Database Info

H950 5.1.1 V11z Bricked/Bootloop: LG Security Error, Authentication Fail #9

Hello
A brief timeline of events leading to this thread:
1. I purchased a G-Flex2 H950 from Ebay for $250 and was supposed to be upgrading from a Galaxy S4-I337.
2. Received my device yesterday and set out to update to 5.1.1 & root the device to remove bloatware.
3. I was able to update to 5.1.1 V11x using my StraightTalk sim on AT&T network.
4. After many frustrating hours of trying to root using different methods, I finally was able to root using the technique mentioned in this thread: http://forum.xda-developers.com/g-flex2/development/root-easy-root-att-flex-2-5-1-1-t3178354
5. A nice complement to point "4" above was the firmware update to 5.1.1 V11z.
6. Extremely happy that I was ready to rock, I set out to delete all the bloatware from my device.
7. First surprise obviously was the inability to remove a bunch of AT&T apps because "APK could not found" error.
8. Like the idiot that I am, I went ahead and deleted the "rootsystem.img" from the internal memory (unnecessarily, blame my OCD!).
9. Now after I finished de-bloating the device (or so I thought), I rebooted it and to my horror... I see the error message:
LG Security Error
Authentication Fail #9
10. I attempted to get to the recovery mode and deleted/erased all data & settings. No dice!
11. I'm still able to get to the download mode using the Volume-Up & USB connect method (& this is why I'm cursing myself at point "8" because I could have re-used the easy root method again to flash the img file).
12. I tried to use the "LG Mobile Support Tool", it recognizes the device correctly as "LGH950" but says V11z is the latest software update.
My question to experts: How SOL am I? I don't think LG would honor my warranty since the purchase is NOT from a authorized dealer/reseller. So no chance of warranty repair/replacement, no?
I looked everywhere (for close to 10 hours) for KDZ & TOT files to even attempt something. But I couldn't find anything for H950. Man, I hate AT&T so much now... Why couldn't they just leave the bootloader unlocked? Or LG (AT&T?)even provide the necessary files to start off with?
Could someone with more knowledge please offer any help? Meanwhile, I've pretty much resigned to be joining the queue full of others with bricked H950's...

From what I've heard LG goes by the S/N and date of manufacturing just like Lenovo for warranty. You can just ask their customer service if the warranty is active for your phone.
As for recovering it all you would've needed to do was use the tool as you stated. I have commented many times explaining people should only disable/freeze bloat and not *delete* anything (there are some crucial system apps, editing build prop seems to cause loops for me for ex.). There was another member in this situation if I remember correctly.
In case you can't go the warranty route ask Sj if he has found a way to push files while the phone is in DL mode.
Sent from my XT1528

Hi i have the same problem, I rename many apps in system folder of my ls996 zv8 and now the phone no boot and only show "LG Security Error"
I tried to rename the files in download mode but system partition is mounted as read only, and also fails when attempting to mount this in rw.
In 5.1.1 the download mode remove the option to read files from sd card.
I tried to mount the sd card, but I had no luck.
The sd-card is located in /sys/block/mmcblk1
cat /proc/partitions show: 179 64 1921024 mmcblk1
Click to expand...
Click to collapse
mount -t vfat -o rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,g id=1023,fmask=0007,dmask=0007,allow_utime=0020,utf 8 /dev/block/vold/179:65 /data/media/1 , fail to mount
Click to expand...
Click to collapse

maxie.maverick said:
Hello
LG Security Error
Authentication Fail #9
10. I attempted to get to the recovery mode and deleted/erased all data & settings. No dice!
11. I'm still able to get to the download mode using the Volume-Up & USB connect method (& this is why I'm cursing myself at point "8" because I could have re-used the easy root method again to flash the img file).
12. I tried to use the "LG Mobile Support Tool", it recognizes the device correctly as "LGH950" but says V11z is the latest software update.
My question to experts: How SOL am I? I don't think LG would honor my warranty since the purchase is NOT from a authorized dealer/reseller. So no chance of warranty repair/replacement, no?
I looked everywhere (for close to 10 hours) for KDZ & TOT files to even attempt something. But I couldn't find anything for H950. Man, I hate AT&T so much now... Why couldn't they just leave the bootloader unlocked? Or LG (AT&T?)even provide the necessary files to start off with?
Could someone with more knowledge please offer any help? Meanwhile, I've pretty much resigned to be joining the queue full of others with bricked H950's...
Click to expand...
Click to collapse
hey have u been able to fix the issue ??
as i just got the ls996 sprint g flex 2, and some how i renamed wrong system file, and got the same issue
my phone is stuck on
SECURITY ERROR
AUTHENTICATION ERROR #9
please help me out if someone around found a solution

same problem here

Security error authentication fail #9 on Lg tribute 2 LGLS665
Hello,
I am stuck on security error authentication fail #9 on Lg tribute 2 LGLS665 at start up.
Got this error when rename the Lgstartupwizard.apk to Lgstartupwizard.bak.
Please Help.........

Same phone and problem as op. H950 V11X Rooted "Authentication Failure #9". Anyone ever figure this out?
We just need someone with the H950 KDZ

Maybe as a G2 user I'm overlooking something but - why not download the kdz from http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=XXXXXX (put your IMEI instead of Xs), eh?

