FORUMS
Remove All Ads from XDA

[GUIDE] [XT1575] Return to stock and relock bootloader

6,278 posts
Thanks Meter: 2,943
 
By acejavelin, Recognized Contributor on 28th October 2016, 06:50 AM
Post Reply Email Thread
*** This process can relock your bootloader if you chose, but it does NOT restore your warranty in any way, so don't ask ***

Be aware you do NOT have to lock the bootloader, have Status Code of 0, or have it show "Official" status to successfully accept and apply an OTA update, it will happily apply with an unlocked bootloader and unofficial software status, as long as you have a 100% pure stock ROM installed the update script doesn't care what the bootloader reports.

Preflash validation error? See notes at the bottom of this post.

Prerequisites:

1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image that is the same version or newer than what you have installed (see below for more info), for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)

XT1572 Factory Images: http://dl.prazaar.de/?dir=Android/XT1572/Factory courtesy of @Prazaar
XT1575 Factory Images: http://forum.xda-developers.com/moto...f-wip-t3224833 - UPDATE: Direct link to XT1575 for 24.49-18-8 (Sept 1, 2016 security update) uploaded on 1/27/2017 courtesy of Motorola Firmware Team. The December 2016 security update image is NOT available as of yet!
Alternate firmware source for Pure and Style: https://firmware.center/firmware/Motorola/
XT1575 OTA ZIP file to go from 18-8 to 18-16 ONLY is available in this post for sideloading thanks to @annoyingduck
NOUGAT FIRMWARE (XT1575 ONLY): https://forum.xda-developers.com/mot...ctory-t3704142

OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.

Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).

Code:
fastboot oem lock begin (see notes below if not wanting to lock)
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1 
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot erase customize
fastboot erase clogo
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.

This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay, Pokemon GO, and banking/financial apps.

Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.

If you are interested in returning to stock WITHOUT locking the bootloader, then follow the above commands, but the following commands in place of the "lock" commands in the list above:
fastboot oem fb_mode_set instead of fastboot oem lock begin
fastboot oem fb_mode_clear instead of fastboot oem lock

The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image. Note that different firmwares may contain a different number of system.img_sparsechunk.X files, you must flash the number you have in your firmware image in order. From what I have seen, most 5.1.1 firmwares have ten (0-9), 6.0 has nine (0-8), 6.0.1 has twelve (0-11), and 7.0 has ten (0-9) sparsechunks, but always verify with the XML flash file contained within the firmware archive to verify if you are in question.

If you lock with this process, you can unlock the bootloader again and even use the same unlock token... subsequent unlocking will wipe data as well. Doing this procedure will set OEM Locking option in Developer options to disabled, although it is perfectly safe to leave it like this, I suggest turning it on immediately since your warranty is gone and if something does go wrong you have the ability to unlock again to fix it.

NOTE: You must use a factory firmware image that is the same version as what you have installed or newer to successfully relock the bootloader, you cannot just grab the old (shipped) version from Moto's site. If you attempt to use a firmware image that is older than what you have installed currently, you will receive a Preflash Validation Error indicating such when you attempt to flash the partition table (gpt.bin). At this point you can either continue the flash and NOT lock the bootloader at the end, or stop until you can find the most current image. Moto used to be quite willing to hand these out when they were requested, so if you have a very new firmware installed you may not find one that you can use to relock with on the Internet. Part of the requirements to lock the bootloader is you must successfully flash the partition table (gpt.bin) in order to complete the lock process, if you can't then the bootloader lock process cannot be finished.

Also, some users have noted that after completing this process the software status does NOT go back to "Official", if it does not, upon accepting the OTA it should go back to official after the OTA is successful. The Status Code will always show 2 (relocked) or 3 (unlocked), and it can never go back to 0 (locked).

A proper flash log is attached to this guide.

Just a blurb on Marshmallow software versions... To determine what you need look at version/build numbers, here is the Security update dates and release dates (actual, not tests) of all known public OTA releases of Marshmallow for the Moto X Pure (Style varies somewhat). The initial release was MPH24.49-18 (sometimes MPH24.49-18_18, we don't know why, but it is the SAME versions), and all others after that are MPHS24.49-XX-XX as shown below.

18 or 18_18 - The initial (shipped) Marshmallow release for Moto X Pure, November 2015 (release via OTA in late-December 2015, incorrectly dated on Moto's official website as 01-SEP-16 in the "official" recovery images section, it is NOT the newest or recommended image to use)
18-3 - February 2016 (released for OTA in mid-March 2016)
18-4 - May 2016 (released for OTA in late-June 2016)
18-8 - September 2016 (released for OTA in early-November 2016)
18-16 - December 2016 (release for OTA in mid-February 2017) *** Not available as a factory image***

Nougat:
NPH25.200-22 - September 2017 (released for OTA September~November 2017) Factory image available as of 11/12/2017
NPH25.200-23 - Little is know about this version, it appears to be slowing rolling out to Verizon users only as of mid-November 2017 (no firmware available as of yet)

To see what version your bootloader is now, go into fastboot and perform a "fastboot getvar ro.build.fingerprint" and look at the output, it should be pretty clear.

NOTE: I no longer own this device, but will help where I can and will keep this thread open to assist users where ever possible, but I no longer have a device to test/verify things with.
Attached Thumbnails
Click image for larger version

Name:	xt1575bootloader_no-serial_small.jpg
Views:	6124
Size:	76.5 KB
ID:	3918598  
Attached Files
File Type: txt XT1575-Relock.txt - [Click for QR Code] (5.2 KB, 2464 views)
The Following 41 Users Say Thank You to acejavelin For This Useful Post: [ View ] Gift acejavelin Ad-Free
 
 
28th October 2016, 12:15 PM |#2  
donrojo's Avatar
Member
Thanks Meter: 67
 
More
Quote:
Originally Posted by acejavelin

*** This will relock your bootloader, but it does NOT restore your warranty in any way, so don't ask ***

So with Nougat coming, several people have asked how to return to stock to get the update... well, I just did this so here is a quick guide.

