Database Info

[GUIDE] [XT1575] Return to stock and relock bootloader

*** This process can relock your bootloader if you chose, but it does NOT restore your warranty in any way, so don't ask ***
Be aware you do NOT have to lock the bootloader, have Status Code of 0, or have it show "Official" status to successfully accept and apply an OTA update, it will happily apply with an unlocked bootloader and unofficial software status, as long as you have a 100% pure stock ROM installed the update script doesn't care what the bootloader reports.
Preflash validation error? See notes at the bottom of this post.
Prerequisites:
1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image that is the same version or newer than what you have installed (see below for more info), for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)
XT1572 Factory Images: http://dl.prazaar.de/?dir=Android/XT1572/Factory courtesy of @Prazaar
XT1575 Factory Images: http://forum.xda-developers.com/moto-x-style/development/pure-firmware-tuff-wip-t3224833 - UPDATE: Direct link to XT1575 for 24.49-18-8 (Sept 1, 2016 security update) uploaded on 1/27/2017 courtesy of Motorola Firmware Team. The December 2016 security update image is NOT available as of yet!
Alternate firmware source for Pure and Style: https://firmware.center/firmware/Motorola/
XT1575 OTA ZIP file to go from 18-8 to 18-16 ONLY is available in this post for sideloading thanks to @annoyingduck
NOUGAT FIRMWARE (XT1575 ONLY): https://forum.xda-developers.com/moto-x-style/general/xt1575-moto-x-pure-edition-factory-t3704142
OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.
Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).
Code:
fastboot oem lock begin (see notes below if not wanting to lock)
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot erase customize
fastboot erase clogo
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.
This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay, Pokemon GO, and banking/financial apps.
Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.
If you are interested in returning to stock WITHOUT locking the bootloader, then follow the above commands, but the following commands in place of the "lock" commands in the list above:
fastboot oem fb_mode_set instead of fastboot oem lock begin
fastboot oem fb_mode_clear instead of fastboot oem lock
The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image. Note that different firmwares may contain a different number of system.img_sparsechunk.X files, you must flash the number you have in your firmware image in order. From what I have seen, most 5.1.1 firmwares have ten (0-9), 6.0 has nine (0-8), 6.0.1 has twelve (0-11), and 7.0 has ten (0-9) sparsechunks, but always verify with the XML flash file contained within the firmware archive to verify if you are in question.
If you lock with this process, you can unlock the bootloader again and even use the same unlock token... subsequent unlocking will wipe data as well. Doing this procedure will set OEM Locking option in Developer options to disabled, although it is perfectly safe to leave it like this, I suggest turning it on immediately since your warranty is gone and if something does go wrong you have the ability to unlock again to fix it.
NOTE: You must use a factory firmware image that is the same version as what you have installed or newer to successfully relock the bootloader, you cannot just grab the old (shipped) version from Moto's site. If you attempt to use a firmware image that is older than what you have installed currently, you will receive a Preflash Validation Error indicating such when you attempt to flash the partition table (gpt.bin). At this point you can either continue the flash and NOT lock the bootloader at the end, or stop until you can find the most current image. Moto used to be quite willing to hand these out when they were requested, so if you have a very new firmware installed you may not find one that you can use to relock with on the Internet. Part of the requirements to lock the bootloader is you must successfully flash the partition table (gpt.bin) in order to complete the lock process, if you can't then the bootloader lock process cannot be finished.
Also, some users have noted that after completing this process the software status does NOT go back to "Official", if it does not, upon accepting the OTA it should go back to official after the OTA is successful. The Status Code will always show 2 (relocked) or 3 (unlocked), and it can never go back to 0 (locked).
A proper flash log is attached to this guide.
Just a blurb on Marshmallow software versions... To determine what you need look at version/build numbers, here is the Security update dates and release dates (actual, not tests) of all known public OTA releases of Marshmallow for the Moto X Pure (Style varies somewhat). The initial release was MPH24.49-18 (sometimes MPH24.49-18_18, we don't know why, but it is the SAME versions), and all others after that are MPHS24.49-XX-XX as shown below.
18 or 18_18 - The initial (shipped) Marshmallow release for Moto X Pure, November 2015 (release via OTA in late-December 2015, incorrectly dated on Moto's official website as 01-SEP-16 in the "official" recovery images section, it is NOT the newest or recommended image to use)
18-3 - February 2016 (released for OTA in mid-March 2016)
18-4 - May 2016 (released for OTA in late-June 2016)
18-8 - September 2016 (released for OTA in early-November 2016)
18-16 - December 2016 (release for OTA in mid-February 2017) *** Not available as a factory image***
Nougat:
NPH25.200-22 - September 2017 (released for OTA September~November 2017) Factory image available as of 11/12/2017
NPH25.200-23 - Little is know about this version, it appears to be slowing rolling out to Verizon users only as of mid-November 2017 (no firmware available as of yet)
To see what version your bootloader is now, go into fastboot and perform a "fastboot getvar ro.build.fingerprint" and look at the output, it should be pretty clear.
NOTE: I no longer own this device, but will help where I can and will keep this thread open to assist users where ever possible, but I no longer have a device to test/verify things with.

acejavelin said:
*** This will relock your bootloader, but it does NOT restore your warranty in any way, so don't ask ***
So with Nougat coming, several people have asked how to return to stock to get the update... well, I just did this so here is a quick guide.
Prerequisites:
1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image, for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)
OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.
Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).
Code:
fastboot oem lock begin
fastboot flash partition gpt.bin
fastboot reboot bootloader
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.
This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay and Pokemon GO as well.
Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.
The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image.
A proper flash log is attached to this guide.
Click to expand...
Click to collapse
So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!

donrojo said:
So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!
Click to expand...
Click to collapse
Yes, of course it does... You can clearly see in the log I attached from my flashing the device.
The key is you cannot downgrade to a lower gpt.bin, you can only flash the same or newer version of firmware. After having several Moto devices, I can attest that downgrading successfully while locking is almost impossible. I will update my guide to make it clearer.
And please do not quote the entire first post and embed your comments in it, on mobile I had a very difficult time trying to determine what you were asking. EDIT: Sorry, your previous post looked very different in the XDA app, looks fine on computer... weird.

What is the purpose of relocking your bootloader? The unlocked bootloader has never interfered with me taking an OTA.

Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?

quakeaz said:
What is the purpose of relocking your bootloader? The unlocked bootloader has never interfered with me taking an OTA.
Click to expand...
Click to collapse
You are correct, and this as nothing to do with accepting OTA (that is just how this discussion came up), but the lock/unlock state of the bootloader has two distinct issues I can think of although there maybe more I am forgetting.
1. Security - If your bootloader is unlocked, anyone who gets access to your device can just fire up fastboot and boot TWRP and access any information on your device, even if it is encrypted since TWRP can read the encryption password.
2. SafetyNet API - Do to recent changes by Google, SafetyNet API checks to fail just because the bootloader is unlocked, even if everything else is perfectly stock... SafetyNet is a mandatory part of Play Services that auto-updates itself regardless of your settings, and it is used to see if your device has been modified (rooted) or tampered with in anyway, and applications can use SafetyNet to check the status of your device... Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting. UPDATE: This only seems to be enforced on devices that shipped with Nougat or newer, and does seem to effect any device upgraded to Nougat so far. Lollipop and Marshmallow devices are not effected.

acejavelin said:
Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting.
Click to expand...
Click to collapse
Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).
If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.
Also, just an observation, I assume once we do get the Nougat (or any other) OTA, the unlocked bootloader warning screen will return, since the unlocked flag has already been tripped and the OTA will write a new logo.bin.
---------- Post added at 08:25 AM ---------- Previous post was at 08:20 AM ----------
Mejilan said:
Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
Click to expand...
Click to collapse
You're fine to downgrade to the latest stock firmware you were running.

quakeaz said:
Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).
If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.
Click to expand...
Click to collapse
Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.
Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something, but it will still be the same code.

quakeaz said:
You're fine to downgrade to the latest stock firmware you were running.
Click to expand...
Click to collapse
Ah hah! Good to know.
Thank you.

acejavelin said:
Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.
Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something.
Click to expand...
Click to collapse
Thanks for confirming about the unlock/relock/unlock.
I just added a CC to check if it'd work. No issues here. Maybe it's only certain devices? Google Play Services 9.8.77.

Mejilan said:
Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
Click to expand...
Click to collapse
The issue isn't the aftermarket firmware or it's version, it could be Android 29 Gamma for all we care... You need to use an official Moto firmware that is at least the same version or newer than your bootloader and partition table (gpt.bin), if you are not a stock firmware you will need to do some investigating via the baseband version what actual version you have (unless you can remember the last official firmware version).
Safest bet is just use the current release, if you can't find it online you can always request it from Moto service but this may take several days (weeks in some areas I have heard). Be aware that the firmware posted on Moto's official is NOT the most current and is likely a downgrade if you have ever accepted an OTA since the device was released.

quakeaz said:
Thanks for confirming about the unlock/relock/unlock.
I just added a CC to check if it'd work. No issues here. Maybe it's only certain devices? Google Play Services 9.8.77.
Click to expand...
Click to collapse
All I know is it didn't work for me on BrokenOS anymore, neither did Pokemon Go (not that big deal though), so I figured go all in...
There are multiple articles on this online, here are just a few...
http://www.xda-developers.com/android-safetynet-now-reportedly-tripped-by-unlocked-bootloaders/
http://www.androidpolice.com/2016/1...unlocked-android-phones-android-pay-affected/
http://www.androidcentral.com/andro...u-unlock-your-bootloader-and-thats-good-thing

acejavelin said:
The issue isn't the aftermarket firmware or it's version, it could be Android 29 Gamma for all we care... You need to use an official Moto firmware that is at least the same version or newer than your bootloader and partition table (gpt.bin), if you are not a stock firmware you will need to do some investigating via the baseband version what actual version you have (unless you can remember the last official firmware version).
Safest bet is just use the current release, if you can't find it online you can always request it from Moto service but this may take several days (weeks in some areas I have heard). Be aware that the firmware posted on Moto's official is NOT the most current and is likely a downgrade if you have ever accepted an OTA since the device was released.
Click to expand...
Click to collapse
Understood, thank you.
I haven't been on stock since the first half of the year.
I honestly don't remember if my last stock build was 5.1.1 or 6.0, but regardless, I should be good to go if I just download the newest stock and attempt your tutorial.
Again, many thanks.

Does the relocking procedure wipe userdata like unlocking does? I am considering relocking as most of the Android Pay issues with unlocked bootloader seem to be with N. I'm already running stock so I was thinking I could just begin lock process, reflash same stock images, complete lock, skipping the erase userdata command.

quakeaz said:
Does the relocking procedure wipe userdata like unlocking does? I am considering relocking as most of the Android Pay issues with unlocked bootloader seem to be with N. I'm already running stock so I was thinking I could just begin lock process, reflash same stock images, complete lock, skipping the erase userdata command.
Click to expand...
Click to collapse
Probably, my assumption is you can't complete the process without erasing cache and userdata, as 'fastboot oem lock' will likely fail, but to be honest I did not test it. Basically to get it complete you must follow all steps of the flashing XML file in the firmware file.

acejavelin said:
Probably, my assumption is you can't complete the process without erasing cache and userdata, as 'fastboot oem lock' will likely fail, but to be honest I did not test it. Basically to get it complete you must follow all steps of the flashing XML file in the firmware file.
Click to expand...
Click to collapse
Interesting. I may give it a shot, if I do I'll report back here. The erase userdata and cache commands are optional according to Motorola.com factory image download page instructions. I've done normal stock reflash without them.

quakeaz said:
Interesting. I may give it a shot, if I do I'll report back here. The erase userdata and cache commands are optional according to Motorola.com factory image download page instructions. I've done normal stock reflash without them.
Click to expand...
Click to collapse
Good luck... Let me know how it goes, but I think that only works for developer models, on "normal" models you have to do oem lock begin before oem lock though, not the same process.

delete wrong thread

Can't seem to boot up
Hi, so I flashed using this guide, I'm using the XT1572 model in the UK and used the appropriate firmware etc, my issue is that after everything had finished and I rebooted, it was stuck booting for an hour, I know this phone can sometimes take a while to boot after a factory reset but I haven't experienced it this badly before, also, I flashed the moto splash screen image but the boot animation is still the one from AICP :/ any help would be appreciated guys

JIMMMEHHHH said:
Hi, so I flashed using this guide, I'm using the XT1572 model in the UK and used the appropriate firmware etc, my issue is that after everything had finished and I rebooted, it was stuck booting for an hour, I know this phone can sometimes take a while to boot after a factory reset but I haven't experienced it this badly before, also, I flashed the moto splash screen image but the boot animation is still the one from AICP :/ any help would be appreciated guys
Click to expand...
Click to collapse
Your flash didn't take... Do you have a log of flash attempt from the terminal?
Also, sometimes the firmware has different numbers of system sparse chunks, it's not always 8, and sometimes it only has "system.img" as a single file, you have to flash what it shows in the XML file contained within the firmware archive.

