• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[blankflash.zip] Hard brick Moto G7 Plus after downgrade

Search This thread

WinnieH

Member
May 15, 2008
26
20
Recently by accident I downgraded the operating system on my Moto G7 Plus device (XT1965-3) and hard bricked my phone. :crying:
It took me some days on checking different threads to come to a solution. I managed to create a blankflash file that finally recovered my bootloader so that I could get into fastboot mode and flash the latest OS.

For those who are faced with the same problem, I'd like to share my solution and hope it works for you as well.

When the phone is hard bricked, it do not boot, it stays in black screen. The good thing though is that by default it goes into Qualcomms EDL (Emergency DownLoad) mode.
When connecting your phone to the PC (e.g. Windows 10) you should see in the device manager under COM the following device:

Qualcomm HS-USB QDLoader 9008 (COM..)

If this do not show up, unplug the phone, press Power + VolumeDown for about 30 seconds and connect the device again.
If it still not works, you might search for the correct drivers.

Assuming you see the device as mentioned above, then you can do the blankflash.
  • Open a cmd window (ideally with Administrator rights)
  • Run blank-flash.bat
  • This should download the bootloader and your phone should get back to live (in fastboot mode)


After you have fixed the bootloader you can flash the latest OS with fastboot mode.
  • Connect the phone in fastboot mode
  • Run flashfile.bat from a cmd window
  • Now the ROM is flashed to the phone

Hope this helps recovering your phone!
 
Last edited:

Lupask

Senior Member
Aug 19, 2016
58
10
is it possible to restore previously unlocked phone to out-of-the-box software and behaviour? specifically I would like to get rid of the bootloader warning and verity disabled message at boot. I wouldn't mind locking again
 

mrufino

New member
Apr 2, 2010
2
0
"Waiting for device"

Hi WinnieH.

First off, i would like to thank you for explaining the necessity of the blankflash to recover the bootloader.
But when i try the steps you suggested, nothing happens. I get stuck in the message "Waiting for device..."
I noticed that the main command in the bat file is just: ".\qboot.exe blank-flash %*".

Wouldn't be necessary a reference to the singleimage.bin file in this command? Or maybe is a file missing in the zip.

I appreciate some suggestion.

Thanks,

Marcos
 

WinnieH

Member
May 15, 2008
26
20
Hi WinnieH.

First off, i would like to thank you for explaining the necessity of the blankflash to recover the bootloader.
But when i try the steps you suggested, nothing happens. I get stuck in the message "Waiting for device..."
I noticed that the main command in the bat file is just: ".\qboot.exe blank-flash %*".

Wouldn't be necessary a reference to the singleimage.bin file in this command? Or maybe is a file missing in the zip.

I appreciate some suggestion.

Thanks,

Marcos

Sorry for late response.
if the message "Waiting for device ..." comes, then your phone is not recognized correctly. Your device when bricked should connect in Emergency Download (EDL) mode. You could see this when you go to the Windows Device Manager. Under the COM devices your phone should show up with the Qualcomm. If not, disconnect the phone for a minute and try it again.
If you have the driver not installed it, the installation video might help: https://www.youtube.com/watch?v=ezQJlBKN9hk

PS: The blank-flash.bat is fine. It will automatically use the singleimage.bin file

Hope you get your way
 

mrufino

New member
Apr 2, 2010
2
0
Thank you WinnieH for the response. (that was not late at all!).

I will try to install the driver; I was unable to connect in Emergency Download Mode.
 

Woif

Senior Member
Dec 2, 2010
60
7
Innermanzing
Moto G7 Plus
Thank you WinnieH for the response. (that was not late at all!).

I will try to install the driver; I was unable to connect in Emergency Download Mode.

