Moto G5s Plus stuck in boot loop - repair or data rescue

Search This thread

cheater00

Member
Jun 27, 2020
29
0
@sd_shadow sorry to bother you again, I was wondering if you had any idea on why LMSA might be saying my phone is incompatible?

fastboot.exe unable to find out the baseband, is that normal, or is this something unusual?

What should I do now - flash with the firmware file you suggested?

Thanks again
 

sd_shadow

Recognized Contributor / XDA Welcome Team
Sep 21, 2011
18,614
2
9,238
South Dakota
goo.gl
Motorola Droid X
Amazon Fire
@sd_shadow sorry to bother you again, I was wondering if you had any idea on why LMSA might be saying my phone is incompatible?

fastboot.exe unable to find out the baseband, is that normal, or is this something unusual?

What should I do now - flash with the firmware file you suggested?

Thanks again
Probably because LMSA cannot determine which baseband is needed.

It's not unusual for a device that will not boot.

I would try using RSD Lite.

Sent from my ali using XDA Labs
 

cheater00

Member
Jun 27, 2020
29
0
Probably because LMSA cannot determine which baseband is needed.

It's not unusual for a device that will not boot.

I would try using RSD Lite.

Sent from my ali using XDA Labs

@sd_shadow Thanks again. I tried RSD Lite but on my Win 10 PC it does not recognize my phone. It's just not listed in the lower half of the window. (update: see below) The drivers are installed correctly and the phone shows up in the Device Manager as "Motorola ADB Interface". I turned on the phone into Fastboot mode and connected it via USB directly to the motherboard's USB port. And RSD Lite is launched in Administrator mode. So there's no reason it shouldn't see the device. Is this how the incompatibility you mentioned earlier manifests itself, or is what I am experiencing due to some other issue? Is Fastboot mode the right way to set up the phone for use with RSD Lite? Or should I enter some other mode? Your guides mention entering a "flash mode", but there's no such thing on this G5S Plus.

Edit: I just got a call from a Motorola engineer in the UK who was trying to reproduce the issue. He said that the baseband on my phone corrupted itself and that for this reason both LMSA and RSD Lite will not work, as they require the baseband information as a sanity check. He mentioned that I would have to basically perform all the steps of servicefile.xml myself by hand using fastboot.exe. So I'm going to try to figure out how to do that now. I think I saw this in one of your guides, but it escapes me where.

Edit2: found how to flash with fastboot.exe here: How to Firmware Restore your Motorola Device on Windows 10 without RSDlite
 
Last edited:

cheater00

Member
Jun 27, 2020
29
0
Probably because LMSA cannot determine which baseband is needed.

It's not unusual for a device that will not boot.

I would try using RSD Lite.

Sent from my ali using XDA Labs

@sd_shadow I have one more question if I may. The Moto engineer I spoke to mentioned that re-flashing the baseband could possibly delete the call logs. Also he mentioned that some or possibly most of the apps might not work any more which would be relevant for recovering the rest of the data. However, the baseband is made of multiple partitions, so I thought, maybe the issue is in just one of the partitions, and maybe flashing just that will not overwrite the phone calls / app-related data / other data that I still need. So I was wondering if you'd be kind enough to tell me what the different partitions do? Can I just flash one of the partitions? (noting that system will need all chunks flashed at the same time). Which one of them might contain app-related or system-related personal data like call logs? Do you know where exactly call logs are stored? Thank you very much. Below is a list of the partitions and image files for reference.

Code:
partition gpt.bin
bootloader bootloader.img
modem NON-HLOS.bin
fsg fsg.mbn
dsp adspso.bin
logo logo.bin
boot boot.img
recovery recovery.img
system system.img_sparsechunk.0
system system.img_sparsechunk.1
system system.img_sparsechunk.2
system system.img_sparsechunk.3
system system.img_sparsechunk.4
system system.img_sparsechunk.5
system system.img_sparsechunk.6
system system.img_sparsechunk.7
system system.img_sparsechunk.8
system system.img_sparsechunk.9
system system.img_sparsechunk.10
oem oem.img
 

sd_shadow

Recognized Contributor / XDA Welcome Team
Sep 21, 2011
18,614
2
9,238
South Dakota
goo.gl
Motorola Droid X
Amazon Fire
@sd_shadow I have one more question if I may. The Moto engineer I spoke to mentioned that re-flashing the baseband could possibly delete the call logs. Also he mentioned that some or possibly most of the apps might not work any more which would be relevant for recovering the rest of the data. However, the baseband is made of multiple partitions, so I thought, maybe the issue is in just one of the partitions, and maybe flashing just that will not overwrite the phone calls / app-related data / other data that I still need. So I was wondering if you'd be kind enough to tell me what the different partitions do? Can I just flash one of the partitions? (noting that system will need all chunks flashed at the same time). Which one of them might contain app-related or system-related personal data like call logs? Do you know where exactly call logs are stored? Thank you very much. Below is a list of the partitions and image files for reference.



