• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[GUIDE] Unbrick MOTO Z Play (not working yet)

Search This thread

benzinerwin

Senior Member
May 1, 2008
50
54
work in progress! (not working yet)
Current status: does not work (but should!), exact reason unknown (to me).
If you managed to "brick" your MOTO Z Play it enters a fail-safe mode as a last resort provided by the chipset manufacturer (Qualcomm). There are packages out there called "blank-flash" that use this mode to restore a proper bootloader that in turn re-enables the use of the fastboot method to write the other flash files and restore full operation - provided the personalized partitions are still present and in good health (or you have a backup of them at hand).

Look at this thread and download the Nougat file. It contains "blank-flash" files. These "should work" but they don't (any more). As I don't have a Z Play, I cannot research the matter myself and instructing helpful others via email exchange is ... complicated.

The thing with failing updates/flash packages is that they usually fail because they do not allow downgrading - even if they allow downgrading of some sort (e.g. OS), they may limit downgrading the second stage bootloader, the signed GPT (partitioning table) etc. As I don't know if and what's the case with the Z Play, I just assumed that *if* it works, it may require the most recent files.

If you run the blank-flash files (qboot) with --debug=2 option you see that after the programmer code is sent to the phone it doesn't send a valid / expected response and ultimately causes the process to fail.

There are many programmer files out there. Most do not work, because they need to be digitally signed with the proper keys. Some are signed with Quallcomm-keys, some with Lenovo-, Motorola- and other with test-keys. And then again, they have to fit with the qboot program that's sending the data to be flashed.

A blankflash archive consists of the following files:
  • qboot, blank-flash.sh ; Linux
  • qboot.exe, qboot.dll, blank-flash.bat ; Windows
  • singleimage.bin ; Both
There are different versions of the qboot program. I've found the versions 2.4, 3.37 and 3.40.
The file "singleimage.bin" contains the flash files and directions crammed into a single file, thus the name:
  1. cmnlib.mbn
  2. cmnlib64.mbn
  3. devcfg.mbn
  4. emmc_appsboot.mbn
  5. gpt_main0.bin
  6. index.xml
  7. keymaster.mbn
  8. programmer.mbn
  9. prov.mbn
  10. rpm.mbn
  11. sbl1.mbn
  12. singleimage.default.xml
  13. singleimage.pkg.xml
  14. tz.mbn
The XML files contain the instructions (the 'recipe'):
index.xml:

Code:
<?xml version="1.0"?>
<index>
  <board id="70" name="MSM8953" storage.type="eMMC"/>
  <package compatible="cpu.name:MSM8953 protocol:qboot" filename="singleimage.pkg.xml"/>
</index>

singleimage.pkg.xml:

Code:
<?xml version="1.0"?>
<package>
  <programmer filename="programmer.mbn"/>
  <recipe filename="singleimage.default.xml"/> 
</package>

singleimage.default.xml:

Code:
<?xml version="1.0" ?> 
<recipe>
  <configure MemoryName="eMMC"/>

  <!-- Flash GPT -->
  <print what="Flashing GPT..."/>
  <flash partition="partition:0" filename="gpt_main0.bin" verbose="true"/>

  <print what="Re-initializing storage..."/>
  <storage operation="reinit"/>

  <!-- Flash bootloader -->
  <print what="Flashing bootloader..."/>
  <flash partition="aboot"     verbose="true" filename="emmc_appsboot.mbn"/>
  <flash partition="rpm"       verbose="true" filename="rpm.mbn"/>
  <flash partition="tz"        verbose="true" filename="tz.mbn"/>
  <flash partition="devcfg"    verbose="true" filename="devcfg.mbn"/>
  <flash partition="cmnlib"    verbose="true" filename="cmnlib.mbn"/>
  <flash partition="cmnlib64"  verbose="true" filename="cmnlib64.mbn"/>
  <flash partition="keymaster" verbose="true" filename="keymaster.mbn"/>
  <flash partition="prov"      verbose="true" filename="prov.mbn"/>
  <flash partition="sbl1"      verbose="true" filename="sbl1.mbn"/>
</recipe>


These files usually do not need to be modified.
programmer.mbn is the flash application that is sent to the phone.

I've compiled the following package, including all the qboot executables:
http://frickelbude.net/moto/blankflash[addison][D61DC5C7][25.211.10][1.07][2017-04-13].zip
D61DC5C7: crc32-checksum of programmer.mbn file (original, motorola signed) (find others here)
25.211.10: firmare package origin of the bootloader files
1.07: bootloader version
2017-04-13: time stamp of bootloader file

This didn't work with recently bricked Z Play phones as some testers confirmed. We also tried all the different programmer executables linked above just to be sure but no luck.

Outlook: you may want to try out Qualcomms QFIL (part of QPST package) (look e.g. at the download section of androidbrick).
However, that requires some handywork - you need to build some XML files, provide the proper programmer file etc. Maybe grab a firmware package e.g. for a Xiaomi phone that has all these files and try and deduce a proper layout for your Z play... and hope, any of the programmer files will actually run and communicate with the pc end.

(Usually the blank-flash files operate in 'sahara' mode/protocol and send the programmer.mbn to the phone. Then it waits for a positive response from the phone to enter 'firehose' mode in order to send all the flash data...)

/update 2017-06-10 a
I've created a blank-flash package based on the files @lozada81 linked below:
bootloader files extracted from: OTA tester Android 7.1.1 BRASIL patch june - Blur_Version.26.1.22.addison.retail.en.US.zip
blank-flash package: http://frickelbude.net/moto/blankflash[addison][D61DC5C7][26.1.22][C1.12][2017-05-22].zip
(Bootloader version: C1.12, GPT layout version: 0x000A)

/update 2017-06-10 b
Same package as above, but with a different programmer.mbn, taken from an older blank-flash package that came with an Android 6.0.1 package @lozada81 linked below.
http://frickelbude.net/moto/blankflash[addison][C0A0D740][26.1.22][C1.12][2017-05-22].zip
Well, it either fails with the infamous io-error or it finally works.. please test & report back!
 
Last edited:

Fargo_Zoidberg

Senior Member
Mar 18, 2015
92
33
Thanks OP for putting this together. I hope someone can help get what we need (someone smarter than me :)). I've had to go back to my Nexus 6P, but the battery life is just horrid. I ended up ordering another Moto Z Play online. This time I'm going to keep the bootloader locked, keep the stock software, etc. I might be done with the rooting/flashing part of my life.
 
  • Like
Reactions: giba_11

giba_11

Member
Jun 7, 2017
5
2
Moto Z Play Brick

Good afternoon.

I am from Brazil and I have a Moto Z Play XT1635-02 and downgraded from Android 7 to 6 and until then, I did the bootloader, root and installed TWRP and followed dowgrade procedures.

The problem happened after the downgrade removed the root I reinstalled the original recovery and downloaded through the mobile the update of the android January 7 via ota and after downloading began the installation and when restarting the cell phone he died and did not call any more and when connecting On the computer only the message in the device manager "Qualcomm HS-USB QDLoader 9008" no solution for now to resuscitate the device?

If someone has the solution and can help, thank you.
 

giri.shiva

Member
Jun 19, 2015
27
5
Good afternoon.

I am from Brazil and I have a Moto Z Play XT1635-02 and downgraded from Android 7 to 6 and until then, I did the bootloader, root and installed TWRP and followed dowgrade procedures.

The problem happened after the downgrade removed the root I reinstalled the original recovery and downloaded through the mobile the update of the android January 7 via ota and after downloading began the installation and when restarting the cell phone he died and did not call any more and when connecting On the computer only the message in the device manager "Qualcomm HS-USB QDLoader 9008" no solution for now to resuscitate the device?

If someone has the solution and can help, thank you.


Same with my case
 

lozada81

Senior Member
Nov 18, 2015
82
28
40
Ciudad de México
Redmi Note 10
  • Like
Reactions: [RoNy]R3laX

benzinerwin

Senior Member
May 1, 2008
50
54
OTA tester Android 7.1.1 BRASIL patch june - Blur_Version.26.1.22.addison.retail.en.US.zip
https://drive.google.com/file/d/0B-9vIY9eZnVqY3BGM0NUdTdsclE/view

I've compiled a new blank-flash package in case anyone would like to try it out (see update in 1st post).
However, I doubt it will work better than the other files. If it keeps on failing with:
Code:
FAILED: qb_flash_singleimage()->sahara_download()->IO error
then there's still something wrong with the communication between qboot and the programmer file. I.e. we would need a programmer file that works with more recent bootloader revisions.
(I assume that the blank-flash packages out there did actually work at some time in the past).
 

giri.shiva

Member
Jun 19, 2015
27
5
I've compiled a new blank-flash package in case anyone would like to try it out (see update in 1st post).
However, I doubt it will work better than the other files. If it keeps on failing with:

then there's still something wrong with the communication between qboot and the programmer file. I.e. we would need a programmer file that works with more recent bootloader revisions.
(I assume that the blank-flash packages out there did actually work at some time in the past).


Where is the Download link ??
 

giri.shiva

Member
Jun 19, 2015
27
5
People who can't read aren't supposed to download, sorry. It's too dangerous, they could flash something without knowing what it does.

Ok, I'll give you a hint: search for update and 1st post ;)
Edit: no, not in the thread. Only in your quote.


I tried those already
I thought you had updated another blankflash file
No offense
 

lozada81

Senior Member
Nov 18, 2015
82
28
40
Ciudad de México
Redmi Note 10
I've compiled a new blank-flash package in case anyone would like to try it out (see update in 1st post).
However, I doubt it will work better than the other files. If it keeps on failing with:
Code:
FAILED: qb_flash_singleimage()->sahara_download()->IO error
then there's still something wrong with the communication between qboot and the programmer file. I.e. we would need a programmer file that works with more recent bootloader revisions.
(I assume that the blank-flash packages out there did actually work at some time in the past).


in this pic, we see error do package, do recipe, do configure, buffer read , this with two firmware of lenovo.ru
https://www.mediafire.com/?eichzw02lsc9kyd

Master, firmware contain blankflash in mbm folder and work programmer until package error or work more that Previous

firmware Oficial XT1635-02_7.0_NPN25.137-24-1 - i n mbm folder blankflash file
https://cloud.mail.ru/public/HoLU/D1tHfMFQY


this two firmware contain blankflash in mbm folder and work programmer until package
firmware Oficial XT1635-02_7.0_NPN25.137-24-1
firmware XT1635-02_6.0.1_MPN24.104-44_47

http://lenovo-forums.ru/files/category/140-moto-z-play/
 

benzinerwin

Senior Member
May 1, 2008
50
54
Thanks for the links. Actually, the older package...
firmware XT1635-02_6.0.1_MPN24.104-44_47
...did contain an old (duh..!) blank-flash package but also wrapped up with a different programmer.mbn, that I didn't know of before. Maybe you give this a try. I've repacked a blank-flash with this programmer.mbn and the most recent bootloader files (see update in 1st post)...
 

lozada81

Senior Member
Nov 18, 2015
82
28
40
Ciudad de México
Redmi Note 10
Thanks for the links. Actually, the older package...

...did contain an old (duh..!) blank-flash package but also wrapped up with a different programmer.mbn, that I didn't know of before. Maybe you give this a try. I've repacked a blank-flash with this programmer.mbn and the most recent bootloader files (see update in 1st post)...



Very much to the cortrario, you are using your valuable time, your great knowledge and your ability to help us out of this huge bache called blankflash since update android 7.0 April update, unfortunately I leave my device at home and until late hours can test.
* But the other partners help them by testing and reporting their results to make it easier and faster the info required @benzinerwin
 

rampare99

Member
Jan 22, 2014
32
10
Córdoba
Thanks for the links. Actually, the older package...

...did contain an old (duh..!) blank-flash package but also wrapped up with a different programmer.mbn, that I didn't know of before. Maybe you give this a try. I've repacked a blank-flash with this programmer.mbn and the most recent bootloader files (see update in 1st post)...

Thanks for your amazing work, Unfortunately, this package doens't work either. I get ERROR: do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
 
  • Like
Reactions: lozada81

angeldarkstorm

New member
Jun 10, 2017
3
2
Toluca
hanks for your support

Thanks for the links. Actually, the older package...

...did contain an old (duh..!) blank-flash package but also wrapped up with a different programmer.mbn, that I didn't know of before. Maybe you give this a try. I've repacked a blank-flash with this programmer.mbn and the most recent bootloader files (see update in 1st post)...

First of all I thank you for the help provided as well as your time, I commented that I have the 2 files that I uploaded today and in both I get the following

FAILED: qb_flash_singleimage()->do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
 
  • Like
Reactions: lozada81

Top Liked Posts

  • There are no posts matching your filters.
  • 17
    work in progress! (not working yet)
    Current status: does not work (but should!), exact reason unknown (to me).
    If you managed to "brick" your MOTO Z Play it enters a fail-safe mode as a last resort provided by the chipset manufacturer (Qualcomm). There are packages out there called "blank-flash" that use this mode to restore a proper bootloader that in turn re-enables the use of the fastboot method to write the other flash files and restore full operation - provided the personalized partitions are still present and in good health (or you have a backup of them at hand).

    Look at this thread and download the Nougat file. It contains "blank-flash" files. These "should work" but they don't (any more). As I don't have a Z Play, I cannot research the matter myself and instructing helpful others via email exchange is ... complicated.

    The thing with failing updates/flash packages is that they usually fail because they do not allow downgrading - even if they allow downgrading of some sort (e.g. OS), they may limit downgrading the second stage bootloader, the signed GPT (partitioning table) etc. As I don't know if and what's the case with the Z Play, I just assumed that *if* it works, it may require the most recent files.

    If you run the blank-flash files (qboot) with --debug=2 option you see that after the programmer code is sent to the phone it doesn't send a valid / expected response and ultimately causes the process to fail.

    There are many programmer files out there. Most do not work, because they need to be digitally signed with the proper keys. Some are signed with Quallcomm-keys, some with Lenovo-, Motorola- and other with test-keys. And then again, they have to fit with the qboot program that's sending the data to be flashed.

    A blankflash archive consists of the following files:
    • qboot, blank-flash.sh ; Linux
    • qboot.exe, qboot.dll, blank-flash.bat ; Windows
    • singleimage.bin ; Both
    There are different versions of the qboot program. I've found the versions 2.4, 3.37 and 3.40.
    The file "singleimage.bin" contains the flash files and directions crammed into a single file, thus the name:
    1. cmnlib.mbn
    2. cmnlib64.mbn
    3. devcfg.mbn
    4. emmc_appsboot.mbn
    5. gpt_main0.bin
    6. index.xml
    7. keymaster.mbn
    8. programmer.mbn
    9. prov.mbn
    10. rpm.mbn
    11. sbl1.mbn
    12. singleimage.default.xml
    13. singleimage.pkg.xml
    14. tz.mbn
    The XML files contain the instructions (the 'recipe'):
    index.xml:

    Code:
    <?xml version="1.0"?>
    <index>
      <board id="70" name="MSM8953" storage.type="eMMC"/>
      <package compatible="cpu.name:MSM8953 protocol:qboot" filename="singleimage.pkg.xml"/>
    </index>

    singleimage.pkg.xml:

    Code:
    <?xml version="1.0"?>
    <package>
      <programmer filename="programmer.mbn"/>
      <recipe filename="singleimage.default.xml"/> 
    </package>

    singleimage.default.xml:

    Code:
    <?xml version="1.0" ?> 
    <recipe>
      <configure MemoryName="eMMC"/>
    
      <!-- Flash GPT -->
      <print what="Flashing GPT..."/>
      <flash partition="partition:0" filename="gpt_main0.bin" verbose="true"/>
    
      <print what="Re-initializing storage..."/>
      <storage operation="reinit"/>
    
      <!-- Flash bootloader -->
      <print what="Flashing bootloader..."/>
      <flash partition="aboot"     verbose="true" filename="emmc_appsboot.mbn"/>
      <flash partition="rpm"       verbose="true" filename="rpm.mbn"/>
      <flash partition="tz"        verbose="true" filename="tz.mbn"/>
      <flash partition="devcfg"    verbose="true" filename="devcfg.mbn"/>
      <flash partition="cmnlib"    verbose="true" filename="cmnlib.mbn"/>
      <flash partition="cmnlib64"  verbose="true" filename="cmnlib64.mbn"/>
      <flash partition="keymaster" verbose="true" filename="keymaster.mbn"/>
      <flash partition="prov"      verbose="true" filename="prov.mbn"/>
      <flash partition="sbl1"      verbose="true" filename="sbl1.mbn"/>
    </recipe>


    These files usually do not need to be modified.
    programmer.mbn is the flash application that is sent to the phone.

    I've compiled the following package, including all the qboot executables:
    http://frickelbude.net/moto/blankflash[addison][D61DC5C7][25.211.10][1.07][2017-04-13].zip
    D61DC5C7: crc32-checksum of programmer.mbn file (original, motorola signed) (find others here)
    25.211.10: firmare package origin of the bootloader files
    1.07: bootloader version
    2017-04-13: time stamp of bootloader file

    This didn't work with recently bricked Z Play phones as some testers confirmed. We also tried all the different programmer executables linked above just to be sure but no luck.

    Outlook: you may want to try out Qualcomms QFIL (part of QPST package) (look e.g. at the download section of androidbrick).
    However, that requires some handywork - you need to build some XML files, provide the proper programmer file etc. Maybe grab a firmware package e.g. for a Xiaomi phone that has all these files and try and deduce a proper layout for your Z play... and hope, any of the programmer files will actually run and communicate with the pc end.

    (Usually the blank-flash files operate in 'sahara' mode/protocol and send the programmer.mbn to the phone. Then it waits for a positive response from the phone to enter 'firehose' mode in order to send all the flash data...)

    /update 2017-06-10 a
    I've created a blank-flash package based on the files @lozada81 linked below:
    bootloader files extracted from: OTA tester Android 7.1.1 BRASIL patch june - Blur_Version.26.1.22.addison.retail.en.US.zip
    blank-flash package: http://frickelbude.net/moto/blankflash[addison][D61DC5C7][26.1.22][C1.12][2017-05-22].zip
    (Bootloader version: C1.12, GPT layout version: 0x000A)

    /update 2017-06-10 b
    Same package as above, but with a different programmer.mbn, taken from an older blank-flash package that came with an Android 6.0.1 package @lozada81 linked below.
    http://frickelbude.net/moto/blankflash[addison][C0A0D740][26.1.22][C1.12][2017-05-22].zip
    Well, it either fails with the infamous io-error or it finally works.. please test & report back!
    13
    Yeah, for those in need of a recap:

    1) Connect the bricked phone to your PC and use this blankflash: http://cloud.vache-android.com/Moto/albus/blankflash/
    2) Once you boot to the bootloader, flash these files: https://drive.google.com/file/d/0B7X6bQHmiX_BY29Damx5ejEyX1U/view
    Code:
    fastboot flash partition gpt.bin
    fastboot flash bootloader bootloader.img
    fastboot reboot-bootloader
    3) Flash 7.0 ROM like you normally would, but WITHOUT replacing the files flashed previously.
    4) Profit

    If you wanna use stock, don´t update it or it will brick again (we need to wait for a new release to be able to fix that).
    My recommendation: use Lineage and forget about it bricking ever again.
    4
    ArykTech They have sent me this message:

    Quick Update: Moto Z Play XT1635-02 (to be precise) unbrick files are ready but the device is not currently available at hand to make a live video tutorial or graphical illustrations with. However, I will be using a similar device to make an illustrated tutorial which shall be published soon.

    Until then, I shall update you guys again.

    http://www.aryk.tech/

    In my country Mexico, the cost of changing the logic card that is the solution of the
    *Service centers is to send it to motorola USA and cost $ 200 dollars, with local repair technicians in Mexico City charging about $ 108 for a used logic card, so I find myself saving money to do it, I have saved a Total of $ 57 dollars so far and no smartphone, I have considered buying a credit, but I am still paying for this device that I damage, in case you can help us save our device, I will donate my savings to Moment without any problem and I know very well that I remain in debt, I thought to do the same with @benzinerwin but I think I abandoned the project.

    *They all mention that being a donation is the amount that is in our possibilities but I would like you to consider the local cost of your region for repair to make the donation in case anyone who helps us, save
    *Our device. I will follow you sharing everything that can help us save our device.
    3
    Thanks for the links. Actually, the older package...
    firmware XT1635-02_6.0.1_MPN24.104-44_47
    ...did contain an old (duh..!) blank-flash package but also wrapped up with a different programmer.mbn, that I didn't know of before. Maybe you give this a try. I've repacked a blank-flash with this programmer.mbn and the most recent bootloader files (see update in 1st post)...
    3
    OTA tester Android 7.1.1 BRASIL patch june - Blur_Version.26.1.22.addison.retail.en.US.zip
    https://drive.google.com/file/d/0B-9vIY9eZnVqY3BGM0NUdTdsclE/view

    I've compiled a new blank-flash package in case anyone would like to try it out (see update in 1st post).
    However, I doubt it will work better than the other files. If it keeps on failing with:
    Code:
    FAILED: qb_flash_singleimage()->sahara_download()->IO error
    then there's still something wrong with the communication between qboot and the programmer file. I.e. we would need a programmer file that works with more recent bootloader revisions.
    (I assume that the blank-flash packages out there did actually work at some time in the past).