Well, first of all thanks to WinnieH for this useful thread. It worked fine for my phone.
@mrufino Maybe you have to install the moto drivers. Or try a different pc. The phone was not detected on my first pc, on my other pc it was detected immediately.
 

diegovmsouza

Member
Feb 15, 2018
17
2
Belo Horizonte
Recently by accident I downgraded the operating system on my Moto G7 Plus device (XT1965-3) and hard bricked my phone. :crying:
It took me some days on checking different threads to come to a solution. I managed to create a blankflash file that finally recovered my bootloader so that I could get into fastboot mode and flash the latest OS.

For those who are faced with the same problem, I'd like to share my solution and hope it works for you as well.

When the phone is hard bricked, it do not boot, it stays in black screen. The good thing though is that by default it goes into Qualcomms EDL (Emergency DownLoad) mode.
When connecting your phone to the PC (e.g. Windows 10) you should see in the device manager under COM the following device:

Qualcomm HS-USB QDLoader 9008 (COM..)

If this do not show up, unplug the phone, press Power + VolumeDown for about 30 seconds and connect the device again.
If it still not works, you might search for the correct drivers.

Assuming you see the device as mentioned above, then you can do the blankflash.
  • Open a cmd window (ideally with Administrator rights)
  • Run blank-flash.bat
  • This should download the bootloader and your phone should get back to live (in fastboot mode)


After you have fixed the bootloader you can flash the latest OS with fastboot mode.
  • Connect the phone in fastboot mode
  • Run flashfile.bat from a cmd window
  • Now the ROM is flashed to the phone

Hope this helps recovering your phone!

Great post. Where did you find the singleimage for your phone? i've tryed to do with my G7 RIVER bricked, but unsuccessful :( need some help!
 

WinnieH

Member
May 15, 2008
26
20
Great post. Where did you find the singleimage for your phone? i've tryed to do with my G7 RIVER bricked, but unsuccessful :( need some help!
Hello,
I did the image by myself. I used a older image of a G6 device and replace a number of elements in the image from the stockrom. With "star" you can delete and add files to the "singleimage.bin" archive. It took me some trials. Check on the latest STOCK ROM "XT1965-3_LAKE_RETEU_9.0_PPWS29.98-111-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml" from https://mirrors.lolinet.com/firmware/moto/lake/official/RETEU/ and you should find the most important files (such as partition table: gpt.bin).
Hope it works for you

Regards
Winnie
 

diegovmsouza

Member
Feb 15, 2018
17
2
Belo Horizonte
Hello,
I did the image by myself. I used a older image of a G6 device and replace a number of elements in the image from the stockrom. With "star" you can delete and add files to the "singleimage.bin" archive. It took me some trials. Check on the latest STOCK ROM "XT1965-3_LAKE_RETEU_9.0_PPWS29.98-111-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml" from https://mirrors.lolinet.com/firmware/moto/lake/official/RETEU/ and you should find the most important files (such as partition table: gpt.bin).
Hope it works for you

Regards
Winnie


Thanks for the answer. Trying to use "Star" I noticed that the files that are inside singleimage.bin are actually files that are inside bootloader.img right? How do I extract the bootloader.img file to use his files? I use linux but I have windows too.
 

WinnieH

Member
May 15, 2008
26
20
Thanks for the answer. Trying to use "Star" I noticed that the files that are inside singleimage.bin are actually files that are inside bootloader.img right? How do I extract the bootloader.img file to use his files? I use linux but I have windows too.

Just use "star list bootloader.img" and you get all the relevant file.

Code:
star list ..\..\XT1965-3_LAKE_RETEU_9.0_PPWS29.98-111-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\bootloader.img
 1     339968 md5:e4c77bb1f8862444bedb908067d5063d abl.elf
 2     519296 md5:4b8eaa75b77eae4981604f7893bf7279 cmnlib.mbn
 3     519296 md5:ac35656340c5f87037a64ce4f937b16c cmnlib64.mbn
 4       2722 md5:d3ee34bff4d352a045b7e42b447666a7 default.xml
 5     126080 md5:4590a7b21b0d70d4403fa95ad23a6e9d devcfg.mbn
 6      38400 md5:27ba16d71e0d16c86423192d5615a25c gpt.bin
 7     519296 md5:0582b648798303e0441930fd84a39b9a hyp.mbn
 8     519296 md5:2686fd49e16e78a0e9ef2335104e96bc keymaster.mbn
 9        125 md5:c3a63b25166c5fcac0cc1426bf44a271 pkg.xml
10     519296 md5:1437d90bab43816d4a3541b18edac61c pmic.elf
11     257152 md5:5e3b6f2cf09747bd3bac33023c2014a7 prov64.mbn
12     519296 md5:31ab4015a996f2ad6dd61c94076fea98 rpm.mbn
13     126080 md5:5054d3c7863d09d6333c509003548e4d storsec.mbn
14    2092160 md5:44a6f561bab5d2822066574e3d0116eb tz.mbn
15    3665024 md5:a2a5945cf2ae44cd95da3ee180480662 xbl.elf
16        172 md5:1fd033214e7e36c4134a927f1ce944f0 index.xml
17     606400 md5:4b6e1345d3fb9b347ce7fc6357def85a programmer.elf

Extract the files from the bootloader and replace them on the singleimage.bin and thats it.

e.g.
Code:
star delete abl.elf
star add abl.elf

Pressing thumbs
 
Last edited:
  • Like
Reactions: diegovmsouza

diegovmsouza

Member
Feb 15, 2018
17
2
Belo Horizonte
Just use "star list bootloader.img" and you get all the relevant file.

Code:
star list ..\..\XT1965-3_LAKE_RETEU_9.0_PPWS29.98-111-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\bootloader.img
 1     339968 md5:e4c77bb1f8862444bedb908067d5063d abl.elf
 2     519296 md5:4b8eaa75b77eae4981604f7893bf7279 cmnlib.mbn
 3     519296 md5:ac35656340c5f87037a64ce4f937b16c cmnlib64.mbn
 4       2722 md5:d3ee34bff4d352a045b7e42b447666a7 default.xml
 5     126080 md5:4590a7b21b0d70d4403fa95ad23a6e9d devcfg.mbn
 6      38400 md5:27ba16d71e0d16c86423192d5615a25c gpt.bin
 7     519296 md5:0582b648798303e0441930fd84a39b9a hyp.mbn
 8     519296 md5:2686fd49e16e78a0e9ef2335104e96bc keymaster.mbn
 9        125 md5:c3a63b25166c5fcac0cc1426bf44a271 pkg.xml
10     519296 md5:1437d90bab43816d4a3541b18edac61c pmic.elf
11     257152 md5:5e3b6f2cf09747bd3bac33023c2014a7 prov64.mbn
12     519296 md5:31ab4015a996f2ad6dd61c94076fea98 rpm.mbn
13     126080 md5:5054d3c7863d09d6333c509003548e4d storsec.mbn
14    2092160 md5:44a6f561bab5d2822066574e3d0116eb tz.mbn
15    3665024 md5:a2a5945cf2ae44cd95da3ee180480662 xbl.elf
16        172 md5:1fd033214e7e36c4134a927f1ce944f0 index.xml
17     606400 md5:4b6e1345d3fb9b347ce7fc6357def85a programmer.elf

Extract the files from the bootloader and replace them on the singleimage.bin and thats it.

e.g.
Code:
star delete abl.elf
star add abl.elf

Pressing thumbs

thanks for listening. When I list the bootloader.iso file it returns me the following error: "Failed: simg_open () -> IO error". already extract the rom stock again, already downloaded it from scratch and the result is the same. When I extract the bootloader.iso file the same error occurs. what could it be? Can you help me extract these files? I am attaching the bootloader file of moto g7 river, if you can help me I will be immensely grateful.
 

