Database Info

H950 5.1.1 V11z Bricked/Bootloop: LG Security Error, Authentication Fail #9

Hello
A brief timeline of events leading to this thread:
1. I purchased a G-Flex2 H950 from Ebay for $250 and was supposed to be upgrading from a Galaxy S4-I337.
2. Received my device yesterday and set out to update to 5.1.1 & root the device to remove bloatware.
3. I was able to update to 5.1.1 V11x using my StraightTalk sim on AT&T network.
4. After many frustrating hours of trying to root using different methods, I finally was able to root using the technique mentioned in this thread: http://forum.xda-developers.com/g-flex2/development/root-easy-root-att-flex-2-5-1-1-t3178354
5. A nice complement to point "4" above was the firmware update to 5.1.1 V11z.
6. Extremely happy that I was ready to rock, I set out to delete all the bloatware from my device.
7. First surprise obviously was the inability to remove a bunch of AT&T apps because "APK could not found" error.
8. Like the idiot that I am, I went ahead and deleted the "rootsystem.img" from the internal memory (unnecessarily, blame my OCD!).
9. Now after I finished de-bloating the device (or so I thought), I rebooted it and to my horror... I see the error message:
LG Security Error
Authentication Fail #9
10. I attempted to get to the recovery mode and deleted/erased all data & settings. No dice!
11. I'm still able to get to the download mode using the Volume-Up & USB connect method (& this is why I'm cursing myself at point "8" because I could have re-used the easy root method again to flash the img file).
12. I tried to use the "LG Mobile Support Tool", it recognizes the device correctly as "LGH950" but says V11z is the latest software update.
My question to experts: How SOL am I? I don't think LG would honor my warranty since the purchase is NOT from a authorized dealer/reseller. So no chance of warranty repair/replacement, no?
I looked everywhere (for close to 10 hours) for KDZ & TOT files to even attempt something. But I couldn't find anything for H950. Man, I hate AT&T so much now... Why couldn't they just leave the bootloader unlocked? Or LG (AT&T?)even provide the necessary files to start off with?
Could someone with more knowledge please offer any help? Meanwhile, I've pretty much resigned to be joining the queue full of others with bricked H950's...

From what I've heard LG goes by the S/N and date of manufacturing just like Lenovo for warranty. You can just ask their customer service if the warranty is active for your phone.
As for recovering it all you would've needed to do was use the tool as you stated. I have commented many times explaining people should only disable/freeze bloat and not *delete* anything (there are some crucial system apps, editing build prop seems to cause loops for me for ex.). There was another member in this situation if I remember correctly.
In case you can't go the warranty route ask Sj if he has found a way to push files while the phone is in DL mode.
Sent from my XT1528

Hi i have the same problem, I rename many apps in system folder of my ls996 zv8 and now the phone no boot and only show "LG Security Error"
I tried to rename the files in download mode but system partition is mounted as read only, and also fails when attempting to mount this in rw.
In 5.1.1 the download mode remove the option to read files from sd card.
I tried to mount the sd card, but I had no luck.
The sd-card is located in /sys/block/mmcblk1
cat /proc/partitions show: 179 64 1921024 mmcblk1
Click to expand...
Click to collapse
mount -t vfat -o rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,g id=1023,fmask=0007,dmask=0007,allow_utime=0020,utf 8 /dev/block/vold/179:65 /data/media/1 , fail to mount
Click to expand...
Click to collapse

maxie.maverick said:
Hello
LG Security Error
Authentication Fail #9
10. I attempted to get to the recovery mode and deleted/erased all data & settings. No dice!
11. I'm still able to get to the download mode using the Volume-Up & USB connect method (& this is why I'm cursing myself at point "8" because I could have re-used the easy root method again to flash the img file).
12. I tried to use the "LG Mobile Support Tool", it recognizes the device correctly as "LGH950" but says V11z is the latest software update.
My question to experts: How SOL am I? I don't think LG would honor my warranty since the purchase is NOT from a authorized dealer/reseller. So no chance of warranty repair/replacement, no?
I looked everywhere (for close to 10 hours) for KDZ & TOT files to even attempt something. But I couldn't find anything for H950. Man, I hate AT&T so much now... Why couldn't they just leave the bootloader unlocked? Or LG (AT&T?)even provide the necessary files to start off with?
Could someone with more knowledge please offer any help? Meanwhile, I've pretty much resigned to be joining the queue full of others with bricked H950's...
Click to expand...
Click to collapse
hey have u been able to fix the issue ??
as i just got the ls996 sprint g flex 2, and some how i renamed wrong system file, and got the same issue
my phone is stuck on
SECURITY ERROR
AUTHENTICATION ERROR #9
please help me out if someone around found a solution

same problem here

Security error authentication fail #9 on Lg tribute 2 LGLS665
Hello,
I am stuck on security error authentication fail #9 on Lg tribute 2 LGLS665 at start up.
Got this error when rename the Lgstartupwizard.apk to Lgstartupwizard.bak.
Please Help.........

Same phone and problem as op. H950 V11X Rooted "Authentication Failure #9". Anyone ever figure this out?
We just need someone with the H950 KDZ

Maybe as a G2 user I'm overlooking something but - why not download the kdz from http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=XXXXXX (put your IMEI instead of Xs), eh?

Security Error
Thanks for the link ..
Its not helping me on Lg tribute 2 LGLS665. Below is the text received.
I have replaced the MEID number below with "X".
<response req_cmd="auth_model_check" status="OK">
<auth_model_check>
<result>2</result>
<esn>XXXXXXXXXXXXXX</esn>
<model>LGLS665</model>
<suffix>AVGMBLH</suffix>
<msn>XXXXXXXXX</msn>
<esn_date/>
<sw_version/>
<sw_url/>
<sw_locale_url/>
<sw_recommand_uri/>
<app_version/>
<app_url/>
<cs_em_flag>N</cs_em_flag>
<cs_em_uri>N</cs_em_uri>
<chip_type/>
<prod_type/>
<buyer>VGM</buyer>
<file_name/>
</auth_model_check>
</response>

mwedo said:
Maybe as a G2 user I'm overlooking something but - why not download the kdz from http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=XXXXXX (put your IMEI instead of Xs), eh?
Click to expand...
Click to collapse
Hey man, thanks for the suggestion, but tried that too. Did not get an option to download the kdz when I entered IMEI. Here's the screenshot I get.

hi sorry to bump in
but i made the huge mistake in renaming system apps, so now bootloop and same security error condition with a ls996 zv6,
1.- i know that don't even think to try to downgrade from zv6 to zv5 tot= Brick.
2.- is there a way to push, copy (aroma file manager, twrp file manager), in normal or stock recovery?
3.- is there a way to flash rootedsystem.img zv6 to the phone in: recovery, fastboot or even the command:
Step 11 flash commands:
For LS996 (ZV6/ZV7/ZV8)
Code:
dd if=/data/media/0/rootedsystem.img bs=8192 seek=58368 count=522240 of=/dev/block/mmcblk0, from another source, rather than from internal sd, because obviously i didn't copied to the device previously?
4.- already tried to flash from stock recovery, the ZV6 Update= update.zip but it gives an error to load because some system app not valid, i remember
please, if someone could help me and us with this problem
thank you very much indeed

atv said:
but i made the huge mistake in renaming system apps, so now bootloop and same security error condition with a ls996 zv6,
1.- i know that don't even think to try to downgrade from zv6 to zv5 tot= Brick.
2.- is there a way to push, copy (aroma file manager, twrp file manager), in normal or stock recovery?
3.- is there a way to flash rootedsystem.img zv6 to the phone in: recovery, fastboot or even the command:
Step 11 flash commands:
For LS996 (ZV6/ZV7/ZV8)
Code:
dd if=/data/media/0/rootedsystem.img bs=8192 seek=58368 count=522240 of=/dev/block/mmcblk0, from another source, rather than from internal sd, because obviously i didn't copied to the device previously?
4.- already tried to flash from stock recovery, the ZV6 Update= update.zip but it gives an error to load because some system app not valid, i remember
please, if someone could help me and us with this problem
thank you very much indeed
Click to expand...
Click to collapse
Only solution is to send it back to LG.
There is no way (yet) to flash with dd command from external SD.
and there is no other tot besides ZV5 and as you said thats a Hard brick.

hi
Alex_XV6700 said:
Only solution is to send it back to LG.
There is no way (yet) to flash with dd command from external SD.
and there is no other tot besides ZV5 and as you said thats a Hard brick.
Click to expand...
Click to collapse
thank you very much indeed for your answer, but as another reply i posted, as question in other thread, read this, maybe a solution if semi bricked, LG security error, in: zv06, zv07 or zv08, if it turns to be truth....
hi...... there is a forum member form another site that claims to have a zv8 rooted tot to sell, but i'm not sure if its true or reliable, claims that it fix bricks and its a 4.3 gb file, does anybody knows about it?
any help or guide please, thank you very much indeed
File name:LGLS996AT-00-ZV8-SPR-US-AUG-18-2015+01.zip
Android OS version:5.1
File Download:
Buy topic
Existing 2 People buy This topic is to be paid to the author 1000 Credits Before viewing
This TOT firmware contains the ROOT authority, after the success of flashing, ROOT success
TOT firmware flashing effect:
1.brick the repair
2, upgrade ROM
3, downgrade ROM
4, remove the lock screen password
5, Clear Google locks
6, restore factory settings
Tips:
1,This TOT firmware suitable for LGFlashTool.
2,After the purchase of the post, hidden content will be displayed, then you can free download attachments.
3,After purchase is successful, the second time to visit this page does not appear charges prompt.