Code:
partition gpt.bin

bootloader bootloader.img

modem NON-HLOS.bin

fsg fsg.mbn

dsp adspso.bin

logo logo.bin

boot boot.img

recovery recovery.img

system system.img_sparsechunk.0

system system.img_sparsechunk.1

system system.img_sparsechunk.2

system system.img_sparsechunk.3

system system.img_sparsechunk.4

system system.img_sparsechunk.5

system system.img_sparsechunk.6

system system.img_sparsechunk.7

system system.img_sparsechunk.8

system system.img_sparsechunk.9

system system.img_sparsechunk.10

oem oem.img
Try
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn

Sent from my Moto E (4) using Tapatalk
 

cheater00

Member
Jun 27, 2020
29
0
Try
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn

Sent from my Moto E (4) using Tapatalk

Hi @sd_shadow, sorry for the longer wait. I tried the following things:

Code:
started with: device in boot loop

.\fastboot.exe flash modem .\NON-HLOS.bin
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase modemst1
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase modemst2
.\fastboot.exe erase modemst1
.\fastboot.exe erase modemst2
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase DDR
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe flash logo .\logo.bin
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe flash dsp .\adspso.bin
.\fastboot.exe reboot

outcome: still in boot loop

After erasing modemst1 and modemst2, the IMEI hasn't changed (I can see it in the fastboot environment by looking at the "barcodes" option). I am hesitant to flash fsg, because it contains the backup of modemst1. On some devices, the IMEI is contained on a separate partition called efs, but sometimes what would normally be inside the efs partition is located in modemst1. It's safe to erase modemst1, because fsg (the "file system gold copy") contains a backup of modemst1 and efs according to this document *. But I'm not sure if overwriting fsg will lose me the IMEI. could you confirm? The issue is that official android docs on Keystore Attestation say the following:


Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and Keymaster enforces restrictions that are difficult to subvert.

This is only true, however, if the keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available keymaster HAL and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, Keymaster introduced key attestation in Android 7.0 (Keymaster 2) and ID attestation in Android 8.0 (Keymaster 3).

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Could you please answer the following 4 questions?

  1. If I understand correctly, if the IMEI changes, the attestation will become void, and therefore the encryption store will become void and I will be unable to access data encrypted using File-Based Encryption (FBE). Do you know if this is correct?
  2. Does the Moto G5S Plus, after upgrading to 8.1, use FBE, or does it use Full-Disk Encryption (FDE)?
  3. Does the Moto G5S Plus have a separate efs partition, or is the IMEI stored on modemst1?
  4. Will reflashing the efg lose the IMEI?


* note: read the "editing" version of this wiki page, because the rendered wiki version eats the line breaks and everything is on one line
 

sd_shadow

Recognized Contributor / XDA Welcome Team
Sep 21, 2011
18,614
2
9,238
South Dakota
goo.gl
Motorola Droid X
Amazon Fire
Hi @sd_shadow, sorry for the longer wait. I tried the following things:

Code:
started with: device in boot loop

.\fastboot.exe flash modem .\NON-HLOS.bin
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase modemst1
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase modemst2
.\fastboot.exe erase modemst1
.\fastboot.exe erase modemst2
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe erase DDR
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe flash logo .\logo.bin
.\fastboot.exe reboot

outcome: still in boot loop

.\fastboot.exe flash dsp .\adspso.bin
.\fastboot.exe reboot

outcome: still in boot loop

After erasing modemst1 and modemst2, the IMEI hasn't changed (I can see it in the fastboot environment by looking at the "barcodes" option). I am hesitant to flash fsg, because it contains the backup of modemst1. On some devices, the IMEI is contained on a separate partition called efs, but sometimes what would normally be inside the efs partition is located in modemst1. It's safe to erase modemst1, because fsg (the "file system gold copy") contains a backup of modemst1 and efs according to this document *. But I'm not sure if overwriting fsg will lose me the IMEI. could you confirm? The issue is that official android docs on Keystore Attestation say the following:




Could you please answer the following 4 questions?

