Database Develop

Can't flash anything via fastboot (XT1068)

I recently got a Moto G 2014 from a friend, who somehow managed to brick it to a point, where it's unrecoverable for me, even after hours of googling and trying. Maybe someone of you has an idea on how to fix this.
I still can boot to fastboot mode, but no farther than that. Recovery doesn't work, and system also. When I'm trying to boot either, I get a fall-through to bootloader with reason "Invalid boot image header".
I already tried restoring stock by flashing several different stock ROMs, but none of them worked so far. I also tried different systems (Windows 10, Arch Linux), but it doesn't seem to make a difference.
When flashing gpt.bin via fastboot, it shows me no error (most of the time, sometimes it's "Preflash validation failed") in console, but the phone shows a "no valid gpt found" message afterwards.
When trying to flash any other partition, I either get "Failed to erase partition" and "Failed to flash partition logo/motoboot/whatever" or (bootloader) permission denied.
I am running fastboot as root on my Arch machine, and when typing "fastboot devices" it shows the serial number of the device followed by "fastboot".
Bootloader is already unlocked.
Here is a dump of "fastboot getvar all":
Code:
(bootloader) version: 0.5
(bootloader) version-bootloader: 4883(*)
(bootloader) product: titan
(bootloader) secure: yes
(bootloader) hwrev: 0x8400
(bootloader) radio: 0x5
(bootloader) emmc: 8GB Sandisk REV=06 PRV=07 TYPE=17
(bootloader) ram: 1024MB Samsung S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8226 CS
(bootloader) serialno: ZX1D224SLX
(bootloader) cid: 0x0007
(bootloader) channelid: 0x45
(bootloader) uid: FEC299050F000000000000000000
(bootloader) unlocked: yes
(bootloader) securestate: unlocked
(bootloader) iswarrantyvoid: yes
(bootloader) mot_sst: 3
(bootloader) max-download-size: 536870912
(bootloader) reason: Fall-through from mot-charger boot mode
(bootloader) imei: [censored]
(bootloader) meid:
(bootloader) date: 09-03-2014
(bootloader) sku: XT1068
(bootloader) battid: (null)
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Thu Aug 6 3:34: 7 UTC 2015"
(bootloader) ro.build.fingerprint[0]: motorola/titan_retde/titan_umtsds:
(bootloader) ro.build.fingerprint[1]: 5.0.2/LXB22.99-16.3/6:user/release
(bootloader) ro.build.fingerprint[2]: -keys
(bootloader) ro.build.version.full[0]: Blur_Version.22.56.3.titan_retde.
(bootloader) ro.build.version.full[1]: retdeall.en.DE
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.045
(bootloader) version-baseband:
(bootloader) kernel.version[0]: Linux version 3.4.42-g0bea67a ([email protected]
(bootloader) kernel.version[1]: ilclbld36) (gcc version 4.8 (GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Tue Aug 25 22:40:50 CDT 2015
(bootloader) sdi.git: sdi.git
(bootloader) sbl1.git: sbl1.git
getvar:all FAILED (status read failed (No such device))
finished. total time: 22.864s
I really hope someone of you has an idea, because I am stumped.

Ever tried to boot twrp ? I mean directly booting with the command: fastboot boot twrp.img ?
This version: https://dl.twrp.me/titan/twrp-2.8.5.0-titan.img Newer ones may fail

zman01 said:
Ever tried to boot twrp ? I mean directly booting with the command: fastboot boot twrp.img ?
This version: https://dl.twrp.me/titan/twrp-2.8.5.0-titan.img Newer ones may fail
Click to expand...
Click to collapse
Yes, I forgot to mention it, but I already tried this. Result is an error message on the phone saying "Incomplete boot image for booting".

any solution you got for this problem?

Unfortunately not, no

System UI has stopped, Phone locked

Hey All,
Device - Motorola One Power
Status - Completely in Stock condition
OS Version - 10(QPTS30.61-18-3)
After I changed a wallpaper on the phone, a popup "System UI has stopped" is perpetually occurring on top of my lock-screen which is making me unable to unlock or use the phone.
User is given with two options on the popup error, App info and Stop app, selecting any of these will give a blank screen and error will popup again repeating the same process.
Situation - USB Debugging is not enabled, USB connection settings set to charging as default.
Troubleshooting and results
1. Normal Mode - Fingerprint accepted, vibration feedback received, PIN mandatory, cannot login as display goes blank after every touch.
2. Safe Mode - Same issues as normal boot.
3. USB OTG-Mouse - Mouse pointer appears on top of the popup error, cannot dismiss, same issue as normal and safe boot.
4. Emergency call mode - Popup appears even on the emergency call.
5. Wipe Cache is unavailable in recovery as the I guess it's the new seamless A/B data structure.
Situation : Data is not backed up and Full Userdata wipe is not an option..
Wipe Data is not an option as I have the only copy of photos of recent family get-together and baby cousin's birthday which I could not back up due to lack of personal time.
Is there any way to get my data back ?
Fastboot?
ADB Zip Sideload?
Factory Mode?
Please help me out guys
Thanks

