I recently discovered this, and I thought it would be of some benefit to those who are wanting to unlock, modify partitions, etc without the need to flash derpunlock.sbf or modify your photon in any way. What you need to do this:
1) fastboot for Windows or Linux
2) unlocked RDL3 (ramloader) which I am providing
The process is very simple, reboot your Motorola Photon, and hold the volume down button and power button. You will see "fastboot" on the screen, now press volume up. Connect your phone to your computer, and issue the following command which I discovered:
[email protected]:~$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
This will load the unlocked ramloader (unlocked will be displayed at the top even if your phone is locked) which is normally only loaded into ram when flashing an SBF! Amazing, I know. Now you can do all kinds of stuff and you've made no modifications, just issue a "fastboot reboot" and nothing has been modified. Now you are able to erase boot, recovery, oem unlock, etc. Here is an example after you have executed the above. This is just me restoring my default boot and recovery partitions which you can't do from your locked bootloader:
[email protected]:~$ fastboot erase recovery
erasing 'recovery'...
OKAY [ 0.739s]
finished. total time: 0.739s
[email protected]:~/Desktop/SMG$ fastboot flash recovery CG58_0x00000120.smg sending 'recovery' (8192 KB)...
OKAY [ 8.760s]
writing 'recovery'...
OKAY [ 1.013s]
finished. total time: 9.773s
[email protected]:~/Desktop/SMG$ fastboot erase boot
erasing 'boot'...
OKAY [ 0.761s]
finished. total time: 0.761s
[email protected]:~/Desktop/SMG$ fastboot flash boot CG59_0x00000130.smg
sending 'boot' (8192 KB)...
OKAY [ 8.800s]
writing 'boot'...
OKAY [ 0.697s]
finished. total time: 9.497s
good progress on it
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
4G ?
Has anyone tried this method and retained 4G?
scottgl9 said:
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
Click to expand...
Click to collapse
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
bigslanki said:
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
Click to expand...
Click to collapse
The process of loading the unlocked ramloader is the same regardless of your firmware, even if the bootloader is 'locked'. The ramloader is just that, its written to ram, and so when the phone is reset the code is cleared out of memory. This means to unlock your radio, you don't have to flash anything to your ram, flashing rdl.bin basically just loads the ramloader to executable memory, then jumps to it. I'm still working on figuring out how to use this to chain load a custom recovery.
Love this! Keep up the good work!
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
may you attach stock recovery here? thanks
rrusek said:
Has anyone tried this method and retained 4G?
Click to expand...
Click to collapse
+1
4G confirmed working or not?
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
dito33 said:
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Click to expand...
Click to collapse
Not yet, you can flash it but it is not yet bootable since I haven't figured out yet how to jump to recovery from the ramloader (you'll probably get an error 2 if you flash CWM then boot to recovery). After you reset your phone, rdl.bin gets cleared out so the same protection mechanisms are still in the bootloader. It's something I'm working on.
firtermish said:
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
Click to expand...
Click to collapse
I already can. just do the following:
fastboot flash rdl.bin RDL3_unlocked.smg
fastboot erase system
fastboot flash system your_system_file.smg
fastboot erase boot
fastboot flash boot your_boot.smg
fastboot reboot
EDIT: file extension doesn't really matter, can be smg or img
Theres also updating from fastboot using a zip file, I'm not 100% sure if this works the same as in recovery:
update <filename> reflash device from update.zip
jortiz12885 said:
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
Click to expand...
Click to collapse
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
herach said:
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
Click to expand...
Click to collapse
At what point did you receive the error?
scottgl9 said:
At what point did you receive the error?
Click to expand...
Click to collapse
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
herach said:
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
Click to expand...
Click to collapse
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Lightsword1942 said:
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Click to expand...
Click to collapse
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
scottgl9 said:
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
Click to expand...
Click to collapse
Tried that. It reboots the device and the device stays on Moto Logo Dual-core Screen with nothing written on it and nothing else works.
I had niles business rom on my phone and it kept messing up on me. so i downloaded the toolkit for s-off. After many tries i was able to get s-off. Now here is where my problem is there is no recovery on my phone now and when i try and do a fastboot in the cmd for my phone it will not write the Amon Ra recovery file. I now get this.
C:\Android\sdk-tools>fastboot flash boot boot.img
sending 'boot' (3896 KB)... OKAY [ 0.814s]
writing 'boot'... FAILED (remote: not allowed)
finished. total time: 1.130s
what should i do?
eggbert81 said:
I had niles business rom on my phone and it kept messing up on me. so i downloaded the toolkit for s-off. After many tries i was able to get s-off. Now here is where my problem is there is no recovery on my phone now and when i try and do a fastboot in the cmd for my phone it will not write the Amon Ra recovery file. I now get this.
C:\Android\sdk-tools>fastboot flash boot boot.img
sending 'boot' (3896 KB)... OKAY [ 0.814s]
writing 'boot'... FAILED (remote: not allowed)
finished. total time: 1.130s
what should i do?
Click to expand...
Click to collapse
So your trying to flash it as a boot.img? Amon Ra should be flashed as fastboot flash recovery recovery.img. Also if your on stock HBoot i think you need a modified HBoot for fastboot commands or unlocked eve on S-Off
sorry should have been
C:\Users\jamie\Desktop\Fastboot>fastboot flash recovery recovery-ra-vigor-3.15-gnm.img
sending 'recovery' (7078 KB)... OKAY [ 1.426s]
writing 'recovery'... FAILED (remote: not allowed)
finished. total time: 1.742s
eggbert81 said:
sorry should have been
C:\Users\jamie\Desktop\Fastboot>fastboot flash recovery recovery-ra-vigor-3.15-gnm.img
sending 'recovery' (7078 KB)... OKAY [ 1.426s]
writing 'recovery'... FAILED (remote: not allowed)
finished. total time: 1.742s
Click to expand...
Click to collapse
Do you have a stock HBoot? if so i think it has to be unlocked for fastboot commands even on s-off unless you have a modified Hboot that allows for fastboot commands while locked.
jon7701 said:
So your trying to flash it as a boot.img? Amon Ra should be flashed as fastboot flash recovery recovery.img. Also if your on stock HBoot i think you need a modified HBoot for fastboot commands or unlocked eve on S-Off
Click to expand...
Click to collapse
i was reading about flashing the boot image so i also tried to take the boot.img out of CleanROM Standard 4.5 and tried to flash the boot and that didnt work either
i do have s-off and i can get my phone to say FASTBOOT USB but everything i try and write to it says sending OKAY then writing FAILED ( remote: not allowed)
eggbert81 said:
i was reading about flashing the boot image so i also tried to take the boot.img out of CleanROM Standard 4.5 and tried to flash the boot and that didnt work either
i do have s-off and i can get my phone to say FASTBOOT USB but everything i try and write to it says sending OKAY then writing FAILED ( remote: not allowed)
Click to expand...
Click to collapse
Well if your bootloader is locked i would unlock it or get a modified bootloader that allows fastboot commands while locked. If those dont work then youll have to ask a dev
somehow i didnt even notice that was locked. ok got recovery on. now going to try and get a rom on it. with all this headache i almost miss my GNex but it has tons of issues
eggbert81 said:
somehow i didnt even notice that was locked. ok got recovery on. now going to try and get a rom on it. with all this headache i almost miss my GNex but it has tons of issues
Click to expand...
Click to collapse
Glad i could help :highfive:
got it all to work. Thanks
eggbert81 said:
got it all to work. Thanks
Click to expand...
Click to collapse
i didt understand much
still a newbie
first how do u know if the bootloader is locked or not
and how did u workout the problem
im having the same issue please help
& thnx:good:
When your in bootloader there will be a big pink highlight that says locked or unlocked
Sent from my ADR6425LVW using xda app-developers app
Deleted
I am unable to get out of bootloader loop. The phone was already not able to boot into the bone stock rom, so i thought I would try to flash a custom recovery and install a custom rom.
After applying the token, the phone won't unlock bootloader.
C:\Amaze>fastboot flash unlocktoken Unlock_code.bin
sending 'unlocktoken' (0 KB)...
OKAY [ 0.146s]
writing 'unlocktoken'...