  1. If I understand correctly, if the IMEI changes, the attestation will become void, and therefore the encryption store will become void and I will be unable to access data encrypted using File-Based Encryption (FBE). Do you know if this is correct?
  2. Does the Moto G5S Plus, after upgrading to 8.1, use FBE, or does it use Full-Disk Encryption (FDE)?
  3. Does the Moto G5S Plus have a separate efs partition, or is the IMEI stored on modemst1?
  4. Will reflashing the efg lose the IMEI?


* note: read the "editing" version of this wiki page, because the rendered wiki version eats the line breaks and everything is on one line

I have used flash fsg fsg.mbn many time on multiple devices, and never lost IMEI.
Code:
fastboot flash fsg fsg.mbn
it's included in every standard Motorola flashfile.xml and servicefile.xml
It's not uncommon for IMEI to show as 0 or missing after flashing a custom rom,
or wifi stops work
If this happens flashing the following often fixes the issue.
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
As far as I know they do not affect encryption on Motorola devices.
 

cheater00

Member
Jun 27, 2020
29
0
I have used flash fsg fsg.mbn many time on multiple devices, and never lost IMEI.
Code:
fastboot flash fsg fsg.mbn
it's included in every standard Motorola flashfile.xml and servicefile.xml
It's not uncommon for IMEI to show as 0 or missing after flashing a custom rom,
or wifi stops work
If this happens flashing the following often fixes the issue.
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
As far as I know they do not affect encryption on Motorola devices.

Thanks @sd_shadow. After performing these steps, the device is still in a boot loop. Can you suggest further steps please? I don't know what the next thing might be that I could try.
 

TwoPointZero

Senior Member
Apr 15, 2012
65
39
Sony Xperia XZ Premium
Thanks @sd_shadow. After performing these steps, the device is still in a boot loop. Can you suggest further steps please? I don't know what the next thing might be that I could try.

On the fastboot screen (AP Fastboot Flash Mode (Secure)), does it list your device
product/variant: sanders XT1805 (good)
or product/variant: sanders 000000000000 (bad)

Second, LMSA (Rescue and Smart Assistant) detects the model when you plug the phone in. Therefore, if it's already plugged into the computer, first unplug then replug and it should be detected.

Third, if you have a micro-sd card in the slot, you should try booting the restored stock rom without any sort of external SD, fused storage or not. If the moto logo stays on-screen for longer than usual it's a good sign (firstboot)
 

cheater00

Member
Jun 27, 2020
29
0
On the fastboot screen (AP Fastboot Flash Mode (Secure)), does it list your device
product/variant: sanders XT1805 (good)
or product/variant: sanders 000000000000 (bad)

Second, LMSA (Rescue and Smart Assistant) detects the model when you plug the phone in. Therefore, if it's already plugged into the computer, first unplug then replug and it should be detected.

Third, if you have a micro-sd card in the slot, you should try booting the restored stock rom without any sort of external SD, fused storage or not. If the moto logo stays on-screen for longer than usual it's a good sign (firstboot)

Thanks for your reply. I'm not sure what you are instructing me to do. Would you mind clarifying please? My device does have an external SD card slot, but no card is inserted. What should I do? @sd_shadow what are your thoughts? Thanks.

Regarding LMSA,
Code:
fastboot getvar all
does not list the baseband version (the output is blank for that variable); having spoken with a Motorola representative who works on their Android software, he said that he doesn't know why this is the case, and that in this case LMSA will not perform any flashing will and reject the device. That's what happens indeed: LMSA says that the device is not supported. Unfortunately, I cannot reach the person any more to ask for any more advice as they have called me.
 

TwoPointZero

Senior Member
Apr 15, 2012
65
39
Sony Xperia XZ Premium
Thanks for your reply. I'm not sure what you are instructing me to do. Would you mind clarifying please? My device does have an external SD card slot, but no card is inserted. What should I do? @sd_shadow what are your thoughts? Thanks.

Regarding LMSA,
Code:
fastboot getvar all
does not list the baseband version (the output is blank for that variable); having spoken with a Motorola representative who works on their Android software, he said that he doesn't know why this is the case, and that in this case LMSA will not perform any flashing will and reject the device. That's what happens indeed: LMSA says that the device is not supported. Unfortunately, I cannot reach the person any more to ask for any more advice as they have called me.

Sorry, I didn't read all the info you posted. Just suggested you try booting with no SIM or SD card inside.
Looking at the LMSA you posted, mine said prior to flashing:
Code:
2020-08-05 15:47:42 [11] [INFO] Device:[Device info[id:ZY******, mn:XT1805,ps:eek:ffline,ss:eek:ffline]] disconnected
2020-08-05 15:47:45 [25] [INFO] Current_SoftStatusChanged - get match params by model name: XT1805
2020-08-05 15:47:46 [25] [INFO] Work - Takes 610 milliseconds, request url[https://lmsa.prod.cloud.lenovo.com/Interface/rescueDevice/getRomMatchParams.jhtml]
2020-08-05 15:47:46 [25] [INFO] Current_SoftStatusChanged - match rescue resource params: {"blurVersion":"Blur_Version.26.11.30.sanders.retail.en.US","fingerPrint":"motorola/sanders_n/sanders_n:7.1.1/NPS26.116-26/30:user/release-keys","fsgVersion.qcom":"SANDERS_EMEADSDS_CUST","roCarrier":"reteu"}
2020-08-05 15:47:48 [25] [INFO] Work - Takes 1389 milliseconds, request url[https://lmsa.prod.cloud.lenovo.com/Interface/rescueDevice/getNewResource.jhtml]
2020-08-05 15:48:13 [16] [INFO] <Start>b__42_0 - Downloading file SANDERS_OPS28.65_36_14_cid50_subsidy_DEFAULT_regulatory_DEFAULT_CFC.xml.zip - try 1
2020-08-05 15:48:14 [6 ] [INFO] <Start>b__42_0 - Downloading file Fastboot_Mot_V1.zip - try 1
2020-08-05 15:48:15 [6 ] [INFO] <Extractor>b__2 - C:\ProgramData\LMSA\Download\ToolFiles\Fastboot_Mot_V1.zip already extractor finished
2020-08-05 15:57:52 [16] [INFO] <Extractor>b__2 - C:\ProgramData\LMSA\Download\RomFiles\SANDERS_OPS28.65_36_14_cid50_subsidy_DEFAULT_regulatory_DEFAULT_CFC.xml.zip already extractor finished
2020-08-05 15:57:53 [29] [INFO] Work - Takes 774 milliseconds, request url[https://lmsa.prod.cloud.lenovo.com/Interface/dataCollection/romDownloadInfo.jhtml]
2020-08-05 15:59:41 [1 ] [INFO] Run - ************Running [LMSA_Recovery] use case start***********
2020-08-05 15:59:41 [28] [INFO] Run - Running Recipe FastBoot Devices
2020-08-05 15:59:41 [28] [INFO] Run - [LMSA_Recovery] Running step 'Waiting to enter Fastboot Flash Mode (WaitConnectByFastboot)'
2020-08-05 15:59:41 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Waiting to enter Fastboot Flash Mode' result 'Passed'
2020-08-05 15:59:41 [28] [INFO] Run - [LMSA_Recovery] Running step 'Waiting (Sleep)'
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Waiting' result 'Passed'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Read Device Mode (ReadDeviceMode)'
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Read Device Mode' result 'Passed'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Connect to Android Device (ADBConnect)'
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Connect to Android Device' result 'Skipped'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Switch to Fastboot Mode (AndroidShell)'
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Switch to Fastboot Mode' result 'Skipped'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Wait for Fastboot Mode (Sleep)'
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Wait for Fastboot Mode' result 'Skipped'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Check if image matches the connected device (FastbootDeviceMatchCheck)'
2020-08-05 15:59:46 [28] [INFO] ReadFastbootDeviceModelName - [LMSA_Recovery] use tool: C:\ProgramData\LMSA\Download\ToolFiles\Fastboot_Mot_V1\Fastboot_Mot_V1\fastboot.exe
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Check if image matches the connected device' result 'Passed'
2020-08-05 15:59:46 [28] [INFO] Run - [LMSA_Recovery] Running step 'Load Flash Files (LoadFiles)'
2020-08-05 15:59:46 [28] [INFO] RunStep - [LMSA_Recovery] loadfile, xmlFile=C:\ProgramData\LMSA\Download\RomFiles\SANDERS_OPS28.65_36_14_cid50_subsidy_DEFAULT_regulatory_DEFAULT_CFC.xml\flashfile.xml
2020-08-05 15:59:46 [28] [INFO] AddResult - [LMSA_Recovery] Step 'Load Flash Files' result 'Passed'
(...)flashing stuff

therefore the en.US part is confusing but expected. Your detection sequence is showing "fsgVersion.qcom":null, as you said it cannot read the baseband version

Is flashing fsg a huge no-no for you? Is unlocking the BL considered tampering with the device as far as the investigation is concerned?
According to others the IMEI is stored in the persist partition (which should by no means be exported from a phone to another) since Moto G5 and modemst1 modemst2 can be regenerated from persist if they've been erased.
If that is an acceptable 'risk' to you, I would flash fsg.mbn as suggested by sd_shadow.