Anyone?
Please help guys

Jack_731 said:
Anyone?
Please help guys
Click to expand...
Click to collapse
Without USB debugging enabled,
I don't think there are any options.
You could try to flash firmware and skip the
erase userdata command
But with the bootloader lock likely
Flashing is blocked.
Sent from my ali using XDA Labs

sd_shadow said:
Without USB debugging enabled,
I don't think there are any options.
You could try to flash firmware and skip the
erase userdata command
But with the bootloader lock likely
Flashing is blocked.
Sent from my ali using XDA Labs
Click to expand...
Click to collapse
Thank you for replying
USB Debugging is disabled, but when I boot to Recovery and go to 'load zip using ADB', ADB gets loaded in "Sideload" mode and the device is visible in Sideload mode in ADB command prompt.
Questions
1) Can I an sideload an official OTA Zip on a locked bootloader?
Here is a link from google support on that same sideload method for Google Pixel https://support.google.com/pixelphone/thread/17016500?hl=en&dark=1
Am referring to that cause my phone is running Android One, and they have migrated the data structure into the new A/B seamless partition.
Thank you again

Jack_731 said:
Thank you for replying
USB Debugging is disabled, but when I boot to Recovery and go to 'load zip using ADB', ADB gets loaded in "Sideload" mode and the device is visible in Sideload mode in ADB command prompt.
Questions
1) Can I an sideload an official OTA Zip on a locked bootloader?
Here is a link from google support on that same sideload method for Google Pixel https://support.google.com/pixelphone/thread/17016500?hl=en&dark=1
Am referring to that cause my phone is running Android One, and they have migrated the data structure into the new A/B seamless partition.
Thank you again
Click to expand...
Click to collapse
Possibly, but Motorola doesn't openly share the OTA updates like Google
Sent from my Moto E (4) using Tapatalk

sd_shadow said:
Possibly, but Motorola doesn't openly share the OTA updates like Google
Sent from my Moto E (4) using Tapatalk
Click to expand...
Click to collapse
Here is a link to a tool made by members of xda https://forum.xda-developers.com/moto-z/development/tool-motorola-ota-link-generator-tool-t3537039
and here is another link of firmwares for motorola one power https://mirrors.lolinet.com/firmware/moto/chef/official/RETIN/
Can you guide on how should I try this way?
Please help me out
Thanks

Anyone here with the expertise and knowledge to guide me through the process?
Any kind of link or guide or steps in which I can revive my on-device data?
Please help me out.
It will be very helpful to me ..

Anyone?
Any help will be appreciated
Thanks..

[
Jack_731 said:
Hi,
Will this method work on Locked BLs, and if USB Debug is off?
My Phone - Moto One Power
Click to expand...
Click to collapse
I don't think the ota update method is going to work.
But editing the erase userdata line
Then flashing with LMSA may
As discussed here
https://forum.xda-developers.com/g5-plus/how-to/how-to-flash-stock-loosing-data-t3871703

Jack_731 said:
Hey @sd_shadow
this is what I get on my Moto One Power (fastboot getvar all)
Code:
(bootloader) kernel: uefi
(bootloader) version-bootloader: MBM-3.0-chef_retail-38523c9-200122
(bootloader) product: chef
(bootloader) board: chef
(bootloader) secure: yes
(bootloader) hwrev: PVT
(bootloader) radio: APAC
(bootloader) storage-type: eMMC
(bootloader) emmc: 64GB SAMSUNG DH6DMB RV=08 PV=05 FV=0000000000000005
(bootloader) ufs: N/A
(bootloader) ram: 4GB SAMSUNG LP4x DIE=16Gb M5=01 M6=06 M7=10 M8=12
(bootloader) cpu: SDM636 1.0 (1)
(bootloader) serialno: ZF6223TFLL
(bootloader) cid: 0x0032
(bootloader) channelid: 0xc0
(bootloader) uid: FDF7898C
(bootloader) verity-state: enforcing (0)
No more info from bootloader.
BL = Locked
USB Debug = Locked
Unrooted
Is there anything I should do?
Thanks
Click to expand...
Click to collapse
I don't know over half the lines are missing
You should have more like this
Code:
(bootloader) verity-state: disabled (0)
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: Volume down key pressed
(bootloader) imei:
(bootloader) meid:
(bootloader) date: 11-20-2018
(bootloader) sku: XT1900-1
(bootloader) carrier_sku: XT1900-1
(bootloader) battid: SNN5994A
(bootloader) battery-voltage: 4006
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) ro.build.fingerprint[0]: motorola/payton/payton:9/PPWS29.69
(bootloader) ro.build.fingerprint[1]: -39-6-2/d2226:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.29.461.11.payton.ret
(bootloader) ro.build.version.full[1]: ail.en.US
(bootloader) ro.build.version.qcom: LA.UM.7.2.r1-04900-sdm660.0
(bootloader) version-baseband: M660_7045.36.01.100R PAYTON_NA_CUST
(bootloader) kernel.version[0]: Linux version 4.4.153-perf-g496fe5a (hud
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.9.x 2015
(bootloader) kernel.version[2]: 0123 (prerelease) (GCC) ) #1 SMP PREEMPT
(bootloader) kernel.version[3]: Thu Oct 31 07:27:03 CDT 2019
(bootloader) git:abl: MBM-3.0-payton_retail-eca8056-191031
(bootloader) git:xbl: MBM-3.0-payton_retail-dec7b7c-191031
(bootloader) git:pmic: MBM-3.0-payton_retail-dec7b7c-191031
(bootloader) git:rpm: MBM-3.0-payton_retail-b0c6622-191031
(bootloader) git:tz: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:hyp: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:devcfg: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:cmnlib: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:cmnlib64: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:keymaster: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:prov: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:storsec: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) frp-state: no protection (77)
(bootloader) ro.carrier: retus
(bootloader) current-slot: b
(bootloader) running-bl-slot: _b/_b
(bootloader) running-boot-lun: 0
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: yes
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 6
all: listed above
Finished. Total time: 0.250s