[GUIDE] How to flash a custom recovery and root a Nokia 6 Retail Phone

WARNING: This method currently doesn't work on Nokia 6 TA-1000 with latest Android O Update! Finding workaround.
Workaround found on leaked Android 8.1 Update, with Magisk Systemless Root Method.
ROOT YOUR PHONE MAY VOID YOUR WARRANTY, DO IT AT YOUR OWN RISK
You can download new recovery from this post: https://forum.xda-developers.com/nokia-6/how-to/nokia-6-ta-1000-homebrew-stock-android-t3752006
Changes in new TWRP Recovery 3.2.1-0:
1. Add English Interface.
2. Use Magisk ROOT instead of SuperSU ROOT.
3. You can backup EFS. However you can't backup modem or the procedure will break.
Thanks to @xinkid 's effort, we can finally root Nokia 6 on Android Oreo again.
Procedure for non TA-1000 users:
0. Backup your phone and remove your lock screen password before proceed! If your phone get stuck at "Powered by Android" splash after the procedure, you may need to format userdata.
1. Sideload the PLE-372B ota package in recovery, which you can download from here:
https://forum.xda-developers.com/nokia-6/help/nokia-6-ota-update-ddls-t3721424
Refer this guide's part 2 to downgrade.
https://forum.xda-developers.com/nokia-6/how-to/guide-upgrade-downgrade-nougat-oreo-t3752393
2. Flash the service bootloader and grant service permission
Reboot to bootloader, then flash the service bootloader with following commands. Service bootloader file (D1C-emmc_appsboot.mbn attached in this topic)
Code:
fastboot oem dm-verity [md5_of_your_device_serial_number]
fastboot flash aboot D1C-emmc_appsboot.mbn
fastboot reboot-bootloader
fastboot oem dm-verity [md5_of_your_device_serial_number]
For example, if your serial number is PLEABCD123456789, and the md5 checksum of your serial number is 5f47b9a8dc1da1873c12945cf806691e, then type this command:
Code:
fastboot oem dm-verity 5f47b9a8dc1da1873c12945cf806691e
fastboot flash aboot D1C-emmc_appsboot.mbn
fastboot reboot-bootloader
fastboot oem dm-verity 5f47b9a8dc1da1873c12945cf806691e
You can google a website to calculate md5 checksum of a string.
3. Reflash newer firmware basis to your phone except aboot
After you grant service permission, Extract the newer one OTA package on your PC, in this case, PLE-558B.
Everything you need are placed at firmware-update folder that you extracted.
Take PLE-558B for example, type these commands (commands need to be changed if newer firmware released):
Code:
fastboot flash sbl1 D1C-0-558B-sbl1.mbn
fastboot flash keymaster D1C-0-558B-keymaster.mbn
fastboot flash devcfg D1C-0-558B-devcfg.mbn
fastboot flash cmnlib64 D1C-0-558B-cmnlib64.mbn
fastboot flash rpm D1C-0-558B-rpm.mbn
fastboot flash tz D1C-0-558B-tz.mbn
fastboot flash cmnlib D1C-0-558B-cmnlib.mbn
fastboot flash modem D1C-0-558B-NON-HLOS.bin
fastboot flash dsp D1C-0-558B-adspso.bin
fastboot flash default_nv D1C-0-558B-NV-default.mbn
fastboot flash persist D1C-0-558B-00WW-persist.img
fastboot flash hwcfg D1C-0-558B-hwcfg.img
fastboot flash mdtp D1C-0-558B-00WW-mdtp.img
fastboot flash systeminfo fver
fastboot flash sec D1C-0-558B-sec.dat
fastboot flash cda PLE-00WW-013-cda.img
You'll also need the boot img in the extracted ota package:
fastboot flash boot boot.img
Then flash the custom recovery:
fastboot flash recovery nokia-6-ta-1000-8_0-twrp3.2.1-7to-recovery-magisk-root-2018.3.15.img
Power off your phone (case sensitive). Disconnect your phone after execute this command:
fastboot oem HALT
4. Connect your phone to a charger. When charging animation appears, press and hold Volume Up and Power until you see "7to.com" logo. Tap the white cog to choose English language, tap Advanced - Magisk Root, and wait for the procedure complete.
========================SEPARATOR====================
This new guide is only based and tested on Nokia 6 TA-1000. Non TA-1000 (e.g. TA-1021) users need to find their own old OTA package to downgrade.
1. Downgrade the bootloader according to this guide: https://forum.xda-developers.com/nokia-6/how-to/guide-upgrade-downgrade-nougat-oreo-t3752393
If you've flashed my homebrew Android O firmware, skip this step.
2. Use old method below to flash the new recovery again. You must use this recovery, otherwise you can't mount and root.
If you've flashed my homebrew Android O firmware, type this command will allow you to flash recovery:
Code:
fastboot-android oem dm-verity (your_serial_number's_md5_checksum)
3. Use old method below to enter recovery. To load English interface, tap the white cog on the top-right corner, then tap "English" and OK button, just wait few seconds.
4. Tap "Advanced" - "Magisk ROOT" and swipe.
5. If you meet recovery loop after rooted, flash the package misc_initial.zip attached below to escape from recovery loop.
That's it. It's not recommended to receive any newer OTA update since it will overwrite bootloader to patched state.
If you're using TA-1000, you can also try to flash Android 8.1 Homebrew Firmware before rooting.
I'm sorry if you found the guide looks confusing.
Following method for Nougat is archived, only for reference.
Yesterday, I got my own Nokia 6 Retail Phone. Since I’ve already rooted Nokia 5, 6 and 8 Prototype, now it’s time to find out how to root retail Nokia 6 without involving risky Qualcomm EDL Mode.
It works on any variant of Nokia 6 in theory, but I only tested it on D1C/TA-1000.
If there’s a custom recovery for Nokia 2/3/5 released, the guide also works on them. But I’ve tested it on a Nokia 8 retail phone, it doesn’t work on it.
To Nokia 7 and 8 Users, You may want to read this topic: https://forum.xda-developers.com/showthread.php?t=3729396
Click to expand...
Click to collapse
First, you need to download OFW of Nokia 6, install OST LA and patch it.
You can download them from here: https://forum.xda-developers.com/no...ia-8-official-firmware-links-updated-t3678487
(Although the link is for Nokia 8, firmware for Nokia 6 is still available)
如果你是中国用户，诺6固件的下载和使用方法请看本文：
https://www.ithome.com/html/android/328333.htm
Click to expand...
Click to collapse
If you own an unlocked prototype device, just skip to step 6.
Click to expand...
Click to collapse
1. Open OST LA from INSTALLATION DIRECTORY DIRECTLY instead of Start Menu.
2. Load your OFW you downloaded with extension name nb0.
3. Power off your phone, then connect it to your PC. This will boot your phone to “Download mode” directly, in fact it’s fastboot mode.
4. Click “Edit Phone Info” on OST LA. This will load a service purposed bootloader. When your phone reboots and re-enters the Download mode, the service purposed bootloader is now loaded.
5. You can close OST LA when it prompts “Boot FTM mode fail”, or just kill it in task manager if it’s not responding.
6. Open a command prompt or PowerShell in OST LA Installation Directory, then execute this command to flash a custom recovery:
Code:
.\fastboot-android flash recovery E:\recovery.img
I assume that you put the custom recovery in drive E and named as recovery.img.
You can also use your own fastboot if you want, but I’ll prefer the one provided along with OST LA.
I used the recovery from here: https://forum.xda-developers.com/no...veryteamwim-recovery-project-nokia-6-t3650499
7. Type this command but do not execute right now:
Code:
.\fastboot-android reboot
8. Now this step is a little tricky. Press and hold [Volume Up] and [Power] on your phone, then execute the command above at the same time. DO NOT RELEASE both keys on your phone until your phone entered the custom recovery.
9. Now your phone has entered a custom recovery. In this example, we’re using TWRP from Chinese 7to forum, only Chinese is available. I believe most of members on XDA can’t read Chinese, so I’ll attach screenshots. Simply tap “Advanced” – “SuperSU ROOT” will root your phone. If you prefer your own root zip update package, tap “Install Zip” then flash your own zip package in your storage, or tap “Advanced” – “ADB Sideload” then use ADB to sideload a zip package.
You can install the Materialized Theme for TWRP to get English interface from https://forum.xda-developers.com/android/themes/theme-twrp-materialised-dark-light-play-t2915584 by @z31s1g
Click to expand...
Click to collapse
Currently, DO NOT FLASH Magisk, or your phone will brick as Qualcomm 900E.
You can only use Magisk Root method in latest Android O Update, which I'll cover later.
Click to expand...
Click to collapse
10. After your phone rooted, you can reboot your phone. DO NOT INSTALL ANY OTA UPDATES OR YOUR PHONE WILL GET STUCK AT STOCK RECOVERY, but I’ll recommend you to disable automatic update in settings.
That’s wraps up the whole guide. Please do feedback if there’s something wrong.
Here' the video of how to root a Nokia 6: https://youtu.be/24b-49qTheg
Special thanks:
@blackpanther0582 for Nokia 3/5/6/8 Official Firmware.
@xinkid from Chinese 7to forum for his TWRP.
@hawwin88 for providing info about adding English Interface to recovery.
UPDATE: Uploaded the SuperSU ZIP (verify-xinkid.zip) used in this recovery.