EDIT: I realized you've done just that in your Aug 2nd reply
Was there any specific output shown for the fastboot commands?
 
Last edited:

cheater00

Member
Jun 27, 2020
29
0
Thanks for your reply.

Is flashing fsg a huge no-no for you? Is unlocking the BL considered tampering with the device as far as the investigation is concerned?
nothing is off the table as long as it gets the phone booting again and gives access to the user data.
According to others the IMEI is stored in the persist partition (which should by no means be exported from a phone to another) since Moto G5 and modemst1 modemst2 can be regenerated from persist if they've been erased.
Where is that stated? Could you point me to that please? Thanks!


If that is an acceptable 'risk' to you, I would flash fsg.mbn as suggested by sd_shadow.

EDIT: I realized you've done just that in your Aug 2nd reply
Was there any specific output shown for the fastboot commands?

No, just normal output as you get when flashing with fastboot.exe.
 

TwoPointZero

Senior Member
Apr 15, 2012
65
39
Sony Xperia XZ Premium
Thanks for your reply.


nothing is off the table as long as it gets the phone booting again and gives access to the user data.

Where is that stated? Could you point me to that please? Thanks!




No, just normal output as you get when flashing with fastboot.exe.

Regarding IMEI in persist, investigations in this thread: https://forum.xda-developers.com/g5...g-baseband-t3806064/post76901785#post76901785 led to this KB article https://forum.xda-developers.com/g5-plus/how-to/fix-persist-resolve-imei0-explanation-t3825147 by NZedPred, rachitrawat


Well, if you're willing to unlock the bootloader, there's an official method that 'voids' warranty (not that it applies in EU mind you)
It's all feasible via fastboot (oem get_unlock_data), you'll need to register for the procedure proper is at https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a (https://support.motorola.com/us/en/solution/ms87215 for other Moto models). The unlock key is mailed to you after accepting the terms.
Unfortunately unlocking wipes the device therefore it won't be good for your case. Sorry :rolleyes:
 

cheater00

Member
Jun 27, 2020
29
0
Regarding IMEI in persist, investigations in this thread: https://forum.xda-developers.com/g5...g-baseband-t3806064/post76901785#post76901785 led to this KB article https://forum.xda-developers.com/g5-plus/how-to/fix-persist-resolve-imei0-explanation-t3825147 by NZedPred, rachitrawat


Well, if you're willing to unlock the bootloader, there's an official method that 'voids' warranty (not that it applies in EU mind you)
It's all feasible via fastboot (oem get_unlock_data), you'll need to register for the procedure proper is at https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a (https://support.motorola.com/us/en/solution/ms87215 for other Moto models). The unlock key is mailed to you after accepting the terms.
Unfortunately unlocking wipes the device therefore it won't be good for your case. Sorry :rolleyes:

Yeah, unfortunately the data is necessary. I am trying to figure out the next steps. Thank you for the links, I will read them as soon as I can.
 
Last edited:

[email protected]

New member
Aug 10, 2022
2
0
Could it be that the battery is shot, and when the device boots up, after a few seconds of boot time the SoC requests higher current, and then the battery cannot deliver the required voltage, and the device browns out and resets?

I had my phone boot up and the screen flashed on and off a few times. It was sitting on the Motorola logo for a while. Then it was stuck on the Lenovo logo. As of this writing the battery is only 78% charged. I am going to charge to 100% and see if it boots then.

I have a Motorola G5S. So its similar I'm guessing?
Btw what is SoC?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    @sd_shadow in one of your threads you mentioned one could ping you with issues with debricking Moto devices, so I was wondering if you'd be kind enough to chime in? I'm trying to recover data from this (stock) G5S Plus, and then debrick it. Thanks.
    Trying to backup data from a locked bootloader device with out usb debugging enabled, is next to impossible, if device will not boot.

    Very possible that the battery has failed.
    Have you tried a different charger and usb cable?
    While it's in fastboot/bootloader mode, connect wall charger and select power off in fastboot options
    Does it show charging screen?
    1
    Hi,
    My personal phone is a Moto G5s Plus, European dual sim version (model "sanders XT1805", retail, unbranded, not from a network) with the latest version of Android available (I think it's 8.0 or 8.1, but not sure). It has rebooted today on its own while being used, and is now stuck in a boot loop. I am trying to either fix the boot loop, or recover personal data from the device (possibly destructively, but I would like to prevent that).