(bootloader) unlock token check success
OKAY [ 0.011s]
finished. total time: 0.161s
But nothing happens on the phone! Still says **LOCKED** on top. Also wierd enough says S-OFF!
But as I can't unlock bootloader, can't flash anything. It keeps rebooting into the bootloader on reboot, power off, and restart via fastboot command.
The phone is from Wind Mobile Canada, and there is no ICS -based RUU for it.
Thoughts?
SaHiLzZ said:
I am unable to get out of bootloader loop. The phone was already not able to boot into the bone stock rom, so i thought I would try to flash a custom recovery and install a custom rom.
After applying the token, the phone won't unlock bootloader.
C:\Amaze>fastboot flash unlocktoken Unlock_code.bin
sending 'unlocktoken' (0 KB)...
OKAY [ 0.146s]
writing 'unlocktoken'...
(bootloader) unlock token check success
OKAY [ 0.011s]
finished. total time: 0.161s
But nothing happens on the phone! Still says **LOCKED** on top. Also wierd enough says S-OFF!
But as I can't unlock bootloader, can't flash anything. It keeps rebooting into the bootloader on reboot, power off, and restart via fastboot command.
The phone is from Wind Mobile Canada, and there is no ICS -based RUU for it.
Thoughts?
Click to expand...
Click to collapse
try a new token? or since your s off simply run a ruu
Hi first time poster but long time lurker here and I have a problem. I used the instructions on HTCdev to unlock the bootloader on my phone, I know it went through because I get this message in the command prompt window.
< waiting for device >
sending 'unlocktoken' (0 KB)...
OKAY [ 0.151s]
writing 'unlocktoken'...
(bootloader) unlock token check successfully
OKAY [ 0.007s]
finished. total time: 0.158s
Correct me if I am wrong but don't I need to unlock before I run the RUU?
I did run the RUU for my device from the HTCdev site but it always gives me the same message of " The ROM Update Utility cannot update your phone - Please get the correct ROM Update Utility and try again".
My current software Version: 2.95.651.6
CDMA
Sprint USA
So what do I do if I can do neither step? If there is any info you would need to assist me let me know and I will provide it.
Any help would be appreciated.
After you got:
< waiting for device >
sending 'unlocktoken' (0 KB)...
OKAY [ 0.151s]
writing 'unlocktoken'...
(bootloader) unlock token check successfully
OKAY [ 0.007s]
finished. total time: 0.158s
something should come up with your phone asking you if you really want to unlock the boot loader. then you have to select yes. did you went trough that? did you go to the boot loader after doing all that, and did it say "unlocked"?
and Btw, if you want to run the RUU, the phone must have a locked bootloader (if i recall correctly. i'm suddenly not so ure). to lock it use
Code:
fastboot oem lock
after that, you can unlock the boot loader again anytime using the exact same unlock token you had with the command
Code:
fastboot flash unlocktoken Unlock_code.bin
EDIT: Actually, i realized you don't have to re-lock the bootloader to run the RUU.
also, please tell me, can you get the phone to boot into the boot loader? are you S-Off?
Hello,
First of all, sorry for my bad English, i hope you will understand me.
I was trying to restore a stock android backup to my phone with twrp, which i downloaded from the internet. But that was a few problems ago.
My CID is HTC_E11.
Now i'm in much bigger trouble namely, i have a stock recovery, relocked bootloader and s-on and i think no ROM.
And if i have a ROM it's broken. I can't even unlock my bootloader because I get the error :
" D:\Downloads\fastboot_adb>fastboot oem unlock Unlock_code.bin
...
(bootloader) [ERR] Command error !!!
OKAY [ 0.003s]
finished. total time: 0.004s"
When I try to flash my recovery i get the error:
" D:\Downloads\fastboot>fastboot flash recovery openrecovery-twrp-2.8.5.0-m8_whl.i
mg
sending 'recovery' (16086 KB)...
OKAY [ 1.516s]
writing 'recovery'...
(bootloader) signature checking...
FAILED (remote: signature verify fail)
finished. total time: 2.220s "
I'm just trying for 3 days long to get my HTC alive, but nothing worked. I hope someone here can help me.
Thank you in advance,
Thomas