Dear Esteemed XDA members,
I have spent literally days of testing and researching to try and unbrick my phone. Friends and family have seen my obsession with trying to fix this, some even offering to buy me a new phone!!!! But this ain't about money - this is about having control of my damn device!!! I'm usually pretty good with trying to solve this kind of stuff, but this time I'm truly stumped (and desperate, and obsessed!). I have come to the conclusion that it's directly related to ARM Trusted Firmware. Here are the details of my "journey" to date... please read it, and if you know how to fix it, please share!!! then I can get my life back!!!! Before I go any further, I am certain that my problem was initially triggered by doing an official update on a rooted phone. So to avoid experiencing the same problem I'm about to describe, it's best to unroot and relock your device before loading new official firmware.
I have a Huawei Honor 4x (Che2-UL00, with Kirin 620 chipset) with an unlocked bootloader. Recently, I tried to manually upgrade from Kitkat (emui3.0) to Lollipop (emui3.1), using the official update.app from huawei's website (image was good - I checked the hash). To load the update.app, I used the official huawei recovery. The progress bar went to roughly 90% and then hung. Upon restarting my phone, it went into rescue mode with the following error: Func NO : 15 (bl31 image) Error NO : 1 (security verify failed).
Interestingly, I looked closely at the fastboot.img files for kitkat Vs lollipop (I got the image files by using HuaweiUpdateExtractor). I noticed that only the lollipop fastboot image contains this error message text. Also, bl31 is related to ARM trusted firmware, for more info search for BL31 (Secure Monitor) on google, or see bl31_main.c in the Trusted Firmware source code. So it seems that the lollipop image is using the full ARM trusted firmware, an extra layer of security which is preventing the (unlocked) bootloader from allowing me to load into recovery. I think this is the core problem, and I think there is a way to solve it but I just don't have a deep enough understanding to get there. Below I'll explain each step I went though and provide some additional diagnostic info:
1. First step was to access recovery mode (Vol UP + power). This failed and resulted in same bl31 error message.
2. Second step was to try and update again using the three-button force update (Vol Up + Vol Down + Power). It vibrates once after a few seconds, and freezes with the logo screen with the red light flashing. As an experiment, I tried this without the SDCARD and noticed it vibrated almost instantly, which suggests that it does try to load something from the SDCARD when inserted. I didn't get any further in this mode.
3. Final step I tried was to load into fastboot (Vol Down + Power). This worked and I got into a special "Rescue&Fastboot" mode. First thing I tried was to manually downgrade to kitkat by flashing the kitkat images using the fastboot flash command. The images boot.img, system.img, recovery.img flashed successfully. cust.img simply failed. I desperately wanted to flash the kitkat fastboot.img which doesn't contain the trusted firmware bl31 image stuff, but fastboot replied: FAILED (remote: Command not allowed). In fact, many of the fastboot commands fail with this same error message, even though there is the "PHONE unlocked" writing in red on my phone screen. With the limited command set available (even fastboot oem device-info is not allowed!), here is the diagnostic info I was able to get:
a) fastboot oem check-rootinfo
(bootloader) old_stat: RISK
(bootloader) now_stat: SAFE
(bootloader) change_time: 1452356543
I think this change from RISK to SAFE is the core of my problem. the change_time is from several days ago when I attempted to update. I think it reflects the trusted firmware state (I'm guessing here, as I can't find documentation for these commands).
b) fastboot oem backdoor info
(bootloader) FB LockState: LOCKED
(bootloader) USER LockState: UNLOCKED
I think that FB LockState: LOCKED means that fastboot is locked (guessing again, can't find documentation!), which explains why many of the commands fail.
c) fastboot oem check-image
(bootloader) secure image verify successfully
I think this checks the recovery image, because when I flash a different recovery, this signature check fails
d) fastboot getvar rescue_phoneinfo
rescue_phoneinfo: Che2-UL00 V100R001CHNC00B365
This appears to be the ROM version at the time of purchase.
e) fastboot oem get-build-number
(bootloader): Che2-UL00 V100R001CHNC00B384
This actually corresponds to the build number of kitkat I was using just before the failed upgrade to lollipop.
f) fastboot oem relock mycode
FAILED (remote: root type not allowed).
I tried this just to see if it wold relock. I'm not sure what the error means, but I do not that this command failed with signature verify fail if i change the recovery image.
Here are the questions I want to ask:
1. Can I force the device to flash a new image? I can't get into recovery or have full access to fastboot commands due to the trusted firmware stuff. And as I mentioned earlier the three button trick fails with a freeze at the logo screen. It appears that I need to do this using a means other than fastboot. The only interface I have is Android Sooner ADB Interface. adb devices renders nothing. Only fastboot finds a device.
2. Can I somehow make the "security verify check" pass so that I don't get that bl31 error? I'm not sure exactly which images this bl31 thing is trying to verify! Perhaps some combination of images from the new lollipop stuff I tried to flash and the kitkat build I had running previously?
3. Can somehow disable all this Trusted Firmware stuff??
4. Any other suggestions???
This is driving me to the brink on insanity!!! Gotta figure it out!! Thanks for reading and trying to help!
Hi,
Did anyone solve this problem?
I'm facing the exact same situation.
Che2-UL00 too.
Thanks in advance!
prezident36 said:
Hi,
Did anyone solve this problem?
I'm facing the exact same situation.
Che2-UL00 too.
Thanks in advance!
Click to expand...
Click to collapse
I still find it hard to believe this problem absolutely cannot be solved. However, I took it to a Huawei service center and they weren't able to unbrick it either. They had to replace the mainboard, which seems like a complete waste. Cost around $50, so not the end of the world but still annoying.
Anyway, screw this whole "trusted firmware" rubbish. I'm the owner of the device, yet I'm not "trusted".
hello, i have exactly the same problem!
---------- Post added at 10:58 PM ---------- Previous post was at 10:41 PM ----------
Where do i get the replacement mainboard from?
Me too, upgrading kitkat to lollipop. Now facing that rescue error.
My Honor 4X is unlock bootloader and root before upgrading lollipop,
Hello friends of XDA, I have a big problem between hands, I have a MOTO Z and I had it in android 7.0 since last year the update to andorid 7.1.1 did not arrive and I felt that with android 7 the battery was consumed very quickly, so I tried to find the update to flash it and just about 3 days ago I found it, I proceeded to download it and flash it in fastboot and adb.
The thing is that a few months ago, browsing through my phone (I had already rotated it, and unlocked the bottloader, I decided to re-block the bootloader, and remove the root, which never worked at 100) I got into the developer options, and I saw an option that until then I didn't know about its "OEM Unlock"function, as it was turned on and deactivated because I thought it didn't work.
Returning to the update flashing I proceeded as usual, with the commands, I proceed to restart the device and show the image of the boot of motrola but then it shows me a message in red letters.
"Startup Failed"
"failed to pass validation, backup to fastboot.
I thought it was a compatibility problem with the downloaded version of 7.1.1 so again I decided to flash the stock rom 7.0 but when I finished and restart the same message appeared.
I started to investigate and it seems that the OEM blockade is responsible for not being able to install any Stock Rom, or anything, and now I have a nice brick with Moto mods and I can't use it.
I wanted to unlock OEM in fastboot but nothing. sends message from "ALLOW OEM UNLOCK IN SETTINGS"
There is way to unlock the OEM from pc or fastboot without needing to be unlocked from the android settings, as in my case it is impossible for me,
I'd be very grateful for your help friends, I know it's a bit tedious to read but it's the only phone I have and I feel weird without it on the street.:bueno::bueno::llorando:
I'm with same problem here!