atv said:
thank you very much indeed for your answer, but as another reply i posted, as question in other thread, read this, maybe a solution if semi bricked, LG security error, in: zv06, zv07 or zv08, if it turns to be truth....
hi...... there is a forum member form another site that claims to have a zv8 rooted tot to sell, but i'm not sure if its true or reliable, claims that it fix bricks and its a 4.3 gb file, does anybody knows about it?
any help or guide please, thank you very much indeed
File name:LGLS996AT-00-ZV8-SPR-US-AUG-18-2015+01.zip
Android OS version:5.1
File Download:
Buy topic
Existing 2 People buy This topic is to be paid to the author 1000 Credits Before viewing
This TOT firmware contains the ROOT authority, after the success of flashing, ROOT success
TOT firmware flashing effect:
1.brick the repair
2, upgrade ROM
3, downgrade ROM
4, remove the lock screen password
5, Clear Google locks
6, restore factory settings
Tips:
1,This TOT firmware suitable for LGFlashTool.
2,After the purchase of the post, hidden content will be displayed, then you can free download attachments.
3,After purchase is successful, the second time to visit this page does not appear charges prompt.
Click to expand...
Click to collapse
Well I wouldnt trust this.
But if this only flashes the system partition well it shouldnt be harmful. You could download the zv6 stock sys.img and flash it afterwards so you can ota update your phone to zv9 and then root again.
But like I said I wouldnt suggest that...

Alex_XV6700 said:
There is no way (yet) to flash with dd command from external SD.
Click to expand...
Click to collapse
Why no? You can use Push_file.exe.

MAXIMATOR said:
Why no? You can use Push_file.exe.
Click to expand...
Click to collapse
Please, elaborate....

jplum22 said:
Please, elaborate....
Click to expand...
Click to collapse
https://www.google.com.ua/#q=Push_file.exe
---------- Post added at 11:30 AM ---------- Previous post was at 11:26 AM ----------
LS9960 ZV6 with
LG Security Error
Authentication Fail #9
was secsessfuly unbricked without SDcard using Push_file.exe for send system.img to internal sdcard

Well this is new @MAXIMATOR at least it is to me.
If you let me I can add this to my back to stock forum.

Push_file.exe can not send files larger than 16 MB . the image to be split into files no more than 16 MB , after which they can be sent to the device . On the device, combined to one file.

MAXIMATOR said:
Push_file.exe can not send files larger than 16 MB . the image to be split into files no more than 16 MB , after which they can be sent to the device . On the device, combined to one file.
Click to expand...
Click to collapse
I've already tried. It doesn't work. Files can not be combined.
http://forum.xda-developers.com/g-flex2/help/to-unbrick-g-flex-2-ls996-t3286105

Need some guidance

so i have a g flex 2 ls996 i am thinking of installing xposed and as we all know that for now there is no custom recovery for flex 2 but i just cant live without xposed. But i do not want to damage my phone either.
Hence i plan to create the backup plan first which is preparing a stock kdz tot first
this is the link i plan to depend on for backup http://romdienthoai.com/search?search-text=ls996
are these files the correct one?
which one should i install in case of bootloop etc?
I have an unlocked phone and i am using it in pakistan.
will installing these files lock my phone on sprint carrier or anything like that?

Personally I've never seen that site before but I know for a fact that almost all of us use or have used the ZV8 TOT file shared here:
http://storagecow.eu/index.php?dir=Xda/LG+G+Flex+2/Sprint/
No issues with that one for me personally. There are no KDZ files available for the LS996 (the Sprint Flex 2) that I'm aware of, and I hope that sometime we might finally get one. The latest firmware is of course the just released ZVB a few days ago but that's just available as an OTA but the system img file is available now as well (it does contain a new radio.img file that should be flashed as well - I can't get an update.zip to flash properly so I had to do everything manually on my own: flash the ZV8 TOT, then flashed the rooted ZVB system img file (which is also available now), then flashed the radio.img file and I'm good to go without any issues.
I can't speak for anything related to your location (Pakistan) so read up on the details but that ZV8 TOT file I provided a link to should work just fine. If you need or want the ZVB (that's ZV-B and in Bravo which has the security patches and other fixes through May 1st) it's available in one of the other threads, and of course the rooted ZVB is available from yet another thread.
Stuff is all over the place, really, could stand some consolidation I suppose.
Flashing any of these should not affect your /carrier folder on the device - firmware upgrades really don't do anything to that folder so as long as it's there and your phone works, upgrading the firmware should not have any effect on your current cellular service but there are never any absolute guarantees.

br0adband said:
Flashing any of these should not affect your /carrier folder on the device - firmware upgrades really don't do anything to that folder so as long as it's there and your phone works, upgrading the firmware should not have any effect on your current cellular service but there are never any absolute guarantees.
Click to expand...
Click to collapse
Thank you very much for your response.
i guess i'll install the xposed then.

