Phone bricked after reboot (Fastboot stuck in 'Device-State: error')

Search This thread


Aug 20, 2015
Yesterday, my phone was acting kinda sluggish, so I rebooted it... And it never came back up.
I force booted into fastboot and was greeted with this [screenshot below]

Now, booting to Recovery and Rescue from the bootloader just goes to black screen (Start goes back to the bootloader), and booting normally also just goes to black screen.
Trying to do most things via fastboot cli just results in the error message FAILED (remote: 'error getting device locked state Protocol Error')

I've tried:
  • setting the active slot
  • flashing the bootloader
  • erasing system_a and boot_a
  • flashing boot.img
  • flashing stock boot.img
  • fastboot booting into boot.img or twrp.img
  • fastboot update (it fails at setting the slot)
  • letting the battery die over night
  • using a different charger
  • using a script to reboot repeatedly
  • removing the sim and booting
  • disconnecting the battery
  • putting it in the freezer (yes)
  • a new battery
I'm also going to try taking it apart and disconnecting the battery

This is the output of `fastboot getvar all`
(bootloader) product:crosshatch
(bootloader) serialno:<redacted>
(bootloader) variant:SDM UFS
(bootloader) max-download-size:0x10000000
(bootloader) slot-suffixes:_a,_b
(bootloader) version-bootloader:b1c1-0.3-6623201
(bootloader) version-baseband:g845-00107-200702-B-6648703
(bootloader) secure-boot:PRODUCTION
(bootloader) secure:yes
(bootloader) hw-revision:MP1.0
(bootloader) is-userspace:no
(bootloader) slot-count:2
(bootloader) current-slot:a
(bootloader) unlocked:error
(bootloader) nos-production:error
(bootloader) off-mode-charge:1
(bootloader) slot-retry-count:a:0
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-retry-count:b:1
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:no
(bootloader) battery-voltage:3781
(bootloader) battery-soc-ok:yes
(bootloader) snapshot-update-status:none
(bootloader) storage-vendor:MICRON
(bootloader) storage-model:128GB-UFS-MT
(bootloader) storage-rev:9QSN
(bootloader) citadel-fw:error
(bootloader) auto-shutdown:0
(bootloader) partition-type:ssd:raw
(bootloader) partition-size:ssd:0x2000
(bootloader) partition-type:misc:raw
(bootloader) partition-size:misc:0x100000
(bootloader) partition-type:keystore:raw
(bootloader) partition-size:keystore:0x80000
(bootloader) partition-type:frp:raw
(bootloader) partition-size:frp:0x80000
(bootloader) partition-type:system_a:raw
(bootloader) partition-size:system_a:0xB0000000
(bootloader) partition-type:system_b:raw
(bootloader) partition-size:system_b:0xB0000000
(bootloader) partition-type:product_a:raw
(bootloader) partition-size:product_a:0x12C00000
(bootloader) partition-type:product_b:raw
(bootloader) partition-size:product_b:0x12C00000
(bootloader) partition-type:vendor_a:raw
(bootloader) partition-size:vendor_a:0x30000000
(bootloader) partition-type:vendor_b:raw
(bootloader) partition-size:vendor_b:0x30000000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a:0x4000000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b:0x4000000
(bootloader) partition-type:modem_a:raw
(bootloader) partition-size:modem_a:0x5000000
(bootloader) partition-type:modem_b:raw
(bootloader) partition-size:modem_b:0x5000000
(bootloader) partition-type:apdp_a:raw
(bootloader) partition-size:apdp_a:0x40000
(bootloader) partition-type:apdp_b:raw
(bootloader) partition-size:apdp_b:0x40000
(bootloader) partition-type:msadp_a:raw
(bootloader) partition-size:msadp_a:0x40000
(bootloader) partition-type:msadp_b:raw
(bootloader) partition-size:msadp_b:0x40000
(bootloader) partition-type:klog:raw
(bootloader) partition-size:klog:0x400000
(bootloader) partition-type:metadata:raw
(bootloader) partition-size:metadata:0x1000000
(bootloader) partition-type:userdata:raw
(bootloader) partition-size:userdata:0x1BCA7FB000
(bootloader) partition-type:xbl_a:raw
(bootloader) partition-size:xbl_a:0x380000
(bootloader) partition-type:xbl_config_a:raw