Suckmymfdick17 said:
Hello friends of XDA, I have a big problem between hands, I have a MOTO Z and I had it in android 7.0 since last year the update to andorid 7.1.1 did not arrive and I felt that with android 7 the battery was consumed very quickly, so I tried to find the update to flash it and just about 3 days ago I found it, I proceeded to download it and flash it in fastboot and adb.
The thing is that a few months ago, browsing through my phone (I had already rotated it, and unlocked the bottloader, I decided to re-block the bootloader, and remove the root, which never worked at 100) I got into the developer options, and I saw an option that until then I didn't know about its "OEM Unlock"function, as it was turned on and deactivated because I thought it didn't work.
Returning to the update flashing I proceeded as usual, with the commands, I proceed to restart the device and show the image of the boot of motrola but then it shows me a message in red letters.
"Startup Failed"
"failed to pass validation, backup to fastboot.
I thought it was a compatibility problem with the downloaded version of 7.1.1 so again I decided to flash the stock rom 7.0 but when I finished and restart the same message appeared.
I started to investigate and it seems that the OEM blockade is responsible for not being able to install any Stock Rom, or anything, and now I have a nice brick with Moto mods and I can't use it.
I wanted to unlock OEM in fastboot but nothing. sends message from "ALLOW OEM UNLOCK IN SETTINGS"
There is way to unlock the OEM from pc or fastboot without needing to be unlocked from the android settings, as in my case it is impossible for me,
I'd be very grateful for your help friends, I know it's a bit tedious to read but it's the only phone I have and I feel weird without it on the street.:bueno::bueno::llorando:
Click to expand...
Click to collapse
Try to boot in Fastboot flash twrp and flash ressurection remix rom. It's great rom. Forget about locking. I had the same problem like you as I was trying to flash stock ROM and lock bootloader.
I gave up on this.
knjigo said:
Try to boot in Fastboot flash twrp and flash ressurection remix rom. It's great rom. Forget about locking. I had the same problem like you as I was trying to flash stock ROM and lock bootloader.
I gave up on this.
Click to expand...
Click to collapse
Well, when the root didn't work properly, I flashed the phone again and blocked the bootloader. Will I still be able to install TWPR or should I lose my phone?
Suckmymfdick17 said:
Well, when the root didn't work properly, I flashed the phone again and blocked the bootloader. Will I still be able to install TWPR or should I lose my phone?
Click to expand...
Click to collapse
What do you mean with "I blocked my bootloader"?
Twrp is easy to flash. Root is integrated in ressurection remix rom. And this rom is great. Just try to flash twrp in Fastboot and than ressurection remix with twrp.
Can you boot in Fastboot?
Do you remember what build of 7.1.1 you had on your device before downgrading to 7.0?
If so, I would suggest finding that firmware (the full stock firmware, not OTA updates) or newer if you can, and try to flash that. Since your bootloader is still likely from the 7.1.1 build, a locked bootloader will only permit files matching the same patch level (i.e. from the exact same stock ROM as that bootloader patch) to boot.
If not, then unfortunately there's not a lot we can do. You could wait for a newer firmware to get leaked, but as your device is unable to boot (due to failing the bootloader checks) and you cannot toggle OEM unlocking because you cannot boot, it's a nasty vicious circle that is difficult to get out of. You may have to consider sending your device for service and pay for an expensive motherboard replacement otherwise, since Motorola have a record of your device being unlocked. Your service centre experience may vary.
Only lock a bootloader after ensuring you've flashed all the stock firmware and it is all the same patch level as your bootloader. Hopefully you'll find newer firmware that you can repair with.
tjgibri said:
I'm with same problem here!
Click to expand...
Click to collapse
I solved it, I finally flashed the stock rom to my phone and it works.