Thank you it worked on nokia6 ta-1000 chinese. I rooted the phone successfully

Finally!
Boy O Boy!
Finally, after a long, long wait, Got my Nokia 6 Rooted! (TA-1000)
Thanks a LOT, Man! :good:

Anyone tried it on any other variant yet?

Hi .i am 1st root my ta1021 with Android 7.1.2 .f**k me
but your method have some problems ...
1. I can't find powershell or anything else in ost la folder.
2.fastboot-android not working....
Now I want complete your method from 6.
6. Before you must install adb and fastboot tools and drivers and use command prompt ,
copy recovery.img to drive c
After ost la changeing phone to edit mod wait 10 second and type this command
Fastboot flash recovery c:\recovery.img
And after flashing completed hold both volume+ and power button and type this command
Fastboot reboot
Don't release buttons and after few seconds you enter Chinese recovery swipe it to right and use screen shots to root your device, after that reboot to system you can find it from screenshot, it go to download mod and then type
Fastboot continue
And enter congratulations, your phone go to normal boot.
Bla bla super su installed....
Thanks, hikari_calyx. For this thread..
Some errors happend when I use rill but after reboot again it is not happening....

same6630 said:
Hi .i am 1st root my ta1021 with Android 7.1.2 .f**k me
but your method have some problems ...
1. I can't find powershell or anything else in ost la folder.
2.fastboot-android not working....
Now I want complete your method from 6.
6. Before you must install adb and fastboot tools and drivers and use command prompt ,
copy recovery.img to drive c
After ost la changeing phone to edit mod wait 10 second and type this command
Fastboot flash recovery c:\recovery.img
And after flashing completed hold both volume+ and power button and type this command
Fastboot reboot
Don't release buttons and after few seconds you enter Chinese recovery swipe it to right and use screen shots to root your device, after that reboot to system you can find it from screenshot, it go to download mod and then type
Fastboot continue
And enter congratulations, your phone go to normal boot.
Bla bla super su installed....
Thanks, hikari_calyx. For this thread..
Some errors happend when I use rill but after reboot again it is not happening....
Click to expand...
Click to collapse
If you're running Windows Vista or Windows 7, you can open a command prompt from installation directory by click right button on the mouse while holding Shift key on the keyboard.
If you're running Windows 8/8.1 or Windows 10, you can open a command prompt or PowerShell from the left corner "File" button. Administrators privilege is optional.
Also, as I mentioned:
You can also use your own fastboot if you want.
Click to expand...
Click to collapse

IDK but you should have change/put the title of this topic as Nokia 6 - TA 1000 (Chinese variant) rather than Retail Phone.
Well, getting root is definitely a temptation but since I'm just a noob and the HMD hasn't release any official firmware/tool yet to recover the phone if thing goes wrong, I guess I'll wait a little bit longer then.

lips_1234 said:
IDK but you should have change/put the title of this topic as Nokia 6 - TA 1000 (Chinese variant) rather than Retail Phone.
Click to expand...
Click to collapse
As I mentioned on the topic, it works on any variant, not only China Variant TA-1000 and Hong Kong Variant TA-1003.
 @same6630 tested on a TA-1021 which is a global variant.
lips_1234 said:
Well, getting root is definitely a temptation but since I'm just a noob and the HMD hasn't release any official firmware/tool yet to recover the phone if thing goes wrong, I guess I'll wait a little bit longer then.
Click to expand...
Click to collapse
HMD released official firmware of Nokia 6 of course, and it's needed to flash a recovery.

Mine
I got some screenshots....

Did someone successfully rooted his Nokia 6 TA-1033?

So just to be clear before I do this to my TA-1000; how do I go about to update it later if I want to update it? For example, my TA-1000 still don't have the 7.1.2 update, and the 8.0 update coming later would be something I want as well.
Do I just update through zip files, or will I simply not be able to update?

