[GUIDE] [XT1575] Return to stock and relock bootloader

Search This thread

acejavelin

Inactive Recognized Contributor
I corrupted the eMMC on my MOTO E4 Plus (X1775) last year, but I managed to restore the bootloader by booting off the SD card. Unfortunately, the bootloader is now locked and I can't successfully boot it into the system partition so that I can flip the OEM Unlocking setting to unlock it again.

In theory, I should be able to flash the latest stock ROM though, right? However, I was getting "Preflash validation failed" on the boot, recovery and system partitions. Knowing what I read in the OP, I figured this was a rollback "feature" and have been waiting over a year to get a newer stock ROM release.

Well, I've definitely found at least two newer OEM ROM releases on mirrors.lolinet.com since then, and I'm still receiving the "Preflash validation failed" when flashing those three partitions. In fact, I know that this OEM firmware has a newer bootloader, since the "version-bootloader" definitely increased.

Are there other workarounds for this "Preflash validation failed" error? Perhaps there are flashing modes in RSD Lite that I can use? Should I be using blankflash?
You can't flash without the bootloader unlocked generally. Some people have had luck if it is the exact same version, but my experience was always it didn't work at all. In theory, it should work if it's the exact same or newer version, but it must also be the same variant and region.

Did you try doing a factory reset in recovery first?

You cant use blankflash unless it's hard-bricked and in Qloader mode.
 

acejavelin

Inactive Recognized Contributor
Unfortunately, the recovery partition is also corrupted. It's frustrating that the Motorola bootloader isn't allowing us to flash a known-good OEM stock firmware release. Other brands like Huawei and Xiaomi allow you to do that when the bootloader is locked as long as it's properly signed.
Since Google sold Motorola to Lenovo, the brand has been going downhill... Lenovo doesn't want to support device more than a year old, they want you to buy a new one. In my opinion, this is just more of their planned obsolescence. In fact, they don't release any firmware images at all anymore, and all the firmware we have gotten since about 2015 for Moto devices has been leaked by employees or service houses, and that has dwindled as well. I have lost all faith in Moto, and I was a HUGE fan and advocate of their products, even into the middle of last year. Now we are a mostly a Pixel and Nokia home, with an HTC and a Samsung straggler (that will likely get Pixel 3a's in the next few months), and I doubt that will change, at least for the next few years.

And I know nothing about Xiaomi, other than they really don't work well in the US due to LTE band support, but Huawei has changed there tune a LOT in the last year or two... There is no more bootloader unlocking at all, no kernel source releases, and support for the custom ROM/mod community went from pretty decent to nothing.
 
  • Like
Reactions: Magendanz

Magendanz

Senior Member
Mar 25, 2008
987
1,071
Issaquah, WA
www.Vote4Chad.com
In my opinion, this is just more of their planned obsolescence. In fact, they don't release any firmware images at all anymore, and all the firmware we have gotten since about 2015 for Moto devices has been leaked by employees or service houses, and that has dwindled as well.
It's a disturbing industry-wide trend, representing a massive shift of power away from consumers and denying us any right to modify or repair the products we purchase. Can you imagine if the auto industry worked that way? Would we tolerate having the engine compartments of our cars and trucks locked up tight so that only the dealers could maintain, repair or make modifications?
 

acejavelin

Inactive Recognized Contributor
It's a disturbing industry-wide trend, representing a massive shift of power away from consumers and denying us any right to modify or repair the products we purchase. Can you imagine if the auto industry worked that way? Would we tolerate having the engine compartments of our cars and trucks locked up tight so that only the dealers could maintain, repair or make modifications?
Actually, your correlation here isn't that different... Yes, hoods are not locked up tights, but what can most people really do? Normal maintenance, maybe replace a few things here and there. Auto makers are locking down many of the things in vehicles. Can you upgrade the indash entertainment system yourself? Can you change the setup of the ECM on most cars? Heck, in some cars it is even impossible to replace the indash radio system at all. You laugh, but it is headed that way... Compare this to a 60's or 70's vehicle, you could literally change or do anything to that, a new 2019 vehicle not so much, except for an elite few people and vehicles.
 