Security Error
Thanks for the link ..
Its not helping me on Lg tribute 2 LGLS665. Below is the text received.
I have replaced the MEID number below with "X".
<response req_cmd="auth_model_check" status="OK">
<auth_model_check>
<result>2</result>
<esn>XXXXXXXXXXXXXX</esn>
<model>LGLS665</model>
<suffix>AVGMBLH</suffix>
<msn>XXXXXXXXX</msn>
<esn_date/>
<sw_version/>
<sw_url/>
<sw_locale_url/>
<sw_recommand_uri/>
<app_version/>
<app_url/>
<cs_em_flag>N</cs_em_flag>
<cs_em_uri>N</cs_em_uri>
<chip_type/>
<prod_type/>
<buyer>VGM</buyer>
<file_name/>
</auth_model_check>
</response>

mwedo said:
Maybe as a G2 user I'm overlooking something but - why not download the kdz from http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=XXXXXX (put your IMEI instead of Xs), eh?
Click to expand...
Click to collapse
Hey man, thanks for the suggestion, but tried that too. Did not get an option to download the kdz when I entered IMEI. Here's the screenshot I get.

hi sorry to bump in
but i made the huge mistake in renaming system apps, so now bootloop and same security error condition with a ls996 zv6,
1.- i know that don't even think to try to downgrade from zv6 to zv5 tot= Brick.
2.- is there a way to push, copy (aroma file manager, twrp file manager), in normal or stock recovery?
3.- is there a way to flash rootedsystem.img zv6 to the phone in: recovery, fastboot or even the command:
Step 11 flash commands:
For LS996 (ZV6/ZV7/ZV8)
Code:
dd if=/data/media/0/rootedsystem.img bs=8192 seek=58368 count=522240 of=/dev/block/mmcblk0, from another source, rather than from internal sd, because obviously i didn't copied to the device previously?
4.- already tried to flash from stock recovery, the ZV6 Update= update.zip but it gives an error to load because some system app not valid, i remember
please, if someone could help me and us with this problem
thank you very much indeed

atv said:
but i made the huge mistake in renaming system apps, so now bootloop and same security error condition with a ls996 zv6,
1.- i know that don't even think to try to downgrade from zv6 to zv5 tot= Brick.
2.- is there a way to push, copy (aroma file manager, twrp file manager), in normal or stock recovery?
3.- is there a way to flash rootedsystem.img zv6 to the phone in: recovery, fastboot or even the command:
Step 11 flash commands:
For LS996 (ZV6/ZV7/ZV8)
Code:
dd if=/data/media/0/rootedsystem.img bs=8192 seek=58368 count=522240 of=/dev/block/mmcblk0, from another source, rather than from internal sd, because obviously i didn't copied to the device previously?
4.- already tried to flash from stock recovery, the ZV6 Update= update.zip but it gives an error to load because some system app not valid, i remember
please, if someone could help me and us with this problem
thank you very much indeed
Click to expand...
Click to collapse
Only solution is to send it back to LG.
There is no way (yet) to flash with dd command from external SD.
and there is no other tot besides ZV5 and as you said thats a Hard brick.

hi
Alex_XV6700 said:
Only solution is to send it back to LG.
There is no way (yet) to flash with dd command from external SD.
and there is no other tot besides ZV5 and as you said thats a Hard brick.
Click to expand...
Click to collapse
thank you very much indeed for your answer, but as another reply i posted, as question in other thread, read this, maybe a solution if semi bricked, LG security error, in: zv06, zv07 or zv08, if it turns to be truth....
hi...... there is a forum member form another site that claims to have a zv8 rooted tot to sell, but i'm not sure if its true or reliable, claims that it fix bricks and its a 4.3 gb file, does anybody knows about it?
any help or guide please, thank you very much indeed
File name:LGLS996AT-00-ZV8-SPR-US-AUG-18-2015+01.zip
Android OS version:5.1
File Download:
Buy topic
Existing 2 People buy This topic is to be paid to the author 1000 Credits Before viewing
This TOT firmware contains the ROOT authority, after the success of flashing, ROOT success
TOT firmware flashing effect:
1.brick the repair
2, upgrade ROM
3, downgrade ROM
4, remove the lock screen password
5, Clear Google locks
6, restore factory settings
Tips:
1,This TOT firmware suitable for LGFlashTool.
2,After the purchase of the post, hidden content will be displayed, then you can free download attachments.
3,After purchase is successful, the second time to visit this page does not appear charges prompt.

atv said:
thank you very much indeed for your answer, but as another reply i posted, as question in other thread, read this, maybe a solution if semi bricked, LG security error, in: zv06, zv07 or zv08, if it turns to be truth....
hi...... there is a forum member form another site that claims to have a zv8 rooted tot to sell, but i'm not sure if its true or reliable, claims that it fix bricks and its a 4.3 gb file, does anybody knows about it?
any help or guide please, thank you very much indeed
File name:LGLS996AT-00-ZV8-SPR-US-AUG-18-2015+01.zip
Android OS version:5.1
File Download:
Buy topic
Existing 2 People buy This topic is to be paid to the author 1000 Credits Before viewing
This TOT firmware contains the ROOT authority, after the success of flashing, ROOT success
TOT firmware flashing effect:
1.brick the repair
2, upgrade ROM
3, downgrade ROM
4, remove the lock screen password
5, Clear Google locks
6, restore factory settings
Tips:
1,This TOT firmware suitable for LGFlashTool.
2,After the purchase of the post, hidden content will be displayed, then you can free download attachments.
3,After purchase is successful, the second time to visit this page does not appear charges prompt.
Click to expand...
Click to collapse
Well I wouldnt trust this.
But if this only flashes the system partition well it shouldnt be harmful. You could download the zv6 stock sys.img and flash it afterwards so you can ota update your phone to zv9 and then root again.
But like I said I wouldnt suggest that...

Alex_XV6700 said:
There is no way (yet) to flash with dd command from external SD.
Click to expand...
Click to collapse
Why no? You can use Push_file.exe.

MAXIMATOR said:
Why no? You can use Push_file.exe.
Click to expand...
Click to collapse
Please, elaborate....

jplum22 said:
Please, elaborate....
Click to expand...
Click to collapse
https://www.google.com.ua/#q=Push_file.exe
---------- Post added at 11:30 AM ---------- Previous post was at 11:26 AM ----------
LS9960 ZV6 with
LG Security Error
Authentication Fail #9
was secsessfuly unbricked without SDcard using Push_file.exe for send system.img to internal sdcard

Well this is new @MAXIMATOR at least it is to me.
If you let me I can add this to my back to stock forum.