[ROM] [US996] US99610k/10l/10n/10o/10p/20f Stock ROM TWRP Flashable Zip KEEP ROOT!

with very little activity lately for the LGV20, especially with the unlocked US996 variant, I created a TWRP flashable package for the recent US99610k release. this zip flash every partition included in the latest KDZ package with the exception of recovery to keep TWRP. standard disclaimer applies, you do all of this at YOUR OWN risk! because I have not tested this yet, I can't verify whether 10k is rootable or not or if there's Anti-RollBack (ARB), so you need to be root'd before flashing this! failure to do so will probably cause you to lose root and/or lose TWRP! if 10k does have ARB you won't be able to downgrade. stay tuned on this.
NOTE1: you can find the partitions that will be flashed in the updater-script. to be extra cautious you can back up all of the partitions that will be overwritten with the following: dd if=/dev/block/bootdevice/by-name/{partition} of=/external_sd/backup/{partition}.img.
NOTE2: boot partition has been modified only to remove rctd, nothing else so I consider this to still be stock
Instructions:
download US99610.zip file listed below and put on microSD card
download your choice of root and put on microSD card, choose from either Magisk or SuperSU *Note: v12.0 of Magisk does not work with the LGV20 device in general and v14.0 is recommended.
backup any data from internal "SD card"
boot into TWRP (requires TWRP recovery to already be installed)
create a TWRP backup of the device
flash zip from microSD card by using "Install"
FLASH YOUR CHOICE OF ROOT - Flashing root is VERY IMPORTANT BEFORE REBOOTING!
reboot
profit!
Download:
US99610k.zip md5sum: 26da82660579673e5486e0361ff8c6e6
US99610l.zip md5sum: 01423ade5ba4977e1e8ae6d5bc244ecf
US99610n.zip* md5sum: bbde6e972305918712b3c51f03a1be10
US99610o.zip md5sum: 6019e92c6e0b3691689820b43b2b0c5d
US99610p.zip md5sum: 9875e4da163168c84ce479509bf7e19d
US99620f.zip* md5sum: 3AEBED11462D0F4A18D3FB9A4FDE95EB
* - unlocked non-US Cellular
for 20f (Oreo) please see this comment about updating TWRP and /data encryption https://www.reddit.com/r/lgv20/comm...s99610k10l10n10o10p20f_stock_rom_twrp/ed5olp6
Flashing Process (what flashing this zip does):
flash necessary partition images with the exception of recovery (to keep TWRP) from the KDZ
rename /system/recovery-from-boot.p to /system/recovery-from-boot.bak to prevent stock recovery from being installed on boot
wipes dalvik-cache and cache
BIG thanks to @McNutnut on guidance, as well as his script to put all of this together!
also thanks to @bullghost for the KDZ extractor (https://forum.xda-developers.com/showthread.php?t=2600575)
@Tilde88 for the original updater-script template w/root (https://forum.xda-developers.com/v20/development/us996-nrd90m-modded-notsostock-rom-v5-1-t3526542)

On your instructions portion it says h91810q.

storm68 said:
On your instructions portion it says h91810q.
Click to expand...
Click to collapse
haha, thank you for helping me correct that!

Hmmmm. Not tested you say.... Nervous I am. Have time to fix using computer I do not.

I've been running 10k for almost a week now and haven't seen any issues. I can't necessarily speak for this ZIP, though. Taking a glance at it things look good.
One thing I'd like to point out is an issue I saw reported by another user. They stated that after they flashed US Cellar US996 updates their Unlocked US996 device was being picked up as the US Cellular device when attempting to use the LG website bootloader unlock. This is most likely due to the US Cellular bootloader being flashed and the device reporting a US Cellular device ID. This hasn't caused any issues when your device has already been bootloader-unlocked but I would not suggest that users re-lock their bootloader when running this US Cellular firmware as you may risk running into problems unlocking. The same user had also reported that they just flashed the 10f kdz with LGUP to correct the problem but not a risk I'd like to see anyone take. Just a word of caution.

McNutnut said:
....
Click to expand...
Click to collapse
Thanks for the heads up.
Can you confirm what security patch 10k is up to on the 996? Any other documented updates/fixes?

nickthaskater said:
Thanks for the heads up.
Can you confirm what security patch 10k is up to on the 996? Any other documented updates/fixes?
Click to expand...
Click to collapse
September 1st
No documented changes that I've seen.

No issues flashing for me... didn't wipe data, works well.. not sure what the changes are though, looks like the same

leonzwrx said:
No issues flashing for me... didn't wipe data, works well.. not sure what the changes are though, looks like the same
Click to expand...
Click to collapse
If it's just a security update there won't be any visual differences.
I just installed and everything is as it was on 10h, save for the security date.

Thank you.
I flashed from US99610h to US99610k with no issues. I did not flash supersu or magistick after flashing the firmware because I need to use uverse app. So far 24 hours with no issue or crash.

I extracted this modem (actually I just removed everything else from the zip and modified the script file) because I wanted to see if the newer modem fixed some streaming issues I had. I'm on Lineage, but it looks like the modem keeps crashing. It works fine for a few minutes while streaming music but then crashes and takes the WiFi and LTE with it for a few seconds.
Shouldn't this updated modem work with 7.1?
Doug

Hello, my phone stuck in Logo LG. But before I was in the red triangle and I thought that installing this would work well. But now the bootloader has been blocked and I can no longer enter recovery. And I have happened to install by fastboot the recovery stock but I can not find that file anywhere.
Somebody can help me please?
Edit. The LGUP detect the phone but with unknow model. I put the dll in common and doesnt work. I dont know how to unbrick my phone
Edit 2: I think the OEM is blocked, because I tried the "fastboot oem lock" command and it says it was already blocked, then try to unlock it "fastboot oem unlock" and says: FAILED (remote: unknown command). I think it's because the box was unchecked in Settings> General> Development, but the problem is that I can not boot to activate it.

