I originally posted this info at -> http://mark.cdmaforums.com/MotoX-Downgrade.htm
But with the recent leak of the Brazil XT1058 Lollipop 5.02 and 5.1 "TEST" zips, and seeing people cross flash, errors from GPT.BIN when flashing, downgrading questions, etc. I figured I'd post it here, with some updates and additional info (that will eventually be added to the source page)...
NOTE: there are MANY threads on XDA Forums from users who have tried to downgrade and have bricked their phones. Many have not been able to recovery them!! This page attempts to give you an understanding of what to look for, and issues that can come from downgrading your phone!
There are discussions on downgrading the bootloader or ROM on the Moto X. This page intends to explain it, why you might would want to, and possible issues around it. And why you usually want to stay away from downgrading.
As of April 1, there are currently 4 Moto or Stock ROMs for the Verizon, T-Mobile and Sprint Moto X.
4.2.2 as Initially shipped on the X
4.2.2 w/camera update or 1st OTA
4.4 or 2nd OTA
4.4.2 or 3rd OTA
4.4.4 or 4th OTA
NOTE: There have been some LEAKED 5.02 and 5.1 soak tests for the Brazil XT1058 and "Retail" XT1053.
To know which one you have on your X, Go App Drawer -> Settings -> About... and take note of the number that SYSTEM VERSION starts with... For Verizon XT1060 they would be as follows... NOTE: For other carriers, the System Version numbers will be slightly different.
139.10.53 = Initial Shipping 4.2.2
139.15.1 = 4.2.2 w/camera update or 1st OTA
140.45.5 = 4.4 or 2nd OTA
164.55.2 = 4.4.2 or 3rd OTA
212.55.26 = 4.4.4 or 4th OTA
Bootloader Versions... (Note: check by Booting the X into Bootloader/Fastboot mode, and make note of the second line on the screen)
30.70 = original 4.2.2 that initially shipped on the 2013 X when the phone first came to market.
30.71 = 4.2.2 OTA with camera update
30.B2 = 4.4 or 2nd OTA
30.B4 = 4.4.2 or 3rd OTA
30.B7 = 4.4.4 or 4th OTA
30.BC = 5.02 (leaked Brazil 5.0.2 update) thanks @sorullo_xgrx Post #4
30.BD = 5.1 (leaked Brazil 5.1 update) thanks @s5610 Post #71
30.BE = 5.1 (2nd leaked Brazil 5.1 update - system 222.21.15.ghost_row.Brasil.en.BR ) thanks @s5610 Post #89 NOTE: this is the version of the final 5.1 now rolling out to some 2013 X's
FAQ's
1. Why is this important? Due to changes in parts (GPT.BIN and Motoboot.img to name a few) that are included with 4.4.2 and up, under certain circumstances when trying to downgrade (like from 4.4.2 to 4.4 or lower, or 4.4.4 to 4.4.2 or lower), you could either brick your phone, or set it up to brick in the future when you take an upgrade. So it is suggested you just stick with what is on your phone once you get on 4.4.2 or newer, and never attempt to downgrade.
With the 5.x leaks so far, GPT.BIN and Motoboot.img have been "upgraded" again. And all reports that you get the same error messages attempting to downgrade them too. Therefore its expected the same issues will apply with the 5.x roms. NOTE: we are seeing reports from those who tried the leaked 5.02 and 5.1 OTA's and have bricked while downgrading!!
2. Why are the Bootloader Versions listed above important to know? Some users have decided to do "tricks" to upgrade or downgrade without touching GPT.BIN and Motoboot.img. Or they have flashed a custom rom like CM11/CM12, so their system version no longer matches the stock moto roms, and they want to go back to stock.
Knowing your bootloader version is important to identify what ROM or SBF its safe to flash on your phone. For example, if your phone shows 30.B7, then do NOT attempt to flash anything but a 4.4.4 rom or newer.
3. Does every ROM/SBF with the same Android Version have the same GPT.BIN/MOTOBOOT.IMG versions? NO. We've seen SBF's of the same "Android Version" have different GPT.BIN versions (due to build level or software version of the SBF/ROM). And this will impact flashing them, so consider this a warning!!
4. Why would I want to downgrade my Rom or Bootloader? The older root and write protection disable processes for a Moto X with a locked bootloader (like ATT and Verizon) rely on taking advantage of vulnerabilities in the 4.2.2 w/Camera update rom version, or the 4.4 rom. These processes walk you through downgrading your ROM/Bootloader to 4.2.2 w/Camera update and following a set of steps to upgrade which will keep root and disable write protection. It is important to know this information about the different rom versions, and the issues already having 4.4.2 on your phone introduces, to prevent bricking your phone! NOTE: It was safe to downgrade from 4.4. to 4.2.2 w/Camera update when following the SlapMyMoto/MotoWpNoMo processes. But that was the only time it was safe!!!!
Another reason to want to downgrade is... You flashed a newer rom, leak or "soak", and don't like how its performing, and want to "roll back" to what you had before.
But again, the previous warnings apply any time you think about downgrading.. DON'T! Unless you are ok with bricking your phone.