Push_file.exe can not send files larger than 16 MB . the image to be split into files no more than 16 MB , after which they can be sent to the device . On the device, combined to one file.

MAXIMATOR said:
Push_file.exe can not send files larger than 16 MB . the image to be split into files no more than 16 MB , after which they can be sent to the device . On the device, combined to one file.
Click to expand...
Click to collapse
I've already tried. It doesn't work. Files can not be combined.
http://forum.xda-developers.com/g-flex2/help/to-unbrick-g-flex-2-ls996-t3286105

Restore v20 to 100% Stock (!!even for bricked devices!!)

This is a simple method to restore your v20 to stock, I have tried with my bricked H990DS with wrong bootloader flashed.
1. Download .kdz file for your v20 model from the following links. Currently v20 models available are:
F800K, F800L, F800S, H915, H918TN, H990, VS995, H990N and H990DS
H990DS https://lg-firmwares.com/lg-h990ds-firmwares/firmwares/
H990N https://lg-firmwares.com/lg-h990n-firmwares/firmwares/
https://lg-firmwares.com/
2. Search, download and install LGUP ( LGUP_Store_Frame_Ver_1_14_3.msi ) and a file called LGUP_common.dll
2a. Copy the LGUP_common.dll to C:\Program Files (x86)\LG Electronics\LGUP\model\common (May need to modify folder access right)
3. Search, download and install LG Driver ( LGMobileDriver_WHQL_Ver_4.1.1.exe )
4. Completely Power off the v20 ( or to remove and put the battery back )
5. Plug the USB end of sync cable to your PC
6. Press and hold "Volume Up"
7. Plug in the USB-C end of sync cable to the v20. The phone will enter download mode (or Firmware Update). Now you can release the "Volume Up".
8. Run LGUP. The program will regconise the v20.
9. At the file path, click "..." and chose the .kdz file
10.Choose "UPGRADE"
11.Click "Start" and wait until the process is complete.
Now we have a safe method of restoring bricked v20. Hope developers can start trying to root without worrying of bricking the phone.
This method is verified on my H990DS. If anybody successfully flash using this method please let us know. Thanks!

Great thread! Just want to add a quick PSA for this:
This may update your phone to the latest firmware which may patchs the current recowvery exploit. While this will unbrick your phone, you should make sure that you have the a firmware below 10i (w/o patch) to flash. If you still have access to TWRP and don't have a 10d firmware for your device, use this instead.

funkeywoookey said:
Great thread! Just want to add a quick PSA for this:
This will update your phone to the latest firmware, 10i (your phone came with 10d). The latest firmware patches the current recowvery exploit we use to root our V20s. While this will unbrick your phone, it should be used a last resort for those still using the 10d firmware and have access to TWRP (use this instead).
Click to expand...
Click to collapse
Thanks for the reminder. Actually it depends on what .kdz is available. For H990DS there is actually v10b firmware for download. So after I flash using this method the dirtycow exploit is still there. Take a look at the filename of the .kdz (e.g. 990ds10b_00_OPEN_TW_DS_OP_1125.kdz is v10b released at Nov 25) Seems that versions below v10i are still ok for dirtycow.

ahlok_hk said:
Thanks for the reminder. Actually it depends on what .kdz is available. For H990DS there is actually v10b firmware for download. So after I flash using this method the dirtycow exploit is still there. Take a look at the filename of the .kdz (e.g. 990ds10b_00_OPEN_TW_DS_OP_1125.kdz is v10b released at Nov 25) Seems that versions below v10i are still ok for dirtycow.
Click to expand...
Click to collapse
Ahh! Nice! Hadn't considered that. I'll update my OP

Darn. Got my hopes up. No VS995 in the list. No T-Mobile and no Sprint either. I don't need it....yet...but I would love to have a restore method for my VS995. Though I've had an LG G3 rooted and flashing custom roms, kernels, and mods for 30 months and never once restored it to stock so perhaps the V20 will be the same

ahlok_hk said:
This is a simple method to restore your v20 to stock, I have tried with my bricked H990DS with wrong bootloader flashed.
1. Download .kdz file for your v20 model from the following links. Currently v20 models available are:
F800K, F800L, F800S, H915, H918TN, H990, H990N and H990DS
http://lg-firmwares.com/category/lg-series/lg-v20-dual/
http://lg-firmwares.com/category/lg-series/lg-v20/
2. Search, download and install LGUP ( LGUP_Store_Frame_Ver_1_14_3.msi )
3. Search, download and install LG Driver ( LGMobileDriver_WHQL_Ver_4.1.1.exe )
4. Completely Power off the v20 ( or to remove and put the battery back )
5. Plug the USB end of sync cable to your PC
6. Press and hold "Volume Up"
7. Plug in the USB-C end of sync cable to the v20. The phone will enter download mode (or Firmware Update). Now you can release the "Volume Up".
8. Run LGUP. The program will regconise the v20.
9. At the file path, click "..." and chose the .kdz file
10.Choose "UPGRADE"
11.Click "Start" and wait until the process is complete.
Now we have a safe method of restoring bricked v20. Hope developers can start trying to root without worrying of bricking the phone.
This method is verified on my H990DS. If anybody successfully flash using this method please let us know. Thanks!
Click to expand...
Click to collapse
are you using uppercut for the model .dll in LGUP?
i have tried this method a few times over the last week, no luck. but i was pretty rough with my phone to be honest, no backup and tried all the other v20 variant roms.
right now LGUP detects my phone as a US99610D so will not flash the H990DS firmware, tried to edit the kdz in hex editor for name value but it detects the kdz as corrupt now. any experience with this?