10l has been released for the US Cellular 996: https://lg-firmwares.com/lg-us996-firmwares/
I confirmed with a US Cellular rep that 10l includes:
KRACK Wi-Fi vulnerability fix
BlueBorne fix (for SPLs September 1 or later)
Anyone with enough brains and heart to put together a .zip for the plebs?

nickthaskater said:
10l has been released for the US Cellular 996: https://lg-firmwares.com/lg-us996-firmwares/
I confirmed with a US Cellular rep that 10l includes:
KRACK Wi-Fi vulnerability fix
BlueBorne fix (for SPLs September 1 or later)
Anyone with enough brains and heart to put together a .zip for the plebs?
Click to expand...
Click to collapse
thanks for the update... I've updated the first post to reflect a 10l TWRP ZIP that works just like 10k that you can flash... tested working on my own US996

dimm0k said:
thanks for the update... I've updated the first post to reflect a 10l TWRP ZIP that works just like 10k that you can flash... tested working on my own US996
Click to expand...
Click to collapse
Thank you very much!

Hey, I'm still on Dec 2016 stock using us996 us cellular. I can flash and keep root? That's what it sounds like but just confirming. If I do a clean flash, Magisk 14 works fine? Thx

strifej said:
Hey, I'm still on Dec 2016 stock using us996 us cellular. I can flash and keep root? That's what it sounds like but just confirming. If I do a clean flash, Magisk 14 works fine? Thx
Click to expand...
Click to collapse
Just follow the instructions in the OP. You need to reflash the Magisk 14 image immediately after flashing the 10L zip.

Anyone know if the radio in either one of these is improved? - I have an unlocked US996 (from B&H photo, not US cellular) and regardless if I am using Verizon or AT&T, my current ROM's (US99610f) radio is very weak in weak signal areas - much crappier phones get much better signal in weak areas. I am hoping a new radio has solved this. It is the only thing I dislike about the V20
Also, with my standard unlocked US996 (already bootloader unlocked via LG developer website) am I better off with 10k or 10l ?

WTF? said:
Anyone know if the radio in either one of these is improved? - I have an unlocked US996 (from B&H photo, not US cellular) and regardless if I am using Verizon or AT&T, my current ROM's (US99610f) radio is very weak in weak signal areas - much crappier phones get much better signal in weak areas. I am hoping a new radio has solved this. It is the only thing I dislike about the V20
Also, with my standard unlocked US996 (already bootloader unlocked via LG developer website) am I better off with 10k or 10l ?
Click to expand...
Click to collapse
Be careful, when I flashed this to my unlocked US996 on Verizon I lost all data, and furthermore could not restore stock without uppercut. I think it's bound to US cellular, these firmwares.

R-T-B said:
Be careful, when I flashed this to my unlocked US996 on Verizon I lost all data, and furthermore could not restore stock without uppercut. I think it's bound to US cellular, these firmwares.
Click to expand...
Click to collapse
I'm not sure what you did, no, you shouldn't have lost your data nor is it bound to US Cellular devices. I have the 10L zip running on my unlocked 996 without any issue. I flashed it via TWRP from 10K and didn't lose anything.

[PROJECT] Real Unbrick for hard-bricked Moto Z Play (addison)