Hey, I just saw your post in my Pixel 3a thread (link if anyone is curious), sorry to hear you ended up in the same boat.
For what it's worth, my 3a suffered from a screen issue before. It's very unlikely (though not impossible) that something was corrupted being processed, but I wanted to add this thought.
Anyway, I hope you find a solution if nothing from my thread works. Although somewhat chaotic (and sometimes unconventional by freezing the UI before it crashes/restarts), it featured every bit me and others were able to think of.
In the end, only a factory reset helped and I lost all data in the process.
I would have been able to rescue everything, if I only had one more second between crashes or hadn't I rebooted in the meantime (no fingerprint allowed), sadly such small obstacles can be complete roadblocks.
So, sorry for not being of bigger help, but if you manage to find a solution which might be applicable to the 3a as well, I'd happily add it to my thread, too.
Good luck.

sysuicrash0511 said:
Hey, I just saw your post in my Pixel 3a thread (link if anyone is curious), sorry to hear you ended up in the same boat.
For what it's worth, my 3a suffered from a screen issue before. It's very unlikely (though not impossible) that something was corrupted being processed, but I wanted to add this thought.
Anyway, I hope you find a solution if nothing from my thread works. Although somewhat chaotic (and sometimes unconventional by freezing the UI before it crashes/restarts), it featured every bit me and others were able to think of.
In the end, only a factory reset helped and I lost all data in the process.
I would have been able to rescue everything, if I only had one more second between crashes or hadn't I rebooted in the meantime (no fingerprint allowed), sadly such small obstacles can be complete roadblocks.
So, sorry for not being of bigger help, but if you manage to find a solution which might be applicable to the 3a as well, I'd happily add it to my thread, too.
Good luck.
Click to expand...
Click to collapse
Hey there,
I think we understand each others problems very well,
Don't be sorry, your post has actually helped me understand that am not alone with the current issue.
This is a serious issue in Android Devices (System UI has stopped), and I guess more than 80% of the consumers don't know anything about USB Debugging or would keep that enabled.
First of all, an error popup should not be front and center on any UI, the pop-up should be dismiss-able / can be minimized away from the general display area of any device.
Just like when in older Android UI, even an incoming-call used to take the entire screen, but nowadays, they are part of notifications, if the user is focusing on another app.
The fact that this 'System UI' error occurred on the latest Android 10 update (Feb 2020), makes it even worse., that Android hasn't matured yet to be stable.
In hindsight, yes if we had not restarted the phone the moment we face that "System UI keeps stopping" error, the in-device data could have been saved 100%.
Cause the phone was functional even after the error pops up, and there are certain ways we can circumvent it (except restarting).
At least Google is publicly providing OTAs for Pixels so that users can try sideloading.
Motorola doesn't provide anything official, even though it's an "Android One" device.
I guess I will have to do factory reset after all , If nothing turns up positive.
Will keep you posted.
Thanks
Cheers

sd_shadow said:
I don't know over half the lines are missing
You should have more like this
Code:
(bootloader) verity-state: disabled (0)
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: Volume down key pressed
(bootloader) imei:
(bootloader) meid:
(bootloader) date: 11-20-2018
(bootloader) sku: XT1900-1
(bootloader) carrier_sku: XT1900-1
(bootloader) battid: SNN5994A
(bootloader) battery-voltage: 4006
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) ro.build.fingerprint[0]: motorola/payton/payton:9/PPWS29.69
(bootloader) ro.build.fingerprint[1]: -39-6-2/d2226:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.29.461.11.payton.ret
(bootloader) ro.build.version.full[1]: ail.en.US
(bootloader) ro.build.version.qcom: LA.UM.7.2.r1-04900-sdm660.0
(bootloader) version-baseband: M660_7045.36.01.100R PAYTON_NA_CUST
(bootloader) kernel.version[0]: Linux version 4.4.153-perf-g496fe5a (hud
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.9.x 2015
(bootloader) kernel.version[2]: 0123 (prerelease) (GCC) ) #1 SMP PREEMPT
(bootloader) kernel.version[3]: Thu Oct 31 07:27:03 CDT 2019
(bootloader) git:abl: MBM-3.0-payton_retail-eca8056-191031
(bootloader) git:xbl: MBM-3.0-payton_retail-dec7b7c-191031
(bootloader) git:pmic: MBM-3.0-payton_retail-dec7b7c-191031
(bootloader) git:rpm: MBM-3.0-payton_retail-b0c6622-191031
(bootloader) git:tz: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:hyp: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:devcfg: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:cmnlib: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:cmnlib64: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:keymaster: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:prov: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) git:storsec: MBM-3.0-payton_retail-fa205ea-dirty-191031
(bootloader) frp-state: no protection (77)
(bootloader) ro.carrier: retus
(bootloader) current-slot: b
(bootloader) running-bl-slot: _b/_b
(bootloader) running-boot-lun: 0
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: yes
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 6
all: listed above
Finished. Total time: 0.250s
Click to expand...
Click to collapse
This was the error message displayed after the command.
Code:
getvar:all FAILED (status read failed (Too many links))
Is there any hardware issue with the phone?