881jz said:
are you using uppercut for the model .dll in LGUP?
i have tried this method a few times over the last week, no luck. but i was pretty rough with my phone to be honest, no backup and tried all the other v20 variant roms.
right now LGUP detects my phone as a US99610D so will not flash the H990DS firmware, tried to edit the kdz in hex editor for name value but it detects the kdz as corrupt now. any experience with this?
Click to expand...
Click to collapse
I did not use uppercut because anti-virus reported it detect trojan when I use the program.

ahlok_hk said:
I did not use uppercut because anti-virus reported it detect trojan when I use the program.
Click to expand...
Click to collapse
so you found a v20 dll file? do you mind posting a link? or how did you get past LGUP picking up v20 as unknown device? or was this not an issue for you?

881jz said:
so you found a v20 dll file? do you mind posting a link? or how did you get past LGUP picking up v20 as unknown device? or was this not an issue for you?
Click to expand...
Click to collapse
The LGUP first did not detect the device and asked for driver. So I installed the driver as mentioned in OP. After that i was able to flash the phone with the kdz file.

Pleaseeeee helllllpppppp !!!!!!!
IS THERE AN KDZ FILE FOR SPRINT V20 VERSION LS997 PLEASEEEE HELPPPPP I WILL SHARE AND SUB AND WHAT YOU WANT PLEASSSSEEEEE HELPPP !!!!!!!:crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying:

Spider Monkey said:
IS THERE AN KDZ FILE FOR SPRINT V20 VERSION LS997 PLEASEEEE HELPPPPP I WILL SHARE AND SUB AND WHAT YOU WANT PLEASSSSEEEEE HELPPP !!!!!!!:crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying:
Click to expand...
Click to collapse
If you know your phone's IMEI number try here:
http://www.rootjunky.com/tag/kdz/

Since some user report this method may not work. Would moderator pls close this thread. Thanks.

There is no any link in the page
I HAVE DO SUCH AS THE EXAMPLE BUT THERE IS NOT ANY LINK IN THE PAGE PLEASEEEE HELPE IS THERE ANY METHOD ELSE
???????:crying::crying::crying:

ahlok_hk said:
Since some user report this method may not work. Would moderator pls close this thread. Thanks.
Click to expand...
Click to collapse
What do you mean?
If this method worked for you & a few other users, it should probably become a sticky rather than closing the thread...
Unbricking a device & restoring to 100% stock is an important feature to most, so if a few users are having issues we should probably help sort out those issues rather than abandoning the thread...
---------- Post added at 03:51 AM ---------- Previous post was at 03:46 AM ----------
Spider Monkey said:
I HAVE DO SUCH AS THE EXAMPLE BUT THERE IS NOT ANY LINK IN THE PAGE PLEASEEEE HELPE IS THERE ANY METHOD ELSE
???????:crying::crying::crying:
Click to expand...
Click to collapse
Just use google
http://www.google.com/search?q=LGUP_Store_Frame_Ver_1_14_3.msi&ie=utf-8&oe=utf-8&client=firefox-b&gfe_rd=cr&ei=ToNeWP79C8Xr8Afvwb6gAQ&gws_rd=cr
&
http://www.google.com/search?q=LGMobileDriver_WHQL_Ver_4.1.1.exe&ie=utf-8&oe=utf-8&client=firefox-b&gfe_rd=cr&ei=1yVfWJGROa_r8AfD9Y_wAg

Anybody confirm working on verizon

Verizon is not listed, so....no
Sent from my VS995 using Tapatalk

Hi I have a lg v20 h918tn and it was rooted with the TWRP ... but my friend messed it up with the recovery mode when he tried to factory reset and he didn't know what he was doing... I can't reboot into system now.. everytime I intall the stock rom when it finishes it always go back to twrp ... I kinda don't get all your info I'm an amateur in all this please help.

Spider Monkey said:
IS THERE AN KDZ FILE FOR SPRINT V20 VERSION LS997 PLEASEEEE HELPPPPP I WILL SHARE AND SUB AND WHAT YOU WANT PLEASSSSEEEEE HELPPP !!!!!!!:crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying::crying:
Click to expand...
Click to collapse
Spider Monkey you are not alone.

ahlok_hk said:
Since some user report this method may not work. Would moderator pls close this thread. Thanks.
Click to expand...
Click to collapse
don't close it off, if it worked for you it should work for others that haven't broken the phone quite as much as me (boot, recovery, aboot and system changed).
the dll looks to be a requirement, perhaps uppercut worked for you prior to you AV killing it. i used it despite the AV alert.
so that part works fine, my phone is detected as version US99610d (files used during root attempt) which prevents me running the KDZ with "Error: KDZ file is invalid. US996 -> H990"
i tried to edit KDZ file to change version from H990 to US996 but this just corrupted the file.
i edited the model in build.prop of a rom and flashed it but it failed to make a difference to LGUP.
in a last ditch effort i restored aboot.img but phone is still detected as 996 instead of 990. but now no more twrp or unlocked bootloader.
any idea what LGUP reads the version info from or how to force it to run a KDZ from a different model?

abel_dlg said:
Hi I have a lg v20 h918tn and it was rooted with the TWRP ... but my friend messed it up with the recovery mode when he tried to factory reset and he didn't know what he was doing... I can't reboot into system now.. everytime I intall the stock rom when it finishes it always go back to twrp ... I kinda don't get all your info I'm an amateur in all this please help.
Click to expand...
Click to collapse
Perhaps this will help: http://forum.xda-developers.com/v20/how-to/restore-h918-to-100-stock-requires-twrp-t3504798

[PROJECT] Real Unbrick for hard-bricked Moto Z Play (addison)