Make.Sense said:
So just to be clear before I do this to my TA-1000; how do I go about to update it later if I want to update it? For example, my TA-1000 still don't have the 7.1.2 update, and the 8.0 update coming later would be something I want as well.
Do I just update through zip files, or will I simply not be able to update?
Click to expand...
Click to collapse
After you rooted your phone, you're not able to install any update until you reinstall stock rom.

[THEME][TWRP] TWRP Materialised
U can also install theme for your chinese twrp and you will show english language ...
download theme from this thread
https://forum.xda-developers.com/android/themes/theme-twrp-materialised-dark-light-play-t2915584

hawwin88 said:
U can also install theme for your chinese twrp and you will show english language ...
download theme from this thread
https://forum.xda-developers.com/android/themes/theme-twrp-materialised-dark-light-play-t2915584
Click to expand...
Click to collapse
Thanks for providing info!

When I try to flash the recovery.img through command I have this:
...etc
FAILED (remote. Partition flashing is not allowed)~
finished. ´
etc...
Im using a TA-1033, unlocked UK version.
Can anyone help me, please.

wolfpower95 said:
When I try to flash the recovery.img through command I have this:
...etc
FAILED (remote. Partition flashing is not allowed)~
finished. ´
etc...
Im using a TA-1033, unlocked UK version.
Can anyone help me, please.
Click to expand...
Click to collapse
maybe u are not in bootloader mode .. try to reconnect ur phone again and tap "edit phone" on OST LA software
or try to type this in command :
"fastboot reboot-bootloader"

hawwin88 said:
maybe u are not in bootloader mode .. try to reconnect ur phone again and tap "edit phone" on OST LA software
or try to type this in command :
"fastboot reboot-bootloader"
Click to expand...
Click to collapse
When I connect my TA-0033 it enters in Download mode, when I press "Edit phone", the device continues in download mode and the OST LA software goes unresponsive.
Im using a TA-0033 with 7.1.2 N

done!!!! thank you my good friend!!!! i've just installed the recovery AND ROOT MY TA-1021 with english theme. only a question. without pc what is the best way to reboot in recovery mode nokia 6? when i'ts time to update to oreo, i've only just click to restore in: setting=>backup and restore?? thanksssssss

canapo92 said:
done!!!! thank you my good friend!!!! i've just installed the recovery AND ROOT MY TA-1021 with english theme. only a question. without pc what is the best way to reboot in recovery mode nokia 6? when i'ts time to update to oreo, i've only just click to restore in: setting=>backup and restore?? thanksssssss
Click to expand...
Click to collapse
I recommend you to install Xposed and GravityBox for Nougat to enable Reboot to Recovery option.

hikari_calyx said:
I recommend you to install Xposed and GravityBox for Nougat to enable Reboot to Recovery option.
Click to expand...
Click to collapse
I just got Nokia 6 TA 1021 android 7.1.1, Build is 00WW_3_320. Can your method also work for it?

Links to Firmware & OTA & TWRP & Magisk & Bootloader - Z3 PLAY BECKHAM (All Variants)

Links to Firmware & OTA & TWRP & Magisk & Bootloader - Z3 PLAY BECKHAM (All Variants)
Firmwares
the latest firmware as of time of writing is February's 2020 OTA (BECKHAM_RETAIL_9.0_PPWS29.131-27-1-18_subsidy-DEFAULT_regulatory-DEFAULT_CFC) = https://mirrors.lolinet.com/firmwar...ubsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
previous OTAs RETAIL variant can be found here = https://mirrors.lolinet.com/firmware/moto/beckham/official/RETAIL/
future OTAs possibly here = https://androidfilehost.com/?w=search&s=beckham
other variants = https://mirrors.lolinet.com/firmware/moto/beckham/official/
Unlock Bootloader
first you need to install Motorola Drivers = https://support.motorola.com/us/en/solution/MS88481
- ATTENTION - use the most up-to-date ADB Drivers otherwise will brick if older version is used; instead of downloading ADB elsewhere which is often old version, get it directly from GOOGLE, here = https://dl.google.com/android/repository/platform-tools-latest-windows.zip
now you can proceed to unlock bootloader = https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a
TWRP
get the official TWRP here = https://dl.twrp.me/beckham/
- ATTENTION - if you just want root access, then there's no need to install TWRP, just boot from the .img once using the latest version
use TWRP to make a backup of EFS partition before installing anything, store the backup files outside of the device
if you want custom ROMs or GSI, then you will need to install TWRP installer .zip into the recovery partition. To install the .zip, boot using a .img for example the 3.3.1-0, then use it to install the latest .zip version in the recovery partition. Unfortunately the only official installable version of TWRP that exists is bugged, and the TWRP developers haven't fixed it yet, go talk to them ask for some love, be respectful = https://github.com/TeamWin/android_device_motorola_beckham/issues
Magisk
install Magisk using the new&correct method AKA "Boot Image Patching Method" to be able to install OTA later = https://topjohnwu.github.io/Magisk/install.html#boot-image-patching
when OTA arrives, you may manually install it whilst retaining Magisk by carefully following these instructions = https://topjohnwu.github.io/Magisk/tutorials.html#ota-installation
- ATTENTION - you won't be able to install stock OTAs if you use older method or if system partition is modified, be really careful to not alter the hash of the partitions

Another mirror for the latest ROM with May 1st patches, uploaded by me you can find here:
https://forum.xda-developers.com/showpost.php?p=79122632&postcount=45

@heynando, what is the difference between "retail" and "retus"? Also, does anyone know the numbering system? All the uploads on lolinet.com for Pie have 131 as the first three numbers, but the few posted about here have 183. Maybe 183 is an ota number?

ritchea said:
@heynando, what is the difference between "retail" and "retus"?
Click to expand...
Click to collapse
RETUS is short for Retail + US.
The difference between RETUS and RETAIL is, I imagine, cannot confirm, the same RETAIL firmware with some US regional modifications such as bloatware or CSC thing
you can check which model is yours in SETTINGS > SYSTEM > ABOUT PHONE > SOFTWARE CHANNEL. Or in the bootloader by running the command
Code:
fastboot getvar product
you can find the entire list of product codes here = https://mirrors.lolinet.com/firmware/moto/readme-en.html#listone
XT1929-4(Canada, SS, 4+32GB) XT1929-3(NA/Sprint, SS, 4+32GB)
XT1929-4(NA/AMZ/BWACA/RETCA/RETUS/USC, SS, 4+64GB)
XT1929-5(BRAZIL/RETBR/TIMBR/TEFBR, DS, 4+64GB / 6+128GB)
XT1929-6(LATAM/AMXLA/NIIPE/ATTMX//TEFCL/TEFPE/RETLA/RETAR/RETMX/RETCL/AMXMX, DS, 4+64GB)
XT1929-6(LATAM/RETLA/TEFCO/TIGCO, DS, 6+128GB)
XT1929-8(EMEA_APAC/RETEU/DTEU, DS, 4+32GB / 4+64GB)
ritchea said:
Also, does anyone know the numbering system? All the uploads on lolinet.com for Pie have 131 as the first three numbers, but the few posted about here have 183. Maybe 183 is an ota number?
Click to expand...
Click to collapse
I believe that's the internal version of the software. If the number changes that emphasizes there has been software changes and/or tweaks in the system and/or firmware. If the number doesn't change, then it's just a regular security patch with no further modifications in system and/or firmware.

