[GUIDE] Unbrick or restore to OOS using only fastboot

[coomac]

This guide will only work up to OOS 11.

This guide is for users that can't or just don't want to download MsmDownloadTool. Linux users especially, since the tool is not available for linux. All you need is a recent version of android tools with a fastboot capable of executing fastboot reboot fastbootd.

To start, download the appropriate Oxygen OS zip for your device from the OP8T repo thread. Extracting the zip file should give you a file named
payload.bin.

Use payload dumper to extract payload.bin.
You can grab payload_dumper from here (Windows and macOS), here (linux), or here (github, any OS).
For the download link from github, make sure you're running python 3.6 or higher. Run payload dumper with:
python payload_dumper.py payload.bin

The image files will be extracted to a folder named output.

Before starting the flashing process, you can check your device memory type using the DevCheck app by flar2 or with the command adb shell getprop ro.boot.ddr_type. The adb command will return 0 for LPDDR4X chips and 1 for LPDDR5 chips. This is important to flash the right xbl img files. LPDDR4X is more common for OP8T, so no worries if you miss this step.

You can start flashing from the standard bootloader or fastbootd. The first three lines below will flash the stock recovery then reboot into fastbootd.

fastboot flash recovery recovery.img
fastboot flash boot boot.img
fastboot flash dtbo dtbo.img
fastboot reboot fastboot
fastboot flash --slot=all recovery recovery.img
fastboot flash --slot=all boot boot.img
fastboot flash --slot=all dtbo dtbo.img
fastboot flash --slot=all abl abl.img
fastboot flash --slot=all aop aop.img
fastboot flash --slot=all bluetooth bluetooth.img
fastboot flash --slot=all cmnlib64 cmnlib64.img
fastboot flash --slot=all cmnlib cmnlib.img
fastboot flash --slot=all devcfg devcfg.img
fastboot flash --slot=all dsp dsp.img
fastboot flash --slot=all featenabler featenabler.img
fastboot flash --slot=all hyp hyp.img
fastboot flash --slot=all imagefv imagefv.img
fastboot flash --slot=all keymaster keymaster.img
fastboot flash --slot=all logo logo.img
fastboot flash --slot=all mdm_oem_stanvbk mdm_oem_stanvbk.img
fastboot flash --slot=all modem modem.img
fastboot flash --slot=all multiimgoem multiimgoem.img
fastboot flash --slot=all qupfw qupfw.img
fastboot flash --slot=all spunvm spunvm.img
fastboot flash --slot=all storsec storsec.img
fastboot flash --slot=all tz tz.img
fastboot flash --slot=all uefisecapp uefisecapp.img

If your phone has the LPDDR4X memory chip (returned 0 with the adb shell command above), flash the images below:

fastboot flash --slot=all xbl_config xbl_config.img
fastboot flash --slot=all xbl xbl.img

LPDDR4X is the more common chip for OP8T, so if you forgot to check, you can flash this.

If your phone has the LPDDR5 chip (returned 1 with the adb shell command above), flash the images below:

fastboot flash --slot=all xbl_config xbl_config_lp5.img
fastboot flash --slot=all xbl xbl_lp5.img

This next section will clear the super partition (contains odm, system, system_ext, vendor and product). It's not absolutely necessary, so you can skip to the next step. Clearing the super partition will help avoid the following error, which can come up if you had manually flashed ROMs on both slots previously.

Resizing '<partition name>'              FAILED (remote: 'Not enough space to resize partition')
Example: Resizing 'product'                          FAILED (remote: 'Not enough space to resize partition')

If you've ever had this error or you just want to be sure that everything is cleared, check the spoiler.