5. Can I use SlapMyMoto/RockMyMoto/etc to root, and MotoWpNoMo to disable write protection on my locked bootloader X? If your X is still on 4.2.2 w/Camera update(1st OTA), or 4.4(2nd OTA), Yes you can. However, because the vulnerabilities that the Slap/Rock/Pwn and MotoWpNoMo processes use to root and disable write protection have been patched in 4.4.2, and the inability to downgrade them, you CAN NOT use those processes to root and disable write protection if you are on 4.4.2 or higher. Another issue is the risks of bricking your phone when you are on 4.4.2 (or higher) and try to downgrade.
6. So I'm on 4.4.2 or newer, and I have a locked bootloader, now what? There is no option to disable write protection on 4.4.2 and newer with a locked bootloader at this time. If you can't obtain a bootloader unlock code (from Moto or a 3rd party), then you can't disable write protection unless someone comes up with new exploits and processes for 4.4.2 for disabling write protection. JCASE has released PIE for Motorola Devices. While it roots 4.4.2, it does not disable write protection, so it is a "temporary" root, lost if you power the phone off/on. Because write protection is still enabled, you can't alter /system, /system/bin, etc., so some ROOT type apps will not work. If you want to make use of XPosed, there are some special considerations such as selecting a certain way to install, and only "soft reboot" and such. The Vulnerability used with the PIE exploit process is patched in 4.4.3 and above.
Update: JCASE has updated SunShine to be compatible with the Moto X and a few other devices. It unlocks the bootloader, disables write protection. It can be used on devices with 4.4.2, 4.4.3, and a few, but not many with 4.4.4. There is discussion -> HERE and HERE
Update2: There is a VERY RISKY method to root for Verizon and ATT 4.4.4 users that have a LOCKED bootloader. See -> Moto X Root AT&T/VZW [KXA21.12-L1.26] You are required to be on a particular firmware level, it does NOT disable write protection, it only roots. It is risky because it intentionally soft bricks the phone back to the Qualcomm HS-USB QDLoader mode.
7. Can I downgrade the firmware or bootloader on my phone after I unlock the bootloader? As for downgrading firmware, the same caveats and warnings apply whether your bootloader is locked or unlocked. Due to changes in the bootloader, GPT.BIN and other parts included with 4.4.2 and up, under certain circumstances when trying to downgrade from 4.4.2 to 4.4 or lower, you could either brick your phone, set it up to brick in the future when you take an upgrade, or have issues/problems with the phone if you can download without bricking. So it is suggested you just stick with what is on your phone once you get on 4.4.2. Besides, if you unlocked your bootloader you wont need to downgrade to gain root anymore.
For more info on why you can't even after you've unlocked your bootloader, please also read #16 below.
8. I understand Root, but what is this "Write Protection" you speak of? By default on the Moto X, write protection is enabled. When its enabled, any changes made to "protected" folders/files on the phone (like anything in /system or the like) will not survive power off/on. Its meant to ensure your phone does not get messed up. Consider it a security measure. MotoWpNoMo was a way for users with locked bootloaders to disable write protection. Initially said to be permanent, the 4.4.2 update/rom patched the exploit used and so write protection gets turned back on once 4.4.2 is installed on the phone. NOTE: If you have a phone with an unlockable bootloader, the process of unlocking the bootloader and rooting disables write protection, and MotoWpNoMo is not needed.
9. Ok, so can I flash the rom/SBF meant for another carrier and model onto my Moto X? (also know as "cross flashing") Technically, with an unlocked bootloader, Yes so long as the GPT.BIN/Motoboot.img version in the SBF you are trying to flash is equal or greater than what is on your phone. However, that doesn't mean your phone will boot and completely work. So it is not recommended.
10. Will it work if I flash my XT10xx with the SBF meant for an XT10yy? In some cases, yes. Again, one big condition is the GPT.BIN/MotoBoot.img versions. But in some cases, even if the flashing completes properly, the Radio files may be incompatible causing the loss of cellular, or even Wifi. And other cases, the phone wont boot past bootloader. So it is not recommended.
11. Can I mix and match parts of various SBF files and flash them to my phone? Like use the System.img from one with the modem files from another? or GPT.BIN/Motoboot.img from one ROM/SBF with parts from another SBF In some cases, you may be able to flash successfully, and even run the phone. But we've seen issues with version mismatches of some features/functions not working, and we've seen OTA's brick the phone. So it is not recommended.
12. If I flash my XT10xx with the SBF meant for an XT10yy, can I return to the SBF meant for my carrier/model? Only IF the GPT.BIN/Motoboot.img version in the SBF you are trying to flash is equal or greater than what is on your phone. So if you have say a European XT1052, flash it with the Brazilian XT1058 4.4.4 SBF, then take the leaked BR XT1058 5.0.2 Soak and run into troubles, you're likely going to have to WAIT until a 5.0.2 SBF for your model and carrier leaks, and HOPE it has the same or newer GPT.BIN/Motoboot.img as the soak you tried, or you'll be stuck. Oh, and as with all LEAKS, we don't know when or even *IF* the SBF files will come. Now, if we leave Lollipop out of this, and say... I have a European XT1052 on 4.4.4, can I flash it with the Brazilian XT1058 4.4.4 SBF? And can I later flash back to the European XT1052 4.4.4 SBF? Again, it depends on the GPT.BIN/Motoboot.img versions of each. Any change in these files between the roms will cause a big problem and potentially brick your phone.
