Database Info

Bootloop after installing an Factory Image for Android 9.0

Hi, i just bought a Google Pixel from Ebay an tried to install an factory image for Android 9 from the Google Website. After fastboot the flash-all.sh (ive got Ubuntu) it got stuck a on the bootscreen (The Google Logo flashes in an instance and the Screen goes black again). Unfortunally the device is locked again (bootloader ist locked), so adb is not working. fastboot works but when i install some other factory images from the google website the problem with the flashing bootscreen reappears.
Loading into bootloader works:
Product/Variant: sailfish-US-PVT
Serial Number FA72H0300560
CPU: MSM8996SG-AB 0x10001
UFS: 32 GB Samsung
DRAM:4096MB Hynix LPDDR4
Boot-slot: a
Console: DISABLED
Secure Boot: PRODUCTION
Device is LOCKED
Could anyone help?
Thanks in advance.

Not sure but I think U can try booting into TWRP using "fastboot flash recovery twrp" command in CMD and than switch boot slot to b, my pixel is in the same situation - I can't boot into slot a and switching to b works
oh sry, the command is "fastboot boot path/to/twrp.img"

Thanks for your help, but it didn't work.
When I try to fastboot with following commands, it says:
sudo ./fastboot boot twrp-3.2.3-1-sailfish.img
Code:
Downloading 'boot.img' OKAY [ 0.785s]
booting (bootloader) Command is not supported.
(bootloader) Please unlock device to enable this command.
FAILED (remote: '')
Finished. Total time: 0.963s
sudo ./fastboot flash recovery twrp
Code:
fastboot: error: cannot load 'twrp': No such file or directory
I have Ubuntu with local platform-tools, so the commands look a little bit different...

Double-check the checksum of the downloaded file.
Open the flash-all.sh file in a text editor, and manually run each of the flash commands individually. See if any of them throw an error.
You might also try to install the OTA.

I tried the first command in the flash-all.sh with the same results:
sudo ./fastboot flash bootloader bootloader-sailfish-8996-012001-1808030001.img
Code:
Sending 'bootloader_a' (32384 KB) OKAY [ 0.951s]
Writing 'bootloader_a' (bootloader) Command is not supported.
(bootloader) Please unlock device to enable this command.
FAILED (remote: '')
Finished. Total time: 1.189s
I will try out the OTA tomorrow. Does anyone know how to handle the payload.bin in to OTA.zip under a Linux-System?
ADB seems not be working. SO adb sideload ota_file.zip, like its mentioned on the google website seems to be also no option....

ArchArch said:
I tried the first command in the flash-all.sh with the same results:
sudo ./fastboot flash bootloader bootloader-sailfish-8996-012001-1808030001.img
Code:
Sending 'bootloader_a' (32384 KB) OKAY [ 0.951s]
Writing 'bootloader_a' (bootloader) Command is not supported.
(bootloader) Please unlock device to enable this command.
FAILED (remote: '')
Finished. Total time: 1.189s
I will try out the OTA tomorrow. Does anyone know how to handle the payload.bin in to OTA.zip under a Linux-System?
ADB seems not be working. SO adb sideload ota_file.zip, like its mentioned on the google website seems to be also no option....
Click to expand...
Click to collapse
You need to re-unlock your bootloader first, then. Try fastboot flashing unlock .

No luck.
sudo ./fastboot flashing unlock
Code:
FAILED (remote: 'oem unlock is not allowed')
Finished. Total time: 0.007s
sudo ./fastboot oem unlock
Code:
FAILED (remote: 'oem unlock is not allowed')
Finished. Total time: 0.038s

ArchArch said:
sudo ./fastboot flash recovery twrp
Code:
fastboot: error: cannot load 'twrp': No such file or directory
I have Ubuntu with local platform-tools, so the commands look a little bit different...
Click to expand...
Click to collapse
Did U opened CMD from the folder in which the TWRP file is located? Just type in CMD: "fastboot boot", and after "boot" type "twr" and press TAB button, program will locate the file itself.

Levan_i said:
Did U opened CMD from the folder in which the TWRP file is located? Just type in CMD: "fastboot boot", and after "boot" type "twr" and press TAB button, program will locate the file itself.
Click to expand...
Click to collapse
He's using linux. The reason his flashes have been unsuccessful is because the bootloader is locked.