Welcome everyone!
This project has started, becouse we need real solution for the problem. The problem of hard bricked Moto devices. It is like a curse.
When my device bricked I have done solid research, I have gathered many informations and files essential to revive my cellphone but 5 years experience of linux, rooting, compiling kernels and roms weren't enough to make it work.
But nevermind. I am even more determinated and I am asking ALL of You guys here to help me. Together we will come to solution.
Here is what I got, happy reading :
DICTIONARY:
PBL - Primary bootloader of the chip - this is like BIOS for phone so it checks chip for damage and problems and then it tries to load SBL but if SBL is corrupted or checksum doesn't match, PBL invokes Qualcomm HS-USB QDLoader 9008 emergency mode. PBL is hard flashed into SoC and can't be corrupted by firmware.
SBL - Second stage bootloader wich is more advanced than PBL. It initializes phone hardware and ABOOT.
ABOOT - Application bootloader (HBOOT). You probably know this one well. Android botloader.
Full mmcblk0 backup - Backup of whole phone flash storage byto to byte.
blankflash - method of repairing msm phones in 9008 state
programmer.mbn - Special type of software programmer that is being sent to chip in Qualcomm 9008 emergency mode. There it comunicates with pc via firehose protocol. Each phone has set of their own programmers, they are unique to phone and other programmers don't work. These programmers are signed so tampering it results in not working one.
firehose protocol - it is used to tell programmer what operations it must do on chip.
singleimage.bin - this package contains instructions for programmer and set of files it need (for example to replace)
gpt_main0.bin - Partition layout
rawprogram0.xml - instructions for programmer
patch0.xml - I don't know yet
STAR.exe - Application for managing and editing contents of singleimage.bin aka blankflash files
QPST - Flash tool from Qualcomm it basic function is to handle blank-flashing in a better way, also it allows for in-depth debugging of the process
Qualcom Premium Tool - Program made by Mppg Myanmar that is capable of making unlocking bootloader, OEM locks, making backup/restore of chip firmware, handling blank-flashing in VERY specific way (creating instructions for programmer), reading eMMC structure from firmware (can generate gpt layout so very useful!!!), modyfing FW and removing Xiaomi account. It also contains ALL programmers
for more:
https://forum.xda-developers.com/android/general/info-android-device-partitions-basic-t3586565
https://alephsecurity.com/
https://github.com/alephsecurity/firehorse
https://github.com/aravindvnair99/Motorola-Moto-E-XT1022-condor-unbrick
INFO:
1. What causes the brick
I bet 100$ that you hard-bricked your Moto Z Play by installing OTA updates after downgrading firmware. This is only known reason for me at the time of writing this. There is most probable reason why it happens, look:
There are two most common chips on which smartphones are built - Qualcomm and Mediatek. While Mediatek chips are "modification friendly" and simple, Qualcomm chips are somewhat more advanced and have many features that can be enabled or disabled during prorammming in factory. One of them is PBL signature checking. During programming of your phone, proper signatures of SBL are written to it. When someone tries to override default SBL with the new one, it checksums are compared with that stored. If they match, new one is flashed, if not, then update does not happen.
Ok, but what it has to do with brick?!
I explain:
1. You decide to downgrade your firmware
2. During flashing, everything goes "well" (Phone boots), but trully update is partial:
FW in chip is (obviously) more recent that the one you downgrade to, and SBL signature is different (updated), so when it is compared to the signature of SBL from FW you want to flash, it don't match. That don't rise error and flashing continues. Only partition that stays untouched is bootloader, but all other partitions get replaced by those in FW zip. SBL is still compatible with the new partition offsets and partition layout overall so phone functions normally.
3 When OTA is executed, it checks the version of currently installed firware. The most reliabe way to do it is to check checksum of SBL which is pretty logical becouse it's checksum is like "fingerprint" of firmware. Normally, if it would detect the old firmware, OTA would be stopped, but newer SBL tricks it and OTA installs anyway.
4 Results are horrible, becouse OTA does not check GPT table and flashes partitions in bad sectors, corrupting FW.
This causes bootloader to go into Qualcomm HS-USB QDLoader 9008 safe mode.
5 Viola! Hard brick!
2. How to fix it?
That is jolly good question! What we have to do is to reflash full chip firmware. Suprisingly I see some solutions, but those need to be developed:
A) SD-BOOT
It turns out that our fancy chip can probably boot from SD-CARD! The procedure works like this:
- When chip starts, one of the very first things it does is loading the memory, so it can actually work. The trick, is that chip loads it from specific disk, marked with exact name (I don't remember which, but I will do research). Speccially repared SD-CARD can appear with that name, so chip boots from it, not from internal memory. (This trick is proved to work on this model)
How to do it?
- Get full dd of working phone - it must be phone with the SAME chip and very likely the same model
- flash it to SD-CARD of 32GB or more, class 10 speed or higher, directly to card, not partition
- put card in phone, turn it on and wait
- you should see HBOOT
- select fastboot and flash new FW via it
- viola!
!!!THIS IS COMPLICATED PROCEDURE, I WILL MAKE DETAILED THREAD SOON, BUT FOLLOW IT ONLY IF YOU KNOW WHAT ARE YOU DOING!!!
B) FIREHOSE/SAHARA ATTACK
This could be achieved by sending payload via Firehose programmer that would allow to break verification of SBL or somehow allow SBL to be flashed. Now, PBL blocks attempts to update SBL. I have thesis that it is becouse PBL do not allows for SBL downgrade, so it's version must be higher, but we try to flash same version of SBL so it doesn't work. That thesis needs confirmation.
C) CRAFT BLANKFLASH
This would be last resort. It will work for sure, but this method needs knowledge and I don't know if it is doable.
STEP 1: Get white-listed blankflash checksums from OTA (we would need to reverse engineer those)
STEP 2: Break hash
STEP 3: Craft blankflash with needed hash
STEP 4: Flash
NEVER USE BLANKFLASH (ATTENTION!)
DO NOT try any blankflash files. They can make situation a lot worse and even physically (!) dmage your phone.
D) JTAG
Medusa Box etc.
E) Qualcomm Premium Tool
This can even work, but it is untested and there is a slight chance that can worsen state of phone (needs confirming).
The tool is very advanced and I need to gather info about usage, so very probable to be a good solution if we will learn how to use it!
E) METHOD 7
Interesting method from this guy: (7th option, I have contacted him if it is compatibile)
https://github.com/aravindvnair99/Motorola-Moto-E-XT1022-condor-unbrick/blob/master/Unbrick%20methods.md
3. DOWNLOAD
(Links will be aded *soon*)
XDA:DevDB Information
Unbrick Developement for Moto Z Play (addison) Full-Brick, Tool/Utility for the Moto Z Play
Contributors
Bobernator, Stayn, Artim_96, Camarda
Version Information
Status: Nightly
Created 2019-05-04
Last Updated 2019-05-14

