[GUIDE] [XT1575] Return to stock and relock bootloader

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
*** This process can relock your bootloader if you chose, but it does NOT restore your warranty in any way, so don't ask ***

Be aware you do NOT have to lock the bootloader, have Status Code of 0, or have it show "Official" status to successfully accept and apply an OTA update, it will happily apply with an unlocked bootloader and unofficial software status, as long as you have a 100% pure stock ROM installed the update script doesn't care what the bootloader reports.

Preflash validation error? See notes at the bottom of this post.

Prerequisites:

1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image that is the same version or newer than what you have installed (see below for more info), for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)

XT1572 Factory Images: http://dl.prazaar.de/?dir=Android/XT1572/Factory courtesy of @Prazaar
XT1575 Factory Images: http://forum.xda-developers.com/moto-x-style/development/pure-firmware-tuff-wip-t3224833 - UPDATE: Direct link to XT1575 for 24.49-18-8 (Sept 1, 2016 security update) uploaded on 1/27/2017 courtesy of Motorola Firmware Team. The December 2016 security update image is NOT available as of yet!
Alternate firmware source for Pure and Style: https://firmware.center/firmware/Motorola/
XT1575 OTA ZIP file to go from 18-8 to 18-16 ONLY is available in this post for sideloading thanks to @annoyingduck
NOUGAT FIRMWARE (XT1575 ONLY): https://forum.xda-developers.com/moto-x-style/general/xt1575-moto-x-pure-edition-factory-t3704142

OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.

Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).

Code:
fastboot oem lock begin (see notes below if not wanting to lock)
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1 
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot erase customize
fastboot erase clogo
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.

This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay, Pokemon GO, and banking/financial apps.

Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.

If you are interested in returning to stock WITHOUT locking the bootloader, then follow the above commands, but the following commands in place of the "lock" commands in the list above:
fastboot oem fb_mode_set instead of fastboot oem lock begin
fastboot oem fb_mode_clear instead of fastboot oem lock

The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image. Note that different firmwares may contain a different number of system.img_sparsechunk.X files, you must flash the number you have in your firmware image in order. From what I have seen, most 5.1.1 firmwares have ten (0-9), 6.0 has nine (0-8), 6.0.1 has twelve (0-11), and 7.0 has ten (0-9) sparsechunks, but always verify with the XML flash file contained within the firmware archive to verify if you are in question.

If you lock with this process, you can unlock the bootloader again and even use the same unlock token... subsequent unlocking will wipe data as well. Doing this procedure will set OEM Locking option in Developer options to disabled, although it is perfectly safe to leave it like this, I suggest turning it on immediately since your warranty is gone and if something does go wrong you have the ability to unlock again to fix it.

NOTE: You must use a factory firmware image that is the same version as what you have installed or newer to successfully relock the bootloader, you cannot just grab the old (shipped) version from Moto's site. If you attempt to use a firmware image that is older than what you have installed currently, you will receive a Preflash Validation Error indicating such when you attempt to flash the partition table (gpt.bin). At this point you can either continue the flash and NOT lock the bootloader at the end, or stop until you can find the most current image. Moto used to be quite willing to hand these out when they were requested, so if you have a very new firmware installed you may not find one that you can use to relock with on the Internet. Part of the requirements to lock the bootloader is you must successfully flash the partition table (gpt.bin) in order to complete the lock process, if you can't then the bootloader lock process cannot be finished.

Also, some users have noted that after completing this process the software status does NOT go back to "Official", if it does not, upon accepting the OTA it should go back to official after the OTA is successful. The Status Code will always show 2 (relocked) or 3 (unlocked), and it can never go back to 0 (locked).

A proper flash log is attached to this guide.

Just a blurb on Marshmallow software versions... To determine what you need look at version/build numbers, here is the Security update dates and release dates (actual, not tests) of all known public OTA releases of Marshmallow for the Moto X Pure (Style varies somewhat). The initial release was MPH24.49-18 (sometimes MPH24.49-18_18, we don't know why, but it is the SAME versions), and all others after that are MPHS24.49-XX-XX as shown below.

18 or 18_18 - The initial (shipped) Marshmallow release for Moto X Pure, November 2015 (release via OTA in late-December 2015, incorrectly dated on Moto's official website as 01-SEP-16 in the "official" recovery images section, it is NOT the newest or recommended image to use)
18-3 - February 2016 (released for OTA in mid-March 2016)
18-4 - May 2016 (released for OTA in late-June 2016)
18-8 - September 2016 (released for OTA in early-November 2016)
18-16 - December 2016 (release for OTA in mid-February 2017) *** Not available as a factory image***

Nougat:
NPH25.200-22 - September 2017 (released for OTA September~November 2017) Factory image available as of 11/12/2017
NPH25.200-23 - Little is know about this version, it appears to be slowing rolling out to Verizon users only as of mid-November 2017 (no firmware available as of yet)

To see what version your bootloader is now, go into fastboot and perform a "fastboot getvar ro.build.fingerprint" and look at the output, it should be pretty clear.

NOTE: I no longer own this device, but will help where I can and will keep this thread open to assist users where ever possible, but I no longer have a device to test/verify things with.
 

Attachments

Last edited:

donrojo

Senior Member
Oct 6, 2012
91
66
0
*** This will relock your bootloader, but it does NOT restore your warranty in any way, so don't ask ***

So with Nougat coming, several people have asked how to return to stock to get the update... well, I just did this so here is a quick guide.

Prerequisites:

1) Fastboot installed and working. I used Linux Mint 18, but the OS is not relevant. There are are various threads discussing how to get this working, I am not covering it.
2) You need a factory firmware image, for me with a Moto X Pure Edition (XT1575) and wanting the latest MPH24.49-18-4 firmware, I used the image from this thread and extracted it into it's own directory. In Windows it is best to place this in the same folder as fastboot (probably the platform-tools folder)

OPTIONAL: 2a) Because when doing this procedure when you are done the logo when booting will still say your bootloader is unlocked, we can fix this by downloading the logo from this thread and extracting the bin file to the same folder as above.

Now, open a terminal or command window into the directory that contains the firmware files you extracted above, on Linux or Mac this could be anywhere, in my example I will use /home/acejavelin/Downloads/MXPE/18-4 as the directory, in Windows this will likely be the same as where your fastboot binary or platform-tools directory is, and follow these commands entering them ONE AT A TIME, do not just copy and paste the entire section. If you are using Linux, I recommend executing "sudo su" prior to beginning to prevent permission errors (this is shown in my sample attachment).

Code:
fastboot oem lock begin
fastboot flash partition gpt.bin
fastboot reboot bootloader 
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1 
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot flash bluetooth BTFM.bin
fastboot erase cache
fastboot erase userdata
fastboot oem lock
fastboot reboot
Note that in place of "fastboot flash logo logo.bin" you can substitute "fastboot flash logo XT1575-logo-new-9-14-15.bin" and it will work and validate at the end, and you will NOT get the bootloader unlocked screen any longer... I tested this and verified it to work.

This will return your bootloader status to LOCKED, although STATUS will still show 2, and your software status to OFFICIAL... It will pass SafetyNet for Android Pay and Pokemon GO as well.

Remember that you will get checked for FRP even with this procedure, so either remove your Google account prior to this or know your credentials. This procedure will not bypass Factory Reset Protection in any way.

The procedure for other XT157x device like the Style would be identical, except substitute your appropriate factory image.

A proper flash log is attached to this guide.
So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
So, flash command for partition gpt.bin does work? I've never been able to lock bootloader due to failure to execute this command. But, I've always thought of downgrading, rather than flashing the same stock build!
Yes, of course it does... You can clearly see in the log I attached from my flashing the device.

The key is you cannot downgrade to a lower gpt.bin, you can only flash the same or newer version of firmware. After having several Moto devices, I can attest that downgrading successfully while locking is almost impossible. I will update my guide to make it clearer.

And please do not quote the entire first post and embed your comments in it, on mobile I had a very difficult time trying to determine what you were asking. EDIT: Sorry, your previous post looked very different in the XDA app, looks fine on computer... weird.
 
Last edited:

Mejilan

Senior Member
Oct 16, 2010
314
119
0
Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
What is the purpose of relocking your bootloader? The unlocked bootloader has never interfered with me taking an OTA.
You are correct, and this as nothing to do with accepting OTA (that is just how this discussion came up), but the lock/unlock state of the bootloader has two distinct issues I can think of although there maybe more I am forgetting.

1. Security - If your bootloader is unlocked, anyone who gets access to your device can just fire up fastboot and boot TWRP and access any information on your device, even if it is encrypted since TWRP can read the encryption password.

2. SafetyNet API - Do to recent changes by Google, SafetyNet API checks to fail just because the bootloader is unlocked, even if everything else is perfectly stock... SafetyNet is a mandatory part of Play Services that auto-updates itself regardless of your settings, and it is used to see if your device has been modified (rooted) or tampered with in anyway, and applications can use SafetyNet to check the status of your device... Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting. UPDATE: This only seems to be enforced on devices that shipped with Nougat or newer, and does seem to effect any device upgraded to Nougat so far. Lollipop and Marshmallow devices are not effected.
 
Last edited:

quakeaz

Senior Member
May 28, 2013
540
213
73
Yavapai County
play.google.com
Sounds harmless enough, but for example this means that even an unlocked bootloader will make it so you can't use Android Pay or many other financial apps or even play Pokemon Go. Until recently, SafetyNet could be fooled with apps like RootCloak or Suhide, but Google has updated it to detect these things and look far beyond simple rooting.
Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).

If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.

Also, just an observation, I assume once we do get the Nougat (or any other) OTA, the unlocked bootloader warning screen will return, since the unlocked flag has already been tripped and the OTA will write a new logo.bin.

---------- Post added at 08:25 AM ---------- Previous post was at 08:20 AM ----------

Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
You're fine to downgrade to the latest stock firmware you were running.
 
Last edited:
  • Like
Reactions: Mejilan

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Interesting, I've used Android Pay with my bootloader unlocked on the MXPE (otherwise stock, no root).

If you decide to unlock the bootloader again, I assume the original code supplied by Motorola is required? I've never relocked/unlocked.
Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.

Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something, but it will still be the same code.
 
Last edited:

quakeaz

Senior Member
May 28, 2013
540
213
73
Yavapai County
play.google.com
Have you used Android Pay since October 16-18, such as to add a payment method/card? Because that is when Google made the changes to the SafetyNet API, and has committed to aggressively maintaining it to detect and report all "tamper" situations.

Yes, the original code works... Tested it myself, locked, unlocked, and locked again, works perfectly, and if you wish you can request the code again from Motorola if you lost the email or something.
Thanks for confirming about the unlock/relock/unlock.

I just added a CC to check if it'd work. No issues here. Maybe it's only certain devices? Google Play Services 9.8.77.
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Thank you for this guide.
I have a question.
I'm currently on a relatively recent nightly of CM13, which I believe is based on 6.0.1.
I don't think the XT1575 ever got 6.0.1, only 6.0.
Is there a way around this issue other than waiting for 7.0 to hit officially?
The issue isn't the aftermarket firmware or it's version, it could be Android 29 Gamma for all we care... You need to use an official Moto firmware that is at least the same version or newer than your bootloader and partition table (gpt.bin), if you are not a stock firmware you will need to do some investigating via the baseband version what actual version you have (unless you can remember the last official firmware version).

Safest bet is just use the current release, if you can't find it online you can always request it from Moto service but this may take several days (weeks in some areas I have heard). Be aware that the firmware posted on Moto's official is NOT the most current and is likely a downgrade if you have ever accepted an OTA since the device was released.
 
  • Like
Reactions: Mejilan

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Thanks for confirming about the unlock/relock/unlock.

I just added a CC to check if it'd work. No issues here. Maybe it's only certain devices? Google Play Services 9.8.77.
All I know is it didn't work for me on BrokenOS anymore, neither did Pokemon Go (not that big deal though), so I figured go all in...

There are multiple articles on this online, here are just a few...

http://www.xda-developers.com/android-safetynet-now-reportedly-tripped-by-unlocked-bootloaders/
http://www.androidpolice.com/2016/1...unlocked-android-phones-android-pay-affected/
http://www.androidcentral.com/andro...u-unlock-your-bootloader-and-thats-good-thing
 

Mejilan

Senior Member
Oct 16, 2010
314
119
0
The issue isn't the aftermarket firmware or it's version, it could be Android 29 Gamma for all we care... You need to use an official Moto firmware that is at least the same version or newer than your bootloader and partition table (gpt.bin), if you are not a stock firmware you will need to do some investigating via the baseband version what actual version you have (unless you can remember the last official firmware version).

Safest bet is just use the current release, if you can't find it online you can always request it from Moto service but this may take several days (weeks in some areas I have heard). Be aware that the firmware posted on Moto's official is NOT the most current and is likely a downgrade if you have ever accepted an OTA since the device was released.
Understood, thank you.
I haven't been on stock since the first half of the year.
I honestly don't remember if my last stock build was 5.1.1 or 6.0, but regardless, I should be good to go if I just download the newest stock and attempt your tutorial.
Again, many thanks.
 

quakeaz

Senior Member
May 28, 2013
540
213
73
Yavapai County
play.google.com
Does the relocking procedure wipe userdata like unlocking does? I am considering relocking as most of the Android Pay issues with unlocked bootloader seem to be with N. I'm already running stock so I was thinking I could just begin lock process, reflash same stock images, complete lock, skipping the erase userdata command.
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Does the relocking procedure wipe userdata like unlocking does? I am considering relocking as most of the Android Pay issues with unlocked bootloader seem to be with N. I'm already running stock so I was thinking I could just begin lock process, reflash same stock images, complete lock, skipping the erase userdata command.
Probably, my assumption is you can't complete the process without erasing cache and userdata, as 'fastboot oem lock' will likely fail, but to be honest I did not test it. Basically to get it complete you must follow all steps of the flashing XML file in the firmware file.
 

quakeaz

Senior Member
May 28, 2013
540
213
73
Yavapai County
play.google.com
Probably, my assumption is you can't complete the process without erasing cache and userdata, as 'fastboot oem lock' will likely fail, but to be honest I did not test it. Basically to get it complete you must follow all steps of the flashing XML file in the firmware file.
Interesting. I may give it a shot, if I do I'll report back here. The erase userdata and cache commands are optional according to Motorola.com factory image download page instructions. I've done normal stock reflash without them.
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Interesting. I may give it a shot, if I do I'll report back here. The erase userdata and cache commands are optional according to Motorola.com factory image download page instructions. I've done normal stock reflash without them.
Good luck... Let me know how it goes, but I think that only works for developer models, on "normal" models you have to do oem lock begin before oem lock though, not the same process.
 

JIMMMEHHHH

Member
Jul 11, 2016
31
6
8
Can't seem to boot up

Hi, so I flashed using this guide, I'm using the XT1572 model in the UK and used the appropriate firmware etc, my issue is that after everything had finished and I rebooted, it was stuck booting for an hour, I know this phone can sometimes take a while to boot after a factory reset but I haven't experienced it this badly before, also, I flashed the moto splash screen image but the boot animation is still the one from AICP :/ any help would be appreciated guys
 

acejavelin

Recognized Contributor
Sep 3, 2009
6,835
3,318
253
Lincoln, ND
Hi, so I flashed using this guide, I'm using the XT1572 model in the UK and used the appropriate firmware etc, my issue is that after everything had finished and I rebooted, it was stuck booting for an hour, I know this phone can sometimes take a while to boot after a factory reset but I haven't experienced it this badly before, also, I flashed the moto splash screen image but the boot animation is still the one from AICP :/ any help would be appreciated guys
Your flash didn't take... Do you have a log of flash attempt from the terminal?

Also, sometimes the firmware has different numbers of system sparse chunks, it's not always 8, and sometimes it only has "system.img" as a single file, you have to flash what it shows in the XML file contained within the firmware archive.