Spoiler

Before deleting, you can check the names of the logical partitions on your phone using fastboot getvar all. Scroll up to the section that looks like this:

(bootloader) is-logical:odm_a:yes
(bootloader) is-logical:product_a:yes
(bootloader) is-logical:system_a:yes
(bootloader) is-logical:system_ext_a:yes
(bootloader) is-logical:vendor_a:yes

or

(bootloader) is-logical:odm_b:yes
(bootloader) is-logical:product_b:yes
(bootloader) is-logical:system_b:yes
(bootloader) is-logical:system_ext_b:yes
(bootloader) is-logical:vendor_b:yes

As @Matt85m pointed out, you may also have:

(bootloader) is-logical:odm:yes
(bootloader) is-logical:product:yes
(bootloader) is-logical:system:yes
(bootloader) is-logical:system_ext:yes
(bootloader) is-logical:vendor:yes

It is also possible to have logical partitions with the same names ending in -cow (system_a-cow, system_b-cow, system_ext_b-cow, vendor_a-cow, product_b-cow, etc).
These are created by various ROMs during an OTA. Shout out to @mslezak for the discovery.

Delete everything with the commands below:

fastboot delete-logical-partition odm
fastboot delete-logical-partition system
fastboot delete-logical-partition system_ext
fastboot delete-logical-partition product
fastboot delete-logical-partition vendor

fastboot delete-logical-partition odm_a
fastboot delete-logical-partition odm_b
fastboot delete-logical-partition system_a
fastboot delete-logical-partition system_b
fastboot delete-logical-partition system_ext_a
fastboot delete-logical-partition system_ext_b
fastboot delete-logical-partition product_a
fastboot delete-logical-partition product_b
fastboot delete-logical-partition vendor_a
fastboot delete-logical-partition vendor_b

Delete any -cow partitions with the same command:

fastboot delete-logical-partition system_a-cow

and so on.

If you get an error deleting the -cow partitions, @firegate22 suggests changing slots from the bootloader (fastboot --set-active=a or b) not from fastbootd, then return to fastbootd and try the delete command again.

All logical partitions can be deleted to free up space in the super partition.

Recreate partitions a and b with the commands below.

fastboot create-logical-partition odm_a 100000
fastboot create-logical-partition odm_b 100000
fastboot create-logical-partition system_a 100000
fastboot create-logical-partition system_b 100000
fastboot create-logical-partition system_ext_a 100000
fastboot create-logical-partition system_ext_b 100000
fastboot create-logical-partition product_a 100000
fastboot create-logical-partition product_b 100000
fastboot create-logical-partition vendor_a 100000
fastboot create-logical-partition vendor_b 100000

Flash the rest of the images.

fastboot flash odm odm.img
fastboot flash system system.img
fastboot flash system_ext system_ext.img
fastboot flash product product.img
fastboot flash vendor vendor.img
fastboot flash --slot=all vbmeta vbmeta.img
fastboot flash --slot=all vbmeta_system vbmeta_system.img

Assuming everything flashes with no errors, return to recovery, do a factory reset and reboot.

 

[BillGoss]

I like what you're proposing. I've been thinking along these lines also.
Would you mind explaining why you're flashing to both slots rather than just the inactive one?
If you leave the current slot untouched you have a fallback position (the whole point of having A/B partitioning).

The same question applies to the flashing/deleting of the dynamic partitions in super.

 

[coomac]

I like what you're proposing. I've been thinking along these lines also.
Would you mind explaining why you're flashing to both slots rather than just the inactive one?
If you leave the current slot untouched you have a fallback position (the whole point of having A/B partitioning).

The same question applies to the flashing/deleting of the dynamic partitions in super.

For this guide specifically, the idea is to return as close to stock as possible. Wiping everything and replacing with OOS would be the best way to do that.

More generally, other than boot.img and recovery.img, the images flashed on both slots in the first part are the firmware files. You can grab and flash them from pretty much any new OOS version to update the firmware without affecting the installed ROMs. The specific files for the ROM are all in the third part. If you extract the payload.bin for any custom ROM, those are usually the only image files included.

You can certainly run two different firmware versions on the two slots, but if the inactive slots are empty or contain much older firmware, you can end up with weird issues in the active slots (usually a boot loop but could be more or less serious). Keeping the versions close is just to avoid unnecessary issues.

Some custom ROMs for OP8T like Lineage recommend or insist on flashing the copy-partitions.zip package for this reason. It's also why the install instructions for older A/B phones that have TWRP generally begin with "flash the stock ROM on both slots" - only the firmware files are strictly necessary, so you can keep the fallback ROM on the other slot if you want to.

That ended up much longer than planned. Hope it answers your questions though!

 

[nero075]

I'm going through this process rn, and I figured I'd ask here. How long does it usually take to flash dsp? It's been over 20 minutes of Sending 'dsp_a' (65536 KB)

65 M looks pretty big, and that's maybe the max size? How long did it take for you?

edit: seems to be unrelated to size as the modem part went fine, and that's bigger

 

[NisseGurra]

No go, next step : fastboot reboot fastboot enter QDLoader mode

 

[coomac]

I'm going through this process rn, and I figured I'd ask here. How long does it usually take to flash dsp? It's been over 20 minutes of Sending 'dsp_a' (65536 KB)

65 M looks pretty big, and that's maybe the max size? How long did it take for you?

edit: seems to be unrelated to size as the modem part went fine, and that's bigger

Did you figure this out? Flashing dsp should only take a couple seconds.

 

[nero075]

Did you figure this out? Flashing dsp should only take a couple seconds.

I ended up just skipping that one, and it turned out fine ¯\_(ツ)_/¯

 

[Deleted member 8498333]

Full time Linux user here, glad to see this guide after few days looking for a way to go back to stock without Msmtool.
However I do have some question, is it possible to have a OTA update from Oneplus if I go back to stock using this method and re-lock my bootloader?

 

[coomac]

Full time Linux user here, glad to see this guide after few days looking for a way to go back to stock without Msmtool.
However I do have some question, is it possible to have a OTA update from Oneplus if I go back to stock using this method and re-lock my bootloader?

Shouldn't be a problem. I was able to install an OTA update after returning to stock using this method with no issues even without relocking my bootloader.

 

[rdlr19]

thanks for this helped me alot to restore my device, i have one question though i checked all the commands and i see there might be one command missing, when i extracted the rom i checked all the img files and saw :
xbl_lp5.img
xbl_config_lp5.img

cant help wonder if i have to input the commands as well

 

[coomac]

thanks for this helped me alot to restore my device, i have one question though i checked all the commands and i see there might be one command missing, when i extracted the rom i checked all the img files and saw :
xbl_lp5.img
xbl_config_lp5.img

cant help wonder if i have to input the commands as well

Glad it helped. Those files depend on whether your device has a DDR type 0 (LPDDR4X) or DDR type 1 (LPDDR5) memory chip.

You can check your device memory type with adb shell getprop ro.boot.ddr_type. It will return 0 or 1. You can also use the DevCheck app by flar2.

I believe most OP8Ts use DDR0, which requires xbl_config.img and xbl.img. The lp5 images are for DDR1.
According to the lineage OS wiki, you'd flash the lp5 images with the same commands on DDR1:

fastboot flash --slot=all xbl_config xbl_config_lp5.img
fastboot flash --slot=all xbl xbl_lp5.img

 

[Matt85m]

I've tried to bring my KB2003 back to stock from LineageOS using this guide and when it comes to flashing the odm, product and vendor files I get the following errors

Sending 'odm' (34544 KB)                           OKAY [  0.849s]
Writing 'odm'                                      FAILED (remote: 'No such file or directory')
fastboot: error: Command failed


Invalid sparse file format at header magic
Resizing 'product_a'                               FAILED (remote: 'Not enough space to resize partition')
fastboot: error: Command failed
Invalid sparse file format at header magic
Resizing 'vendor_a'                                FAILED (remote: 'Not enough space to resize partition')
fastboot: error: Command failed

I've cleared the logical partitions. any ideas? Ignoring these errors and the device doesnt boot, just get a black screen

edit: if I do these product and vendor files first, system throws the error. Are the posted logical partition sizes correct?

 

[coomac]

I've tried to bring my KB2003 back to stock from LineageOS using this guide and when it comes to flashing the odm, product and vendor files I get the following errors

Sending 'odm' (34544 KB)                           OKAY [  0.849s]
Writing 'odm'                                      FAILED (remote: 'No such file or directory')
fastboot: error: Command failed


Invalid sparse file format at header magic
Resizing 'product_a'                               FAILED (remote: 'Not enough space to resize partition')
fastboot: error: Command failed
Invalid sparse file format at header magic
Resizing 'vendor_a'                                FAILED (remote: 'Not enough space to resize partition')
fastboot: error: Command failed

I've cleared the logical partitions. any ideas? Ignoring these errors and the device doesnt boot, just get a black screen

edit: if I do these product and vendor files first, system throws the error. Are the posted logical partition sizes correct?

You need to clear more space in the super partition. You can basically delete and recreate both slots a and b for system, system_ext, product, vendor, and probably even odm to get more space.

 

[Matt85m]

You need to clear more space in the super partition. You can basically delete and recreate both slots a and b for system, system_ext, product, vendor, and probably even odm to get more space.

is't that was the

fastboot delete-logical-partition

fastboot create-logical-partition

commands were about? I've followed that step as you laid out. I've now tried it by adding a line for deleting and recreating the odm partition and still no joy

 

[coomac]

is't that was the

fastboot delete-logical-partition

fastboot create-logical-partition

commands were about? I've followed that step as you laid out. I've now tried it by adding a line for deleting and recreating the odm partition and still no joy

Yeah, that's what they're for. Strange. Any other errors before the one for odm? Would be helpful if you can upload a screenshot of your terminal with all the commands.

Edit: One suggestion is to make sure you're in fastbootd, not fastboot. Also, the size for the new logical partitions is arbitrary - they get resized when being flashed.

 

[Matt85m]

Yeah, that's what they're for. Strange. Any other errors before the one for odm? Would be helpful if you can upload a screenshot of your terminal with all the commands.

Edit: One suggestion is to make sure you're in fastbootd, not fastboot. Also, the size for the new logical partitions is arbitrary - they get resized when being flashed.

it definitely is in fastbootd, I ran into that issue initially as the android-tools package shipped with Fedora was out of date, I dumped the newer tools from google into my /usr/bin.

Here is a dump of my last step by step attempt text file

 

[coomac]

OK, couple things you can try.
- Switch to slot a and try flashing again.
- If that doesn't work, flash the copy-partitions zip from the lineage wiki then try again.

Btw you can check the size of the super partition using fastboot getvar partition-size:super (you'll have to convert the hex value to decimal). It should be around 7.5 gb. Use fastboot getvar all to get the sizes of all the logical partitions. The total should be between ~3.3 and 4 gb after flashing or about 500 mb after you delete/recreate them.

 

[coomac]

it definitely is in fastbootd, I ran into that issue initially as the android-tools package shipped with Fedora was out of date, I dumped the newer tools from google into my /usr/bin.

Here is a dump of my last step by step attempt text file

Responded above.

 

[Matt85m]

Responded above.

worked it out looking at the entire list of partitions - I had 3 lots of each rom partion for example system_a, system_b and system, for all vendor product etc. purging the ones without the _a/b allowed the process to complete.

Might be a quirk of lineageOS installation process - you might want to make a note of it on the OP incase someone else runs into it

 

[coomac]

worked it out looking at the entire list of partitions - I had 3 lots of each rom partion for example system_a, system_b and system, for all vendor product etc. purging the ones without the _a/b allowed the process to complete.

Might be a quirk of lineageOS installation process - you might want to make a note of it on the OP incase someone else runs into it

Good to know. I'll update the OP.