Hey @sd_shadow,
Can you check these recovery logs to get a clearer picture of this issue?
Especially these lines
Code:
ro.adb.secure=1
ro.mot.security.enable=1
ro.opa.eligible_device=true
ro.secure=1
ro.debuggable=0
ro.oem_unlock_supported=1
ro.boot.flash.locked=1
ro.boot.write_protect=0
ro.boot.secure_hardware=1
1) Does it means it is flash protected?
2) If 'fastboot getvar all' command result is not completely getting loaded, does that mean "fastboot flash" command is out of bounds?
Thanks..

Jack_731 said:
Hey @sd_shadow,
Can you check these recovery logs to get a clearer picture of this issue?
Especially these lines
Code:
ro.adb.secure=1
ro.mot.security.enable=1
ro.opa.eligible_device=true
ro.secure=1
ro.debuggable=0
ro.oem_unlock_supported=1
ro.boot.flash.locked=1
ro.boot.write_protect=0
ro.boot.secure_hardware=1
1) Does it means it is flash protected?
2) If 'fastboot getvar all' command result is not completely getting loaded, does that mean "fastboot flash" command is out of bounds?
Thanks..
Click to expand...
Click to collapse
@sd_shadow
What do you think?
Am a bit concerned , as If I may get stuck while flashing and this phone will end up useless.
If 'fastboot getvar all' command result is not completely getting loaded, does that mean "fastboot flash" command is out of bounds?
Thanks

Moto G2 XT1072 can't boot

Hi all,
I had a XT1072 with Android 6 and wanted to go back to 5 due to problems with GPS.
I unlocked the boot loader, flashed stock ROM with Android 6 and all was fine.
I next tried to flash stock ROM with Android 5 and was stuck in fast boot with errors like "invalid system image signature" or similar.
Next I messed around with TWRP, stock again, lock, unlock... a mess.
Now it's stuck in fastboot with status "LOCKED, status code 2" (0 is LOCKED, 3 UNLOCKED, 2 what is it?)
I tried flashing stock ROM both 5 and 6 in different versions:
RETDEALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETESALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
Motorola_Moto_G2_XT1072_MPB24.65-34_CID12_6.0
But all fail with "failed validation";
Unlock fails, but I cannot boot in Android to change mentioned option:
Code:
mfastboot-v2> .\mfastboot oem unlock XSVDURWNGOWYDFMGU5ZT
...
(bootloader) Check 'Allow OEM Unlock' in Developer Options.
FAILED (remote failure)
finished. total time: 0.057s
RSD Lite to flash stock ROM doesn't see my device.
Rescue and Smart Assistant cannot proceed due to "missing version-baseband:" (see empty var listed below).
Code:
mfastboot-v2> .\mfastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 4821
(bootloader) product: thea
(bootloader) secure: yes
(bootloader) hwrev: 0x8300
(bootloader) radio: 0x3
(bootloader) emmc: 8GB Toshiba REV=06 PRV=51 TYPE=17
(bootloader) ram: 1024MB Elpida S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8926
(bootloader) serialno: ZX1C2272TX
(bootloader) cid: 0x0007
(bootloader) channelid: 0x40
(bootloader) uid: C96B590915000000000000000000
(bootloader) unlocked: no
(bootloader) securestate: locked
(bootloader) iswarrantyvoid: yes
(bootloader) mot_sst: 2
(bootloader) max-download-size: 536870912
(bootloader) reason: Fall-through from mot-charger boot mode
(bootloader) imei: 353310061467870
(bootloader) meid:
(bootloader) date: 04-28-2015
(bootloader) sku: XT1072
(bootloader) battid: SNN5956A
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Fri Sep 16 3: 2:45 UTC 2016"
(bootloader) ro.build.fingerprint[0]: motorola/thea_reteu/thea:6.0/MPBS2
(bootloader) ro.build.fingerprint[1]: 4.65-34-5/6:user/release-keys
(bootloader) ro.build.version.full[0]: Blur_Version.24.201.5.thea_reteu.
(bootloader) ro.build.version.full[1]: reteuall.en.EU
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.045
(bootloader) version-baseband:
(bootloader) kernel.version[0]: Linux version 3.4.42-g495dfd8 ([email protected]
(bootloader) kernel.version[1]: ilclbld71) (gcc version 4.8 (GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Sat Sep 10 01:48:29 CDT 2016
(bootloader) sdi.git: git=MBM-NG-V48.21-0-gdc5aeaf
(bootloader) sbl1.git: git=MBM-NG-V48.21-0-gbffe41a
(bootloader) rpm.git: git=MBM-NG-V48.21-0-gbe53f43
(bootloader) tz.git: git=MBM-NG-V48.21-0-g31cba28
(bootloader) aboot.git: git=MBM-NG-V48.21-0-gd8d8d9e
(bootloader) partition-type: raw
(bootloader) partition-size:
(bootloader) qe: qe 0/0
(bootloader) productid: ZX1C2272TX
(bootloader) sutinfo:
(bootloader) ro.carrier: reteu
all: listed above
finished. total time: 0.105s
Do you have any suggestions to restore it?
Let me know if I can give you more information.
Thanks