Welcome everyone!
This project has started, becouse we need real solution for the problem. The problem of hard bricked Moto devices. It is like a curse.
When my device bricked I have done solid research, I have gathered many informations and files essential to revive my cellphone but 5 years experience of linux, rooting, compiling kernels and roms weren't enough to make it work.
But nevermind. I am even more determinated and I am asking ALL of You guys here to help me. Together we will come to solution.
Here is what I got, happy reading :
DICTIONARY:
PBL - Primary bootloader of the chip - this is like BIOS for phone so it checks chip for damage and problems and then it tries to load SBL but if SBL is corrupted or checksum doesn't match, PBL invokes Qualcomm HS-USB QDLoader 9008 emergency mode. PBL is hard flashed into SoC and can't be corrupted by firmware.
SBL - Second stage bootloader wich is more advanced than PBL. It initializes phone hardware and ABOOT.
ABOOT - Application bootloader (HBOOT). You probably know this one well. Android botloader.
Full mmcblk0 backup - Backup of whole phone flash storage byto to byte.
blankflash - method of repairing msm phones in 9008 state
programmer.mbn - Special type of software programmer that is being sent to chip in Qualcomm 9008 emergency mode. There it comunicates with pc via firehose protocol. Each phone has set of their own programmers, they are unique to phone and other programmers don't work. These programmers are signed so tampering it results in not working one.
firehose protocol - it is used to tell programmer what operations it must do on chip.
singleimage.bin - this package contains instructions for programmer and set of files it need (for example to replace)
gpt_main0.bin - Partition layout
rawprogram0.xml - instructions for programmer
patch0.xml - I don't know yet
STAR.exe - Application for managing and editing contents of singleimage.bin aka blankflash files
QPST - Flash tool from Qualcomm it basic function is to handle blank-flashing in a better way, also it allows for in-depth debugging of the process
Qualcom Premium Tool - Program made by Mppg Myanmar that is capable of making unlocking bootloader, OEM locks, making backup/restore of chip firmware, handling blank-flashing in VERY specific way (creating instructions for programmer), reading eMMC structure from firmware (can generate gpt layout so very useful!!!), modyfing FW and removing Xiaomi account. It also contains ALL programmers
for more:
https://forum.xda-developers.com/android/general/info-android-device-partitions-basic-t3586565
https://alephsecurity.com/
https://github.com/alephsecurity/firehorse
https://github.com/aravindvnair99/Motorola-Moto-E-XT1022-condor-unbrick
INFO:
1. What causes the brick
I bet 100$ that you hard-bricked your Moto Z Play by installing OTA updates after downgrading firmware. This is only known reason for me at the time of writing this. There is most probable reason why it happens, look:
There are two most common chips on which smartphones are built - Qualcomm and Mediatek. While Mediatek chips are "modification friendly" and simple, Qualcomm chips are somewhat more advanced and have many features that can be enabled or disabled during prorammming in factory. One of them is PBL signature checking. During programming of your phone, proper signatures of SBL are written to it. When someone tries to override default SBL with the new one, it checksums are compared with that stored. If they match, new one is flashed, if not, then update does not happen.
Ok, but what it has to do with brick?!
I explain:
1. You decide to downgrade your firmware
2. During flashing, everything goes "well" (Phone boots), but trully update is partial:
FW in chip is (obviously) more recent that the one you downgrade to, and SBL signature is different (updated), so when it is compared to the signature of SBL from FW you want to flash, it don't match. That don't rise error and flashing continues. Only partition that stays untouched is bootloader, but all other partitions get replaced by those in FW zip. SBL is still compatible with the new partition offsets and partition layout overall so phone functions normally.
3 When OTA is executed, it checks the version of currently installed firware. The most reliabe way to do it is to check checksum of SBL which is pretty logical becouse it's checksum is like "fingerprint" of firmware. Normally, if it would detect the old firmware, OTA would be stopped, but newer SBL tricks it and OTA installs anyway.
4 Results are horrible, becouse OTA does not check GPT table and flashes partitions in bad sectors, corrupting FW.
This causes bootloader to go into Qualcomm HS-USB QDLoader 9008 safe mode.
5 Viola! Hard brick!
2. How to fix it?
That is jolly good question! What we have to do is to reflash full chip firmware. Suprisingly I see some solutions, but those need to be developed:
A) SD-BOOT
It turns out that our fancy chip can probably boot from SD-CARD! The procedure works like this:
- When chip starts, one of the very first things it does is loading the memory, so it can actually work. The trick, is that chip loads it from specific disk, marked with exact name (I don't remember which, but I will do research). Speccially repared SD-CARD can appear with that name, so chip boots from it, not from internal memory. (This trick is proved to work on this model)
How to do it?
- Get full dd of working phone - it must be phone with the SAME chip and very likely the same model
- flash it to SD-CARD of 32GB or more, class 10 speed or higher, directly to card, not partition
- put card in phone, turn it on and wait
- you should see HBOOT
- select fastboot and flash new FW via it
- viola!
!!!THIS IS COMPLICATED PROCEDURE, I WILL MAKE DETAILED THREAD SOON, BUT FOLLOW IT ONLY IF YOU KNOW WHAT ARE YOU DOING!!!
B) FIREHOSE/SAHARA ATTACK
This could be achieved by sending payload via Firehose programmer that would allow to break verification of SBL or somehow allow SBL to be flashed. Now, PBL blocks attempts to update SBL. I have thesis that it is becouse PBL do not allows for SBL downgrade, so it's version must be higher, but we try to flash same version of SBL so it doesn't work. That thesis needs confirmation.
C) CRAFT BLANKFLASH
This would be last resort. It will work for sure, but this method needs knowledge and I don't know if it is doable.
STEP 1: Get white-listed blankflash checksums from OTA (we would need to reverse engineer those)
STEP 2: Break hash
STEP 3: Craft blankflash with needed hash
STEP 4: Flash
NEVER USE BLANKFLASH (ATTENTION!)
DO NOT try any blankflash files. They can make situation a lot worse and even physically (!) dmage your phone.
D) JTAG
Medusa Box etc.
E) Qualcomm Premium Tool
This can even work, but it is untested and there is a slight chance that can worsen state of phone (needs confirming).
The tool is very advanced and I need to gather info about usage, so very probable to be a good solution if we will learn how to use it!
E) METHOD 7
Interesting method from this guy: (7th option, I have contacted him if it is compatibile)
https://github.com/aravindvnair99/Motorola-Moto-E-XT1022-condor-unbrick/blob/master/Unbrick%20methods.md
3. DOWNLOAD
(Links will be aded *soon*)
XDA:DevDB Information
Unbrick Developement for Moto Z Play (addison) Full-Brick, Tool/Utility for the Moto Z Play
Contributors
Bobernator, Stayn, Artim_96, Camarda
Version Information
Status: Nightly
Created 2019-05-04
Last Updated 2019-05-14