13. Ok, this is great, but "SOMEONE" said its safe to flash skipping GPT.BIN and stuff.. Fine, believe them instead of me. Its your phone. But there have been enough threads of people who have tried and have bricked when the GPT.BIN and/or MOTOBOOT.IMG are not consistent with the ROM/SBF being used. And we have also seen cases where some are "successful" flashing without bricking now, but some features don't work, and/or they brick later.
Also the Moderators have closed and deleted threads advising downgrading and flashing like this as being "safe" without providing any warnings!
NOTE: At the bottom of this post I've added some examples of threads started by people bricking their phones when they ignored the warnings...
14. KidJoe/Mark_Venture, aren't you just being paranoid? Maybe, but I don't want to see anyone ruin their phone. And I'm usually someone who has helped many try to recover from bricking their phone in the past. With the amount of people now throwing caution to the wind, trying to flash the Brazilian XT1058 4.4.4 on their NON-Brazilian X just to take this SOAK TEST, I wont have time to help them if they mess up their phone.
15. Does the Brazil XT1058 5.02 Soak ZIP file contain updated GPT.BIN or Motoboot.img? Moto has updated GPT.BIN at least parts of the contents of MOTOBOOT.IMG in 4.4.2, 4.4.3 and 4.4.4 updates so far. The BR XT1058 5.02 Soak zip does include GPT.BIN and TZ.MBM (TZ.MBM is part of motoboot.img). So while I haven't had time to confirm they are newer, it should be expected they are newer.
Confirmed: The Brazil XT1058 TEST 5.0.2 zip that leaked does contain bootloader 30.BC which is newer than found in 4.4.4.
Confirmed: The Brazil XT1058 TEST 5.1 update ZIP that leaked does contain bootloader 30.BD, which is newer that what is included in the 5.02.
16. I'm new to moto, I came from HTC where we could flash/upgrade/downgrade whatever we wanted, and didn't have issues. The biggest mistake people make is equating one phone to another. There are many who came from HTC devices where they could get S-OFF & Unlock the bootloader, to the X where they could just unlock the bootloader. They couldn't understand why they couldn't just upgrade/downgrade all components at will like they could on past phones.
I get it, I had the HTC Incredible and HTC Thunderbolts as my main phones for a long while. I had them S-off, I could completely downgrade, with no ill effects, if I didn't like the latest updates. Moto is definitely different.
Short answer, unlocking the bootloader on the X does not grant S-OFF, so many of the phone's security checks are in place. (for more see the 2nd FAQ at -> http://theroot.ninja/faq.html ). In the case of GPT.BIN/Motoboot.img, its not a security bug. Its a security feature to prevent them being downgraded. If you search on GPT.Bin you will see its basically the partition table for the phone. Motoboot.img includes the bootloader, trusted zone, and a few other things. So GPT.BIN and MOTOBOOT.IMG respect security on the phone.
Not to beat a dead horse but, unlocking the X bootloader doesn't get you S-OFF (like it can on HTC and other devices), so if you try to downgrade parts protected by the phone's security measures, they will fail, and in some cases brick the phone in doing so, or put your phone in a situation which will brick later. (it was a 100% certainty of getting a brick when downgrading from the first 4.2.2 OTA to the original shipping 4.2.2, now with 4.4.4 to 4.4.2 its a little less than 100% but still high enough chance to give warnings!! and in some cases the brick happens AFTER downgrading.)
17. What about flashing a CUSTOM or 3rd party rom? Does that matter? I use stock Moto roms, so I can only answer this by saying... My best understanding is that most custom or 3rd party roms, like CM11, CM12, or any ROM based on AOSP, only flash SYSTEM, and do not touch gpt.bin or the parts of motoboot.img. The only time this might not hold true are those Custom Roms which use a Stock Moto rom as a base. So just pay attention to what you flash. Before you flash, ask in the thread about that ROM if you are unsure!!
18. What about flashing a leaked SOAK or TEST version, then reverting to "stock"? All OTA's (including Official updates, SOAKS and BETA TESTS) have been incremental updates so far, have a pre-flash validation check to ensure your phone is on the correct level, and if your phone isn't, it wont flash. IF the update includes a newer GPT.BIN or any component of Motoboot.img, you will not be able to downgrade with out the risks already stated.
19. How does Moto get around the pre-flash validation check when pushing multiple test/soak versions? When you registered to the Motorola Feedback Network (MFN), they have record of your IMEI. When they INVITE YOU to a Test or Soak, they add your IMEI to the list if testers. This is how they control who gets the test file. They will also know what is on your phone, and will push updates that take into account what version should be on your phone.
So, for those invited, if Moto sends you more than ONE test update, the subsequent updates will have a pre-flash validation file looking for "the last version" they sent you. For example, if Moto sends tests of 5.02, then 5.1, then an updated 5.1, each of those three updates will look for the previous version. If the phone is running something else, the install will fail.