Attachments

  • bootloader.img
    7.2 MB · Views: 101
Last edited:

WinnieH

Member
May 15, 2008
26
20
thanks for listening. When I list the bootloader.iso file it returns me the following error: "Failed: simg_open () -> IO error". already extract the rom stock again, already downloaded it from scratch and the result is the same. When I extract the bootloader.iso file the same error occurs. what could it be? Can you help me extract these files? I am attaching the bootloader file of moto g7 river, if you can help me I will be immensely grateful.
Hello,
you are right. I should have written down how I created the singleimage.bin file. I replaced the following files in the singleimage.bin from the river stock rom version: XT1962-6_RIVER_RETEU_PPOS29.114-134-2_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml (loaded from: https://mirrors.lolinet.com/firmware/moto/river/official/RETEU/)
  • gpt.bin
And changed the index.xml to the right CPU 632
You might to play around with the board id if it do not work (board id="204"). I hope the programmer file is the same for the G7 (processor type is slightly different: Snapdragon 632 instead of 636).

Give it a try with attached blankflashRiver.zip
 

Attachments

  • blankflashRiver.zip
    4.5 MB · Views: 372

diegovmsouza

Member
Feb 15, 2018
17
2
Belo Horizonte
Hello,
you are right. I should have written down how I created the singleimage.bin file. I replaced the following files in the singleimage.bin from the river stock rom version: XT1962-6_RIVER_RETEU_PPOS29.114-134-2_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml (loaded from: https://mirrors.lolinet.com/firmware/moto/river/official/RETEU/)
  • gpt.bin
And changed the index.xml to the right CPU 632
You might to play around with the board id if it do not work (board id="204"). I hope the programmer file is the same for the G7 (processor type is slightly different: Snapdragon 632 instead of 636).

Give it a try with attached blankflashRiver.zip

Thanks for the help. the Programmer file isn't the same. After to work arround and beat my head over and over on the wall, I've took my phone to an authorized Motorola. For my surprise, as my phone shows oem_lock, they accepted on warranty. LOL. Now it's on repair and I'll catch tomorrow or another. Thanks for all. Thumbs up!
 

pipenet

Member
Oct 20, 2019
5
1
does it works in moto g7 power? or others ways that qualcomm port not send error
I tryed in windows 7x64,10x64 without response, it shows me an error port just every time, qualcom usb drivers are shows correct ,
I cant continues with the fastboot part, people any advice?
 

pipenet

Member
Oct 20, 2019
5
1
Thanks for the answer. Trying to use "Star" I noticed that the files that are inside singleimage.bin are actually files that are inside bootloader.img right? How do I extract the bootloader.img file to use his files? I use linux but I have windows too.


Greetings Winnieh !, thanks for all the time and good information that you post,
I have doubts I would appreciate some advice, I have a motorola g7 power (ocean) tha's in hardbrick mode, I have already installed the correct qualcom drivers, the com port recognizes my device, but I cannot get the file blankflash.bat to load the phone to the moment executing it gives me an error:

Motorola qboot utility version 3.86
[ -0.000] Opening device: \\.\COM3
[ 0.003] Detecting device
[ 2.218] ReadFile() failed, GetLastError()=0
[ 11.019] ERROR: sahara_greet_device()->device_open()->error opening device
[ 11.019] Check qboot_log.txt for more details
[ 11.019] Total time: 11.019s
FAILED: qb_flash_singleimage()->sahara_greet_device()->device_open()->error open
ing device

I realize that the blankflash.bat for the motog7 + version (river)

based on the blankflash file that you attached
I extracted the bootloader.img files from the stockrom of the motog7 power (ocean) XT1955-2 XT1955-2_OCEAN_AMX_9.0_PPO29.80-79_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml , so also delete and add all the files to the singleimpt.bin file - the gpt.bin file from stock rom copy and replace the one I saw in singleimage.bin
what you notice that index.xml refers to as "cpu.name: msm8953"
it also appears the same in the gpt.bin file, finally with the new singleimage.bin file compiled try to run the blankflash.bat again
unsuccessfully....
Could you tell me what are the mistakes that I can't solve?

i'm not a programmer just a bad lucky pal. if by chance have you a blankflash.bat for ocean version?, i'll really appreciate
Thank you! for your time
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    Recently by accident I downgraded the operating system on my Moto G7 Plus device (XT1965-3) and hard bricked my phone. :crying:
    It took me some days on checking different threads to come to a solution. I managed to create a blankflash file that finally recovered my bootloader so that I could get into fastboot mode and flash the latest OS.

