Android - Corrupted system after security update

[tom353]

After installing a security update, my device won’t boot. Is there a way out of this without losing my data?

In more details:

My device is a Moto e7 XT2095-2 with Android 10.

Today I got a notification for the latest security update. I downloaded it. My phone tried to restart but failed, and looped several times.
In the end it displayed a black screen with a barcode and “fastboot mode ...”.

After trying to reboot again, now I’m getting this message:

Android Recovery
motorola/malta_reteu/malta
10/QOFS30.569-36-31/095c7
user/release-keys
Use volume up/down and power
Can’t load Android system. Your data may be corrupt. If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on this device.

If I select “Try again”, I’m getting an “Error!” screen then the device reboots (tries to, I mean).

The device is not rooted. I haven’t unlocked the bootloader, installed a custom ROM, or a custom recovery.
Developer options are enabled – that’s the only difference from the average person’s smartphone.

I have no backup of my data.

I know very little about Android, but as a developer I’m comfortable enough learning about it.

I searched online what I could do, and tried to ADB sideload the stock OTA as described here:
https://www.droidwin.com/fix-cant-load-android-system-your-data-may-be-corrupt-without-reset/

with the 2 latest files from here https://mirrors.lolinet.com/firmware/moto/malta/official/RETEU/

On my laptop terminal, I got this:

serving: 'update.zip' (~0%) adb: failed to read command: Undefined error: 0

And on the device:

Finding update package…
Opening update package…
Verifying update package…
E:footer is wrong
Update package verification took 0.2s (result 1)
E:Signature verification failed
E:error: 21
Install from ADB completed with status 2.
Installation aborted.

I’m a bit confused from reading a lot of contradictory information. Is this method supposed to work or is it failing because my bootloader is locked or because I’m using the stock recovery?

Is there a way to fix this bootloop without losing my data? Is there any way to backup the device’s data before a factory reset?

I would really appreciate if someone could point me to things worth trying!

Thanks

 

[aIecxs]

you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup

 

[tom353]

(replied to the wrong post)

 

[tom353]

you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup

Thanks for the suggestions!

2) I had never heard of A/B slots before, I will read a bit about it and try

1) Error 21 seems to be caused by a ROM that isn’t signed by the manufacturer. https://gossipfunda.com/android-update-error-21/

All the ROMS on https://mirrors.lolinet.com/firmware/moto/malta/official/RETEU/ seem to be “user signed”, the 2 I tried have these filenames:

XT2095-2_MALTA_RETEU_10_QOFS30.569-36-29_2201_220222_user_SIGN_008_SVC.zip
XT2095-2_MALTA_RETEU_10_QOFS30.569-36-31_2203_220331_user_SIGN_008_SVC.zip

I read that the signature verification can be bypassed using a custom recovery, but this requires unlocking the bootloader and erasing all data.

I will try to find a signed ROM.

 

[aIecxs]

please double check maybe it's zip in zip

 

[tom353]

please double check maybe it's zip in zip

It's not, the zip contains a few dozen files, mostly .img

 

[tom353]

you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup

I tried to change the slot, but no luck. It's only possible with an unlocked device.

That's a pity. If it's meant to help average users who just get into a bootloop caused by a faulty update, they're unlikely to have unlocked their device, why would they?

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s
$ ./fastboot --set-active=b
Setting current slot to 'b' FAILED (remote: 'set_active command is not allowed on locked devices')
fastboot: error: Command failed
$

Also found this: https://www.droidwin.com/fix-failed-remote-slot-change-is-not-allowed-in-lock-state/

 

[aIecxs]

too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)

 

[tom353]

too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)

Thanks! I'll read more about this, to be sure I understand what I'm doing, then give it a go.

Is there a step to relock with mtkclient at some point, or should I leave it unlocked and boot normally at the end?

 

[aIecxs]

as mentioned, do not try to boot in unlocked state you will lose all data. re-lock bootloader by restoring (locked) seccfg first!

 

[tom353]

as mentioned, do not try to boot in unlocked state you will lose all data. re-lock bootloader by restoring (locked) seccfg first!

Ok, I didn't know that would restore the locked state as well.

 

[tom353]

too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)

I'm delayed by other issues while trying to get a win10 virtualbox running so that I can run mtkclient... Am I right to assume it can run in virtualbox, and doesn't require a non-virtual win OS?

 

[aIecxs]

virtalbox requires usb passthrough. why not use native OS all platform supported. or just try the Live DVD V4 provided?

 

[tom353]

virtalbox requires usb passthrough. why not use native OS all platform supported. or just try the Live DVD V4 provided?

You're right. I think I had seen only Win and Linux, not MacOS. I was probably confused with some other tool I came across in my search!

 

[tom353]

You're right. I think I had seen only Win and Linux, not MacOS. I was probably confused with some other tool I came across in my search!

Actually that was for SP Flash Tool, not mtkclient. So that I can backup seccfg.

 

[aIecxs]

mtkclient is replacement for SP Flash Tool, you can backup all partitions at once into directory out (rl = read all)

python3 mtk rl out

 

[tom353]

mtkclient is replacement for SP Flash Tool, you can backup all partitions at once into directory out (rl = read all)

python3 mtk rl out

Ah, great. Thanks!

 

[tom353]

In following the steps in https://github.com/bkerler/mtkclient I'm reading this:

If the device has a vendor interface 0xFF (like LG), make sure to add "blacklist qcaux" to the "/etc/modprobe.d/blacklist.conf".

How can I find out whether my device "has a vendor interface 0xFF"?

 

[aIecxs]

check bDeviceClass on lsusb -vv
https://www.beyondlogic.org/usbnutshell/usb5.shtml#DeviceDescriptors

 

[tom353]

It’s been a while (life happens...), but I haven’t given up on this!

I couldn’t get MTKClient to run on MacOSX, but I eventually got my hands on an old PC and used the liveDVD.

So, I did what you suggested. Backup up seccfg, unlocked bootloader with MTKClient, switched slots with fastboot, then restored seccfg.

Unfortunately, the device is still stuck in the same bootloop. Then after maybe 5 tries it goes into either fastboot, or that “Can’t load Android system. Your data may be corrupt.” screen from my first post.

Also, it switches back to slot A during that bootloop.

I could verify that after a ./fastboot reboot (into fastboot again) , the current-slot was indeed changed to B.

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot --set-active=b
Setting current slot to 'b' OKAY [ 0.011s]
Finished. Total time: 0.014s

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot set_active b
Setting current slot to 'b' OKAY [ 0.008s]
Finished. Total time: 0.011s

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot reboot
Rebooting OKAY [ 0.003s]
Finished. Total time: 0.003s

$ ./fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.003s

During the bootloop , I also diverted it into fastboot to verify, after 2 or 3 boot attempts, it was still on B. But later on it switched back to A.

Actually, I noticed that I could change the slot without unlocking the bootloader.

There are 2 ways to access fastboot on that device. One way is from within recovery mode, which I had been using initially, and in this fastboot I’m getting this message “set_active command is not allowed on locked devices”. But the other way is to access fastboot from the first menu, and that fastboot lets me use set_active.

This restriction that applies to one fastboot and not the other made me wonder whether the “OKAY” message actually did the job, but the different responses from getvar current-slot seem to confirm that.

Anyway, the short conclusion is that switching slots didn’t make the device to boot, and it sets itself back to slot A after trying to boot on B.

Another observation I made is that I’m not sure MTKClient effectively unlocked my device. It reported that it unlocked it, but then when I used it the second time to restore seccfg, it said “Device is protected”.

[09:56:23]: Loading payload from mt6765_payload.bin, 0x264 bytes
[09:56:23]: Kamakiri / DA Run
[09:56:23]: Trying kamakiri2..
[09:56:23]: Done sending payload...
[09:56:24]: Successfully sent payload: /opt/mtkclient/mtkclient/payloads/mt6765_payload.bin
[09:56:24]: Device is protected.
[09:56:24]: Device is in BROM mode. Trying to dump preloader.
[09:56:58]: Bootloader: unlock

[10:05:07]: Loading payload from mt6765_payload.bin, 0x264 bytes
[10:05:07]: Kamakiri / DA Run
[10:05:07]: Trying kamakiri2..
[10:05:07]: Done sending payload...
[10:05:07]: Successfully sent paylad: /opt/mtkclient/mtkclient/payloads/mt6765_payload.bin
[10:05:07]: Device is protected.
[10:05:07]: Device is in BROM mode. Trying to dump preloader.
[10:07:25]: test
[10:07:35]: write done!

I also went to see what fastboot was reporting after unlocking with MTKClient:

$ ./fastboot getvar unlocked
unlocked: no
Finished. Total time: 0.003s

However, that doesn’t necessarily matters, as I didn’t need to unlock it to switch slots.

Now, is there anything else I could try?

I was thinking of retrying to ADB sideload the stock OTA while the device is “maybe unlocked”.

I mean, by the look of it, it’s still locked, but I have limited trust in what my 2 inconsistent fastboot report.

So, assuming it is unlocked, is it safe to try ADB sideload while unlocked, or could this cause data loss?