For the those NOT invited, as in the past Moto will likely compile and push a "Current STOCK" -> "FINAL Update" OTA zip for each carrier/model which will have a preflash check looking for the "Current Stock" version/build for the particular carrier/model. In the case of lollipop FINAL, it will be a 4.4.4 to 5.1 update for each carrier/model with specific carrier/model pre-flash checks. For carriers, like US Cellular, who stopped on 4.4.2, if they are getting Lollipop, they will get a 4.4.2 to 5.1 update with their own pre-flash validation check.
For those that manually applied any leaks, because they were NOT invited to the MFN test/soak, Moto will NOT have their IMEI to push a special version, so in the case of Lollipop they will be off stock 4.4.4, and any 5.1 push from the carrier/moto will fail to install due to the preflash check. They'll either need to revert to 4.4.4 (where GPT.BIN/Motoboot.img have been the cause of many bricks in the past when downgrading, so its expected to continue to be risky going forward), or must wait for a leak of the 5.1 SBF for their carrier/model.
That is why many suggested if you're not part of the MFN invites, you should wait on installing the leaks until/unless its know to be the absolute final release candidate that all will be getting eventually.
20. What is the difference between a TEST and a SOAK? Per the post about the MFN on Moto's web site, a SOAK "is a final review of new phone software before it goes out to everyone", however the MFN can also put Beta or "TEST DRIVE" which are "longer activities and the members may see multiple versions of the software, helping us get to the soak version." It is important to know this, because if you were not Invited by MFN to take part, and apply a leaked TEST DRIVE version, you will not be on the final, and you will be off the normal upgrade/update path. See FAQ #19 for more. This is the case with the Lollipop updates for Brazil, we've seen 5.02 and several 5.1 updates yet the general public hasn't received the final yet.
21. What are GPT.BIN and Motoboot.img? GPT.BIN is the partition table for the phone. It provides for the size and location of each "space" on the phone. When it comes to Motoboot.img, think of it as a "zip file" as it contians multiple parts/files. Motoboot.img contains the bootloader, Trusted ZONE, and a few other major parts which get updated when motoboot.img is flashed.
22. So are GPT.BIN and Motoboot.img the same in all roms of the same Android version? (Please also see Item #3 above). No. We've seen 4.4.4 roms that have had different GPT.BIN and Motoboot.img versions. And to expand on that further... I'm going to quote myself from Post #9 of this thread...
The Bootloader version (30.B7) is the same for ALL 4.4.4 roms, but GPT.BIN and motoboot.img appear to be different in some roms. Even with the same bootloader version, we've seen issues caused when flashing gpt.bin and motoboot.img that are not the same. Usually it varies when the build numbers vary.
For example: XT1058_OI-BR_4.4.4_KXA21.12-L1.29.1_2_cid12_CFC_1FF.xml vs XT1058_CLARO-BR_4.4.4_KXA21.12-L1.26_62_cid12_CFC_1FF.xml (I highlighted the build number).. because they are different build numbers, they could possibly have different GPT.BIn or Motoboot.img files, with the OI-BR having the newer. Meaning, if you try to flash the XT1058 Claro on the XT1058 phone running the OI-BR rom, it could fail due to GPT.BIN.
Where as XT1052_RETAIL-ASIA_4.4.4_KXA21.12-L1.26_18_cid7_CFC_1FF.xml has the same build as the Claro SBF, so chances are better the GPT.Bin/Motoboot will be the same.
Keep in mind, I haven't taken apart nor have I flashed every rom to prove exactly which are newer, older, etc. BUT I have taken part in rescuing phones where the owners have tried flashing and run into the issue, so I'm reasonably certain if the build numbers don't match, the GPT.BIN/Motoboot.img will be different.
No matter what though, it is Always risky to flash a ROM not meant for your phone's model and carrier.
23. Can I tell what version GPT.BIN or Motoboot.img are in a ROM file or on my phone? No. there is no visible version number for these files either on the phone or in the ROM files. Other than the first OTA (4.2.2.w/camera fix) and the recent Verizon maintenance release for 4.4.4, all updates have incremented the Android version number and Bootloader Version. So knowing the bootloader version and carrier rom you used, we can determine what build number you had on your phone to know if the next stock rom you want to flash is newer or not.
24. How can I prove the GPT.BIN and Motoboot.img are either the same or different between two roms? Well, one way is explained in item #22, different build numbers usually has meant different GPT.BIN/MotoBoot.img. Another way would be if you have the GPT.BIN and Motoboot.img files from each rom. You can do a good old "file compare" between the two. ( FC /B File1 File2 ). If differences are encountered, you know they are not the same.
So that is about it...
That covers enough of it.
Its your phone, you can do what you want, just please make an informed decision.
Please also see -> http://xdaforums.com/moto-x/general/unlocked-soak-test-invites-goind-moto-t3054502/post59524348
Good luck and happy flashing.
EDIT: And this is what we were trying to prevent with these types of warnings....
[Q] Am I screwed?
[Q] HELP ME: '(Lollipop Update Brick
Help with possible bricked device
Full Brick On My Moto X - Help Plz
Individual post in another thread -> http://xdaforums.com/showpost.php?p=60650177&postcount=432
[Q] Invalid CID MOTO X XT1058
[Q] [ Q&A ] Help me, blink my phone, moto x, when trying to install lollipop
But with the recent leak of the Brazil XT1058 Lollipop 5.02 and 5.1 "TEST" zips, and seeing people cross flash, errors from GPT.BIN when flashing, downgrading questions, etc. I figured I'd post it here, with some updates and additional info (that will eventually be added to the source page)...