Apparently my pc was not flashing the stock rom in adb, and the phone turned off when loading the software. I did it 3 times until I load correctly and start well.
if you have the same problem apparently then OEM Blocking is not responsible. You have to flash the most current rom or the one that you had by default when the brick happened to you, you flash it in a normal way with commands of adb and ready, I would have to come back to life.
download from firmware center MotoZ Griffin the most current rom stock at 7.1.1
echo92 said:
Do you remember what build of 7.1.1 you had on your device before downgrading to 7.0?
If so, I would suggest finding that firmware (the full stock firmware, not OTA updates) or newer if you can, and try to flash that. Since your bootloader is still likely from the 7.1.1 build, a locked bootloader will only permit files matching the same patch level (i.e. from the exact same stock ROM as that bootloader patch) to boot.
If not, then unfortunately there's not a lot we can do. You could wait for a newer firmware to get leaked, but as your device is unable to boot (due to failing the bootloader checks) and you cannot toggle OEM unlocking because you cannot boot, it's a nasty vicious circle that is difficult to get out of. You may have to consider sending your device for service and pay for an expensive motherboard replacement otherwise, since Motorola have a record of your device being unlocked. Your service centre experience may vary.
Only lock a bootloader after ensuring you've flashed all the stock firmware and it is all the same patch level as your bootloader. Hopefully you'll find newer firmware that you can repair with.
Click to expand...
Click to collapse
Thanks for your help friend, I finally flashed it with a recent android 7.1.1 update. Apparently the OEM lockout was not the culprit, but it was an interrupted flash of android 7.1.1 at some point when loading the software to the phone, it would shut down on its own and not complete the installation, which showed me the mentioned message. I didn't realize that and thought it was the OEM blockade.
I finally did it on another pc and it worked. the phone came back to life.
I have one Moto Z2 Force (XT1789-05), bought from coolicool.com, I didn't know device came Unlocked Bootloader, Device rom had problem with many apps, I googled and found one topic in XDA developer to Install Stock Rom, I downloaded and Installed India Rom, it's worked somehow fine, but still had problem, I downloaded Verizon Rom, Android 8, after Installed Android 8 Verizon Rom, Locked device bootloader immediately, now device stuck at Welcome Wizard in Android 8, after select language I got this message: (Please wait, this may take a few minutes) this is proof video (http://ahmn.co/Upload/IMG_0161.MOV), after this issue, device already locked, I can't unlock, because need to go to the Developer Option in Setting, I stucked in Welcome Wizard, there isn't any bypass, So, I start to search in Google, XDA-Forum, Android Central and more, I created many threads, many requests, no one can't help me, I tried to reach google developer support to the tell to me how can I bypass Android 8 Welcome Wizard, there is must be a way, but I can't find it, now I can access to Android Recovery and Bootloader
1. if you help me to FORCE UNLOCK device without need Developer Option in setting my problem will solve
2. If you help me to Bypass Android Welcome Wizard, access setting and enable OEM Unlock
3. If you help me to update the device from Android 8 to Android 9 Verizon ROM via ADB Sideload or Update from SD card in Recovery mode
4. If you have any idea to how can I fix it
Extra Information: I bought Belkin and Uni USB-C to Ethernet Adaptor to help me bypass Android 8 Welcome Wizard, I bought WSKY WIFI Adaptor because device Wifi can't find any network (I found QR setup by tap several times in Language Selection), after this section need to download google device policy apk, my device can't find any Wifi Network and my Ethernet Adaptor can't help me either, So, I just remained with my phone, and I can't do anything,
Please, someone, help me
My Device SKU: XT1789-05
Hello my name is Aleksander i have bricked my mate 10 lite.
Original phone is rne-l21c432 but i rebranded it few weeks back to c185 for update to OREO.
Yesterday i wannted to update to last rom b332 with HuRUpdater_0.3
It flashed ok but rhere was one error but i didnt mind of that becouse at flashing before yesderday was also error and everything worked ok.
Now i can only get in rescue mode and got this error
Error!