Thanks for that info. Yeah, I know mine has the retus software channel. I just couldn't find or figure out if Retail was actually one word or if it was a combo of ret+ail. That version has a LOT of software posted.

I flashed retail on an EU model. And after it the software channel say Reteu just like the original. Also the model number is as it should be. In my opinion you can flash retail firmware on us and EU models.

confirmed that this firmware is working on XT1929-4
these are the steps I took:
downloads and setup
install moto drivers (in windows, not needed for linux)
install android tools (adb and fastboot)
downloaded official TWRP
downlaoded and extracted the firmware
backup of partitions (including efs)
Code:
adb reboot bootloader
fastboot boot twrp_recovery.img
backed up lots of partitions
rebooted system
copied the TWRP backup files to my pc for safe keeping
set the fastboot slot (i did this because many of teh fastboot commands below were failing)
Code:
adb reboot bootloader
fastboot --set-active=a
rebooted back into bootloader
installed the firmware
Code:
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash bluetooth BTFM.bin
fastboot flash dsp dspso.bin
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system_b system_other.img
fastboot flash oem oem.img
fastboot flash oem_b oem_other.img
fastboot flash vendor vendor.img_sparsechunk.0
fastboot flash vendor vendor.img_sparsechunk.1
fastboot erase carrier
fastboot erase cache
fastboot erase userdata
fastboot erase ddr
fastboot reboot
installed magisk the new good way
did the initial device setup
installed magisk manager
copied the boot.img from the extracted firmware above to the phone.
followed these steps for boot img patching and install of magisk https://topjohnwu.github.io/Magisk/install.html#boot-image-patching

sirkuttin,
Thanks for the detail how to. That worked perfectly for me, and my moto z3 play, same model as yours. I could not get the ota or even lenovo smart assistant to work on my phone. It basically had it locked up, stuck on the boot logo. I'm assuming its the old way of install magisk that caused that. This got me on the latest firmware release, and then installed magisk the new way. Lenovo smart assistant was useful in downloading the firmware.
Thanks.

Hi I tried the new magisk install way. I'm on XT1929-4_BECKHAM_RETUS_9.0_PPW29.183-29-1, copy boot.img and patched it to magisk_patched.img. Then after fastboot flash boot /path/to/magisk_patched.img and a reboot, i'm not stuck on the motorola powered by android screen. Verity mode is set to disabled.
I tried holding down the power button to simulate a battery pull but no luck, the screen just stays on. Can anybody give me any advise? I think now I have to just wait till the device is out of juice. Never experience this before.
---------- Post added at 02:16 PM ---------- Previous post was at 01:31 PM ----------
So the battery pull is "Power + Vol Down". I was able to flash the PPW29.183-29-1 firmware and get it going again. I noticed it tried to upgrade me to PPW29.183-29-1-2 so I must have been on newer firmware. I flashed the magisk_patched and am rooted now.

It seems there is TWRP 3.3.1-1 with an Installer. Does it mean it can be flashed to recovery partition? Tried booting it, but got stuck on TWRP logo (3.3.1-0 boots fine).

ch3mn3y said:
It seems there is TWRP 3.3.1-1 with an Installer. Does it mean it can be flashed to recovery partition? Tried booting it, but got stuck on TWRP logo (3.3.1-0 boots fine).
Click to expand...
Click to collapse
I haven't tested it myself, though you're correct, the installer .zip can be installed on recovery partition. To install the .zip, boot using a .img for example the 3.3.1-0, then use it to install the .zip in the recovery partition.
PS only do it if you have a reason to, I'm not sure if the firmware OTA checks the hashing of the recovery partition so altering it could potentially prevent you from installing OTAs of the official ROM.

heynando said:
I haven't tested it myself, though you're correct, the installer .zip can be installed on recovery partition. To install the .zip, boot using a .img for example the 3.3.1-0, then use it to install the .zip in the recovery partition.
PS only do it if you have a reason to, I'm not sure if the firmware OTA checks the hashing of the recovery partition so altering it could potentially prevent you from installing OTAs of the official ROM.
Click to expand...
Click to collapse
It, unfortunately, does... However I csnnot update (continous update unsuccesful) :f Have to check if Xposed module is not a reason.
And You probably could use Installer to flash stock recovery? If not TWTP itself however I've never checked if one for Play has access to recovery partiotion to flash images. It should gave if it can be done using the installer...
Sent from my Moto Z3 Play using Tapatalk

ch3mn3y said:
However I csnnot update (continous update unsuccesful)
Click to expand...
Click to collapse
Me too and it drove me nuts, I did patch the /boot partition with the original file, but the OTA app still failed to install, even after reboot. And there's no useful data in the logcat to debug the app. So I gave up and had to use Titanium to freeze the OTA app otherwise it would keep trying to download and install infinitely.
ch3mn3y said:
:f Have to check if Xposed module is not a reason.
Click to expand...
Click to collapse
It's probably not because I don't use it and the OTA method didn't work me either
ch3mn3y said:
And You probably could use Installer to flash stock recovery?
Click to expand...
Click to collapse
Yes you're right, I agree there..

heynando said:
Yes you're right, I agree there..
Click to expand...
Click to collapse
Just checked the inside of the installer zip file and it won't work. Still once every 3 months it wouldn't be a problem to connect device to PC and flash recovery.img with fastboot.
Is there a list with a commands and order how to flash Z3 Play images of official firmware? I want July patches and have some problems, so clean reflash is what I need.
Additional question is if I have to use "-u" when flashing second and other system images? Remember I had to do it with my X Play coz of unlocked bootloader and here I have one in the same state as well. If yes than could someone tell me where to put it, coz I'm not sure...

tb110188 said:
Another mirror for the latest ROM with May 1st patches, uploaded by me you can find here:
https://forum.xda-developers.com/showpost.php?p=79122632&postcount=45
Click to expand...
Click to collapse
Hi. How are you doing. My software channel says: US Retail. and my build number is 183-19-1-2. What would be the firmware?

tb110188 said:
Another mirror for the latest ROM with May 1st patches, uploaded by me you can find here:
https://forum.xda-developers.com/showpost.php?p=79122632&postcount=45
Click to expand...
Click to collapse
Hi. How are you doing. My software channel says: US Retail. and my build number is 183-19-1-2. What would be the firmware?

