.bin
fastboot flash tz tz.mbn
fastboot flash boot boot.img
fastboot flash cache cache.img
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash userdata userdata_64G.img
fastboot reboot
THIS IS FOR 64GB ONLY with 16GB change userdata_64.img to the file userdata.img
In Linux open terminal, drop to root
Code:
sudo su -
you can then run above files or run flash-radio.sh
Code:
./flash-radio.sh
weirly may still need sudo!!!
This will install the os etc and you are back to stock (although old)
Now you can install twrp as normal
Code:
fastboot flash recovery twrp.img
Code:
fastboot reboot
here you should be back to normal twrp recovery
Copy over your ROM and Gapps
Install as normal twrp and done
im now on pie with 3.2.2 twrp and gapps 9
This installed ROMs that were complaining of not the right model, error 7, error 255 ........ and on
All sorted, in fact ive installed 3 different roms now without fails

cannot enter TWRP recovery ("no command" message)

Hi I flashed my recovery to TWRP recovery, but unfortunately if I enter recovery mode in boot menu I'll get "no command" screen and I have no idea what causes that.
commands I ran:
Code:
PS C:\Users\honza\Downloads\twrp> fastboot oem unlock
...
(bootloader) Showing Options on Display.
(bootloader) Use device keys for selection.
(bootloader) erasing userdata...
(bootloader) erasing userdata done
(bootloader) erasing cache...
(bootloader) erasing cache done
(bootloader) unlocking...
(bootloader) Bootloader is unlocked now.
OKAY [ 20.799s]
finished. total time: 20.799s
PS C:\Users\honza\Downloads\twrp> fastboot flash recovery twrp-3.2.3-0-shieldtablet.img
target reported max download size of 100663296 bytes
sending 'recovery' (12448 KB)...
OKAY [ 0.545s]
writing 'recovery'...
OKAY [ 0.456s]
finished. total time: 1.001s
PS C:\Users\honza\Downloads\twrp> fastboot reboot
rebooting...
finished. total time: 0.017s
PS C:\Users\honza\Downloads\twrp> adb devices
List of devices attached
PS C:\Users\honza\Downloads\twrp> fastboot devices
thanks for help.
temporaly solved
I tried to use "fastboot boot" and this works well, and since I need TWRP only temporaly this solution is sufficient for me.

OnePlus One bricked - Bootlooder locked unable to unlock - system partition lost

Please help!!
I have messed up my oneplus one bacon
I was using lineageos 16 and all was fine. For some dumb reason like getting 'Screen mirroring' feature, I decided to go back to lineageos 15.1. Somewhere in the instructions I [mis]read, a clean wipe is recommended to go back to previous release.
I wiped all my partitions from twrp. That's why, my system partition is gone.
I tried a bunch of things after searching on these forums for similar symptoms, but no luck as of yet.
I tried to flash the stock recovery and stock ROM
Recovery flash was successful and so I am on CWM, but the ROM failed as the system partition could not be mounted/unmounted
Now, my phone's state -- I have Cyanogen recovery
ADB devices does not work.
> adb reboot bootloader
adb server is out of date. killing...
* daemon started successfully *
error: device not found
Fastboot works, but am unable to unlock my bootloader, not sure how it got locked.
>fastboot oem unlock
OKAY [ 0.009s]
Finished. Total time: 0.019s
It simple reboots to the recovery without unlocking
>fastboot oem device-info
(bootloader) Device tampered: true
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
(bootloader) console_enabled: 0
(bootloader) exec_console_unconsole: 0
OKAY [ 0.021s]
Finished. Total time: 0.028s
I tried sideload to upload files like stock ROM, I get verification errors.
I was hoping this thread would help me. But not sure how to apply this fix
I am unable to flash or boot as I get the following error
> fastboot flash recovery recovery.img
target reported max download size of 1073741824 bytes
sending 'recovery' (9968 KB)...
OKAY [ 0.317s]
writing 'recovery'...
FAILED (remote: Device not unlocked cannot flash or erase)
>fastboot boot recovery.img
downloading 'boot.img'...
OKAY [ 0.318s]
booting...
FAILED (remote: Device not unlocked cannot boot)
finished. total time: 0.339s
Please help!!!

How do I solve Fingerprint Enrollment error

Fingerprint lost, I backed up persist in advance, so I restore it by
fastboot flash persist [INSERT YOUR PERSIST.IMG HERE]
not worked,prompted for "Flashing is not allowed for Critical Partitions"
then I tried
adb shell
su
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist
I checked /mnt/vendor/persist,files were successfully extracted.
However,the problem still occurred.
Appreciate for any helps.
ChuyanFang said:
Fingerprint lost, I backed up persist in advance, so I restore it by
fastboot flash persist [INSERT YOUR PERSIST.IMG HERE]
not worked,prompted for "Flashing is not allowed for Critical Partitions"
then I tried
adb shell
su
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist
I checked /mnt/vendor/persist,files were successfully extracted.
However,the problem still occurred.
Appreciate for any helps.
Click to expand...
Click to collapse
Enter this command first: fastboot flashing unlock_critical
Sent from my OnePlus KB2007 using XDA Labs
jwarrior319 said:
Enter this command first: fastboot flashing unlock_critical
Sent from my OnePlus KB2007 using XDA Labs
Click to expand...
Click to collapse
Thanks for ur reply.
It still doesn't work.
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock_critical
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.005s
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.003s
I checked the unlocked status then:
C:\Program Files (x86)\OnePlus Mobile>fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [ 0.006s]
Finished. Total time: 0.007s
*never mind*
ChuyanFang said:
Thanks for ur reply.
It still doesn't work.
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock_critical
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.005s
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.003s
I checked the unlocked status then:
C:\Program Files (x86)\OnePlus Mobile>fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [ 0.006s]
Finished. Total time: 0.007s
Click to expand...
Click to collapse
Hmm, it wont allow you to unlock critical. Idk how to fix that.
You could try fastboot oem flashing unlock_critical or fastboot oem unlock_critical
Sent from my OnePlus KB2007 using XDA Labs

Categories

Resources