NOTE: there are MANY threads on XDA Forums from users who have tried to downgrade and have bricked their phones. Many have not been able to recovery them!! This page attempts to give you an understanding of what to look for, and issues that can come from downgrading your phone!
Code:
Typical errors you will see if your phone has become "bricked" as a result of downgrading, or attempting to downgrade:
[B]downgraded security version
update gpt_main version failed[/B]
[B]Invalid CID[/B]
[b]Bootup Failed[/b]There are discussions on downgrading the bootloader or ROM on the Moto X. This page intends to explain it, why you might would want to, and possible issues around it. And why you usually want to stay away from downgrading.
As of April 1, there are currently 4 Moto or Stock ROMs for the Verizon, T-Mobile and Sprint Moto X.
4.2.2 as Initially shipped on the X
4.2.2 w/camera update or 1st OTA
4.4 or 2nd OTA
4.4.2 or 3rd OTA
4.4.4 or 4th OTA
NOTE: There have been some LEAKED 5.02 and 5.1 soak tests for the Brazil XT1058 and "Retail" XT1053.
To know which one you have on your X, Go App Drawer -> Settings -> About... and take note of the number that SYSTEM VERSION starts with... For Verizon XT1060 they would be as follows... NOTE: For other carriers, the System Version numbers will be slightly different.
139.10.53 = Initial Shipping 4.2.2
139.15.1 = 4.2.2 w/camera update or 1st OTA
140.45.5 = 4.4 or 2nd OTA
164.55.2 = 4.4.2 or 3rd OTA
212.55.26 = 4.4.4 or 4th OTA
Bootloader Versions... (Note: check by Booting the X into Bootloader/Fastboot mode, and make note of the second line on the screen)
30.70 = original 4.2.2 that initially shipped on the 2013 X when the phone first came to market.
30.71 = 4.2.2 OTA with camera update
30.B2 = 4.4 or 2nd OTA
30.B4 = 4.4.2 or 3rd OTA
30.B7 = 4.4.4 or 4th OTA
30.BC = 5.02 (leaked Brazil 5.0.2 update) thanks @sorullo_xgrx Post #4
30.BD = 5.1 (leaked Brazil 5.1 update) thanks @s5610 Post #71
30.BE = 5.1 (2nd leaked Brazil 5.1 update - system 222.21.15.ghost_row.Brasil.en.BR ) thanks @s5610 Post #89 NOTE: this is the version of the final 5.1 now rolling out to some 2013 X's
FAQ's
1. Why is this important? Due to changes in parts (GPT.BIN and Motoboot.img to name a few) that are included with 4.4.2 and up, under certain circumstances when trying to downgrade (like from 4.4.2 to 4.4 or lower, or 4.4.4 to 4.4.2 or lower), you could either brick your phone, or set it up to brick in the future when you take an upgrade. So it is suggested you just stick with what is on your phone once you get on 4.4.2 or newer, and never attempt to downgrade.
With the 5.x leaks so far, GPT.BIN and Motoboot.img have been "upgraded" again. And all reports that you get the same error messages attempting to downgrade them too. Therefore its expected the same issues will apply with the 5.x roms. NOTE: we are seeing reports from those who tried the leaked 5.02 and 5.1 OTA's and have bricked while downgrading!!
2. Why are the Bootloader Versions listed above important to know? Some users have decided to do "tricks" to upgrade or downgrade without touching GPT.BIN and Motoboot.img. Or they have flashed a custom rom like CM11/CM12, so their system version no longer matches the stock moto roms, and they want to go back to stock.
Knowing your bootloader version is important to identify what ROM or SBF its safe to flash on your phone. For example, if your phone shows 30.B7, then do NOT attempt to flash anything but a 4.4.4 rom or newer.
3. Does every ROM/SBF with the same Android Version have the same GPT.BIN/MOTOBOOT.IMG versions? NO. We've seen SBF's of the same "Android Version" have different GPT.BIN versions (due to build level or software version of the SBF/ROM). And this will impact flashing them, so consider this a warning!!
4. Why would I want to downgrade my Rom or Bootloader? The older root and write protection disable processes for a Moto X with a locked bootloader (like ATT and Verizon) rely on taking advantage of vulnerabilities in the 4.2.2 w/Camera update rom version, or the 4.4 rom. These processes walk you through downgrading your ROM/Bootloader to 4.2.2 w/Camera update and following a set of steps to upgrade which will keep root and disable write protection. It is important to know this information about the different rom versions, and the issues already having 4.4.2 on your phone introduces, to prevent bricking your phone! NOTE: It was safe to downgrade from 4.4. to 4.2.2 w/Camera update when following the SlapMyMoto/MotoWpNoMo processes. But that was the only time it was safe!!!!
Another reason to want to downgrade is... You flashed a newer rom, leak or "soak", and don't like how its performing, and want to "roll back" to what you had before.
But again, the previous warnings apply any time you think about downgrading.. DON'T! Unless you are ok with bricking your phone.