Ramble2k said:
Hi. How are you doing. My software channel says: US Retail. and my build number is 183-19-1-2. What would be the firmware?
Click to expand...
Click to collapse
This one, make sure to get the latest. https://mirrors.lolinet.com/firmware/moto/beckham/official/RETUS/

Hi, I'm trying to unlock my Moto Z3 Play bootloader, but I don't get the code on CMD, but only a few numbers ... The version of my device is PPW29.131-27-1-11, channel RETBR software.
Someone went through this, can you tell how to reverse this situation?

I couldn't get the bootloader unlocked for xt1929-4. I tried different computers, Linux and win. Have latest adb and fastboot. When fastboot OEM get_unlock_data is given, I says counttas slot not found etc., can someone help?

It may seem obvious, but you
checked OEM unlocking and USB Debugging?

[STOCK FIRMWARE][WINDOWS][OUTDATED] How to upgrade and clean wipe from Stock Android 10 to Stock Android 11 without OTA [Retail USA Channel]

NOTICE : As of June 15, 2022 you no longer NEED this method as the OTA for Android 11 has been released. This is here for those who don't get the OTA or need an upgrade from a clean reset manually using only the RSA tool.
Credits to : morpheus092511 over on the Lenovo Forums for tricking the Moto Tool into installing the stock firmware, and Chepr29 from the Lenovo Forums for the fastboot method that doesn't require the tool.
In fastboot on your PC after your extract the Android 11 firmware and have your device in recovery mode enter the following commands (back up your data this will clean wipe it!) :
Code:
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash vbmeta vbmeta.img
fastboot flash radio radio.img
fastboot flash bluetooth BTFM.bin
fastboot flash dsp dspso.bin
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash dtbo dtbo.img
fastboot flash super super.img_sparsechunk.0
fastboot flash super super.img_sparsechunk.1
fastboot flash super super.img_sparsechunk.2
fastboot flash super super.img_sparsechunk.3
fastboot flash super super.img_sparsechunk.4
fastboot flash super super.img_sparsechunk.5
fastboot flash super super.img_sparsechunk.6
fastboot flash super super.img_sparsechunk.7
fastboot flash super super.img_sparsechunk.8
fastboot flash super super.img_sparsechunk.9
fastboot flash super super.img_sparsechunk.10
fastboot erase userdata
fastboot erase carrier
fastboot erase metadata
fastboot erase ddr
fastboot oem fb_mode_clear
fastboot reboot
1. BACK UP ANY IMPORTANT FILES OR INFORMATION! DON'T FORGET TO BACK UP YOUR TWO FACTOR AUTHENTICATION CODES AS WELL! This method can be done with other firmwares, but I have only tested a clean wipe upgrade from stock Android 10 to 11 RETUS on the Motorola One Ace 5G (Unlocked from Amazon) and can't comment on other firmwares.
2. Windows ONLY! DOWNLOAD THE RSA software from Motorola that allows you to recover, backup, or flash stock firmware to your device.
https://download.lenovo.com/lsa/Releases/Rescue_and_Smart_Assistant_v6.1.1.9_signed_setup.exe
3. DOWNLOAD the retail Android 11 firmware for the Motorola One Ace 5G (Kiev) Retail USA / Unlocked from here :
https://mirrors.lolinet.com/firmware/moto/kiev/official/RETUS/XT2113-2_KIEV_RETUS_11_RZK31.Q3-45-16_subsidy-DEFAULT_regulatory-DEFAULT_R8_CFC.xml.zip
4. Go to C:\ProgramData\RSA\Download\RomFiles and extract the .zip folder here. You may need 7Zip, or WinRAR to do so. I recommend 7Zip as it's open source and free without nag popups.
https://www.7-zip.org/a/7z2107-x64.exe
5. Connect your phone to the PC via USB-C and shut it off. Hold volume down, and power on at the same time until the recovery screen shows.
6. The RSA software will detect your proper "latest" firmware automatically in fastboot mode, allow it time to download and wait until it's done, give it some time after it hits 100.00% because the program will begin decompressing and unzipping the stock firmware, but it will NOT tell you this, keep that in mind!
7. Under the same directory in Step 4, you should now have two folders. One that says 10 and 11 with almost the same naming convention, delete ALL of the files in the folder that RSA downloaded (the 10 folder), and copy and paste all of the files from (the 11 folder), but LEAVE the name of the folder the same as what it was when RSA downloaded it, don't change the name or you'll either have to re-name it back, or re-download the firmware once more and let it extract.
8. Go back to the RSA program and hit the yellow "Rescue" button. Don't touch your phone and leave it alone! All data will be erased and it will begin flashing the firmware from Android 11 without a single issue. If you have PIN or password locked your phone previously, upon first boot up Android will ask you for your previous device PIN before you can begin setting up the device initially.
NOTE : This should preserve your warranty, mine expired a few months ago and I haven't been able to confirm this 100% because of this. (we waited a LONG time for this update!) Since the process does NOT require your bootloader to be unlocked or modified in anyway whatsoever, I do NOT see how you could possibly void the warranty. As of this writing, I have NEVER attempted to even unlock my bootloader for stability purposes, and because rooting isn't a concern to me on this device. In fact, to my knowledge you are NO LONGER able to unlock the bootloader on Android 11, so proceed with caution if this is something you require! There may be a 3-day wait of being connected to the Internet before you are allowed to use the OEM Unlock function, please keep that in mind if this is an issue.
Since it is stock firmware, there are no functionality issues to be concerned with. Calling, 5G, camera, Bluetooth, NFC and other basic sensors and extra functionality work 100% to my knowledge after testing most functions myself for the better duration of a day, even my Fossil Gen 6 Android Wear 2.0 (updating to 3.0 soon) watch is functioning flawlessly over WiFI and Bluetooth with the new update.

Please note this method is now outdated, as the OTA has been released for Android 11.