I really hope we can get a fully working detailed method to unbrick this device, I'll follow this project and try to help what I can, my phone isn't bricked but I think that an unbrick guide is absolutely necessary.
By the way, did you tried the Qualcomm Board Diag method? Before the Moto Z Play I had a LG G3 and got it hard-bricked and my pc would recognize it as "Qualcomm HS-USB QDLoader 9008" too, using the Board Diag method I got to erase completely the emmc and flash each partition manually, that got it back to life again, of course theres a requirement and it's the AP Chipset files. I don't know if you already tried so you tell me

Stayn said:
I really hope we can get a fully working detailed method to unbrick this device, I'll follow this project and try to help what I can, my phone isn't bricked but I think that an unbrick guide is absolutely necessary.
By the way, did you tried the Qualcomm Board Diag method? Before the Moto Z Play I had a LG G3 and got it hard-bricked and my pc would recognize it as "Qualcomm HS-USB QDLoader 9008" too, using the Board Diag method I got to erase completely the emmc and flash each partition manually, that got it back to life again, of course theres a requirement and it's the AP Chipset files. I don't know if you already tried so you tell me
Click to expand...
Click to collapse
Hi! Really nice to read that . I didn't tried it but i will chec k it out in a while. Sorry for not responding immediatelly but this will change from now, I have XDA app so I stay updated.

Have you seen this post? There's apparently a new Oreo blankflash https://forum.xda-developers.com/showpost.php?p=79514510&postcount=419

echo92 said:
Have you seen this post? There's apparently a new Oreo blankflash https://forum.xda-developers.com/showpost.php?p=79514510&postcount=419
Click to expand...
Click to collapse
Website is legit, sounds like something good, but i will byte-compare it to my other blank flashes in collection. Maby it will worsen state of my device but I will try it.
Ps. I am working on a download section!!!
EDIT: DO NOT TRY IT YET. As you can see in the link this has been uploaded 2 days ago. Post has 1 day, so this is suspicous as hell.

Bobernator said:
Website is legit, sounds like something good, but i will byte-compare it to my other blank flashes in collection. Maby it will worsen state of my device but I will try it.
Ps. I am working on a download section!!!
EDIT: DO NOT TRY IT YET. As you can see in the link this has been uploaded 2 days ago. Post has 1 day, so this is suspicous as hell.
Click to expand...
Click to collapse
I understand the reason to be suspicious, since there's also no way to verify the origin of this blankflash. Also, is there a OPNS27.76-12-22-10 firmware? I thought OPNS27.76-12-22-9 was the last build?

I will answer this way:

Bobernator said:
I will answer this way:
Click to expand...
Click to collapse
That blankflash looks like it worked - seems your device is in fastboot mode despite the photo angle.

echo92 said:
That blankflash looks like it worked - seems your device is in fastboot mode despite the photo angle.
Click to expand...
Click to collapse
Yes, it worked! But do not make misteake and after you flash blankflash do not flash full firmware. Instead flash only recovery - TWRP and make backup of modemst1, modemst2 and FSG partitions, so you can revert your IMEI. After that full flash android 8 FW

Bobernator said:
Yes, it worked! But do not make misteake and after you flash blankflash do not flash full firmware. Instead flash only recovery - TWRP and make backup of modemst1, modemst2 and FSG partitions, so you can revert your IMEI. After that full flash android 8 FW
Click to expand...
Click to collapse
Can you see your recovery partition with the dummy bootloader from the blankflash? Do you have to flash the GPT/bootloader from firmware first?

Well, this is nuts @Bobernator, I'm really happy we have an unbrick method.
If MTP is still working, you can flash the file I attached to this post to automatically backup the required partitions, this can also be helpful in case anyone wants a full IMEI Backup, also, I tried this step:
fastboot flash fsg mmcblk0p29_fsg_backup
fastboot flash modemst1 mmcblk0p27_modemst1_backup
fastboot flash modemst2 mmcblk0p28_modemst2_backup
Click to expand...
Click to collapse
and it gives me permission denied when flashing modemst1 and modemst2, I think we should flash modem NON-HLOS.bin and erase modemst1 and modemst2, if you agree I'll update the zip I made to backup NON-HLOS.bin instead of modemst1 and modemst2

Quick question, is it worth mentioning only to perform steps 12 and 13 (flashing your FSG and modemst backups) if your device has no signal/IMEI issues after flashing the Oreo firmware? Just wondering since the firmware flash and subsequent boot may correctly rebuild the modemst files...

echo92 said:
Quick question, is it worth mentioning only to perform steps 12 and 13 (flashing your FSG and modemst backups) if your device has no signal/IMEI issues after flashing the Oreo firmware? Just wondering since the firmware flash and subsequent boot may correctly rebuilt the modemst files...
Click to expand...
Click to collapse
I don't know for sure but a backup is always recommended and more if it is the IMEI, then, you can flash all partitions and then before restoring the backup boot into the system and check by yourself if you're getting signal and its working... :good:

Stayn said:
I don't know for sure but a backup is always recommended and more if it is the IMEI, then, you can flash all partitions and then before restoring the backup boot into the system and check by yourself if you're getting signal and its working... :good:
Click to expand...
Click to collapse
Yup, an IMEI backup is always useful Just wanted to ask since it's not pointed out in the opening post's guide to check your IMEI/signal before committing to step 12/13. If it's working, no need for those two steps!

