Softbricked Razer 2 using "fastboot flash recovery twrp.img"

Search This thread

Pernilex

Member
May 6, 2022
20
3
Razer Phone 2
Here were my steps with Razer 2:
  1. SUCCESS: Developer Mode USB Debugging
  2. SUCCESS: (CMD) fastboot flashing unlock
  3. SKIPPED BY MISTAKE: (CMD) fastboot flashing unlock_critical
  4. SUCCESS: (CMD) fastboot flash recovery twrp.img
  5. SOFTBRICKED: TWRP.img flashed on recovery partition alerted Google Security AI
So, I received the error in this picture:
Fixes-for-Your-Device-is-Corrupted-and-Cannot-Be-Trusted-Overview-2.jpg

RAZER 2 SOFTBRICK ERROR
I did not unlock bootloader partition access, so when I use flash_all.bat, the script does not successfully create the hard drive partitions.
Strangely, it still tries to install system files on both A and B partitions (the Razer 2 uses A-B partitioning).
Of course, since creating the partitions failed, when the system.img flash reaches file 6/6 on partition B it has no partition to send the files to, so the script kicks me out.

Since the phone is softbricked, the phone does not show up on my drivers list either. The computer can flash the script, but it does not recognize the device is there at the same time:
fastboot devices: Visible
adb devices: not visible

It said Razer 2 in device manager prior to bricking, and changed to ADB interface while in bootloader mode after installing the correct USB Drives (Found on the Razer site). now it doesn't even show that the USB port is active.
I found a forum online that suggests using the CMD command to remove the error:adb reboot "dm-verity enforcing"

However, it failed and spit this error out:
Screenshot 2023-04-03 214116.png

adb reboot "dm-verity enforcing" Failed. Error: no devices/emulators found
I'm wondering if it because the computer cannot see the phone in device manager.

Or maybe it's because I don't have the patch they are talking about on the XDA forum. I am still learning and not familiar with what patches are. I know some bug fixes are called patches but aside from that I don't know how to use them. This was the patch link they sent that they said you need for the command to work:
https://github.com/invisiblek/andro...mmit/e1f62399183b854144301ce85f3a33b53ebfdde7

I also tried:
CMD: fastboot flash boot boot.img
CMD: fastboot flash boot_a boot.img
fastboot flash boot_b boot.img

This did not erase the error either.

Apparently, some phones did away with the recovery partition post 2016 (my razer is Dec 2020).
They flashed the recovery partition inside of the boot Kernel in newer phones instead of having a separate recovery partition with its own Kernel.
I also discovered that my phone's firmware (Found directly on Razer 2 Site) does not have an existing recovery.img file to even dirty flash to erase the TWRP file.
So naturally I am assuming that there ISN'T a recovery partition to flash the img file onto in the first place. This also explains why I am able to still use recovery mode on the phone even though I bricked it by flashing TWRP and replacing the stock recovery.img.

So CMD: fastboot flash recovery recovery.img is useless (I already tried just in case)
So now I have this TWRP file floating on the hardrive somewhere and do not know how to get rid of it if these 3 methods don't work.

So if the TWRP.img was not successfully flashed onto an existing partition (and bypassed security successfully), then I would imagine that flashing the original boot.img would not help which is why it did nothing.

If anyone knows how to get my device to get recognized while in this error mode that would help. Then I can figure out how to use the patch to get the CMD command to work to wipe the boot error.

I used CMD: fastboot flashing get_unlock_ability, and it spit out a zero (Meaning it can't be). So I need to change that to a 1 somehow with some voodoo tech magic.
 

V0latyle

Forum Moderator
Staff member
Seems like you're making a lot of assumptions here. There is no "Google AI security". This error message means there's a dm-verity corruption error: Android Boot Flow

This is probably because you attempted to flash an image without properly unlocking the bootloader, so what you flashed does not match the verification signature.

I'm not familiar with the Razer 2, but if it's an A/B device (meaning it has A/B slots) it most likely does not have a recovery partition. The recovery kernel is compressed into the boot image, which contains the ramdisk and system kernel as well. It is not possible to directly "flash" portions of the boot image; any image flashed to /boot will completely overwrite the contents of the /boot partition.

It is important to note that due to the compression used for the recovery kernel, there is no custom recovery that can replace the factory recovery unless the entire boot image is replaced - i.e., LineageOS. TWRP does not support the compression necessary.

Remember that adb commands only work in recovery or system. You have to use fastboot commands in bootloader or fastbootd, and you must have the correct driver installed to interface with your device in bootloader/fastbootd mode.

If you're able to boot into bootloader, try the correct command to unlock bootloader on the critical partitions: fastboot flashing unlock_critical
 

Pernilex

Member
May 6, 2022
20
3
Razer Phone 2
Seems like you're making a lot of assumptions here. There is no "Google AI security". This error message means there's a dm-verity corruption error: Android Boot Flow

This is probably because you attempted to flash an image without properly unlocking the bootloader, so what you flashed does not match the verification signature.

I'm not familiar with the Razer 2, but if it's an A/B device (meaning it has A/B slots) it most likely does not have a recovery partition. The recovery kernel is compressed into the boot image, which contains the ramdisk and system kernel as well. It is not possible to directly "flash" portions of the boot image; any image flashed to /boot will completely overwrite the contents of the /boot partition.