TheLastSidekick said:
Please note this method is now outdated, as the OTA has been released for Android 11.
Click to expand...
Click to collapse
It does work though, for anybody needing (or just wanting) to recover from a blown system without having to wait for a Rescue download.
Also it's a bit irritating that 95-9 for RETUS never got uploaded to lolinet. And now since 11 is released, that's all you can get through RSA, because it INSISTS on upgrading the phone to the latest version.
(Edit/Add) I would just like to have 95-9 handy for emergency reflashing if ever needed, but now I can't get my hands on it anywhere . . . except on that "easy" website and I don't really trust it 100%.
NOTE: I just flashed an 11 upgrade (manually via fastboot) and there was only 0-9 sparsechunk files. No super.img_sparsechunk.10 to be found, either the file or in the servicefile.xml . . . ? This was specifically the KIEV_RETAIL_RZK31.Q3_45_16_subsidy_DEFAULT_regulatory_DEFAULT_R8_CFC.xml firmware . . .

Moondroid said:
It does work though, for anybody needing (or just wanting) to recover from a blown system without having to wait for a Rescue download.
Also it's a bit irritating that 95-9 for RETUS never got uploaded to lolinet. And now since 11 is released, that's all you can get through RSA, because it INSISTS on upgrading the phone to the latest version.
(Edit/Add) I would just like to have 95-9 handy for emergency reflashing if ever needed, but now I can't get my hands on it anywhere . . . except on that "easy" website and I don't really trust it 100%.
NOTE: I just flashed an 11 upgrade (manually via fastboot) and there was only 0-9 sparsechunk files. No super.img_sparsechunk.10 to be found, either the file or in the servicefile.xml . . . ? This was specifically the KIEV_RETAIL_RZK31.Q3_45_16_subsidy_DEFAULT_regulatory_DEFAULT_R8_CFC.xml firmware . . .
Click to expand...
Click to collapse
Yeah the whole thing is strange the way the way each firmware is slightly a different size between what is evidently the same Retail build.

Actually, there's an easier method using RSA rescue.
You can grab boot.img for rooting.

mingkee said:
Actually, there's an easier method using RSA rescue.
You can grab boot.img for rooting.
Click to expand...
Click to collapse
I was using Rescue tool for this, may I please ask you how you were able to grab the boot.img? Thank you in advance!
Also, for those wondering if using the method above if OTAs will continue to update the answer is 100% YES confirmed.

TheLastSidekick said:
I was using Rescue tool for this, may I please ask you how you were able to grab the boot.img? Thank you in advance!
Also, for those wondering if using the method above if OTAs will continue to update the answer is 100% YES confirmed.
Click to expand...
Click to collapse
After rescue, check C:\Program Data\RSA\Download\romfiles\
Check Kiev folder

Question ROOT

Hi, I would like to ask if anyone knows how to get root permissions and install a super su or superuser application, by the way, I really care about not bricking my phone because it is my only phone that I am able to use as a daily driver. i mainly want to remove system apps and use drivedroid app

I imagine the process for the G62 would be similar to the G60. See this thread

@synakszymon09 Please check your PMs immediately.

magisk work on all devices android 6+: https://github.com/topjohnwu/Magisk --- i have also one phone and do it with magisk.

what a phone do you have. if you have a xiaomi you must unlock the bootloader. MAKE SURE: Unlocking erase your data. so make a backup first if you are sure

ABC00012345 said:
what a phone do you have. if you have a xiaomi you must unlock the bootloader. MAKE SURE: Unlocking erase your data. so make a backup first if you are sure
Click to expand...
Click to collapse
I made a post on Moto g62 so it's probably logical that I use Moto g62 I'm quite skeptical about magisk unless it's the only method because the last time I used it I broke my phone and spent PLN 80 (about $20) on a service center that still didn't fix it

synakszymon09 said:
I made a post on Moto g62 so it's probably logical that I use Moto g62 I'm quite skeptical about magisk unless it's the only method because the last time I used it I broke my phone and spent PLN 80 (about $20) on a service center that still didn't fix it
Click to expand...
Click to collapse
is there a other method

ABC00012345 said:
is there a other me Could you write step by step how to root this phone without risk of brickingCould you write step by step how to root this phone without risk of bricking
Click to expand...
Click to collapse

its extremaly simple
unlock bootloader
download the firmware for phone
extract boot.img and copy to phone /sdcard
install magisk
open magisk and flash magisk to image file
copy /download/magisk_boot.img to pc
restart phone to fastboot
flash magisk_boot.img to both boot_a & boot_b
flash vbmeta --disable verification & verity
flash vbmeta_system --disable verification & verity *not mandatory
flash vbmeta_boot --disable verification & verity *not mandatory
restart phone

please see my comment - it is extremely basic - as an added messure as i have had magisc not be completely functional ( and this is frrom reasearching but there is a slight difference between flashing the device directly and flashing the boot.img file and then having to flash thatt via fastboot) but as I say it is just an added measure
re-flash the device from magisk after it has been booted just to cement the root processes - and you shouldnt have any issues at all.

smiley.raver said:
its extremaly simple
unlock bootloader
download the firmware for phone
extract boot.img and copy to phone /sdcard
install magisk
open magisk and flash magisk to image file
copy /download/magisk_boot.img to pc
restart phone to fastboot
flash magisk_boot.img to both boot_a & boot_b
flash vbmeta --disable verification & verity
flash vbmeta_system --disable verification & verity *not mandatory
flash vbmeta_boot --disable verification & verity *not mandatory
restart phone
Click to expand...
Click to collapse
I have a problem even with the first step because my computer does not see the phone in fastboot mode (adb works as it should) and when I try to install the drivers, the progress bar stops at some point

synakszymon09 said:
I have a problem even with the first step because my computer does not see the phone in fastboot mode (adb works as it should) and when I try to install the drivers, the progress bar stops at some point
Click to expand...
Click to collapse
place your phone into fastboot mode - power and volume down or enter abd command to adb reboot bootloader

This is the most obvious thing that I didn't even check in any guide, I just guessed

did you get it to work?

smiley.raver said:
did you get it to work?
Click to expand...
Click to collapse
unfortunately not, but I'll try to install these drivers again because I have another computer and now I'm using linux (I'm going to install them via wine HQ)

IT WORKED and that's even without drivers I got a lot of numbers and letters after typing fastboot oem get_unlock_data

[[email protected] szymon]# fastboot oem get_unlock_data
< waiting for any device >
(bootloader) Unlock data:
(bootloader) 3A95314132950537#5A593232473337
(bootloader) 4D4D57006D6F746F2067360000#A9D0
(bootloader) B4207FCFBBEB957812FBEDF94C05075
(bootloader) CA3D171765180BD2F9B98DDBF55AC#4
(bootloader) D91C0FC000000000000000000000000
OKAY [ 0.029s]
Finished. Total time: 0.029s
[[email protected] szymon]#

unfortunately it doesn't work as it should

out of date, I managed to unlock it, I just didn't remove the space from the string before