Android - Corrupted system after security update

Search This thread

tom353

Member
Jun 25, 2022
29
1
After installing a security update, my device won’t boot. Is there a way out of this without losing my data?

In more details:

My device is a Moto e7 XT2095-2 with Android 10.

Today I got a notification for the latest security update. I downloaded it. My phone tried to restart but failed, and looped several times.
In the end it displayed a black screen with a barcode and “fastboot mode ...”.

After trying to reboot again, now I’m getting this message:

Android Recovery
motorola/malta_reteu/malta
10/QOFS30.569-36-31/095c7
user/release-keys
Use volume up/down and power
Can’t load Android system. Your data may be corrupt. If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on this device.

If I select “Try again”, I’m getting an “Error!” screen then the device reboots (tries to, I mean).

The device is not rooted. I haven’t unlocked the bootloader, installed a custom ROM, or a custom recovery.
Developer options are enabled – that’s the only difference from the average person’s smartphone.

I have no backup of my data.

I know very little about Android, but as a developer I’m comfortable enough learning about it.

I searched online what I could do, and tried to ADB sideload the stock OTA as described here:
https://www.droidwin.com/fix-cant-load-android-system-your-data-may-be-corrupt-without-reset/

with the 2 latest files from here https://mirrors.lolinet.com/firmware/moto/malta/official/RETEU/

On my laptop terminal, I got this:

serving: 'update.zip' (~0%) adb: failed to read command: Undefined error: 0

And on the device:

Finding update package…
Opening update package…
Verifying update package…
E:footer is wrong
Update package verification took 0.2s (result 1)
E:Signature verification failed
E:error: 21
Install from ADB completed with status 2.
Installation aborted.

I’m a bit confused from reading a lot of contradictory information. Is this method supposed to work or is it failing because my bootloader is locked or because I’m using the stock recovery?

Is there a way to fix this bootloop without losing my data? Is there any way to backup the device’s data before a factory reset?

I would really appreciate if someone could point me to things worth trying!

Thanks
 

aIecxs

Senior Member
Feb 17, 2016
1,891
543
gitlab.com
you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup
 
  • Like
Reactions: tom353

tom353

Member
Jun 25, 2022
29
1
you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup

Thanks for the suggestions!

2) I had never heard of A/B slots before, I will read a bit about it and try 😊

1) Error 21 seems to be caused by a ROM that isn’t signed by the manufacturer. https://gossipfunda.com/android-update-error-21/

All the ROMS on https://mirrors.lolinet.com/firmware/moto/malta/official/RETEU/ seem to be “user signed”, the 2 I tried have these filenames:

XT2095-2_MALTA_RETEU_10_QOFS30.569-36-29_2201_220222_user_SIGN_008_SVC.zip
XT2095-2_MALTA_RETEU_10_QOFS30.569-36-31_2203_220331_user_SIGN_008_SVC.zip

I read that the signature verification can be bypassed using a custom recovery, but this requires unlocking the bootloader and erasing all data.

I will try to find a signed ROM.
 

tom353

Member
Jun 25, 2022
29
1
you will find lot of contradictory information, also on xda. so please handle my information with care, too

1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup

I tried to change the slot, but no luck. It's only possible with an unlocked device.

That's a pity. If it's meant to help average users who just get into a bootloop caused by a faulty update, they're unlikely to have unlocked their device, why would they?

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s
$ ./fastboot --set-active=b
Setting current slot to 'b' FAILED (remote: 'set_active command is not allowed on locked devices')
fastboot: error: Command failed
$

Also found this: https://www.droidwin.com/fix-failed-remote-slot-change-is-not-allowed-in-lock-state/
 
Last edited:

aIecxs

Senior Member
Feb 17, 2016
1,891
543
gitlab.com
too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)
 
Last edited:
  • Like
Reactions: tom353

tom353

Member
Jun 25, 2022
29
1
too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)


Thanks! I'll read more about this, to be sure I understand what I'm doing, then give it a go.

Is there a step to relock with mtkclient at some point, or should I leave it unlocked and boot normally at the end?
 
Last edited:

tom353

Member
Jun 25, 2022
29
1
too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)

I'm delayed by other issues while trying to get a win10 virtualbox running so that I can run mtkclient... Am I right to assume it can run in virtualbox, and doesn't require a non-virtual win OS?
 

tom353

Member
Jun 25, 2022
29
1
It’s been a while (life happens...), but I haven’t given up on this!

I couldn’t get MTKClient to run on MacOSX, but I eventually got my hands on an old PC and used the liveDVD.

So, I did what you suggested. Backup up seccfg, unlocked bootloader with MTKClient, switched slots with fastboot, then restored seccfg.

Unfortunately, the device is still stuck in the same bootloop. Then after maybe 5 tries it goes into either fastboot, or that “Can’t load Android system. Your data may be corrupt.” screen from my first post.

Also, it switches back to slot A during that bootloop.

I could verify that after a ./fastboot reboot (into fastboot again) , the current-slot was indeed changed to B.

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot --set-active=b
Setting current slot to 'b' OKAY [ 0.011s]
Finished. Total time: 0.014s

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot set_active b
Setting current slot to 'b' OKAY [ 0.008s]
Finished. Total time: 0.011s

$ ./fastboot getvar current-slot
current-slot: a
Finished. Total time: 0.003s

$ ./fastboot reboot
Rebooting OKAY [ 0.003s]
Finished. Total time: 0.003s

$ ./fastboot getvar current-slot
current-slot: b
Finished. Total time: 0.003s

During the bootloop , I also diverted it into fastboot to verify, after 2 or 3 boot attempts, it was still on B. But later on it switched back to A.

Actually, I noticed that I could change the slot without unlocking the bootloader.

There are 2 ways to access fastboot on that device. One way is from within recovery mode, which I had been using initially, and in this fastboot I’m getting this message “set_active command is not allowed on locked devices”. But the other way is to access fastboot from the first menu, and that fastboot lets me use set_active.

This restriction that applies to one fastboot and not the other made me wonder whether the “OKAY” message actually did the job, but the different responses from getvar current-slot seem to confirm that.

Anyway, the short conclusion is that switching slots didn’t make the device to boot, and it sets itself back to slot A after trying to boot on B.

Another observation I made is that I’m not sure MTKClient effectively unlocked my device. It reported that it unlocked it, but then when I used it the second time to restore seccfg, it said “Device is protected”.

[09:56:23]: Loading payload from mt6765_payload.bin, 0x264 bytes
[09:56:23]: Kamakiri / DA Run
[09:56:23]: Trying kamakiri2..
[09:56:23]: Done sending payload...
[09:56:24]: Successfully sent payload: /opt/mtkclient/mtkclient/payloads/mt6765_payload.bin
[09:56:24]: Device is protected.
[09:56:24]: Device is in BROM mode. Trying to dump preloader.
[09:56:58]: Bootloader: unlock

[10:05:07]: Loading payload from mt6765_payload.bin, 0x264 bytes
[10:05:07]: Kamakiri / DA Run
[10:05:07]: Trying kamakiri2..
[10:05:07]: Done sending payload...
[10:05:07]: Successfully sent paylad: /opt/mtkclient/mtkclient/payloads/mt6765_payload.bin
[10:05:07]: Device is protected.
[10:05:07]: Device is in BROM mode. Trying to dump preloader.
[10:07:25]: test
[10:07:35]: write done!

I also went to see what fastboot was reporting after unlocking with MTKClient:

$ ./fastboot getvar unlocked
unlocked: no
Finished. Total time: 0.003s

However, that doesn’t necessarily matters, as I didn’t need to unlock it to switch slots.

Now, is there anything else I could try?

I was thinking of retrying to ADB sideload the stock OTA while the device is “maybe unlocked”.

I mean, by the look of it, it’s still locked, but I have limited trust in what my 2 inconsistent fastboot report.

So, assuming it is unlocked, is it safe to try ADB sideload while unlocked, or could this cause data loss?
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    you will find lot of contradictory information, also on xda. so please handle my information with care, too

    1) no problem for official OTAs, stock recovery is intented to flash (proper signed) update.zip on locked bootloader. have a look into zip META-INF/com/google/android/updater-script and figure out where the error 21 comes from, or search for it...

    2) it is A/B device so you might be able to switch slot from fastboot and boot into other working slot (if not flagged as invalid)

    3) you can backup (encrypted) userdata partition from mtkclient. unfortunately this won't help on factory reset, as every android device run several proprietary OS (which can't backed up) so factory reset will destroy encryption regardless of your backup
    1
    please double check maybe it's zip in zip
    1
    too bad. you can backup seccfg, unlock with mtkclient (no fastboot flashing unlock needed) switch slots and restore seccfg. it's a bit dangerous as accidentially booting into android while in unlocked state will make encryption invalid, so make sure you boot into fastboot mode only (maybe use hair tie for volume key?)

    unlocking with mtkclient does not factory reset, but do not erase metadata, userdata or md_udc (backup recommended)
    1
    as mentioned, do not try to boot in unlocked state you will lose all data. re-lock bootloader by restoring (locked) seccfg first!
    1
    virtalbox requires usb passthrough. why not use native OS all platform supported. or just try the Live DVD V4 provided?