enricocava said:
Hi all,
I had a XT1072 with Android 6 and wanted to go back to 5 due to problems with GPS.
I unlocked the boot loader, flashed stock ROM with Android 6 and all was fine.
I next tried to flash stock ROM with Android 5 and was stuck in fast boot with errors like "invalid system image signature" or similar.
Next I messed around with TWRP, stock again, lock, unlock... a mess.
Now it's stuck in fastboot with status "LOCKED, status code 2" (0 is LOCKED, 3 UNLOCKED, 2 what is it?)
Click to expand...
Click to collapse
Sometimes the bootloader will relock, when using a custom recovery is used.
I'm not sure why usually when trying to install a rom.
It's very common, but it happens on many Moto devices.
enricocava said:
I tried flashing stock ROM both 5 and 6 in different versions:
RETDEALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETESALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
Motorola_Moto_G2_XT1072_MPB24.65-34_CID12_6.0
Click to expand...
Click to collapse
That will have made it worse.
enricocava said:
But all fail with "failed validation";
Unlocking fails with "Please allow OEM unlock from developer options", but Android is not booting so I cannot change it.
RSD Lite to flash stock ROM doesn't see my device.
Click to expand...
Click to collapse
RSD Lite doesn't work with Windows 9/10/11
Use XP/7
enricocava said:
Rescue and Smart Assistant cannot proceed due to "missing base version" (string is not correct, I'll chek it later).
Do you have any suggestions to restore it?
Let me know if I can give you more information.
Thanks
Click to expand...
Click to collapse
What does getvar all say?
Code:
fastboot getvar all
[Guide] Using Fastboot.exe with Motorola devices
Guide: Using Fastboot.exe with Motorola Devices If your device has its own section please post in that section. You can ping me with @sd_shadow MediaTek or Qualcomm Chip? Do I have a MediaTek Device? see post #26 Info: If you have a MediaTek...
forum.xda-developers.com

Thank you for your quick reply.
sd_shadow said:
RSD Lite doesn't work with Windows 9/10/11
Use XP/7
Click to expand...
Click to collapse
Colud it work on a Win7 on a Virtual machine or does it need direct access to USB ports? At the moment I have not an old Windows available.
sd_shadow said:
What does getvar all say?
Click to expand...
Click to collapse
I updated the original post.
sd_shadow said:
[Guide] Using Fastboot.exe with Motorola devices
Guide: Using Fastboot.exe with Motorola Devices If your device has its own section please post in that section. You can ping me with @sd_shadow MediaTek or Qualcomm Chip? Do I have a MediaTek Device? see post #26 Info: If you have a MediaTek...
forum.xda-developers.com
Click to expand...
Click to collapse
I missed this post, I'll take a look.

enricocava said:
Hi all,
I had a XT1072 with Android 6 and wanted to go back to 5 due to problems with GPS.
I unlocked the boot loader, flashed stock ROM with Android 6 and all was fine.
I next tried to flash stock ROM with Android 5 and was stuck in fast boot with errors like "invalid system image signature" or similar.
Next I messed around with TWRP, stock again, lock, unlock... a mess.
Now it's stuck in fastboot with status "LOCKED, status code 2" (0 is LOCKED, 3 UNLOCKED, 2 what is it?)
I tried flashing stock ROM both 5 and 6 in different versions:
RETDEALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETESALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.46-28_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
RETGBALL_XT1072_5.0.2_LXB22.99-24_cid7_subsidy-DEFAULT_CFC.xml
Motorola_Moto_G2_XT1072_MPB24.65-34_CID12_6.0
But all fail with "failed validation";
Unlock fails, but I cannot boot in Android to change mentioned option:
Code:
mfastboot-v2> .\mfastboot oem unlock XSVDURWNGOWYDFMGU5ZT
...
(bootloader) Check 'Allow OEM Unlock' in Developer Options.
FAILED (remote failure)
finished. total time: 0.057s
RSD Lite to flash stock ROM doesn't see my device.
Rescue and Smart Assistant cannot proceed due to "missing version-baseband:" (see empty var listed below).
Code:
mfastboot-v2> .\mfastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 4821
(bootloader) product: thea
(bootloader) secure: yes
(bootloader) hwrev: 0x8300
(bootloader) radio: 0x3
(bootloader) emmc: 8GB Toshiba REV=06 PRV=51 TYPE=17
(bootloader) ram: 1024MB Elpida S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8926
(bootloader) serialno: ZX1C2272TX
(bootloader) cid: 0x0007
(bootloader) channelid: 0x40
(bootloader) uid: C96B590915000000000000000000
(bootloader) unlocked: no
(bootloader) securestate: locked
(bootloader) iswarrantyvoid: yes
(bootloader) mot_sst: 2
(bootloader) max-download-size: 536870912
(bootloader) reason: Fall-through from mot-charger boot mode
(bootloader) imei: 353310061467870
(bootloader) meid:
(bootloader) date: 04-28-2015
(bootloader) sku: XT1072
(bootloader) battid: SNN5956A
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Fri Sep 16 3: 2:45 UTC 2016"
(bootloader) ro.build.fingerprint[0]: motorola/thea_reteu/thea:6.0/MPBS2
(bootloader) ro.build.fingerprint[1]: 4.65-34-5/6:user/release-keys
(bootloader) ro.build.version.full[0]: Blur_Version.24.201.5.thea_reteu.
(bootloader) ro.build.version.full[1]: reteuall.en.EU
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.045
(bootloader) version-baseband:
(bootloader) kernel.version[0]: Linux version 3.4.42-g495dfd8 ([email protected]
(bootloader) kernel.version[1]: ilclbld71) (gcc version 4.8 (GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Sat Sep 10 01:48:29 CDT 2016
(bootloader) sdi.git: git=MBM-NG-V48.21-0-gdc5aeaf
(bootloader) sbl1.git: git=MBM-NG-V48.21-0-gbffe41a
(bootloader) rpm.git: git=MBM-NG-V48.21-0-gbe53f43
(bootloader) tz.git: git=MBM-NG-V48.21-0-g31cba28
(bootloader) aboot.git: git=MBM-NG-V48.21-0-gd8d8d9e
(bootloader) partition-type: raw
(bootloader) partition-size:
(bootloader) qe: qe 0/0
(bootloader) productid: ZX1C2272TX
(bootloader) sutinfo:
(bootloader) ro.carrier: reteu
all: listed above
finished. total time: 0.105s
Do you have any suggestions to restore it?
Let me know if I can give you more information.
Thanks
Click to expand...
Click to collapse
Code:
(bootloader) ro.build.fingerprint[0]: motorola/thea_reteu/thea:6.0/MPBS2
(bootloader) ro.build.fingerprint[1]: 4.65-34-5/6:user/release-keys
This should be the correct firmware
https://mirrors-obs-2.lolinet.com/firmware/motorola/2015/thea/official/RETEU/
XT1072_THEA_RETEU_6.0_MPBS24.65-34-5_cid7_subsidy-DEFAULT_CFC.xml.zip
Try flashing
Code:
fastboot flash partition gpt.bin
fastboot reboot bootloader
Then flash the firmware using the flash_file.xml as reference.