Magendanz

Senior Member
Mar 25, 2008
987
1,071
Issaquah, WA
www.Vote4Chad.com
Just to really emphasize how broken Motorola's firmware upgrade system is, today I went to upgrade a Cricket Moto G6 Play (XT1922-9) to Android Pie, which is available for the XT1922-9 but only for the RETUS channel. I ran the batch file in fastboot and received the same "Preflash validation failed" on the boot, recovery and system partitions. Now the device only boots to the bootloader because it fails to validate the boot image. Likewise, recovery mode is inaccessible because it can't validate the recovery image. (Interestingly enough, neither of these images were actually flashed.)

Now, the locked device is completely bricked. Motorola wouldn't allow me to unlock the bootloader, and trying to flash the original Oreo ROM for the Cricket channel also fails validation. I'm stuck again on the bootloader with the inability to flash known-good (and properly signed) OEM firmware. How could they not leave a way to flash their own ROMs on unlocked devices?
 

Jman47

Member
Mar 8, 2011
5
2
Mililani, HI
This 7.0 NPHS25.200-23 file fixed it

https://xdaforums.com/moto-x-style/...on-factory-t3704142/post77054647#post77054647

I was able to locate both stock ROMs and didn't see them posted here at all in any thread anywhere so, I tossed them both up on Mega if anyone finds themselves in a situation where they could prove useful. As I understand it, NPHS25.200-22-1 was the minimum build for any carrier usage either CDMA or GSM, but NPHS25.200-23-1 was more for GSM use. I cannot verify that, it's just something I saw mentioned on another forum that one user pointed out. What I can say for sure is that there are differences in the checksums of the system.img_sparsechunk files and some others as well included in these ROMs so there are differences in there somewhere.

Regardless, here are NPHS25.200-22-1 and NPHS25.200-23-1 stock ROMs if anyone happens to need them so you won't have to deal with or wait for any OTA updates to patch things along the way - considering they still leave the MXPE with the October 1 2017 security patch, I think it's fairly safe to say Lenovo will never release another update for this device and if they do it'll be a small miracle at this point.

NOTE: THESE ARE FOR THE XT1575 ONLY AS I UNDERSTAND IT, I have no way of verifying if they'd be functional on the XT1572 model (Style), so be aware of this fact. I own an XT1575 and I cannot say if these will work on the XT1572 - it's sufficiently say to say "Nope, they are for the XT1575 only..." and be done with it

CLARK_RETUS_7.0_NPHS25.200-23-1_cid9_subsidy-DEFAULT_CFC.xml.zip
1.39 GB (1,498,747,731 bytes)
SHA1: feccf2c71bb5d55cb5405e5698053f6c7332eb13
flashfile.xml = <software_version version="clark_retus-user 7.0 NPHS25.200-23-1 1 release-keysM8992_1255331.29.01.88.09R"/>

https://mega.nz/#!xUsiXI6C!cAyj2HZgoyxUIcnhNtso7nw6lo-0qKeJnmGoNaHQrec

THIS SAVED ME.
Locked Bootloader (had 'Allow OEM Unlock' in Developer Options. error)
firmware on 200-23. was bootlooping without an OS.

was able to fastboot and ADB soI tried everything on the forums but everyone only had 200-22 available.
i downloaded this file and everything flashed perfectly. was able to boot and "allow oem unlocking " used my code and unlocked the bootloader

mirror for download: https://drive.google.com/open?id=16LD16SS9hNqIAD6DHTgi8PVsghe-s_bd
 
Last edited:
  • Like
Reactions: pshadoww

tswrench

New member
May 1, 2010
3
0
Halp!

Got a NOS Moto X Pure Edition xt1575 and experienced some kind of rooting glitch after having unlocked the bootloader and installing TWRP. Long story short, after a frantic bout of wiping and swiping, the OS is gone, I can't select the micro SD in TWRP, and fastboot only sees the phone in recovery. I found this thread, which seemed promising, but it appears to be a no-go without access to the bootloader. I've flashed so many custom ROMS to a tablet I have, that I thought this phone would be a cakewalk, but it seems to have rolled right over me. So, is it time to slather some mortar on this thing and add it to the wall (bricked), or is there a Hail Mary play, or Jiu Jitsu move out there somewhere? Anything...ANY-THING would be welcome and much appreciated. Thank you.
 
Last edited:

bhati2710

Member
Jun 29, 2019
22
0
Gurgaon
Help XT1925 Motorola G6

Hi @acejavelin ,
I know this is not the correct thread to discuss it but I have found that you know well about the fasboot and flashing moto devices. Therefore, I couldn't stop myself to put a question here. I am using XT1925-2 device which shows CID: 0xdead at this moment due to which I couldn't flash firmware and phone was stuck into boot loops. Whenever I run command bootloader.img and GPT.bin, they are successfully but boot.img, recovery.img, system, vendor doesn't flash at this moment and gives an error "Preflash Validation failed". I thought, it could be happening due to locked bootloader so I get an unlock key from Motorola and when I try to unlock my XT1925-2 motorola G6, it gives an error "premission failed" as unable to unlock.

Also, I don't boot into TWRP using "fastboot boot twrp.img". Please help me if there is an option to restore my phone. Thanks in advance.
 

pshadoww

Senior Member
Mar 8, 2011
176
13
Thank you, this works!
  • I tried to relock my phone, which is running version NPHS25.200-22-1
  • I downloaded NPHS25.200-22-1 image
  • I failed due to "Preflash Validation failed"
  • I downloaded this 25.200-23-1 version
  • relocked successfully!

https://xdaforums.com/moto-x-style/...on-factory-t3704142/post77054647#post77054647



THIS SAVED ME.
Locked Bootloader (had 'Allow OEM Unlock' in Developer Options. error)
firmware on 200-23. was bootlooping without an OS.

was able to fastboot and ADB soI tried everything on the forums but everyone only had 200-22 available.
i downloaded this file and everything flashed perfectly. was able to boot and "allow oem unlocking " used my code and unlocked the bootloader

mirror for download: https://drive.google.com/open?id=16LD16SS9hNqIAD6DHTgi8PVsghe-s_bd
 

Top Liked Posts

  • There are no posts matching your filters.
  • 53
    *** This process can relock your bootloader if you chose, but it does NOT restore your warranty in any way, so don't ask ***

    Be aware you do NOT have to lock the bootloader, have Status Code of 0, or have it show "Official" status to successfully accept and apply an OTA update, it will happily apply with an unlocked bootloader and unofficial software status, as long as you have a 100% pure stock ROM installed the update script doesn't care what the bootloader reports.

    Preflash validation error? See notes at the bottom of this post.

    Prerequisites:

    1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
    2) You need a factory firmware image that is the same version or newer than what you have installed (see below for more info), for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)

    XT1572 Factory Images: http://dl.prazaar.de/?dir=Android/XT1572/Factory courtesy of @Prazaar
    XT1575 Factory Images: http://xdaforums.com/moto-x-style/development/pure-firmware-tuff-wip-t3224833 - UPDATE: Direct link to XT1575 for 24.49-18-8 (Sept 1, 2016 security update) uploaded on 1/27/2017 courtesy of Motorola Firmware Team. The December 2016 security update image is NOT available as of yet!
    Alternate firmware source for Pure and Style: https://firmware.center/firmware/Motorola/
    XT1575 OTA ZIP file to go from 18-8 to 18-16 ONLY is available in this post for sideloading thanks to @annoyingduck
    NOUGAT FIRMWARE (XT1575 ONLY): https://xdaforums.com/moto-x-style/general/xt1575-moto-x-pure-edition-factory-t3704142

    OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.

    Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).

    Code:
    fastboot oem lock begin (see notes below if not wanting to lock)
    fastboot flash partition gpt.bin
    fastboot flash bootloader bootloader.img
    fastboot flash logo logo.bin
    fastboot flash boot boot.img
    fastboot flash recovery recovery.img
    fastboot flash system system.img_sparsechunk.0
    fastboot flash system system.img_sparsechunk.1
    fastboot flash system system.img_sparsechunk.2
    fastboot flash system system.img_sparsechunk.3
    fastboot flash system system.img_sparsechunk.4
    fastboot flash system system.img_sparsechunk.5
    fastboot flash system system.img_sparsechunk.6
    fastboot flash system system.img_sparsechunk.7
    fastboot flash system system.img_sparsechunk.8
    fastboot flash system system.img_sparsechunk.9
    fastboot flash modem NON-HLOS.bin
    fastboot erase modemst1 
    fastboot erase modemst2
    fastboot flash fsg fsg.mbn
    fastboot flash bluetooth BTFM.bin
    fastboot erase cache
    fastboot erase userdata
    fastboot erase customize
    fastboot erase clogo
    fastboot oem lock
    fastboot reboot
    Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.

    This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay, Pokemon GO, and banking/financial apps.

    Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.

    If you are interested in returning to stock WITHOUT locking the bootloader, then follow the above commands, but the following commands in place of the "lock" commands in the list above:
    fastboot oem fb_mode_set instead of fastboot oem lock begin
    fastboot oem fb_mode_clear instead of fastboot oem lock

    The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image. Note that different firmwares may contain a different number of system.img_sparsechunk.X files, you must flash the number you have in your firmware image in order. From what I have seen, most 5.1.1 firmwares have ten (0-9), 6.0 has nine (0-8), 6.0.1 has twelve (0-11), and 7.0 has ten (0-9) sparsechunks, but always verify with the XML flash file contained within the firmware archive to verify if you are in question.

    If you lock with this process, you can unlock the bootloader again and even use the same unlock token... subsequent unlocking will wipe data as well. Doing this procedure will set OEM Locking option in Developer options to disabled, although it is perfectly safe to leave it like this, I suggest turning it on immediately since your warranty is gone and if something does go wrong you have the ability to unlock again to fix it.

    NOTE: You must use a factory firmware image that is the same version as what you have installed or newer to successfully relock the bootloader, you cannot just grab the old (shipped) version from Moto's site. If you attempt to use a firmware image that is older than what you have installed currently, you will receive a Preflash Validation Error indicating such when you attempt to flash the partition table (gpt.bin). At this point you can either continue the flash and NOT lock the bootloader at the end, or stop until you can find the most current image. Moto used to be quite willing to hand these out when they were requested, so if you have a very new firmware installed you may not find one that you can use to relock with on the Internet. Part of the requirements to lock the bootloader is you must successfully flash the partition table (gpt.bin) in order to complete the lock process, if you can't then the bootloader lock process cannot be finished.

    Also, some users have noted that after completing this process the software status does NOT go back to "Official", if it does not, upon accepting the OTA it should go back to official after the OTA is successful. The Status Code will always show 2 (relocked) or 3 (unlocked), and it can never go back to 0 (locked).

    A proper flash log is attached to this guide.

    Just a blurb on Marshmallow software versions... To determine what you need look at version/build numbers, here is the Security update dates and release dates (actual, not tests) of all known public OTA releases of Marshmallow for the Moto X Pure (Style varies somewhat). The initial release was MPH24.49-18 (sometimes MPH24.49-18_18, we don't know why, but it is the SAME versions), and all others after that are MPHS24.49-XX-XX as shown below.

    18 or 18_18 - The initial (shipped) Marshmallow release for Moto X Pure, November 2015 (release via OTA in late-December 2015, incorrectly dated on Moto's official website as 01-SEP-16 in the "official" recovery images section, it is NOT the newest or recommended image to use)
    18-3 - February 2016 (released for OTA in mid-March 2016)
    18-4 - May 2016 (released for OTA in late-June 2016)
    18-8 - September 2016 (released for OTA in early-November 2016)
    18-16 - December 2016 (release for OTA in mid-February 2017) *** Not available as a factory image***

    Nougat:
    NPH25.200-22 - September 2017 (released for OTA September~November 2017) Factory image available as of 11/12/2017
    NPH25.200-23 - Little is know about this version, it appears to be slowing rolling out to Verizon users only as of mid-November 2017 (no firmware available as of yet)

    To see what version your bootloader is now, go into fastboot and perform a "fastboot getvar ro.build.fingerprint" and look at the output, it should be pretty clear.

    NOTE: I no longer own this device, but will help where I can and will keep this thread open to assist users where ever possible, but I no longer have a device to test/verify things with.
    6
    I just flashed the MPH24.49-18-8 firmware, rooted with Magisk, and extracted the OTA MPH24.49-18-8 to MPH24.49-18-16. The file is labeled: Blur_Version.24.221.8.clark_retus.retus.en.US.zip. @acejavelin if you want to link this in the OP for anyone that may want to directly sideload it after flashing 18-8 for any reason. Here's a link to the file: https://mega.nz/#F!iBhGmBDD!O3D9n8ggKZs_MNj2hax1PA
    4
    If anyone is looking for the Nougat OTA 25.11.23 that was released for T-Mobile (and apparently Verizon) users. I uploaded it here https://mega.nz/#!rFEUkCzC!Bj9x_AU9uhaNFYV9706XGdf-NJ9KovqCrUTsCZlcN0o Feel free to do what you want with the file.


    Edit: fixed the download link
    4
    No, I'm not here to whine about something not working. This is a success story.

    I simply wanted to jump to the December update, failing to realize that I cannot update via OTA as while I did not have a custom recovery, I did have my phone rooted (I simply booted my Moto X Pure to TWRP and flashed PHH's Superuser, not flashing the recovery, just booting to it.)

    I used Motorola's factory image directly from Motorola's site, thinking it was for the September 2016 security update (since the builds appear to be from September 1, 2016 or something of that sort,) only to find myself stuck at the update for November 2015.

    I downloaded the September 2016 factory image from the OP and followed the bunch of commands, I do not care about relocking my bootloader. I acknowledged the repercussions of unlocking it in the first place. The only hiccup was flashing the modem, it will shout at you the first time you try it.

    You need to try the command again. If you ignore this part, the OTA will not work, as the update will tell you something about the modem when trying to verify the system before updating via OTA (Something like modem/image/adsp.b01 has unexpected contents, status 7.)
    Code:
    D:\Users\Steve\Downloads\CLARK_RETUS_6.0_MPHS24.49-18-8_cid9_subsidy-DEFAULT_CFC
    .xml>fastboot flash modem NON-HLOS.bin
    target reported max download size of 536870912 bytes
    sending 'modem' (41686 KB)...
    OKAY [  1.563s]
    writing 'modem'...
    (bootloader) Preflash validation failed
    FAILED (remote failure)
    finished. total time: 1.579s
    
    D:\Users\Steve\Downloads\CLARK_RETUS_6.0_MPHS24.49-18-8_cid9_subsidy-DEFAULT_CFC
    .xml>fastboot flash modem NON-HLOS.bin
    target reported max download size of 536870912 bytes
    sending 'modem' (41686 KB)...
    OKAY [  1.546s]
    writing 'modem'...
    OKAY [  1.128s]
    finished. total time: 2.675s

    After this, following the rest of the commands, and booting up with a fresh installation, I was greeted again by the December security update, and I updated perfectly fine, and now my phone is on the December update.

    Thank you.
    4
    Issue: was tired of the buggy nougat roms so I followed the steps and the phone boots just fine, but I have no wifi (MPHS24.49-18-8). Reflashed the non-hlos.bin and fsg.mbn files, still no wifi. Reflashed again, no wifi. That's usually the fix for this problem, yes? But I don't want to just keep reflashing to infinity if it's not going to solve anything. Any ideas?
    Reflash boot and radios, and remember to erase modemstX partitions. That is usually all it takes.