Tanks for your efforts so far...
Just for clarification: The initial plan was to root my device, according to the XDA-Guide for rooting an Pixel XL Android 9.0 (with the Files for my "Sailfish"-Pixel) https://forum.xda-developers.com/pixel-xl/how-to/guide-pixel-xl-android-9-0-pie-unlock-t3825866
First when I bought the Pixel the "OEM Unlock"-Option in the Developers-Menu was greyed out.
So i tried out, beneath some other guides, the XDA-Guide for unlocking a Verizon Pixel and it worked. https://forum.xda-developers.com/pixel-xl/how-to/how-to-unlock-bootloader-verizon-pixel-t3796030
So I thought its an VerizonPixel, installed an Verizon Image from the Google Website, got always the message at bootup that an unlocked bootloader is some sort of threat, closed the Bootloader and the flashing bootscreen-problem began…

List of fastboot oem commands on the Pixel 3 XL

I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.
I haven't tested these, since most don't work when the bootloader is locked:
Code:
$ fastboot oem dmesg
FAILED (remote: 'Fastboot OEM command (dmesg) is not allowed when locked')
Finished. Total time: 0.081s
Note that fastboot commands can brick and damage your phone. Be careful when testing.
Here's the list of commands. You can run them with "fastboot oem <command>".
Code:
setbrightness
get_config
set_config
rm_config
get_platform_info
set_platform_info
select-display-panel
esim_erase
esim_atp
uart
off-mode-charge
sha1sum
ramdump
ramdump_sahara
rma
dump-chipid
check-hw-security
HALT
set_display_power_mode
citadel
enable-factory-lock
factory-lock
ddrtest
continue-factory
dmesg

500 Internal Server Error said:
I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.
I haven't tested these, since most don't work when the bootloader is locked:
Code:
$ fastboot oem dmesg
FAILED (remote: 'Fastboot OEM command (dmesg) is not allowed when locked')
Finished. Total time: 0.081s
Note that fastboot commands can brick and damage your phone. Be careful when testing.
Here's the list of commands. You can run them with "fastboot oem <command>".
Code:
setbrightness
get_config
set_config
rm_config
get_platform_info
set_platform_info
select-display-panel
esim_erase
esim_atp
uart
off-mode-charge
sha1sum
ramdump
ramdump_sahara
rma
dump-chipid
check-hw-security
HALT
set_display_power_mode
citadel
enable-factory-lock
factory-lock
ddrtest
continue-factory
dmesg
Click to expand...
Click to collapse
Any idea what OEM citadel does? I have no clue from a precursory look.

Must be super secret. I can't find anything on that

I couldn't find anything about that either.
Pixel 3 XL, haven't crashed it, YET

its in the crosshatch source code....https://android.googlesource.com/de...bfe57aaaf2cdd656a4476bbfb5c01314a09/device.mk

i believe citadel has to do with the new Titan security chip but I could be wrong

elliwigy said:
i believe citadel has to do with the new Titan security chip but I could be wrong
Click to expand...
Click to collapse
It does seem that is the only command new to the 3 XL compared to the 2xl. The latter does not have the Titan chip

NVM, I misunderstood.
Pixel 3 XL, haven't crashed it, YET

cmh714 said:
its in the crosshatch source code....https://android.googlesource.com/de...bfe57aaaf2cdd656a4476bbfb5c01314a09/device.mk
Click to expand...
Click to collapse
Am I pretty much blind or anything, but it doesn't exist anything regarding what the 'set display power mode' OEM command does within the link to the Crosshatch source(s), or..?

Can you "turn off" Titan and then run commands? Is that something to do with Citadel?

500 Internal Server Error said:
I extracted the "fastboot oem" commands supported by the Pixel 3 XL from the firmware.
I haven't tested these, since most don't work when the bootloader is locked:
Click to expand...
Click to collapse
This is the message I am getting when trying to use anyone of the OEM commands, in this case, the possible adjustment of the display power mode.
FAILED (remote: Fastboot OEM command (set_display_power_mode) is not allowed)
finished. total time: 0.378s
PS C:\Users\Christofferwassberg\Downloads\platform-tools_r28.0.1-windows\platform-tools> fastboot oem set_display_power_
mode
Is it any secret restrictions enabled somewhere that is denying us from modifying, or checking the stats of phone, from the bootloader level?
EDIT: Yes, my bootloader is unlocked.

xFirefly93 said:
This is the message I am getting when trying to use anyone of the OEM commands, in this case, the possible adjustment of the display power mode.
FAILED (remote: Fastboot OEM command (set_display_power_mode) is not allowed)
finished. total time: 0.378s
PS C:\Users\Christofferwassberg\Downloads\platform-tools_r28.0.1-windows\platform-tools> fastboot oem set_display_power_
mode
Is it any secret restrictions enabled somewhere that is denying us from modifying, or checking the stats of phone, from the bootloader level?
EDIT: Yes, my bootloader is unlocked.
Click to expand...
Click to collapse
Yes, the device checks whether the PRODUCTION fuse, in our case, likely just QCOM_SEC_BOOT is blown, and if it is it restricts a whole number of commands/functions.

npjohnson said:
Yes, the device checks whether the PRODUCTION fuse, in our case, likely just QCOM_SEC_BOOT is blown, and if it is it restricts a whole number of commands/functions.
Click to expand...
Click to collapse
Sounds like something that only Samsung would add, but Google? Nah..

xFirefly93 said:
Sounds like something that only Samsung would add, but Google? Nah..
Click to expand...
Click to collapse
That wasn't said in a questioning way lol -- its just how it is.
Every non-Chinese phone has Qualcomm Secure Boot enabled by that exact means (the SEC_BOT Fuse row). If you Google it, you'll find such. It's why we can't run custom bootloader's (exempting S-OFF HTC devices which are an odd and interesting case where QCOM secureboot only verfies very specific chunks of the bootchain the user doesn't normally touch).
QCOM secure boot is literally the industry standard lol - using the production state to limit OEM commands is new as of the Pixel 2, and correctly restricting them is new to the 3 series.

Could you maybe provide some info on how you extracted these commands from the firmware? Might be useful to me and others as well.

npjohnson said:
Any idea what OEM citadel does? I have no clue from a precursory look.
Click to expand...
Click to collapse
This is from sargo. I tried some of the other oem commands that sounded non-destructive, but got a lot of invalid oem command errors.
I didn't try any of these citadel commands, but they do sound interesting. I have no idea if they will apply to the blueline/crosshatch.
Code:
[email protected]:# fastboot oem citadel
...
(bootloader) citadel <command>
(bootloader) Commands:
(bootloader) rescue Try to rescue Citadel
(bootloader) state Print current Citadel state
(bootloader) reset Reset Citadel
(bootloader) reset-locks Reset AVB locks
(bootloader) version Print citadel OS version
(bootloader) reprovision Reprovision device after a RMA unlock
(bootloader) suzyq on|off Enable or disable SuzyQable
FAILED (remote failure)
finished. total time: 0.060s

Does anyone know how to use the citadel commands?
Im trying to restore a bricked 3a. so far here are my attempts
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel
(bootloader) citadel <command>
(bootloader) Commands:
(bootloader) rescue Try to rescue Citadel
(bootloader) state Print current Citadel state
(bootloader) reset Reset Citadel
(bootloader) reset-locks Reset AVB locks
(bootloader) version Print citadel OS version
(bootloader) reprovision Reprovision device after a RMA unlock
(bootloader) suzyq on|off Enable or disable SuzyQable
FAILED (remote: '')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel rescue
FAILED (remote: 'no staged data, use fastboot stage <file>')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe stage bootloader-sargo-b4s4-0.2-5402313.img
Sending 'bootloader-sargo-b4s4-0.2-5402313.img' (8349 KB) OKAY [ 0.355s]
Finished. Total time: 0.413s
PS C:\Program Files (x86)\Minimal ADB and Fastboot> .\fastboot.exe oem citadel rescue
(bootloader) Recovering citadel - it may take a couple of minutes
FAILED (remote: 'failed to rescue citadel Bad Buffer Size')
fastboot: error: Command failed
PS C:\Program Files (x86)\Minimal ADB and Fastboot>
Click to expand...
Click to collapse

zimmie said:
Does anyone know how to use the citadel commands?
Im trying to restore a bricked 3a. so far here are my attempts
Click to expand...
Click to collapse
Did you ever manage to make this work? I'm in the same situation

plz help unlocking realme 5 pro !!!

PS C:\adb> fastboot oem unlock
FAILED (Write to device failed (Too many links))
fastboot: error: Command failed
PS C:\adb> fastboot devices
PS C:\adb> fastboot devices
PS C:\adb> fastboot devices
de3d7f09 fastboot
PS C:\adb> fastboot oem unlock
FAILED (Write to device failed (Unknown error))
fastboot: error: Command failed
PS C:\adb>
tried every fastboot command but szme error

The correct command is "fastboot flashing unlock" !
https://c.realme.com/in/post-details/1244566811094024192

zabbaluga said:
The correct command is "fastboot flashing unlock" !
https://c.realme.com/in/post-details/1244566811094024192
Click to expand...
Click to collapse
Same error with that command i tried every command noluck

Did you first apply the deep testing apk?

zabbaluga said:
Did you first apply the deep testing apk?
Click to expand...
Click to collapse
Yeah idid i solved the problem , to use fastboot command with realme devices you should use an usb 2.0 port not a 3.0 or usb ones coz my laptops had only usb 3.2 i used another one and i succeeded now im on pixel experience, thanks for your time dude

How do I solve Fingerprint Enrollment error

Fingerprint lost, I backed up persist in advance, so I restore it by
fastboot flash persist [INSERT YOUR PERSIST.IMG HERE]
not worked,prompted for "Flashing is not allowed for Critical Partitions"
then I tried
adb shell
su
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist
I checked /mnt/vendor/persist,files were successfully extracted.
However,the problem still occurred.
Appreciate for any helps.

ChuyanFang said:
Fingerprint lost, I backed up persist in advance, so I restore it by
fastboot flash persist [INSERT YOUR PERSIST.IMG HERE]
not worked,prompted for "Flashing is not allowed for Critical Partitions"
then I tried
adb shell
su
dd if=/sdcard/persist.img of=/dev/block/bootdevice/by-name/persist
I checked /mnt/vendor/persist,files were successfully extracted.
However,the problem still occurred.
Appreciate for any helps.
Click to expand...
Click to collapse
Enter this command first: fastboot flashing unlock_critical
Sent from my OnePlus KB2007 using XDA Labs

jwarrior319 said:
Enter this command first: fastboot flashing unlock_critical
Sent from my OnePlus KB2007 using XDA Labs
Click to expand...
Click to collapse
Thanks for ur reply.
It still doesn't work.
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock_critical
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.005s
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.003s
I checked the unlocked status then:
C:\Program Files (x86)\OnePlus Mobile>fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [ 0.006s]
Finished. Total time: 0.007s

*never mind*

ChuyanFang said:
Thanks for ur reply.
It still doesn't work.
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock_critical
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.005s
C:\Program Files (x86)\OnePlus Mobile>fastboot flashing unlock
FAILED (remote: Device already : unlocked!)
Finished. Total time: 0.003s
I checked the unlocked status then:
C:\Program Files (x86)\OnePlus Mobile>fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [ 0.006s]
Finished. Total time: 0.007s
Click to expand...
Click to collapse
Hmm, it wont allow you to unlock critical. Idk how to fix that.
You could try fastboot oem flashing unlock_critical or fastboot oem unlock_critical
Sent from my OnePlus KB2007 using XDA Labs

Error "Your device does not qualify for bootloader unlocking." in a Retail Copy of Moto G8 Plus XT2019-2

Not just the code is weird:
0000000000000000#30303633323539333933006D6F746F2067280000#E533CBDEB3EC7E3E09767F70BC4B79D715A572C8#CEA5B75C000000000000000000000000
because of 0's on the start
but it's a 100% retail copy: (No AT&T Mobile, no Claro, no whatever it is)

Noc02008 said:
Not just the code is weird:
0000000000000000#30303633323539333933006D6F746F2067280000#E533CBDEB3EC7E3E09767F70BC4B79D715A572C8#CEA5B75C000000000000000000000000
because of 0's on the start
but it's a 100% retail copy: (No AT&T Mobile, no Claro, no whatever it is)
Click to expand...
Click to collapse
Which cid and channel?
Code:
fastboot getvar cid
fastboot getvar ro.carrier

sd_shadow said:
Which cid and channel?
Code:
fastboot getvar cid
fastboot getvar ro.carrier
Click to expand...
Click to collapse
C:\Users\Nico>fastboot getvar cid
cid: 0x0000
finished. total time: 0.000s
C:\Users\Nico>fastboot getvar ro.carrier
ro.carrier: unknown
finished. total time: 0.003s

I'm still with this issue, also 2 friends helped me but nothing of solving