sd_shadow said:
Code:
(bootloader) ro.build.fingerprint[0]: motorola/thea_reteu/thea:6.0/MPBS2
(bootloader) ro.build.fingerprint[1]: 4.65-34-5/6:user/release-keys
This should be the correct firmware
https://mirrors-obs-2.lolinet.com/firmware/motorola/2015/thea/official/RETEU/
XT1072_THEA_RETEU_6.0_MPBS24.65-34-5_cid7_subsidy-DEFAULT_CFC.xml.zip
Try flashing
Code:
fastboot flash partition gpt.bin
fastboot reboot bootloader
Then flash the firmware using the flash_file.xml as reference.
Click to expand...
Click to collapse
Thank you, it worked! So the problem was the wrong fw version and messing up gpt with random commands, right?
For a downgrade I can follow this one, right? https://forum.xda-developers.com/t/guide-flashing-motorola-firmware.4042039/post-84863341

enricocava said:
Thank you, it worked! So the problem was the wrong fw version and messing up gpt with random commands, right?
Click to expand...
Click to collapse
I believe so
enricocava said:
For a downgrade I can follow this one, right? https://forum.xda-developers.com/t/guide-flashing-motorola-firmware.4042039/post-84863341
Click to expand...
Click to collapse
Do not downgrade unless the bootloader says unlocked again.
If the bootloader is reported as unlocked again,
sure you should be able to downgrade the firmware.

OEM Unlocking disabled and Android not booting

I have been using my Moto X4 on a custom ROM (with magisk) for over 3 years without any issues. Just yesterday, my phone battery died and I plugged in a charger and start up the phone in a couple of mins and I get this message "Your device is corrupt. It cant be trusted and will not boot.
I was surprised to find that on the Fastboot screen, the OEM Status shows as LOCKED - How can this happen after so many years and that too in a snap ?
The problem now is that I'm not sure if the "OEM Unlocking option" under Developer Settings is disabled (It has been long since I went into these settings).
When I try to unlock OEM, I get this message below. What are my options now since the phone doesn't start for me to enable the option using the GUI ? I would like to access my data if there is an chance.
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem unlock O4USDSC3JS6UX4VQBA1B
...
(bootloader) Check 'OEM unlocking' in Android Settings > Developer
(bootloader) Options
OKAY [ 0.012s]
finished. total time: 0.013s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) kernel: uefi
(bootloader) version-bootloader: MBM-3.0-uefi-c18849c-181018
(bootloader) product: payton
(bootloader) board: payton
(bootloader) secure: yes
(bootloader) hwrev: P4
(bootloader) radio: APAC
(bootloader) storage-type: eMMC
(bootloader) emmc: 64GB SAMSUNG DH6DMB RV=08 PV=05 FV=0000000000000005
(bootloader) ufs: N/A
(bootloader) ram: 4GB SAMSUNG LP4x DIE=16Gb M5=01 M6=06 M7=10 M8=12
(bootloader) cpu: SDM630 1.0 (0)
(bootloader) serialno: ZY224GABCD
(bootloader) cid: 0xDEAD
(bootloader) channelid: 0x00
(bootloader) uid: 00000000
(bootloader) securestate: oem_locked
(bootloader) verity-state: enforcing (0)
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: Volume down key pressed
(bootloader) imei: 351899081981234
(bootloader) meid:
(bootloader) date: 10-25-2017
(bootloader) sku: XT1900-2
(bootloader) carrier_sku:
(bootloader) battid: SNN5995A
(bootloader) battery-voltage: 4135
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) ro.build.fingerprint[0]: motorola/payton/payton:8.0.0/OPWS2
(bootloader) ro.build.fingerprint[1]: 7.57-40-3-15/16:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.27.306.16.payton.ret
(bootloader) ro.build.version.full[1]: ail.en.US
(bootloader) ro.build.version.qcom: <not found>
(bootloader) version-baseband[0]: M660_7036.16.01.69.02R PAYTON_APACDSDS
(bootloader) version-baseband[1]: _CUST
(bootloader) kernel.version[0]: Linux version 4.4.78-perf-gc27dd6c (huds
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.9.x 20150
(bootloader) kernel.version[2]: 123 (prerelease) (GCC) ) #1 SMP PREEMPT
(bootloader) kernel.version[3]: Thu Oct 18 11:53:59 CDT 2018
(bootloader) git:abl: MBM-3.0-uefi-c18849c-181018
(bootloader) git:xbl: MBM-3.0-uefi-dfccc3a-181018
(bootloader) git:pmic: MBM-3.0-uefi-dfccc3a-181018
(bootloader) git:rpm: MBM-3.0-uefi-245b046-181018
(bootloader) git:tz: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:hyp: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:devcfg: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:cmnlib: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:cmnlib64: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:keymaster: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:prov: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) git:storsec: MBM-3.0-uefi-30789d4-dirty-181018
(bootloader) qe: "qe 1/1"
(bootloader) frp-state: protected (77)
(bootloader) ro.carrier: retin
(bootloader) current-slot: _b
(bootloader) running-bl-slot: _b/_b
(bootloader) running-boot-lun: 0
(bootloader) slot-suffixes: _a,_b
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: yes
(bootloader) slot-unbootable:_a: yes
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 6
all: listed above
finished. total time: 0.984s
C:\Program Files (x86)\Minimal ADB and Fastboot>

1/ You'd better hide serial and imei number from your post
2/ Moto forums say to try to fix it going back to stock rom using rescue software
Rescue and Smart Assistant Tool - Motorola
<h6><span style="color:#FFFFFF"><strong>Our Rescue and Smart Assistant tool</strong><br />can help diagnose and resolve issues on your<br />Motorola phone or Lenovo phone/tablet.</span></h6>
www.motorola.com
And if does not work to send to repair services
GL

OK. I tried the RSA software and that too identifies my phone correctly, downloads the Stock ROM and failed with an error message saying "Flash Failed. try again". Could this be due to the settings in Developer options being disabled ?(which I cannot get to)
I tried the below to see if it helps, but didnt get far :
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot boot boot.img
downloading 'boot.img'...
OKAY [ 0.514s]
booting...
(bootloader) permission denied!
FAILED (remote failure)
finished. total time: 0.524s
Do I have any options to bring back my phone even if if the data is lost and i need to go back to stock ROM or any other ROM. I just want to have a working phone. Please advise.
Is there a way to unlock the OEM or enable the Unlock OEM in Dev settings without being able to boot into the Operating system ?

Only if you can send adb commands
And so, be able to enter Recovery mode (buttons volume down+power when phone off, just in case)
'Install update > From adb' menus will make you enter adb mode
There may have plenty of softwares for data recovery through adb

Finway said:
Only if you can send adb commands
And so, be able to enter Recovery mode (buttons volume down+power when phone off, just in case)
'Install update > From adb' menus will make you enter adb mode
There may have plenty of softwares for data recovery through adb
Click to expand...
Click to collapse
Thanks. Can adb commands be used even if USB debugging may not be enabled ? Can you guide me to a post on the forum which I can use to follow instructions to try and install a new ROM keeping in mind my current situation.

In Recovery Mode yes you can send adb commands
Do you have acces to it ?
Code:
adb sideload lineage-19.1-20220426-nightly-payton-signed.zip
or any other version of lineage to install it

Info about payton | LineageOS Wiki
wiki.lineageos.org

may i know if this is solved? i have same problem as well, wanna know how to get my x4 out of the error message

Another corrupted X4, am I screwed?