I really hope we can get a fully working detailed method to unbrick this device, I'll follow this project and try to help what I can, my phone isn't bricked but I think that an unbrick guide is absolutely necessary.
By the way, did you tried the Qualcomm Board Diag method? Before the Moto Z Play I had a LG G3 and got it hard-bricked and my pc would recognize it as "Qualcomm HS-USB QDLoader 9008" too, using the Board Diag method I got to erase completely the emmc and flash each partition manually, that got it back to life again, of course theres a requirement and it's the AP Chipset files. I don't know if you already tried so you tell me

Stayn said:
I really hope we can get a fully working detailed method to unbrick this device, I'll follow this project and try to help what I can, my phone isn't bricked but I think that an unbrick guide is absolutely necessary.
By the way, did you tried the Qualcomm Board Diag method? Before the Moto Z Play I had a LG G3 and got it hard-bricked and my pc would recognize it as "Qualcomm HS-USB QDLoader 9008" too, using the Board Diag method I got to erase completely the emmc and flash each partition manually, that got it back to life again, of course theres a requirement and it's the AP Chipset files. I don't know if you already tried so you tell me
Click to expand...
Click to collapse
Hi! Really nice to read that . I didn't tried it but i will chec k it out in a while. Sorry for not responding immediatelly but this will change from now, I have XDA app so I stay updated.

Have you seen this post? There's apparently a new Oreo blankflash https://forum.xda-developers.com/showpost.php?p=79514510&postcount=419

echo92 said:
Have you seen this post? There's apparently a new Oreo blankflash https://forum.xda-developers.com/showpost.php?p=79514510&postcount=419
Click to expand...
Click to collapse
Website is legit, sounds like something good, but i will byte-compare it to my other blank flashes in collection. Maby it will worsen state of my device but I will try it.
Ps. I am working on a download section!!!
EDIT: DO NOT TRY IT YET. As you can see in the link this has been uploaded 2 days ago. Post has 1 day, so this is suspicous as hell.

Bobernator said:
Website is legit, sounds like something good, but i will byte-compare it to my other blank flashes in collection. Maby it will worsen state of my device but I will try it.
Ps. I am working on a download section!!!
EDIT: DO NOT TRY IT YET. As you can see in the link this has been uploaded 2 days ago. Post has 1 day, so this is suspicous as hell.
Click to expand...
Click to collapse
I understand the reason to be suspicious, since there's also no way to verify the origin of this blankflash. Also, is there a OPNS27.76-12-22-10 firmware? I thought OPNS27.76-12-22-9 was the last build?

I will answer this way:

Bobernator said:
I will answer this way:
Click to expand...
Click to collapse
That blankflash looks like it worked - seems your device is in fastboot mode despite the photo angle.

echo92 said:
That blankflash looks like it worked - seems your device is in fastboot mode despite the photo angle.
Click to expand...
Click to collapse
Yes, it worked! But do not make misteake and after you flash blankflash do not flash full firmware. Instead flash only recovery - TWRP and make backup of modemst1, modemst2 and FSG partitions, so you can revert your IMEI. After that full flash android 8 FW

Bobernator said:
Yes, it worked! But do not make misteake and after you flash blankflash do not flash full firmware. Instead flash only recovery - TWRP and make backup of modemst1, modemst2 and FSG partitions, so you can revert your IMEI. After that full flash android 8 FW
Click to expand...
Click to collapse
Can you see your recovery partition with the dummy bootloader from the blankflash? Do you have to flash the GPT/bootloader from firmware first?

Well, this is nuts @Bobernator, I'm really happy we have an unbrick method.
If MTP is still working, you can flash the file I attached to this post to automatically backup the required partitions, this can also be helpful in case anyone wants a full IMEI Backup, also, I tried this step:
fastboot flash fsg mmcblk0p29_fsg_backup
fastboot flash modemst1 mmcblk0p27_modemst1_backup
fastboot flash modemst2 mmcblk0p28_modemst2_backup
Click to expand...
Click to collapse
and it gives me permission denied when flashing modemst1 and modemst2, I think we should flash modem NON-HLOS.bin and erase modemst1 and modemst2, if you agree I'll update the zip I made to backup NON-HLOS.bin instead of modemst1 and modemst2

Quick question, is it worth mentioning only to perform steps 12 and 13 (flashing your FSG and modemst backups) if your device has no signal/IMEI issues after flashing the Oreo firmware? Just wondering since the firmware flash and subsequent boot may correctly rebuild the modemst files...

echo92 said:
Quick question, is it worth mentioning only to perform steps 12 and 13 (flashing your FSG and modemst backups) if your device has no signal/IMEI issues after flashing the Oreo firmware? Just wondering since the firmware flash and subsequent boot may correctly rebuilt the modemst files...
Click to expand...
Click to collapse
I don't know for sure but a backup is always recommended and more if it is the IMEI, then, you can flash all partitions and then before restoring the backup boot into the system and check by yourself if you're getting signal and its working... :good:

Stayn said:
I don't know for sure but a backup is always recommended and more if it is the IMEI, then, you can flash all partitions and then before restoring the backup boot into the system and check by yourself if you're getting signal and its working... :good:
Click to expand...
Click to collapse
Yup, an IMEI backup is always useful Just wanted to ask since it's not pointed out in the opening post's guide to check your IMEI/signal before committing to step 12/13. If it's working, no need for those two steps!

@echo92 I forgotten about IMEI totally so I can't tell you, but I can't confirm that's safe to flash gpt and bootloader from OREO fw (8.0). I did this way and everthing is working. Even OTA updates to most recent witouth problems! Here are the proofs (language is "Polish" if you want to translate):

Stayn said:
Well, this is nuts @Bobernator, I'm really happy we have an unbrick method.
If MTP is still working, you can flash the file I attached to this post to automatically backup the required partitions, this can also be helpful in case anyone wants a full IMEI Backup, also, I tried this step:
and it gives me permission denied when flashing modemst1 and modemst2, I think we should flash modem NON-HLOS.bin and erase modemst1 and modemst2, if you agree I'll update the zip I made to backup NON-HLOS.bin instead of modemst1 and modemst2
Click to expand...
Click to collapse
I really appreciate this! Thanks!
If you update your ZIP, I will attach it into the project today, and I will try to find out solution for you, becouse it looks if you can't restore IMEI now (correct me if I am wrong)

echo92 said:
Yup, an IMEI backup is always useful Just wanted to ask since it's not pointed out in the opening post's guide to check your IMEI/signal before committing to step 12/13. If it's working, no need for those two steps!
Click to expand...
Click to collapse
You are surely right. I will correct thread today.

Bobernator said:
I really appreciate this! Thanks!
If you update your ZIP, I will attach it into the project today, and I will try to find out solution for you, becouse it looks if you can't restore IMEI now (correct me if I am wrong)
Click to expand...
Click to collapse
Don't worry about the IMEI, I got it again after flashing my fsg backup, modem and erasing modemst1 and modemst2, now the problem is that on every ROM I get everytime a popup "com.android.phone" has stopped, till I remove the sim card, what could this be? This isn't my main phone so I'm not worried at all but this could happen to someone else

Dial *#06#, if you will get nothing or zero's that means it can be modem failure
Ps. Is your zip updated now?

Hello Guys,
I have the exact same problem. All started here with a changed screen that after update to 8 stopped working, so I did downgrade to 7, and the touch as back, than it started doing the OTA updates and I (dumb enough) accepted it, and now I have a bricked device.
***EDIT***
Now I could get access to the bootloader again, the flash blank worked but it had a catch, if I just executed the bat, it would not work, I had to open a CMD with admin rights, go to the folder and run the bat from there.
***EDIT 2***
So restored bootloader, and booted just like before it was corrupted, now it keeps asking for update, and I disabled it on the "Developer Menu", is that enough? Will not play with updates on this device anymore, android 7.1.1 with 2017 security updates will do it.
***EDIT 3***
Now I have a Mobile Network problem, it does recognize the SIM Chip, but won't get network access, I didn't backup before doing the Blank Flash, but it was not showing on the system before (because the downgrade from 8 to 6, and them upgrade to 7), is there a way to recover it or fix this no network registration possible?

Increase storage space in the root directory for adding and editing system files

I would like to increase the storage space in the root location of my phone. I have rooted my phone with magisk.

Yes, you can repartition the /system partition. Not only is it quite difficult and risky to perform it, it also requires specialized skills which the average user may not have. There is one solution to the problem though: Flash a Custom ROM.

I would love to flash a custom ROM but can't find any for my device. I have an Infinix smart 5 (x657c for the model)

Even a Custom Recovery like TWRP actually isn't available for this phone.
But you can try to make it at your own because phone is based on Mediatek chiset:
Firmware Care
FirmwareCare is one of the ideal firmware download websites, serving Stock Firmware (ROM) for 343 Mobile brands in the World. The Stock Firmware shared on the website came with the Driver, Flash Tool, and How-to Flash Manual.
firmwarecare.com

jwoegerbauer said:
Even a Custom Recovery like TWRP actually isn't available for this phone.
But you can try to make it at your own because phone is based on Mediatek chiset:
Firmware Care
FirmwareCare is one of the ideal firmware download websites, serving Stock Firmware (ROM) for 343 Mobile brands in the World. The Stock Firmware shared on the website came with the Driver, Flash Tool, and How-to Flash Manual.
firmwarecare.com
Click to expand...
Click to collapse
Thanks i will try this

EzioAudit12 said:
I would love to flash a custom ROM but can't find any for my device. I have an Infinix smart 5 (x657c for the model)
Click to expand...
Click to collapse
Due to the unpopularity of Infinix (&Tecno) phones, there's no custom ROM available for your device. Nevertheless, you should absolutely be able to flash GSIs [I WILL NOT BE HELD RESPONSIBLE FOR YOUR ACTIONS, ONLY SUGGESTING!], because I'm sure that device is Treble-supported.
There're tons of very similar Infinix phones (Smart 4, Hot 8, Hot 9 & 10 Play) that have GSIs successful installed, you can check them out on YouTube.