    For those who are faced with the same problem, I'd like to share my solution and hope it works for you as well.

    When the phone is hard bricked, it do not boot, it stays in black screen. The good thing though is that by default it goes into Qualcomms EDL (Emergency DownLoad) mode.
    When connecting your phone to the PC (e.g. Windows 10) you should see in the device manager under COM the following device:

    Qualcomm HS-USB QDLoader 9008 (COM..)

    If this do not show up, unplug the phone, press Power + VolumeDown for about 30 seconds and connect the device again.
    If it still not works, you might search for the correct drivers.

    Assuming you see the device as mentioned above, then you can do the blankflash.
    • Open a cmd window (ideally with Administrator rights)
    • Run blank-flash.bat
    • This should download the bootloader and your phone should get back to live (in fastboot mode)


    After you have fixed the bootloader you can flash the latest OS with fastboot mode.
    • Connect the phone in fastboot mode
    • Run flashfile.bat from a cmd window
    • Now the ROM is flashed to the phone

    Hope this helps recovering your phone!
    2
    thanks for listening. When I list the bootloader.iso file it returns me the following error: "Failed: simg_open () -> IO error". already extract the rom stock again, already downloaded it from scratch and the result is the same. When I extract the bootloader.iso file the same error occurs. what could it be? Can you help me extract these files? I am attaching the bootloader file of moto g7 river, if you can help me I will be immensely grateful.
    Hello,
    you are right. I should have written down how I created the singleimage.bin file. I replaced the following files in the singleimage.bin from the river stock rom version: XT1962-6_RIVER_RETEU_PPOS29.114-134-2_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml (loaded from: https://mirrors.lolinet.com/firmware/moto/river/official/RETEU/)
    • gpt.bin
    And changed the index.xml to the right CPU 632
    You might to play around with the board id if it do not work (board id="204"). I hope the programmer file is the same for the G7 (processor type is slightly different: Snapdragon 632 instead of 636).

    Give it a try with attached blankflashRiver.zip
    2
    I got it working ! :) Booted in to Windows (8.1) and tried it. I have so many versions of the blankflash I don't remember where I got the one that actually worked so I'll attach it here. Note, both in Linux and Windows you must have root/admin privs in the terminal or it will not work. In both OS make sure all of the files are executable by you. For sure you'll have to change permissions in Linux. Check them in Windows. I didn't get in on the first try. I took a few tries. Start the bat file and quickly plug in the USB. It will probably fail. Hold the VOL- and the PWR same time for a while, 20-30 secs. With your other hand keep trying the bat file (scroll the up arrow in the terminal window so you don't have to retype and hit enter) while holding the buttons. If the flash starts release the buttons and let it finish. Keep trying and hopefully you'll snag it. Phone will boot to fastboot and even rebooted in to my original ROM OS! Now let's see if I can mess it up again or actually get that TWRP on there :) Thanks for your help W's !
    2
    Just for good measure, this is what it looks like when it works:


    C:\Source\blankflash>blank-flash.bat


    C:\Source\blankflash>.\qboot.exe blank-flash
    Motorola qboot utility version 3.86
    [ 0.000] Opening device: \\.\COM10
    [ 0.000] Detecting device
    [ 23.832] ReadFile() failed, GetLastError()=0
    [ 31.724] ...cpu.id = 204 (0xcc)
    [ 31.724] ...cpu.sn = 277249XXX22 (0xa540f922)
    [ 31.724] Opening singleimage
    [ 31.818] Loading package
    [ 31.818] ...filename = pkg.xml
    [ 31.833] Loading programmer
    [ 31.833] ...filename = programmer.elf
    [ 31.833] Sending programmer
    [ 32.021] Handling things over to programmer
    [ 32.021] Identifying CPU version
    [ 32.021] Waiting for firehose to get ready
    [ 35.068] ...SDM636 1.0
    [ 35.068] Determining target secure state
    [ 35.083] ...secure = yes
    [ 35.130] Configuring device...
    [ 35.130] Flashing GPT...
    [ 35.162] Flashing partition with gpt.bin
    [ 35.177] Initializing storage
    [ 35.240] ...blksz = 512
    [ 35.412] Re-initializing storage...
    [ 35.412] Initializing storage
    [ 35.599] Flashing bootloader...
    [ 35.662] Flashing xbl_a with xbl.elf
    [ 36.084] Flashing pmic_a with pmic.elf
    [ 36.224] Flashing rpm_a with rpm.mbn
    [ 36.349] Flashing tz_a with tz.mbn
    [ 36.584] Flashing hyp_a with hyp.mbn
    [ 36.709] Flashing devcfg_a with devcfg.mbn
    [ 36.787] Flashing prov_a with prov64.mbn
    [ 36.880] Flashing cmnlib_a with cmnlib.mbn
    [ 37.005] Flashing cmnlib64_a with cmnlib64.mbn
    [ 37.099] Flashing keymaster_a with keymaster.mbn
    [ 37.240] Flashing storsec_a with storsec.mbn
    [ 37.318] Flashing abl_a with abl.elf
    [ 37.427] Rebooting to fastboot
    [ 37.427] Total time: 37.427s


    C:\Source\blankflash>pause
    Press any key to continue . . .
    1
    Thanks for the answer. Trying to use "Star" I noticed that the files that are inside singleimage.bin are actually files that are inside bootloader.img right? How do I extract the bootloader.img file to use his files? I use linux but I have windows too.

    Just use "star list bootloader.img" and you get all the relevant file.

    Code:
    star list ..\..\XT1965-3_LAKE_RETEU_9.0_PPWS29.98-111-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\bootloader.img
     1     339968 md5:e4c77bb1f8862444bedb908067d5063d abl.elf
     2     519296 md5:4b8eaa75b77eae4981604f7893bf7279 cmnlib.mbn
     3     519296 md5:ac35656340c5f87037a64ce4f937b16c cmnlib64.mbn
     4       2722 md5:d3ee34bff4d352a045b7e42b447666a7 default.xml
     5     126080 md5:4590a7b21b0d70d4403fa95ad23a6e9d devcfg.mbn
     6      38400 md5:27ba16d71e0d16c86423192d5615a25c gpt.bin
     7     519296 md5:0582b648798303e0441930fd84a39b9a hyp.mbn
     8     519296 md5:2686fd49e16e78a0e9ef2335104e96bc keymaster.mbn
     9        125 md5:c3a63b25166c5fcac0cc1426bf44a271 pkg.xml
    10     519296 md5:1437d90bab43816d4a3541b18edac61c pmic.elf
    11     257152 md5:5e3b6f2cf09747bd3bac33023c2014a7 prov64.mbn
    12     519296 md5:31ab4015a996f2ad6dd61c94076fea98 rpm.mbn
    13     126080 md5:5054d3c7863d09d6333c509003548e4d storsec.mbn
    14    2092160 md5:44a6f561bab5d2822066574e3d0116eb tz.mbn
    15    3665024 md5:a2a5945cf2ae44cd95da3ee180480662 xbl.elf
    16        172 md5:1fd033214e7e36c4134a927f1ce944f0 index.xml
    17     606400 md5:4b6e1345d3fb9b347ce7fc6357def85a programmer.elf

    Extract the files from the bootloader and replace them on the singleimage.bin and thats it.

    e.g.
    Code:
    star delete abl.elf
    star add abl.elf

    Pressing thumbs