5. Can I use SlapMyMoto/RockMyMoto/etc to root, and MotoWpNoMo to disable write protection on my locked bootloader X? If your X is still on 4.2.2 w/Camera update(1st OTA), or 4.4(2nd OTA), Yes you can. However, because the vulnerabilities that the Slap/Rock/Pwn and MotoWpNoMo processes use to root and disable write protection have been patched in 4.4.2, and the inability to downgrade them, you CAN NOT use those processes to root and disable write protection if you are on 4.4.2 or higher. Another issue is the risks of bricking your phone when you are on 4.4.2 (or higher) and try to downgrade.
6. So I'm on 4.4.2 or newer, and I have a locked bootloader, now what? There is no option to disable write protection on 4.4.2 and newer with a locked bootloader at this time. If you can't obtain a bootloader unlock code (from Moto or a 3rd party), then you can't disable write protection unless someone comes up with new exploits and processes for 4.4.2 for disabling write protection. JCASE has released PIE for Motorola Devices. While it roots 4.4.2, it does not disable write protection, so it is a "temporary" root, lost if you power the phone off/on. Because write protection is still enabled, you can't alter /system, /system/bin, etc., so some ROOT type apps will not work. If you want to make use of XPosed, there are some special considerations such as selecting a certain way to install, and only "soft reboot" and such. The Vulnerability used with the PIE exploit process is patched in 4.4.3 and above.
Update: JCASE has updated SunShine to be compatible with the Moto X and a few other devices. It unlocks the bootloader, disables write protection. It can be used on devices with 4.4.2, 4.4.3, and a few, but not many with 4.4.4. There is discussion -> HERE and HERE
Update2: There is a VERY RISKY method to root for Verizon and ATT 4.4.4 users that have a LOCKED bootloader. See -> Moto X Root AT&T/VZW [KXA21.12-L1.26] You are required to be on a particular firmware level, it does NOT disable write protection, it only roots. It is risky because it intentionally soft bricks the phone back to the Qualcomm HS-USB QDLoader mode.
7. Can I downgrade the firmware or bootloader on my phone after I unlock the bootloader? As for downgrading firmware, the same caveats and warnings apply whether your bootloader is locked or unlocked. Due to changes in the bootloader, GPT.BIN and other parts included with 4.4.2 and up, under certain circumstances when trying to downgrade from 4.4.2 to 4.4 or lower, you could either brick your phone, set it up to brick in the future when you take an upgrade, or have issues/problems with the phone if you can download without bricking. So it is suggested you just stick with what is on your phone once you get on 4.4.2. Besides, if you unlocked your bootloader you wont need to downgrade to gain root anymore.
For more info on why you can't even after you've unlocked your bootloader, please also read #16 below.
8. I understand Root, but what is this "Write Protection" you speak of? By default on the Moto X, write protection is enabled. When its enabled, any changes made to "protected" folders/files on the phone (like anything in /system or the like) will not survive power off/on. Its meant to ensure your phone does not get messed up. Consider it a security measure. MotoWpNoMo was a way for users with locked bootloaders to disable write protection. Initially said to be permanent, the 4.4.2 update/rom patched the exploit used and so write protection gets turned back on once 4.4.2 is installed on the phone. NOTE: If you have a phone with an unlockable bootloader, the process of unlocking the bootloader and rooting disables write protection, and MotoWpNoMo is not needed.
9. Ok, so can I flash the rom/SBF meant for another carrier and model onto my Moto X? (also know as "cross flashing") Technically, with an unlocked bootloader, Yes so long as the GPT.BIN/Motoboot.img version in the SBF you are trying to flash is equal or greater than what is on your phone. However, that doesn't mean your phone will boot and completely work. So it is not recommended.
10. Will it work if I flash my XT10xx with the SBF meant for an XT10yy? In some cases, yes. Again, one big condition is the GPT.BIN/MotoBoot.img versions. But in some cases, even if the flashing completes properly, the Radio files may be incompatible causing the loss of cellular, or even Wifi. And other cases, the phone wont boot past bootloader. So it is not recommended.
11. Can I mix and match parts of various SBF files and flash them to my phone? Like use the System.img from one with the modem files from another? or GPT.BIN/Motoboot.img from one ROM/SBF with parts from another SBF In some cases, you may be able to flash successfully, and even run the phone. But we've seen issues with version mismatches of some features/functions not working, and we've seen OTA's brick the phone. So it is not recommended.
12. If I flash my XT10xx with the SBF meant for an XT10yy, can I return to the SBF meant for my carrier/model? Only IF the GPT.BIN/Motoboot.img version in the SBF you are trying to flash is equal or greater than what is on your phone. So if you have say a European XT1052, flash it with the Brazilian XT1058 4.4.4 SBF, then take the leaked BR XT1058 5.0.2 Soak and run into troubles, you're likely going to have to WAIT until a 5.0.2 SBF for your model and carrier leaks, and HOPE it has the same or newer GPT.BIN/Motoboot.img as the soak you tried, or you'll be stuck. Oh, and as with all LEAKS, we don't know when or even *IF* the SBF files will come. Now, if we leave Lollipop out of this, and say... I have a European XT1052 on 4.4.4, can I flash it with the Brazilian XT1058 4.4.4 SBF? And can I later flash back to the European XT1052 4.4.4 SBF? Again, it depends on the GPT.BIN/Motoboot.img versions of each. Any change in these files between the roms will cause a big problem and potentially brick your phone.