It is important to note that due to the compression used for the recovery kernel, there is no custom recovery that can replace the factory recovery unless the entire boot image is replaced - i.e., LineageOS. TWRP does not support the compression necessary.

Remember that adb commands only work in recovery or system. You have to use fastboot commands in bootloader or fastbootd, and you must have the correct driver installed to interface with your device in bootloader/fastbootd mode.

If you're able to boot into bootloader, try the correct command to unlock bootloader on the critical partitions: fastboot flashing unlock_critical
I did try that but I get this error:
View attachment 5880855

So I think the dm-verity issue is locking me out of the access to use that command.


Also, I meant the Google AI Security that flags it as a dm-verity. This video also explains that it places the app in the boot Kernal (which is accessible still), which is how I think you are able to work around getting TWRP on the phone.

This is where I got my info:
(watch @ 4:00)
(watch @ 6:00)
 
Last edited:

Pernilex

Member
May 6, 2022
20
3
Razer Phone 2
Again, there is no "Google AI Security". Dm-verity is the first thing executed by the kernel - it compares a hash of the boot image against a reference hash. See Dm-verity


This should not matter on an unlocked bootloader; the only thing the bootloader checks is for a valid boot image header.
It might be misinformation then on the video. I don't know but I guess it's not relevant either way.

Valid boot image header?

Any ideas why I am getting the error:

No adb devices/emulators found?

The phone isn't even showing when I use Diskpart on CMD to search for Disks.

I can't use an ADB command if it can't communcate with the phone. I ws going to try to use the command:
adb connect [USB port name]. Only fastboot works.

I saw someone connect that way when it was not showing. other than that I don't know how else to get my CPU to recognize my phone. Any ideas?
 

V0latyle

Forum Moderator
Staff member
It might be misinformation then on the video. I don't know but I guess it's not relevant either way.

Valid boot image header?
Yeah, the bootloader needs a properly formatted header in order to load the boot image.
Any ideas why I am getting the error:

No adb devices/emulators found?
It depends. What command are you trying to use, and what mode is your device in when you're trying to use it? This error means that ADB is not able to detect a device that is either in recovery mode or Android system. If you try to use ADB commands in bootloader/fastboot mode, you may get this error too.
The phone isn't even showing when I use Diskpart on CMD to search for Disks.
Why would it? Diskpart only shows currently mounted partitions, so this would only work if the PC detects the phone as attached storage.
I can't use an ADB command if it can't communcate with the phone. I ws going to try to use the command:
adb connect [USB port name]. Only fastboot works.
Of all the ADB commands I'm aware of, "connect" is not one of them. Any connected ADB device will show up in adb devices
I saw someone connect that way when it was not showing. other than that I don't know how else to get my CPU to recognize my phone. Any ideas?
Try fastboot devices with the phone in bootloader mode, if nothing shows up you probably have a driver issue.
 

Pernilex

Member
May 6, 2022
20
3
Razer Phone 2
fastboot devices recognizes my phone.
adb devices also recognized my phone and so did device manager before I soft-bricked the phone.
So definitely not a driver issue.

ADB devices only recognized my phone when I selected USB file transfer while my phone was on the home screen and I could actually boot into it.

Before I bricked it, my phone's drivers were only recognized on the device drivers or under adb devices when the phone was in file sharing mode. My phone was never visible in adb devices while in bootloader/fastboot mode, so I assume this is what you are getting at.

I had forgotten that this was how I entered ADB device manager before I bricked it.

I'm assuming I have to turn file transfer on again somehow while stuck on bootloop without access to the User Interface.

Then once file transfer via USB Debugging is active, I can use the ADB command to disable dm-verity and get out of the loop.

Then I can double unlock the bootloader the way I was supposed to the first time and unlock internal storage access, not just the bootloader itself.

Then I will have access to the storage partitions so the phone will flash_all correctly and not try to flash the system image onto the phone without a partition and kick me out of the script.

Question is, how do I turn on file sharing with only access to fastboot? My phone is locked again right now (I re-locked it trying to follow a bootloop troubleshoot guide). It is now showing the same error as the fastboot critical_unlock command and saying I cannot do that.

So obviously remove dm-verity needs to come first after I enter file sharing mode. Then I can follow the proper double unlock steps.

Is there a fastboot command to re-enable USB debugging?

For example (ignore validity of commands this is just an example of steps):

1. fastboot enable USB debugging
2. fastboot boot USB file sharing / fastboot switch to ADB
3. fastboot disable dm-verity (bypass bootloop)
4. fastboot oem unlock bootloader
5. fastboot flashing unlock_critical (parttion access)
6. Fastboot flash_all (Razer 2 Stock ROM)

PS: I thought anything plugged into a USB port, HDMI port or a second hard drive port would be recognized by DIskpart. I did not know it was only for storage. I learned how to access it when I was teaching myself how to put windows ISO on a flash drive to reset my PC offline. That being said, if the CPU had access to my Razer's storage, wouldn't it show up like a flash drive would if it was hooked up to USB?