    Here are things I have tried:
    - I have checked that it's not the contact on the power button stuck in the on position that creates the boot loop. I have experienced this with a previous phone. Cleaning the contact with IPA and engaging it a few times helped this issue.
    - I have tried entering recovery mode and formatting the cache partition. This hasn't helped.

    I am a developer, but I don't know that much about Android devices. This phone has the stock boot loader and OS image. Is it possible to hook it up via adb, and possibly browse the file system or do something else to debug and fix the boot loop?

    The device does boot into recovery mode. Recovery mode contains options for applying an update from an SD card, and via ADB via sideloading. Could this be used to fix this situation somehow?
    I don't think so, Moto updates only update, they don't work for same version they would install.
    There would have to be an update for your current version, then you need a copy of it.
    Same Model and software channel.

    The battery in this device is somewhat bad. Sometimes it would turn off when on battery power, and not hooked up to a charger, if the battery was on 30%, and recently it did once when it was on 60%. The battery is a 3.8V Motorola HG30. Could it be that the battery is shot, and when the device boots up, after a few seconds of boot time the SoC requests higher current, and then the battery cannot deliver the required voltage, and the device browns out and resets? I tried booting with a charger hooked up (which also supports QC 3.0) but that didn't help.

    The boot loader also has the following two options: "BP Tools" and "QCom" but I don't know what they do. Both of them reboot the device, it sits in the boot screen for a longer time and then enters the boot loop again. There is also an option in the boot loader for turning on "tool mode" which sounds like it might be a way of enabling some form of debug tools.
    There is no way to use those modes that I know of.
    The device contains important personal information that I need to recover. I am very good with micro-soldering (I can solder 01005 without magnification), and I have the right fluxes and ball kits, although at the moment I don't have a hot air station but could possibly get one. In case such physical access could help in rooting this device, how would I do this?
    I haven't heard of any modern Motorola devices being rooted with a Locked Bootloader.
    Finally, I am aware that the emmc chip can be read by a Beaglebone Black, but I'm hoping it will not come to that. If I do that, will the file system be encrypted in some way?
    I have no idea.

    ---------- Post added at 07:04 PM ---------- Previous post was at 06:23 PM ----------

    I thought I'd post what I learn from the forum here and from other places... information that might be relevant to figuring out this issue, plus questions I have regarding those options:

    • I have tried to let the device discharge completely (I left it running in the boot loop), then I charged it up to 100%, but that did not help.
    • If your Moto will not boot, and your PC shows it as Qualcomm HS-USB QDLoader 9008 or Qualcomm QHSUSB_Bulk - but if I go into FastBoot mode (by holding power and volume down), and connect via USB, then the device does not show up in Windows 10 at all. If I tell FastBoot to go to Recovery Mode and in there select to download update via ADB, Windows 10 finds the phone and it shows up in the Device Manager under "Universal Serial Bus devices" as "Moto G (5S) Plus". Inside Properties for that item, the "Device description" field says "ADB Device". However, my PC doesn't have fastboot installed, or the Motorola drivers.
    If it boots to fastboot mode it is not in EDL mode.
    Terminal is an app you would install, the whole backup process requires the device can boot normally.
    • How to Unbrick (Debrick) Qualcomm Android Devices Using your SD Card - ArykSTORE - this allows to boot the device from SD card. I am not sure if it will let me boot my device without first unlocking the bootloader. However, the SD card created in this image puts the phone into download mode and I wouldn't like to do that. If the SD Card image boots up, and is able to enter download mode, then I assume it can access mmcblk0. Can I create an image that I can use to run dd in order to image mmcblk0 onto the file system of the SD card? (phone is 32 GB, SD card is 64 GB, so there should be space).
    As the device cannot boot normally, someone else with same model would have to create an loader.img
    Flashing a full mmcblk0.img would likely overwrite userdata.
    Normally after flashing a loader.img, flashing stock firmware is necessary before the device will boot normally.
    I believe this method only works with an unlocked bootloader, I haven't had time to thoroughly tests method.
    • [FIX] Phone Reboots Into Recovery Mode & Can Only Be Started From Fastboot - describes how to clear the misc partition using TRWP - is the misc partition different from the cache partition? Could this help with the boot loop? Note that my recovery mode has no option to "boot normally". Fastboot has an option called "START", but using that just enters the boot loop again.
    Most moto devices no longer have a real cache, to was removed with the a/b system partition change from a single system partition.
    Misc is used by recovery.
    • Hacking Hardware With A $10 SD Card Reader (pdf) - worst case scenario, I could try and modify the hardware to use this method of recovering data from eMMC. It uses an SD Card Reader or a BeagleBone Black (use BBB if you also want to read the mmcblkXbootY partitions. Not sure if that's necessary). One of the things I'd like to recover is URLs of tabs open in Google Chrome. Will they be on a boot partition, or the "normal" partitions available via SD Card interface?
    If you were signed in to a google account, browser history maybe synced. Depending on which browser was being used.