(bootloader) partition-size:xbl_config_a:0x20000
(bootloader) partition-type:xbl_b:raw
(bootloader) partition-size:xbl_b:0x380000
(bootloader) partition-type:xbl_config_b:raw
(bootloader) partition-size:xbl_config_b:0x20000
(bootloader) partition-type:ALIGN_TO_128K_1:raw
(bootloader) partition-size:ALIGN_TO_128K_1:0x1A000
(bootloader) partition-type:cdt:raw
(bootloader) partition-size:cdt:0x20000
(bootloader) partition-type:ddr:raw
(bootloader) partition-size:ddr:0x100000
(bootloader) partition-type:modemcal:raw
(bootloader) partition-size:modemcal:0x200000
(bootloader) partition-type:uefivar:raw
(bootloader) partition-size:uefivar:0x100000
(bootloader) partition-type:sec:raw
(bootloader) partition-size:sec:0x4000
(bootloader) partition-type:aop_a:raw
(bootloader) partition-size:aop_a:0x80000
(bootloader) partition-type:tz_a:raw
(bootloader) partition-size:tz_a:0x200000
(bootloader) partition-type:hyp_a:raw
(bootloader) partition-size:hyp_a:0x80000
(bootloader) partition-type:abl_a:raw
(bootloader) partition-size:abl_a:0x200000
(bootloader) partition-type:keymaster_a:raw
(bootloader) partition-size:keymaster_a:0x80000
(bootloader) partition-type:cmnlib_a:raw
(bootloader) partition-size:cmnlib_a:0x80000
(bootloader) partition-type:cmnlib64_a:raw
(bootloader) partition-size:cmnlib64_a:0x80000
(bootloader) partition-type:devcfg_a:raw
(bootloader) partition-size:devcfg_a:0x20000
(bootloader) partition-type:qupfw_a:raw
(bootloader) partition-size:qupfw_a:0x10000
(bootloader) partition-type:vbmeta_a:raw
(bootloader) partition-size:vbmeta_a:0x10000
(bootloader) partition-type:dtbo_a:raw
(bootloader) partition-size:dtbo_a:0x800000
(bootloader) partition-type:storsec_a:raw
(bootloader) partition-size:storsec_a:0x20000
(bootloader) partition-type:aop_b:raw
(bootloader) partition-size:aop_b:0x80000
(bootloader) partition-type:tz_b:raw
(bootloader) partition-size:tz_b:0x200000
(bootloader) partition-type:hyp_b:raw
(bootloader) partition-size:hyp_b:0x80000
(bootloader) partition-type:abl_b:raw
(bootloader) partition-size:abl_b:0x200000
(bootloader) partition-type:keymaster_b:raw
(bootloader) partition-size:keymaster_b:0x80000
(bootloader) partition-type:cmnlib_b:raw
(bootloader) partition-size:cmnlib_b:0x80000
(bootloader) partition-type:cmnlib64_b:raw
(bootloader) partition-size:cmnlib64_b:0x80000
(bootloader) partition-type:devcfg_b:raw
(bootloader) partition-size:devcfg_b:0x20000
(bootloader) partition-type:qupfw_b:raw
(bootloader) partition-size:qupfw_b:0x10000
(bootloader) partition-type:vbmeta_b:raw
(bootloader) partition-size:vbmeta_b:0x10000
(bootloader) partition-type:dtbo_b:raw
(bootloader) partition-size:dtbo_b:0x800000
(bootloader) partition-type:storsec_b:raw
(bootloader) partition-size:storsec_b:0x20000
(bootloader) partition-type:ALIGN_TO_128K_2:raw
(bootloader) partition-size:ALIGN_TO_128K_2:0x1A000
(bootloader) partition-type:persist:raw
(bootloader) partition-size:persist:0x2800000
(bootloader) partition-type:modemst1:raw
(bootloader) partition-size:modemst1:0x200000
(bootloader) partition-type:modemst2:raw
(bootloader) partition-size:modemst2:0x200000
(bootloader) partition-type:fsg:raw
(bootloader) partition-size:fsg:0x200000
(bootloader) partition-type:fsc:raw
(bootloader) partition-size:fsc:0x20000
(bootloader) partition-type:devinfo:raw
(bootloader) partition-size:devinfo:0x1000
(bootloader) partition-type:dip:raw
(bootloader) partition-size:dip:0x100000
(bootloader) partition-type:spunvm:raw
(bootloader) partition-size:spunvm:0x800000
(bootloader) partition-type:limits:raw
(bootloader) partition-size:limits:0x1000
(bootloader) partition-type:toolsfv:raw
(bootloader) partition-size:toolsfv:0x100000
(bootloader) partition-type:logfs:raw
(bootloader) partition-size:logfs:0x800000
(bootloader) partition-type:sti:raw
(bootloader) partition-size:sti:0x200000
(bootloader) partition-type:ImageFv:raw
(bootloader) partition-size:ImageFv:0x200000
(bootloader) partition-type:splash:raw
(bootloader) partition-size:splash:0x4000