13. Ok, this is great, but "SOMEONE" said its safe to flash skipping GPT.BIN and stuff.. Fine, believe them instead of me. Its your phone. But there have been enough threads of people who have tried and have bricked when the GPT.BIN and/or MOTOBOOT.IMG are not consistent with the ROM/SBF being used. And we have also seen cases where some are "successful" flashing without bricking now, but some features don't work, and/or they brick later.
Also the Moderators have closed and deleted threads advising downgrading and flashing like this as being "safe" without providing any warnings!
NOTE: At the bottom of this post I've added some examples of threads started by people bricking their phones when they ignored the warnings...
14. KidJoe/Mark_Venture, aren't you just being paranoid? Maybe, but I don't want to see anyone ruin their phone. And I'm usually someone who has helped many try to recover from bricking their phone in the past. With the amount of people now throwing caution to the wind, trying to flash the Brazilian XT1058 4.4.4 on their NON-Brazilian X just to take this SOAK TEST, I wont have time to help them if they mess up their phone.
15. Does the Brazil XT1058 5.02 Soak ZIP file contain updated GPT.BIN or Motoboot.img? Moto has updated GPT.BIN at least parts of the contents of MOTOBOOT.IMG in 4.4.2, 4.4.3 and 4.4.4 updates so far. The BR XT1058 5.02 Soak zip does include GPT.BIN and TZ.MBM (TZ.MBM is part of motoboot.img). So while I haven't had time to confirm they are newer, it should be expected they are newer.
Confirmed: The Brazil XT1058 TEST 5.0.2 zip that leaked does contain bootloader 30.BC which is newer than found in 4.4.4.
Confirmed: The Brazil XT1058 TEST 5.1 update ZIP that leaked does contain bootloader 30.BD, which is newer that what is included in the 5.02.
16. I'm new to moto, I came from HTC where we could flash/upgrade/downgrade whatever we wanted, and didn't have issues. The biggest mistake people make is equating one phone to another. There are many who came from HTC devices where they could get S-OFF & Unlock the bootloader, to the X where they could just unlock the bootloader. They couldn't understand why they couldn't just upgrade/downgrade all components at will like they could on past phones.
I get it, I had the HTC Incredible and HTC Thunderbolts as my main phones for a long while. I had them S-off, I could completely downgrade, with no ill effects, if I didn't like the latest updates. Moto is definitely different.
Short answer, unlocking the bootloader on the X does not grant S-OFF, so many of the phone's security checks are in place. (for more see the 2nd FAQ at -> http://theroot.ninja/faq.html ). In the case of GPT.BIN/Motoboot.img, its not a security bug. Its a security feature to prevent them being downgraded. If you search on GPT.Bin you will see its basically the partition table for the phone. Motoboot.img includes the bootloader, trusted zone, and a few other things. So GPT.BIN and MOTOBOOT.IMG respect security on the phone.
Not to beat a dead horse but, unlocking the X bootloader doesn't get you S-OFF (like it can on HTC and other devices), so if you try to downgrade parts protected by the phone's security measures, they will fail, and in some cases brick the phone in doing so, or put your phone in a situation which will brick later. (it was a 100% certainty of getting a brick when downgrading from the first 4.2.2 OTA to the original shipping 4.2.2, now with 4.4.4 to 4.4.2 its a little less than 100% but still high enough chance to give warnings!! and in some cases the brick happens AFTER downgrading.)
17. What about flashing a CUSTOM or 3rd party rom? Does that matter? I use stock Moto roms, so I can only answer this by saying... My best understanding is that most custom or 3rd party roms, like CM11, CM12, or any ROM based on AOSP, only flash SYSTEM, and do not touch gpt.bin or the parts of motoboot.img. The only time this might not hold true are those Custom Roms which use a Stock Moto rom as a base. So just pay attention to what you flash. Before you flash, ask in the thread about that ROM if you are unsure!!
18. What about flashing a leaked SOAK or TEST version, then reverting to "stock"? All OTA's (including Official updates, SOAKS and BETA TESTS) have been incremental updates so far, have a pre-flash validation check to ensure your phone is on the correct level, and if your phone isn't, it wont flash. IF the update includes a newer GPT.BIN or any component of Motoboot.img, you will not be able to downgrade with out the risks already stated.
19. How does Moto get around the pre-flash validation check when pushing multiple test/soak versions? When you registered to the Motorola Feedback Network (MFN), they have record of your IMEI. When they INVITE YOU to a Test or Soak, they add your IMEI to the list if testers. This is how they control who gets the test file. They will also know what is on your phone, and will push updates that take into account what version should be on your phone.
So, for those invited, if Moto sends you more than ONE test update, the subsequent updates will have a pre-flash validation file looking for "the last version" they sent you. For example, if Moto sends tests of 5.02, then 5.1, then an updated 5.1, each of those three updates will look for the previous version. If the phone is running something else, the install will fail.