    Stuff I've read that didn't give me any new ideas on how to fix my issue:
    If you have a Windows pc that originally did not have 10 (7 or XP). You can flash firmware without wiping data.
    RSD Lite is your best option.

    What does getvar all say?
    Code:
    fastboot getvar all
    1
    Thanks a lot for the reply. I have fastboot.exe from the Android SDK.
    Do I need to have the Motorola Drivers installed for this? I can't install them. I got the file from XDA from your link here.

    I opened the downloaded file in 7zip and double clicked on Motorola_End_User_Driver_Installation_6.4.0_64bit.msi, clicked "Next", "I agree", and "Next", and I was presented with the image "motorola drivers error 1" in the attachment. Clicking through on those continued what you can see in file 2 and 3.

    Use the newer link
    https://mobilesupport.lenovo.com/us/en/solution/MS88481

    The PC I am on has Windows 10, but it didn't come with it - I installed it manually. Will that be fine?
    I also have an older PC which never had Windows 10 on it (only Linux and maybe XP, not sure). I would run RSD on that too, but it would take a bunch of time to set up.
    RSD Lite doesn't work with PCs built for windows 10, not sure why exactly.
    I know RSD Lite doesn't like usb 3.0.
    I have used RSD Lite on a few PCs that have been updated to 10 that worked fine.

    How would I use RSD Lite for that purpose? Will "without wiping data" also mean photos, as well as Chrome tabs and settings of other apps? (Google Authenticator, Steam Authenticator, Google Keep (notes), WhatsApp, etc)

    Chrome on that device is not logged in so the tabs are not in the cloud.

    Thanks again for being so nice to help out - that means a lot to me!
    see My flashing guide https://forum.xda-developers.com/general/rooting-roms/guide-flashing-motorola-firmware-t4042039
    use getvar all to find codename, software channel, and moto blur software version.
    You must not downgrade software version.
    Downgrade the correct firmware from
    https://mirrors.lolinet.com/firmware/moto/

    or use LMSA Flash rescue to download firmware
    This is the safer option
    LMSA will ask to download firmware, after downloading, it will ask to continue with flashing.
    Just don't flash with LMSA.
    Firmware will be in something like c/program data/lmsa/downloads/romfiles

    If you download from Lolinet unzip the file, LMSA shouldn't be zipped.
    There should be 2 .xml files in the folder, these contain the flashing commands.
    The servicefile.xml does not wipe user data, the flashfile.xml does wipe data.
    If you want you can use notepad++ to view the xml file commands.
    select the servicefile.xml with RSD Lite and flash.

    After flashing with RSD Lite the device should boot, provided there is not a hardware issue.
    No guarantees though.
    1
    Thanks again. Highly appreciated.



    Unfortunately this results in the same error. I guess RSD Lite and the other software will not work without those drivers. So I might have to build a new windows system for this purpose. I will try to do that asap.
    You could try the google android drivers
    https://developer.android.com/studio/run/win-usb
    or manually install the old moto drivers.
    https://forum.xda-developers.com/showpost.php?p=59139887&postcount=4

    Thank you. Just to be sure. Using servicefile.xml with RSD Lite will not erase phone logs? Can you tell me about that specifically? The reason is, and I'm not sure if I should be talking about this here, the following. (please let me know and I'll delete this or feel free to edit the post on your own). I'm pretty ill with, well, you can guess what, and I'm quarantined. Since March none the less. So every now and then the police will come checking if I'm home. Apparently last month they couldn't find me on one day. But I did call them back after I woke up. So to prove this I need the phone logs. Otherwise I might go to jail for a month, just because I was sleeping (because after all I'm ill!). So as you can tell this is pretty important... it's not just kitten pictures. I would appreciate if you could let me know.
    As long as the .xml doesn't contain the line
    Code:
    fastboot erase userdata
    Call logs, browser history, texts... will still be there.
    To be extra safe I would remove the flashfile.xml

    Have you tried any fastboot commands?
    like fastboot devices, fastboot getvar all ?
    1
    Thank you very much for confirming!