I'm running Dirty Unicorns 14.7-20200913-1623 with Magisk (probably the latest)
I know I've installed Youtube Vanced, Adaway, and Universal SafetyNet Fix
I did NOT have Xposed or others installed, and I don't remember if the device fingerprint was still being spoofed (I don't think it was)

If anyone happened to have the EDL / QPST files, that would be handy as well

*sigh* I have 0 idea how this happened. Could even be an eMMC hardware failure, which would not be nice


After shattering the back glass pannel, and accidentally pulling off the fingerprint sensor connector, I can confirm that detaching the battery does NOT work. The phone still boots into fastboot, which is good.
At this point, I'm just interested in data recovery

Edit 2:
I just ordered new battery. The old one seems flaky and acting like it's not holding a charge (and a new one is inexpensive). I'm also going to try to leave the battery disconnected overnight (I'm hoping there's some volatile storage or capacitor that'll be discharged and refreshed in the morning)

Edit 3:
The new battery did not help. ugh.
Last edited:


Senior Member
  • Aug 2, 2019
    At this point QPST would make matters worse by formatting userdata. Your only hope for recovering the data might be to reboot the phone to edl with fastboot using fastboot reboot emergency and then flashing the exact same system and boot image that you were using. You might need to convert the file to system.img. Flash it with the adb edl command and then try to reboot.


    Aug 20, 2015
    I tried fastboot reboot emergency, which didn't work ("no" reboot target 'emergency'')
    But fastboot oem reboot-edl gave back error getting device locked state Protocol Error. So that may be a valid command, but due to the reason for needing it, I can't use it.

    However, I've got the back panel off the phone. If i can find the EDL short points, I might still be able to go that route


    Aug 20, 2015
    In my disassembly of the phone, I just broke the side buttons (power + vol) ribbon connector.
    So, unless a new battery works (or i can find the EDL test points), I might be SOL

    (I could probably buy a busted 3XL off ebay and swap the mobo's. But it's not looking good)


    Aug 20, 2015
    I found the EDL test points! But nobody's gonna like where they are.

    They're on the underside of the motherboard, the left 2 of a cluster of 3 just under one of the mounting holes.

    Unplug the battery, plug it back in, use something to bridge the two contacts, and plug in the usb power


    • pixel 3 xl edl test points.png
      pixel 3 xl edl test points.png
      14.9 MB · Views: 20
    • pixel 3 xl edl test points 2.png
      pixel 3 xl edl test points 2.png
      268 KB · Views: 21


    Aug 20, 2015
    @lightfire228 Hello. Are you able to fix your phone?
    I haven't tried anything since finding the EDL test points.
    I'm still waiting on a replacement battery. If that works, then I'm just going to transfer the data to my new phone.
    If not, I'll look into prodding the EDL. But, since I've not had a lot of time to research that particular route, nor have I done any sort of reverse-engineering like that, I don't how feasible that will be
    • Like
    Reactions: Godwin.L

    Top Liked Posts

    • There are no posts matching your filters.
    • 1
      @lightfire228 Hello. Are you able to fix your phone?
      I haven't tried anything since finding the EDL test points.
      I'm still waiting on a replacement battery. If that works, then I'm just going to transfer the data to my new phone.
      If not, I'll look into prodding the EDL. But, since I've not had a lot of time to research that particular route, nor have I done any sort of reverse-engineering like that, I don't how feasible that will be