For the those NOT invited, as in the past Moto will likely compile and push a "Current STOCK" -> "FINAL Update" OTA zip for each carrier/model which will have a preflash check looking for the "Current Stock" version/build for the particular carrier/model. In the case of lollipop FINAL, it will be a 4.4.4 to 5.1 update for each carrier/model with specific carrier/model pre-flash checks. For carriers, like US Cellular, who stopped on 4.4.2, if they are getting Lollipop, they will get a 4.4.2 to 5.1 update with their own pre-flash validation check.
For those that manually applied any leaks, because they were NOT invited to the MFN test/soak, Moto will NOT have their IMEI to push a special version, so in the case of Lollipop they will be off stock 4.4.4, and any 5.1 push from the carrier/moto will fail to install due to the preflash check. They'll either need to revert to 4.4.4 (where GPT.BIN/Motoboot.img have been the cause of many bricks in the past when downgrading, so its expected to continue to be risky going forward), or must wait for a leak of the 5.1 SBF for their carrier/model.
That is why many suggested if you're not part of the MFN invites, you should wait on installing the leaks until/unless its know to be the absolute final release candidate that all will be getting eventually.
20. What is the difference between a TEST and a SOAK? Per the post about the MFN on Moto's web site, a SOAK "is a final review of new phone software before it goes out to everyone", however the MFN can also put Beta or "TEST DRIVE" which are "longer activities and the members may see multiple versions of the software, helping us get to the soak version." It is important to know this, because if you were not Invited by MFN to take part, and apply a leaked TEST DRIVE version, you will not be on the final, and you will be off the normal upgrade/update path. See FAQ #19 for more. This is the case with the Lollipop updates for Brazil, we've seen 5.02 and several 5.1 updates yet the general public hasn't received the final yet.
21. What are GPT.BIN and Motoboot.img? GPT.BIN is the partition table for the phone. It provides for the size and location of each "space" on the phone. When it comes to Motoboot.img, think of it as a "zip file" as it contians multiple parts/files. Motoboot.img contains the bootloader, Trusted ZONE, and a few other major parts which get updated when motoboot.img is flashed.
22. So are GPT.BIN and Motoboot.img the same in all roms of the same Android version? (Please also see Item #3 above). No. We've seen 4.4.4 roms that have had different GPT.BIN and Motoboot.img versions. And to expand on that further... I'm going to quote myself from Post #9 of this thread...
The Bootloader version (30.B7) is the same for ALL 4.4.4 roms, but GPT.BIN and motoboot.img appear to be different in some roms. Even with the same bootloader version, we've seen issues caused when flashing gpt.bin and motoboot.img that are not the same. Usually it varies when the build numbers vary.
For example: XT1058_OI-BR_4.4.4_KXA21.12-L1.29.1_2_cid12_CFC_1FF.xml vs XT1058_CLARO-BR_4.4.4_KXA21.12-L1.26_62_cid12_CFC_1FF.xml (I highlighted the build number).. because they are different build numbers, they could possibly have different GPT.BIn or Motoboot.img files, with the OI-BR having the newer. Meaning, if you try to flash the XT1058 Claro on the XT1058 phone running the OI-BR rom, it could fail due to GPT.BIN.
Where as XT1052_RETAIL-ASIA_4.4.4_KXA21.12-L1.26_18_cid7_CFC_1FF.xml has the same build as the Claro SBF, so chances are better the GPT.Bin/Motoboot will be the same.
Keep in mind, I haven't taken apart nor have I flashed every rom to prove exactly which are newer, older, etc. BUT I have taken part in rescuing phones where the owners have tried flashing and run into the issue, so I'm reasonably certain if the build numbers don't match, the GPT.BIN/Motoboot.img will be different.
No matter what though, it is Always risky to flash a ROM not meant for your phone's model and carrier.
23. Can I tell what version GPT.BIN or Motoboot.img are in a ROM file or on my phone? No. there is no visible version number for these files either on the phone or in the ROM files. Other than the first OTA (4.2.2.w/camera fix) and the recent Verizon maintenance release for 4.4.4, all updates have incremented the Android version number and Bootloader Version. So knowing the bootloader version and carrier rom you used, we can determine what build number you had on your phone to know if the next stock rom you want to flash is newer or not.
24. How can I prove the GPT.BIN and Motoboot.img are either the same or different between two roms? Well, one way is explained in item #22, different build numbers usually has meant different GPT.BIN/MotoBoot.img. Another way would be if you have the GPT.BIN and Motoboot.img files from each rom. You can do a good old "file compare" between the two. ( FC /B File1 File2 ). If differences are encountered, you know they are not the same.
So that is about it...
That covers enough of it.
Its your phone, you can do what you want, just please make an informed decision.
Please also see -> http://xdaforums.com/moto-x/general/unlocked-soak-test-invites-goind-moto-t3054502/post59524348
Good luck and happy flashing.
EDIT: And this is what we were trying to prevent with these types of warnings....
[Q] Am I screwed?
[Q] HELP ME: '(Lollipop Update Brick
Help with possible bricked device
Full Brick On My Moto X - Help Plz
Individual post in another thread -> http://xdaforums.com/showpost.php?p=60650177&postcount=432
[Q] Invalid CID MOTO X XT1058
[Q] [ Q&A ] Help me, blink my phone, moto x, when trying to install lollipop
Last edited:
