[GUIDE] How to Avoid Killing Your OnePlus 8 Pro / 8T / 9R with OxygenOS 12 / ColorOS 12

Search This thread

dargur.mikk

New member
Aug 29, 2022
1
0
So, to clarify,
i have ota oxygen os 11.0.11.11.IN11BA, unlocked bootloader, root, magisk 25.2 with zygisk and ramdisk
will i brick my op8p if i apply ota IN2023_11.C.16_1160_202204222258?

should i do all this before applying the update?
1. uninstall magisk
2. factory reset
3. unroot
4. flash original boot.img
5. lock bootloader
 

ko_hi

Senior Member
Mar 25, 2020
138
103
So, to clarify,
i have ota oxygen os 11.0.11.11.IN11BA, unlocked bootloader, root, magisk 25.2 with zygisk and ramdisk
will i brick my op8p if i apply ota IN2023_11.C.16_1160_202204222258?

should i do all this before applying the update?
1. uninstall magisk
2. factory reset
3. unroot
4. flash original boot.img
5. lock bootloader
Most likely you just need to remove the safetynet props or any that tampers the props in general
 

sketch.droid

Senior Member
Dec 11, 2010
70
16
Perth
OnePlus 5
OnePlus 8T
Some extra warnings:
1. OnePlus 8T/9R also has LPDDR4x variant, make sure the variants before flashing.
2. The DDR detection process was artificially killed, stay away from the Magisk modules to keep safe.
3. TWRP is no longer recommended, use OxygenOS modified recovery or other ROM's recovery instead.
4. Flash/Root has huge risks, all operations need to be careful.

OnePlus 8 - LPDDR4x
OnePlus 8 Pro - LPDDR5
OnePlus 8T - LPDDR4x/LPDDR5
OnePlus 9R - LPDDR4x/LPDDR5
This whole situation scares me from even attempting any Updates anymore.... I cant afford a new phone!

but while reading about this I came across a Reddit post confirming that 8T variants came with both LPDDR4x and LPDDR5, and poster provided an adb command to check which RAM type you have.
Not sure if I'm allowed to post a link to it...

I think this should be added to the first post.

Code:
adb shell getprop ro.boot.ddr_type

getting a 0 (zero) means LPDDR4x
getting a 1 (one) means LPDDR5
 
  • Like
Reactions: tfae and Nimueh

denvit

Member
Jul 5, 2013
45
18
I too bricked my phone by running (as per my usual):

```
for i in *.img; do fastboot flash ${i/.img/} $i; done
```

from the extracted payload.bin of the global C.16 build (ota_target_version=IN2025_11.C.16_1160_202204222300)

This caused the `xbl.img` to be flashed on the xbl partition and the xbl_lp5.img to not be flashed anywhere.
Rebooting the phone bricked it: can't enter EDL in any way (maybe pin shorting is our last resort) and the phone is basically a brick.

Analyzing the bootloader difference, there seems to be the check mentioned in the initial post. I'm not sure why you think this is not working (other than the fact that the phone doesn't show anything).

It would be interesting to get some UART logs, but I have no clue on how the motherboard looks like, let alone where the pins are.

xbl.img​

xbl-build.png

xbl-lp5.img
xbl-lp5-build.png


If anyone has any tip on how to proceed, it would be great - tbh I'm surprised the bootloader wasn't a protected partition to begin with, or that they don't fall back to EDL in this case.
 

Peter Linzbauer

New member
Jul 5, 2020
2
1
Hi I am trying to flash lineage 19 on my Oneplus8 Pro. I tried a bunch of stuff and now I need some help. I understand how to unpack the OnePlus8ProOxygen.zip via payload-dumper-go. I had Problems flashing the .img in fastboot. When I entered fastboot with the lineageOS-recovery it worked fine.

My Problem now, I can't find the xbl_lp5.img & xbl_config_lp5.img files. Where do I get them from?

Edit: So I found them in the .zip I downloaded with the Oxygen Updater App. I installed it on an other phone. Then I proceeded to unpack with the payload-dumper-go Tool und flashed the .img via fastboot.
 
Last edited:
  • Like
Reactions: runhard

ikram.senguen

Senior Member
Feb 5, 2012
257
47
Samsung Galaxy S8
Hi I am trying to flash lineage 19 on my Oneplus8 Pro. I tried a bunch of stuff and now I need some help. I understand how to unpack the OnePlus8ProOxygen.zip via payload-dumper-go. I had Problems flashing the .img in fastboot. When I entered fastboot with the lineageOS-recovery it worked fine.

My Problem now, I can't find the xbl_lp5.img & xbl_config_lp5.img files. Where do I get them from?

Edit: So I found them in the .zip I downloaded with the Oxygen Updater App. I installed it on an other phone. Then I proceeded to unpack with the payload-dumper-go Tool und flashed the .img via fastboot.
Lieber Peter, lieber versuchs erst garnicht, habe mein phone gebricked und ich bin eigentlich erfahren in allem hier, das geschilderte problem mit dem ram zerstört das handy und es könnte überall die falsche xbl file drinn sein

gehst du auf lineage 19, kommst du nich zurück auf OOS, und versucht du es, brickst du dein phone, für immer ( wusste auch nicht das das möglich is per adb und fastboot, aber scheinbar ist es das! )

am besten bleib auf oos
 

Nimueh

Recognized Contributor
May 19, 2012
3,332
2,911
OnePlus 3
Samsung Galaxy Tab A series
Lieber Peter, lieber versuchs erst garnicht, habe mein phone gebricked und ich bin eigentlich erfahren in allem hier, das geschilderte problem mit dem ram zerstört das handy und es könnte überall die falsche xbl file drinn sein

gehst du auf lineage 19, kommst du nich zurück auf OOS, und versucht du es, brickst du dein phone, für immer ( wusste auch nicht das das möglich is per adb und fastboot, aber scheinbar ist es das! )

am besten bleib auf oos
Please translate your post to English, as required by the XDA rules ;)
 
  • Like
Reactions: FreshlyBaked 420

runhard

New member
Oct 20, 2022
1
0
Hi I am trying to flash lineage 19 on my Oneplus8 Pro. I tried a bunch of stuff and now I need some help. I understand how to unpack the OnePlus8ProOxygen.zip via payload-dumper-go. I had Problems flashing the .img in fastboot. When I entered fastboot with the lineageOS-recovery it worked fine.

My Problem now, I can't find the xbl_lp5.img & xbl_config_lp5.img files. Where do I get them from?

Edit: So I found them in the .zip I downloaded with the Oxygen Updater App. I installed it on an other phone. Then I proceeded to unpack with the payload-dumper-go Tool und flashed the .img via fastboot.

Peter, do you have the xbl_lp5 files you would be able to share? Thankfully the Lineage instructions warn against flashing the wrong version, but now I am stuck needing those before I can continue with the install on a OnePlus 8 Pro. Otherwise, if you could provide the steps you took to find the files, that would be helpful, too.

EDIT: Was able to locate. Now the Fastboot screen is cycling through the input options and not responding to add.
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
Anyway you probably can't run EDL without working ram.
Mmm, I don't think that's true.
I can't speak for every processor, but they mostly (all?) include static RAM on the chip just for starting up.
The ROM bootloader is simple and doesn't configure any external DRAM (AFAIK).
I have worked with secondary loaders where I have seen that they configure external DRAM.
It seems to me that just a processor by itself should be able to get the Sahara protocol running at least.
Whether the Firehose loaders use external DRAM is a different question.
I think that I have a phone that I can actually check that with. I can hit the DRAM with a center punch.

Also, that this whole thread is about the DRAM configuration code in xbl...

As far as getting into EDL mode, I think EDL test points are the "gold standard".
Just as adb reboot edl is dependent on the reboot executable and abl that knows to look for something in /misc or elsewhere, buttons are random GPIOs that abl polls,
There's no reason that Qualcomm when they make a chip would know/care that a Zircon 3000 phone uses GPIO 27 for VolUp.
I do not believe that "EDL mode USB cables" are detected inside the SoC ROM, but in abl or elsewhere.

I'd welcome any corrections to my understanding.
 
  • Like
Reactions: ppajdek

rmedure

Senior Member
Dec 30, 2013
115
19
Austin, TX
I took the android 12 OTA on OP8 Plus, version IN2025_11_C.21, downloaded with the "Oxygen Updater" app. Using payload dumper shows that there are only 2 xbl images:

xbl.img
xbl_config.img

So then, how do I tell if these are the correct xbl images?
 
Last edited:

ShadoV90

Senior Member
Mar 5, 2017
271
96
Legnica
I took the android 12 OTA on OP8 Plus, version IN2025_11_C.21, downloaded with the "Oxygen Updater" app. Using payload dumper shows that there are only 2 xbl images:

xbl.img
xbl_config.img

So then, how do I tell if these are the correct xbl images?
If you took A12 official OOS ROM, then after using payload dumper, you should have:
xbl.img
xbl_config.img

xbl_lp5.img
xbl_config_lp5.img

As first post says with bold letters:
"If You have OnePlus 8 (DDR4) You're supposed to flash xbl.img & xbl_config.img"

"If You have OnePlus 8 Pro [...] (DDR5) You're supposed to flash xbl_lp5.img & xbl_config_lp5.img"

IN2025 is OnePlus 8 Pro (NA variant)
Double check everything. It's better to check 100 times, than end with dead device.
 

rmedure

Senior Member
Dec 30, 2013
115
19
Austin, TX
Hmm, my bad. All 4 xbl images are there ... I swear I checked twice and only saw the 2. Anyway, I was able to dd the xbl partition and compare and find that it does indeed match xbl_lp5.img in the payload. So I guess I was lucky to happen to follow a procedure that worked.

I used the Magisk manager app to "uninstall Magisk" (I guess this restores the boot partition to original). Then ran "local update" with OTA zip downloaded with OxygenUpdater (did NOT reboot yet). Then used Magisk manager to install Magisk to inactive slot. Seems all went well.

I am not trying to use any custom recovery yet. My understanding is that new A12 TWRP for OP8 Plus is not yet done.

Hopefully this helps some of y'all.

Cheers!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Anyway you probably can't run EDL without working ram.
    Mmm, I don't think that's true.
    I can't speak for every processor, but they mostly (all?) include static RAM on the chip just for starting up.
    The ROM bootloader is simple and doesn't configure any external DRAM (AFAIK).
    I have worked with secondary loaders where I have seen that they configure external DRAM.
    It seems to me that just a processor by itself should be able to get the Sahara protocol running at least.
    Whether the Firehose loaders use external DRAM is a different question.
    I think that I have a phone that I can actually check that with. I can hit the DRAM with a center punch.

    Also, that this whole thread is about the DRAM configuration code in xbl...

    As far as getting into EDL mode, I think EDL test points are the "gold standard".
    Just as adb reboot edl is dependent on the reboot executable and abl that knows to look for something in /misc or elsewhere, buttons are random GPIOs that abl polls,
    There's no reason that Qualcomm when they make a chip would know/care that a Zircon 3000 phone uses GPIO 27 for VolUp.
    I do not believe that "EDL mode USB cables" are detected inside the SoC ROM, but in abl or elsewhere.

    I'd welcome any corrections to my understanding.
  • 27
    As You can see, recently we started seeing more and more threads complaining about OxygenOS 12 killing people's devices. I lost my 8 Pro the same way few months ago and we finally know what caused this!

    ANSWER - THE BOOTLOADER!


    While OxygenOS OTA is mostly safe, it can still accidentally flash the wrong bootloader on Your phone! Examples are having Magisk Props Module installed which will lead to OxygenOS flashing the wrong image or TWRP telling payload to flash DDR4 bootloader onto DDR5 device.

    But wait.. how can an official bootloader kill the motherboard beyond MSM?! Well.. Here's the thing, OnePlus uses same signature to sign all four firmwares, OP8, OP8T, OP8Pro, 9R all use identical signature, which means that PBL (Primary Bootloader) will load XBL (Secondary Bootloader) no matter which one You flash.

    But wait.. isn't there any protection to stop this from happening? Well.. there should be. In fact previously OnePlus 8 and 8 Pro firmwares both shipped with single bootloader that was either designed for DDR4 or DDR5. Now since OxygenOS 12 they started shipping DDR4 and DDR5 in the same package. And the reason why the phone dies is because LPDDR5 RAM uses lower voltage compared to LPDDR4X, and just because there's no code to prevent XBL from setting voltage too high on LPDDR5, it leads to RAM getting overvolted and dying.


    How can we tell which one we should flash if we end up flashing OOS OTA manually through fastboot?

    Update: Double check Your RAM just in case!

    Post #3


    If You have OnePlus 8 (DDR4) You're supposed to flash xbl.img & xbl_config.img

    If You have OnePlus 8 Pro / 8T / 9R (DDR5) You're supposed to flash xbl_lp5.img & xbl_config_lp5.img

    I recommend everyone who makes fastboot flashers to include that change or make separate flashers for each codename!


    Previously LP5 was only available in 9R firmware but it seems that OnePlus after joining OPPO has changed things a little and made things quite dangerous for many people.

    1649027073073.png

    1649027150167.png


    Images above show that there are some checks but unfortunately they don't seem to work correctly and voltage is being set too high anyway.

    So, Dear OnePlus, please stop adding non DDR5 bootloader to 8 Pro firmware builds! Or at least add protection to fail boot if DDR5 is detected.
    9
    Some extra warnings:
    1. OnePlus 8T/9R also has LPDDR4x variant, make sure the variants before flashing.
    2. The DDR detection process was artificially killed, stay away from the Magisk modules to keep safe.
    3. TWRP is no longer recommended, use OxygenOS modified recovery or other ROM's recovery instead.
    4. Flash/Root has huge risks, all operations need to be careful.

    OnePlus 8 - LPDDR4x
    OnePlus 8 Pro - LPDDR5
    OnePlus 8T - LPDDR4x/LPDDR5
    OnePlus 9R - LPDDR4x/LPDDR5
    6
    As You can see, recently we started seeing more and more threads complaining about OxygenOS 12 killing people's devices. I lost my 8 Pro the same way few months ago and we finally know what caused this!

    ANSWER - THE BOOTLOADER!


    While OxygenOS OTA is mostly safe, it can still accidentally flash the wrong bootloader on Your phone! Examples are having Magisk Props Module installed which will lead to OxygenOS flashing the wrong image or TWRP telling payload to flash DDR4 bootloader onto DDR5 device.

    But wait.. how can an official bootloader kill the motherboard beyond MSM?! Well.. Here's the thing, OnePlus uses same signature to sign all four firmwares, OP8, OP8T, OP8Pro, 9R all use identical signature, which means that PBL (Primary Bootloader) will load XBL (Secondary Bootloader) no matter which one You flash.

    But wait.. isn't there any protection to stop this from happening? Well.. there should be. In fact previously OnePlus 8 and 8 Pro firmwares both shipped with single bootloader that was either designed for DDR4 or DDR5. Now since OxygenOS 12 they started shipping DDR4 and DDR5 in the same package. And the reason why the phone dies is because LPDDR5 RAM uses lower voltage compared to LPDDR4X, and just because there's no code to prevent XBL from setting voltage too high on LPDDR5, it leads to RAM getting overvolted and dying.


    How can we tell which one we should flash if we end up flashing OOS OTA manually through fastboot?

    If You have OnePlus 8 (DDR4) You're supposed to flash xbl.img & xbl_config.img

    If You have OnePlus 8 Pro / 8T / 9R (DDR5) You're supposed to flash xbl_lp5.img & xbl_config_lp5.img

    I recommend everyone who makes fastboot flashers to include that change or make separate flashers for each codename!


    Previously LP5 was only available in 9R firmware but it seems that OnePlus after joining OPPO has changed things a little and made things quite dangerous for many people.

    View attachment 5578875
    View attachment 5578877


    Images above show that there are some checks but unfortunately they don't seem to work correctly and voltage is being set too high anyway.

    So, Dear OnePlus, please stop adding non DDR5 bootloader to 8 Pro firmware builds! Or at least add protection to fail boot if DDR5 is detected.

    This is so F'ing insane
    3
    Holy ****...

    These are the images of IN2025_11_C_OTA_1100


    Code:
    abl.img
    aop.img
    bluetooth.img
    boot.img
    cmnlib.img
    cmnlib64.img
    devcfg.img
    dsp.img
    dtbo.img
    featenabler.img
    hyp.img
    imagefv.img
    keymaster.img
    logo.img
    mdm_oem_stanvbk.img
    modem.img
    multiimgoem.img
    my_bigball.img
    my_carrier.img
    my_company.img
    my_engineering.img
    my_heytap.img
    my_manifest.img
    my_preload.img
    my_product.img
    my_region.img
    my_stock.img
    odm.img
    product.img
    qupfw.img
    recovery.img
    spunvm.img
    storsec.img
    system.img
    system_ext.img
    tz.img
    uefisecapp.img
    vbmeta.img
    vbmeta_system.img
    vendor.img
    xbl.img
    xbl_config.img
    xbl_config_lp5.img
    xbl_lp5.img

    And these are the images of 11.0.11.11

    Code:
    abl.img
    aop.img
    bluetooth.img
    boot.img
    cmnlib.img
    cmnlib64.img
    devcfg.img
    dsp.img
    dtbo.img
    featenabler.img
    hyp.img
    imagefv.img
    keymaster.img
    logo.img
    mdm_oem_stanvbk.img
    modem.img
    multiimgoem.img
    odm.img
    product.img
    qupfw.img
    recovery.img
    reserve.img
    spunvm.img
    storsec.img
    system.img
    system_ext.img
    tz.img
    uefisecapp.img
    vbmeta.img
    vbmeta_system.img
    vendor.img
    xbl.img
    xbl_config.img

    Usually i use this script after changing a rom and after using MSM tool.


    Code:
    fastboot -w
    fastboot flash boot boot.img
    fastboot flash dtbo dtbo.img
    fastboot flash modem modem.img
    fastboot flash recovery recovery.img
    fastboot --disable-verity flash vbmeta vbmeta.img
    fastboot --disable-verity flash vbmeta_system vbmeta_system.img
    fastboot reboot fastboot
    fastboot flash abl abl.img
    fastboot flash aop aop.img
    fastboot flash bluetooth bluetooth.img
    fastboot flash cmnlib cmnlib.img
    fastboot flash cmnlib64 cmnlib64.img
    fastboot flash devcfg devcfg.img
    fastboot flash dsp dsp.img
    fastboot flash featenabler featenabler.img
    fastboot flash hyp hyp.img
    fastboot flash imagefv imagefv.img
    fastboot flash keymaster keymaster.img
    fastboot flash logo logo.img
    fastboot flash mdm_oem_stanvbk mdm_oem_stanvbk.img
    fastboot flash multiimgoem multiimgoem.img
    fastboot flash odm odm.img
    fastboot flash opproduct opproduct.img
    fastboot flash qupfw qupfw.img
    fastboot flash spunvm spunvm.img
    fastboot flash storsec storsec.img
    fastboot flash tz tz.img
    fastboot flash uefisecapp uefisecapp.img
    fastboot flash xbl xbl.img
    fastboot flash xbl_config xbl_config.img
    fastboot flash system system.img
    fastboot flash vendor vendor.img
    fastboot flash product product.img
    fastboot reboot fastboot
    fastboot flash --slot=all abl abl.img
    fastboot flash --slot=all aop aop.img
    fastboot flash --slot=all bluetooth bluetooth.img
    fastboot flash --slot=all cmnlib64 cmnlib64.img
    fastboot flash --slot=all cmnlib cmnlib.img
    fastboot flash --slot=all devcfg devcfg.img
    fastboot flash --slot=all dsp dsp.img
    fastboot flash --slot=all featenabler featenabler.img
    fastboot flash --slot=all hyp hyp.img
    fastboot flash --slot=all imagefv imagefv.img
    fastboot flash --slot=all keymaster keymaster.img
    fastboot flash --slot=all logo logo.img
    fastboot flash --slot=all mdm_oem_stanvbk mdm_oem_stanvbk.img
    fastboot flash --slot=all modem modem.img
    fastboot flash --slot=all multiimgoem multiimgoem.img
    fastboot flash --slot=all qupfw qupfw.img
    fastboot flash --slot=all spunvm spunvm.img
    fastboot flash --slot=all storsec storsec.img
    fastboot flash --slot=all tz tz.img
    fastboot flash --slot=all uefisecapp uefisecapp.img
    fastboot flash --slot=all xbl_config xbl_config.img
    fastboot flash --slot=all xbl xbl.img
    fastboot reboot-bootloader

    If i would have used this with OOS12 i would have bricked my phone on both slots instantly.....

    Im so glad that i was sceptical because OOS12 had more .img files compared to OOS11 and i did not use the script.

    People need to know this...


    Am i right that as long as we stay on OOS11 and dont use anything from OOS12 we are good to go like before?
    3
    Friendly reminder:
    OnePlus8ProOxygen_15.E.15_OTA_1032_all_2204021901_1b9e6
    IN2023_11_C.15 - European Firmware - 3.9 GB

    Still has the potential to brick your device! I dont know if they fixed the checks now.

    IMG List:

    Code:
    44
    abl.img
    aop.img
    bluetooth.img
    boot.img
    cmnlib.img
    cmnlib64.img
    devcfg.img
    dsp.img
    dtbo.img
    featenabler.img
    hyp.img
    imagefv.img
    keymaster.img
    logo.img
    mdm_oem_stanvbk.img
    modem.img
    multiimgoem.img
    my_bigball.img
    my_carrier.img
    my_company.img
    my_engineering.img
    my_heytap.img
    my_manifest.img
    my_preload.img
    my_product.img
    my_region.img
    my_stock.img
    odm.img
    product.img
    qupfw.img
    recovery.img
    spunvm.img
    storsec.img
    system.img
    system_ext.img
    tz.img
    uefisecapp.img
    vbmeta.img
    vbmeta_system.img
    vendor.img
    xbl.img
    xbl_config.img
    xbl_config_lp5.img
    xbl_lp5.img