    Thank you, it works now! Here's the output.

    Code:
    > .\fastboot.exe devices
    ZY32283ZDS      fastboot

    Code:
    > .\fastboot.exe getvar all
    (bootloader) version: 0.5
    (bootloader) version-bootloader: moto-msm8953-C2.12
    (bootloader) product: sanders
    (bootloader) board: sanders
    (bootloader) secure: yes
    (bootloader) hwrev: P4
    (bootloader) radio: 1
    (bootloader) storage-type: emmc
    (bootloader) emmc: 32GB SAMSUNG RX14MB RV=08 PV=07 FV=0000000000000007
    (bootloader) ram: 4GB SAMSUNG LP3 DIE=8Gb M5=01 M6=05 M7=00 M8=5F
    (bootloader) cpu: MSM8953
    (bootloader) serialno: (removed) (let me know if you need it)
    (bootloader) cid: 0x0032
    (bootloader) channelid: 0x40
    (bootloader) uid: (removed) (let me know if you need it)
    (bootloader) securestate: oem_locked
    (bootloader) iswarrantyvoid: no
    (bootloader) max-download-size: 534773760
    (bootloader) reason: Volume down key pressed
    (bootloader) imei: (removed) (let me know if you need it)
    (bootloader) meid:
    (bootloader) date: 08-10-2017
    (bootloader) sku: XT1805
    (bootloader) carrier_sku:
    (bootloader) battid:
    (bootloader) iccid:
    (bootloader) cust_md5:
    (bootloader) max-sparse-size: 268435456
    (bootloader) current-time: "Fri Jan  2  0:44:35 UTC 1970"
    (bootloader) ro.build.fingerprint[0]: motorola/sanders_n/sanders_n:8.1.0
    (bootloader) ro.build.fingerprint[1]: /OPS28.65-36-14/63857:user/release
    (bootloader) ro.build.fingerprint[2]: -keys
    (bootloader) poweroffalarm: 0
    (bootloader) ro.build.version.full[0]: Blur_Version.28.271.12.sanders.re
    (bootloader) ro.build.version.full[1]: tail.en.US
    (bootloader) ro.build.version.qcom: LA.UM.6.6.r1-08600-89xx.0
    (bootloader) version-baseband: <not found>
    (bootloader) kernel.version[0]: Linux version 3.18.71-perf-gfde333e (hud
    (bootloader) kernel.version[1]: [email protected]) (gcc version 4.9.x 2015
    (bootloader) kernel.version[2]: 0123 (prerelease) (GCC) ) #1 SMP PREEMPT
    (bootloader) kernel.version[3]:  Tue Aug 13 15:23:08 CDT 2019
    (bootloader) sbl1.git: git=MBM-NG-VC2.12-0-g698fb2f
    (bootloader) rpm.git: git=92e5e21-dirty
    (bootloader) tz.git: git=d95e83f
    (bootloader) devcfg.git: git=d95e83f
    (bootloader) keymaster.git: git=d95e83f
    (bootloader) cmnlib.git: git=d95e83f
    (bootloader) cmnlib64.git: git=d95e83f
    (bootloader) prov.git: git=d95e83f
    (bootloader) aboot.git: git=MBM-NG-VC2.12-0-g07ff23c
    (bootloader) frp-state: protected (1003)
    (bootloader) ro.carrier: reteu
    (bootloader) current-slot:
    (bootloader) slot-suffixes: _a
    (bootloader) slot-count: 1
    (bootloader) slot-successful:_a: INVALID
    (bootloader) slot-successful:_b: INVALID
    (bootloader) slot-bootable:_a: INVALID
    (bootloader) slot-bootable:_b: INVALID
    (bootloader) slot-retry-count:_a: unknown
    (bootloader) slot-retry-count:_b: unknown
    all: listed above
    Finished. Total time: 0.110s

    Please let me know if you see anything interesting here - or what you're looking for - I'd love to learn more about the topic. Thanks.

    codename is sanders
    Model is XT1805
    Software Channel is reteu
    Software Version is 28.65-36-14
    so this version should be good.
    https://mirrors.lolinet.com/firmware/moto/sanders/official/RETEU/
    XT1805_SANDERS_RETEU_DS_8.1.0_OPS28.65-36-14_cid50_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
    but I would also see which version LMSA selects.