Func NO 15(bl31 image)
Error NO 1(security verify failed)
I tryed to flash with DC-Phoenix and it's not working. Early version of dc-phoenix works for flashing but i got this. dc-phoenix can not activate back door and fb lock state is locked.
Newer versions says that the device is not supported.
I tryed to relock bootloader and unlock again, but now i can not get in to the fastboot anymore. it is looping constantly in that rescue mode and i get that errors Func NO 15 and errror NO1.
I don't know what to do anymore.
Does anybody have any solution to try? .
The Dc-Phoenix did work like few weeks back on my Mate 10 lite.
Thank you for youre response.
rutarvip said:
Hello my name is Aleksander i have bricked my mate 10 lite.
Original phone is rne-l21c432 but i rebranded it few weeks back to c185 for update to OREO.
Yesterday i wannted to update to last rom b332 with HuRUpdater_0.3
It flashed ok but rhere was one error but i didnt mind of that becouse at flashing before yesderday was also error and everything worked ok.
Now i can only get in rescue mode and got this error
Error!
Func NO 15(bl31 image)
Error NO 1(security verify failed)
I tryed to flash with DC-Phoenix and it's not working. Early version of dc-phoenix works for flashing but i got this. dc-phoenix can not activate back door and fb lock state is locked.
Newer versions says that the device is not supported.
I tryed to relock bootloader and unlock again, but now i can not get in to the fastboot anymore. it is looping constantly in that rescue mode and i get that errors Func NO 15 and errror NO1.
I don't know what to do anymore.
Does anybody have any solution to try? .
The Dc-Phoenix did work like few weeks back on my Mate 10 lite.
Thank you for youre response.
Click to expand...
Click to collapse
Is there really no solution ?
My mate 10 lite is bricked too that's why I'm following your post too
I have the phoenix 4 lm x210apm with android 7.1.2
and I do not have android 8.1, it does not update
in the official page of At & t and in the lg it appears that if there is an update but I can not update.
try to install the version of k8 + of android 8.1 but exit dll error in the LGup
someone help?
Someone, can help?
I have the same problem. I want to update my software
Trying to unlock bootloader and root my lg phoenix 4
I recently purchased the phoenix 4 lm-210apm and I downloaded the drivers and have minimal adb and fastboot tool and tried adb reboot bootloader and all it does is reboot the phone ive tried to you the keys but that doesnt work either in asking if someone would be able to give me a step bg step on how to unlock the bootloader and how to root the phone I been at this for a while and I cant get anywhere please help
downgrade to Nougat
Curiously_Frustrated420 said:
I recently purchased the phoenix 4 lm-210apm and I downloaded the drivers and have minimal adb and fastboot tool and tried adb reboot bootloader and all it does is reboot the phone ive tried to you the keys but that doesnt work either in asking if someone would be able to give me a step bg step on how to unlock the bootloader and how to root the phone I been at this for a while and I cant get anywhere please help
Click to expand...
Click to collapse
to get to bootloader we need to downgrade our phones to Nougat and I've been searching and cannot find a file to flash using lgup to downgrade.
Hello, dear friends. will you be able to install firmware with Redmi 4A on this device? the processor is the same, the RAM is the same. what could go wrong? who is very well versed in this matter?
Hi, I'm face the same problem here can I get here with the full stock rom?
Hi everyone,
I am having trouble unlocking the bootloader for my Realme 7 5G phone (RMX2111 AU).
The specific issue is that following installation of the unlock tool, opening it leads to immediate crashing. The Stock ROM is Android 11, not Android 10. I thought if I tried to downgrade to the latter, the bug might not exist to crash the unlock tool app.
In trying to downgrade (from within Realme's Stock Recovery) I got the message "Installation failed - The installed version is lower than current."
If anyone has advice to either stop the unlock tool from crashing, or a way for me to downgrade from Android 11 to Android 10 in the hopes the unlock tool would then work normally, I would be grateful!
Thanks for any help