My Wife has an X4, xt1900-1 from Google Fi, that she no longer uses as a phone but uses it on wifi only to run a special piece of software. It got the "device is corrupted" error and will not boot to anything other than FastBoot. Adding results of "Fastboot getvar all" at the end of post. Running "Fastboot oem get_unlock_data" returns:
(bootloader) Failed to get unlock data.
OKAY [ 0.002s]
Finished. Total time: 0.003s
Running LMSA initially wouldn't detect the device, then it did detect and begins the re-flash process but fails at flashing around 69 percent.(nice) No other information is given other than flashing failed.
Attempting to flash the firmware that the LMSA downloaded manually via fastboot and it flashes the first couple bits but fails at the bootloader.
Attempting to fastboot boot into twrp returns:
Sending 'boot.img' (38672 KB) OKAY [ 1.412s]
Booting (bootloader) permission denied!
FAILED (remote: '')
fastboot: error: Command failed
I found the blankflash image for this version of payton, when attempting to run it, the terminal just displays:
< waiting for device >
And nothing ever happens.
I've tried it on Windows and Linux with a handful of different cables and the results are the same. Am I SOL and it's time to replace the device?
Thanks,
(bootloader) kernel: uefi
(bootloader) version-bootloader: MBM-3.0-payton_fi-eca8056931-200924
(bootloader) product: payton
(bootloader) board: payton
(bootloader) secure: yes
(bootloader) hwrev: P4
(bootloader) radio: NA
(bootloader) storage-type: eMMC
(bootloader) emmc: 32GB SAMSUNG DD68MB RV=08 PV=02 FV=0000000000000002
(bootloader) ufs: N/A
(bootloader) ram: 3GB SAMSUNG LP4x DIE=12Gb M5=01 M6=06 M7=00 M8=0E
(bootloader) cpu: SDM630 1.0 (2)
(bootloader) serialno: ZY224H58SP
(bootloader) cid: 0xDEAD
(bootloader) channelid: 0x00
(bootloader) uid: 00000000
(bootloader) securestate: oem_locked
(bootloader) verity-state: enforcing (0)
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: UTAG bootmode configured as fastboot
(bootloader) imei: 356484080483981
(bootloader) meid:
(bootloader) date: 10-15-2017
(bootloader) sku: XT1900-1
(bootloader) carrier_sku:
(bootloader) battid: SNN5995A
(bootloader) battery-voltage: 3899
(bootloader) iccid: 8901260971113779407
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) ro.build.fingerprint[0]: motorola/payton_fi/payton_sprout:9
(bootloader) ro.build.fingerprint[1]: /PPWS29.69-39-6-13/badd5:user/rele
(bootloader) ro.build.fingerprint[2]: ase-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.29.491.55.payton_fi.
(bootloader) ro.build.version.full[1]: google_fi.en.US
(bootloader) ro.build.version.qcom: LA.UM.7.2.r1-04900-sdm660.0
(bootloader) version-baseband: M660_7048.65.01.101R PAYTON_NA_CUST
(bootloader) kernel.version[0]: Linux version 4.4.153-perf-g097f40be62ed
(bootloader) kernel.version[1]: ([email protected]) (gcc version 4.9.x
(bootloader) kernel.version[2]: 20150123 (prerelease) (GCC) ) #1 SMP PR
(bootloader) kernel.version[3]: EEMPT Thu Sep 24 04:43:29 CDT 2020
(bootloader) git:abl: MBM-3.0-payton_fi-eca8056931-200924
(bootloader) git:xbl: MBM-3.0-payton_fi-b24b3b6a2-200924
(bootloader) gitmic: MBM-3.0-payton_fi-b24b3b6a2-200924
(bootloader) git:rpm: MBM-3.0-payton_fi-f97e5eb-200924
(bootloader) git:tz: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:hyp: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:devcfg: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:cmnlib: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:cmnlib64: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:keymaster: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) gitrov: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) git:storsec: MBM-3.0-payton_fi-68ee948c3-200924
(bootloader) frp-state: protected (77)
(bootloader) ro.carrier: retus
(bootloader) current-slot: a
(bootloader) running-bl-slot: _a/_a
(bootloader) running-boot-lun: 0
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: no
(bootloader) slot-successful:_b: no
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 4
(bootloader) slot-retry-count:_b: 0
all: listed above
Finished. Total time: 0.047s

Heyyo, blankflash only works if you reboot the device into EDL mode. I can't remember if powering it off, holding down both volume keys and plugging it into a PC will actually boot it into EDL mode or not for Motorola devices though...
You can also try the TinyFastbootScript and see if that works?
Download the ROM from here:
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors-obs-2.lolinet.com
Download TinyFastbootScript from here which also has the instructions:
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com
If that doesn't work and you can't force reboot to EDL? You can search on Amazon / AliExpress or others for an "Android EDL cable" which can also work to force EDL mode.

ThE_MarD said:
Heyyo, blankflash only works if you reboot the device into EDL mode. I can't remember if powering it off, holding down both volume keys and plugging it into a PC will actually boot it into EDL mode or not for Motorola devices though...
You can also try the TinyFastbootScript and see if that works?
Download the ROM from here:
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors-obs-2.lolinet.com
Download TinyFastbootScript from here which also has the instructions:
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com
If that doesn't work and you can't force reboot to EDL? You can search on Amazon / AliExpress or others for an "Android EDL cable" which can also work to force EDL mode.
Click to expand...
Click to collapse
Awesome thanks for the reply. Yeah I tried a couple different key combinations that I have seen people reference but nothing seemed to work, however I didn't try holding down both volume keys while plugging it in. I'll try that, and also try the tinyfastboot script too and see what happens. Thanks!

Well I think it's toast. The Tinyfastboot script was giving a lot of the same errors when I was running things manually. I could not get the device to boot into EDL through key combinations either. I think the biggest issue is that the bootloader is locked, and cannot be unlocked. I might try to find a cable and give that a shot but I am thinking now it's a waste of time.
Thanks for the help anyway.

Im facing same issue here as well. so EDL method doesnt work?