@echo92 I forgotten about IMEI totally so I can't tell you, but I can't confirm that's safe to flash gpt and bootloader from OREO fw (8.0). I did this way and everthing is working. Even OTA updates to most recent witouth problems! Here are the proofs (language is "Polish" if you want to translate):

Stayn said:
Well, this is nuts @Bobernator, I'm really happy we have an unbrick method.
If MTP is still working, you can flash the file I attached to this post to automatically backup the required partitions, this can also be helpful in case anyone wants a full IMEI Backup, also, I tried this step:
and it gives me permission denied when flashing modemst1 and modemst2, I think we should flash modem NON-HLOS.bin and erase modemst1 and modemst2, if you agree I'll update the zip I made to backup NON-HLOS.bin instead of modemst1 and modemst2
Click to expand...
Click to collapse
I really appreciate this! Thanks!
If you update your ZIP, I will attach it into the project today, and I will try to find out solution for you, becouse it looks if you can't restore IMEI now (correct me if I am wrong)

echo92 said:
Yup, an IMEI backup is always useful Just wanted to ask since it's not pointed out in the opening post's guide to check your IMEI/signal before committing to step 12/13. If it's working, no need for those two steps!
Click to expand...
Click to collapse
You are surely right. I will correct thread today.

Bobernator said:
I really appreciate this! Thanks!
If you update your ZIP, I will attach it into the project today, and I will try to find out solution for you, becouse it looks if you can't restore IMEI now (correct me if I am wrong)
Click to expand...
Click to collapse
Don't worry about the IMEI, I got it again after flashing my fsg backup, modem and erasing modemst1 and modemst2, now the problem is that on every ROM I get everytime a popup "com.android.phone" has stopped, till I remove the sim card, what could this be? This isn't my main phone so I'm not worried at all but this could happen to someone else

Dial *#06#, if you will get nothing or zero's that means it can be modem failure
Ps. Is your zip updated now?

Hello Guys,
I have the exact same problem. All started here with a changed screen that after update to 8 stopped working, so I did downgrade to 7, and the touch as back, than it started doing the OTA updates and I (dumb enough) accepted it, and now I have a bricked device.
***EDIT***
Now I could get access to the bootloader again, the flash blank worked but it had a catch, if I just executed the bat, it would not work, I had to open a CMD with admin rights, go to the folder and run the bat from there.
***EDIT 2***
So restored bootloader, and booted just like before it was corrupted, now it keeps asking for update, and I disabled it on the "Developer Menu", is that enough? Will not play with updates on this device anymore, android 7.1.1 with 2017 security updates will do it.
***EDIT 3***
Now I have a Mobile Network problem, it does recognize the SIM Chip, but won't get network access, I didn't backup before doing the Blank Flash, but it was not showing on the system before (because the downgrade from 8 to 6, and them upgrade to 7), is there a way to recover it or fix this no network registration possible?

Wrong sboot.bin on Samsung Xcover 3 - Hardbricked?

Greetings, everyone! Usually I have good knowledge regarding rooting, custom recovery and flashing a new system. But this time I tried to downgrade the Samsung Xcover 3 of my friend and flashed the Android 4.4.4 sboot.bin with Heimdall - unfortunately I forgot to tick the "no reboot" option. The moment it rebootet, I know do not have any access to the phone anymore.
When trying to bring it into download mode, it vibrates, but nothing else. Neither Linux nor Windows recognizes the phone. Is it dead? How to gain access so that I can flash the correct sboot.bin? Any tricks you recommend?

back2nature said:
Greetings, everyone! Usually I have good knowledge regarding rooting, custom recovery and flashing a new system. But this time I tried to downgrade the Samsung Xcover 3 of my friend and flashed the Android 4.4.4 sboot.bin with Heimdall - unfortunately I forgot to tick the "no reboot" option. The moment it rebootet, I know do not have any access to the phone anymore.
When trying to bring it into download mode, it vibrates, but nothing else. Neither Linux nor Windows recognizes the phone. Is it dead? How to gain access so that I can flash the correct sboot.bin? Any tricks you recommend?
Click to expand...
Click to collapse
If you can find a "debrick.img" or "debrick.bin" for your specific model number, there is a method that uses your external sdcard to boot the phone then repair it while it is booted.
But, first, you need to find a debrick.img or debrick.bin for your specific model number. If you can't find a copy for your model number, you can try finding another member here that has a rooted Xcover 3 with the exact same firmware as your device had and have them pull a copy of debrick.img or debrick.bin from their device then upload it for you to download.
If you can't find that, the only other options are to send the device to a repair shop for JTAG service or replace the motherboard.
Sent from my SM-S767VL using Tapatalk

Droidriven said:
If you can find a "debrick.img" or "debrick.bin" for your specific model number, there is a method that uses your external sdcard to boot the phone then repair it while it is booted.
But, first, you need to find a debrick.img or debrick.bin for your specific model number. If you can't find a copy for your model number, you can try finding another member here that has a rooted Xcover 3 with the exact same firmware as your device had and have them pull a copy of debrick.img or debrick.bin from their device then upload it for you to download.
If you can't find that, the only other options are to send the device to a repair shop for JTAG service or replace the motherboard.
Click to expand...
Click to collapse
I did not even expect that someone would answer here. THANK YOU SO MUCH, @Droidriven! That gives me hope to rescue the phone instead of having o buy a new one for my friend. Here is what I actually did wrong: In my attempt to "downgrade" from 5.1.1 Lollipop to Android 4.4.4 Kitkat (downgrade needed to be able to root the phone) I flashed the sboot.bin of Android 4.4.4 Kitkat with Heimdall and forgot to tick the NO REBOOT option.
That being said, the phone now only vibrates when using my JTAG (yes, I actually have one and the phone vibrates, but does not boot into download mode and is not recognized by neither Windows nor Linux). So, how to build this unbrick image? Could you help me with that? Both firmwares are to be found here:
Code:
https://samsungfirmware.net/samsung-galaxy-xcover-3-sm-g388f-stock-firmware
Another thread with sadly no file uploaded was to be found here:
Code:
https://forum.xda-developers.com/general/help/search-g388f-xcover3-debrick-img-sdc-t3399231
As for the creation of the unbrick image, do you recommend this tool? I currently have no Windows at hand but can provide you with the original PIT file if you can run this tool to create it:
Code:
http://forum.gsmhosting.com/vbb/f609/atf-v12-70-update-31-mar-2017-a-937102/index5.html#post10127092
DOWNLOAD LINK ATF_v12.70_Full_Installer:
Code:
http://www.mediafire.com/file/l1c9o7ibv2jypfv/ATF_v12.70_Full_Installer_%2528xdarom.com%2529.rar/file
Furthermore, I actually wanted to install LineageOS on that phone. Not sure if you have a Google-foo so strong that you are able to find a working one for me?
Thanks a lot for your help. May god return your efforts in helping me!

back2nature said:
I did not even expect that someone would answer here. THANK YOU SO MUCH, @Droidriven! That gives me hope to rescue the phone instead of having o buy a new one for my friend. Here is what I actually did wrong: In my attempt to "downgrade" from 5.1.1 Lollipop to Android 4.4.4 Kitkat (downgrade needed to be able to root the phone) I flashed the sboot.bin of Android 4.4.4 Kitkat with Heimdall and forgot to tick the NO REBOOT option.
That being said, the phone now only vibrates when using my JTAG (yes, I actually have one and the phone vibrates, but does not boot into download mode and is not recognized by neither Windows nor Linux). So, how to build this unbrick image? Could you help me with that? Both firmwares are to be found here:
Code:
https://samsungfirmware.net/samsung-galaxy-xcover-3-sm-g388f-stock-firmware
Another thread with sadly no file uploaded was to be found here:
Code:
https://forum.xda-developers.com/general/help/search-g388f-xcover3-debrick-img-sdc-t3399231
As for the creation of the unbrick image, do you recommend this tool? I currently have no Windows at hand but can provide you with the original PIT file if you can run this tool to create it:
Code:
http://forum.gsmhosting.com/vbb/f609/atf-v12-70-update-31-mar-2017-a-937102/index5.html#post10127092
DOWNLOAD LINK ATF_v12.70_Full_Installer:
Code:
http://www.mediafire.com/file/l1c9o7ibv2jypfv/ATF_v12.70_Full_Installer_%2528xdarom.com%2529.rar/file
Furthermore, I actually wanted to install LineageOS on that phone. Not sure if you have a Google-foo so strong that you are able to find a working one for me?
Thanks a lot for your help. May god return your efforts in helping me!
Click to expand...
Click to collapse
Sorry, I'm just now seeing this. Did you ever make any progress? Yes, I think there are some reliable methods to create debrick.img/debrick.bin files, there is one such method posted here at XDA in a random post in a thread here but I can't remember exactly what thread it is.

Question the boot.img file was downloaded to my phone to root it and then it has no identifiable imei number

the boot.img file was loaded into my phone in order to get root after that it could not detect imei numbers. Although they are in fastboot. I tried many different firmwares for this phone, but there is no result! I ask for your help. I was left without communication (sorry for not being very clear. I don't understand Russian and don't understand English at all, that's why I'm writing through a translator

The first thing you want to do is STOP FLASHING random images. It sounds like you are going to cause more harm than good if you keep going.
Figure out which firmware you started on (WW, EU, CN) and get the raw firmware for it. Follow the instructions to flash the raw firmware.
If that doesn't work, then you may need to contact the manufacturer, BUT at least you will be restored to stock. I cannot promise they will help you, but it sounds like you did more than flash a boot image. The IMEI is not stored there.

twistedumbrella said:
The first thing you want to do is STOP FLASHING random images. It sounds like you are going to cause more harm than good if you keep going.
Figure out which firmware you started on (WW, EU, CN) and get the raw firmware for it. Follow the instructions to flash the raw firmware.
If that doesn't work, then you may need to contact the manufacturer, BUT at least you will be restored to stock. I cannot promise they will help you, but it sounds like you did more than flash a boot image. The IMEI is not stored there.
Click to expand...
Click to collapse
Tell me where you can find the pure CN firmware? This phone was presented to me in this form already. And they told what happened to him. I doubt that ASUS support will help me, since in addition to everything according to the owner, the EMMCCDL_GUI utility was used. So I ask for help from knowledgeable people here.

And most importantly, what to flash and how?

Repair your ASUS ROG Phone 5 with EDL mode
If your phone can only enter EDL mode (9008 mode) this firmware is glad to help you. It can be flashed in through the miflash tool. The firmware is made through the official package...
forum.xda-developers.com
RAW Firmware Collection and Guide
All fastboot / adb commands require using the side USB-C port https://developer.android.com/studio/releases/platform-tools.html#download Make sure you have fastboot installed Add platform tools to PATH (post 2) Make a backup of anything...
forum.xda-developers.com

twistedumbrella said:
Repair your ASUS ROG Phone 5 with EDL mode
If your phone can only enter EDL mode (9008 mode) this firmware is glad to help you. It can be flashed in through the miflash tool. The firmware is made through the official package...
forum.xda-developers.com
RAW Firmware Collection and Guide
All fastboot / adb commands require using the side USB-C port https://developer.android.com/studio/releases/platform-tools.html#download Make sure you have fastboot installed Add platform tools to PATH (post 2) Make a backup of anything...
forum.xda-developers.com
Click to expand...
Click to collapse
did not help(

What? So no one will help ???

Return the phone or wait until the methods exist.
Those are the only quick answers left.

twistedumbrella said:
Return the phone or wait until the methods exist.
Those are the only quick answers left.
Click to expand...
Click to collapse
It was opened. This is not an option either

If you purchased it used and the seller refused a return, it sounds like they were trying to recover what they could by selling their problem to someone else. It's likely they knew there wasn't a self-service fix right now.
Just to be clear, what you need is a low-level EDL restore. As it stands, one of the files required is not available to the public. If you have a local repair shop, they may be able to do it (and will likely charge a fee).
Do NOT pay someone over the internet. It CANNOT be done remotely.