Prerequisites:

1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image, for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)

OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.

Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).

Code:
fastboot oem lock begin
fastboot flash partition gpt.bin
fastboot reboot bootloader 
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1 
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.

This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay and Pokemon GO as well.

Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.

The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image.

A proper flash log is attached to this guide.

So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!
28th October 2016, 01:30 PM |#3  
acejavelin's Avatar
OP Recognized Contributor
Flag Bismarck, ND
Thanks Meter: 2,943
 
Donate to Me
More
Quote:
Originally Posted by donrojo

So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!

Yes, of course it does... You can clearly see in the log I attached from my flashing the device.

The key is you cannot downgrade to a lower gpt.bin, you can only flash the same or newer version of firmware. After having several Moto devices, I can attest that downgrading successfully while locking is almost impossible. I will update my guide to make it clearer.

And please do not quote the entire first post and embed your comments in it, on mobile I had a very difficult time trying to determine what you were asking. EDIT: Sorry, your previous post looked very different in the XDA app, looks fine on computer... weird.
28th October 2016, 04:18 PM |#4  
quakeaz's Avatar
Senior Member
Flag Yavapai County
Thanks Meter: 179
 
More
What is the purpose of relocking your bootloader? The unlocked bootloader has never interfered with me taking an OTA.
28th October 2016, 05:12 PM |#5  
Senior Member
Thanks Meter: 47
 
More
Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
28th October 2016, 05:14 PM |#6  
acejavelin's Avatar
OP Recognized Contributor
Flag Bismarck, ND
Thanks Meter: 2,943
 
Donate to Me
More
Quote:
Originally Posted by quakeaz

What is the purpose of relocking your bootloader? The unlocked bootloader has never interfered with me taking an OTA.

You are correct, and this as nothing to do with accepting OTA (that is just how this discussion came up), but the lock/unlock state of the bootloader has two distinct issues I can think of although there maybe more I am forgetting.

1. Security - If your bootloader is unlocked, anyone who gets access to your device can just fire up fastboot and boot TWRP and access any information on your device, even if it is encrypted since TWRP can read the encryption password.

2. SafetyNet API - Do to recent changes by Google, SafetyNet API checks to fail just because the bootloader is unlocked, even if everything else is perfectly stock... SafetyNet is a mandatory part of Play Services that auto-updates itself regardless of your settings, and it is used to see if your device has been modified (rooted) or tampered with in anyway, and applications can use SafetyNet to check the status of your device... Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting. UPDATE: This only seems to be enforced on devices that shipped with Nougat or newer, and does seem to effect any device upgraded to Nougat so far. Lollipop and Marshmallow devices are not effected.
The Following 2 Users Say Thank You to acejavelin For This Useful Post: [ View ] Gift acejavelin Ad-Free
28th October 2016, 05:25 PM |#7  
quakeaz's Avatar
Senior Member
Flag Yavapai County
Thanks Meter: 179
 
More
Quote:
Originally Posted by acejavelin

Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting.

Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).

If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.

Also, just an observation, I assume once we do get the Nougat (or any other) OTA, the unlocked bootloader warning screen will return, since the unlocked flag has already been tripped and the OTA will write a new logo.bin.

---------- Post added at 08:25 AM ---------- Previous post was at 08:20 AM ----------

Quote:
Originally Posted by Mejilan

Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?

You're fine to downgrade to the latest stock firmware you were running.
The Following User Says Thank You to quakeaz For This Useful Post: [ View ] Gift quakeaz Ad-Free
28th October 2016, 05:26 PM |#8  
acejavelin's Avatar
OP Recognized Contributor
Flag Bismarck, ND
Thanks Meter: 2,943
 
Donate to Me
More
Quote:
Originally Posted by quakeaz

Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).

If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.

Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.

Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something, but it will still be the same code.
28th October 2016, 05:31 PM |#9  
Senior Member
Thanks Meter: 47
 
More
Quote:
Originally Posted by quakeaz

You're fine to downgrade to the latest stock firmware you were running.

Ah hah! Good to know.
Thank you.
28th October 2016, 05:32 PM |#10  
quakeaz's Avatar
Senior Member
Flag Yavapai County
Thanks Meter: 179
 
More
Quote:
Originally Posted by acejavelin

Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.

Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something.

Thanks for confirming about the unlock/relock/unlock.

I just added a CC to check if it'd work. No issues here. Maybe it's only certain devices? Google Play Services 9.8.77.
28th October 2016, 05:32 PM |#11  
acejavelin's Avatar
OP Recognized Contributor
Flag Bismarck, ND
Thanks Meter: 2,943
 
Donate to Me
More
Quote:
Originally Posted by Mejilan

Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?

The issue isn't the aftermarket firmware or it's version, it could be Android 29 Gamma for all we care... You need to use an official Moto firmware that is at least the same version or newer than your bootloader and partition table (gpt.bin), if you are not a stock firmware you will need to do some investigating via the baseband version what actual version you have (unless you can remember the last official firmware version).

Safest bet is just use the current release, if you can't find it online you can always request it from Moto service but this may take several days (weeks in some areas I have heard). Be aware that the firmware posted on Moto's official is NOT the most current and is likely a downgrade if you have ever accepted an OTA since the device was released.
The Following User Says Thank You to acejavelin For This Useful Post: [ View ] Gift acejavelin Ad-Free
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes