System integrity is compromised error after restoring using Moto smart assistant.

[minipretzel]

I've had my Moto G6 rooted for some time now. An ota update for PPS29.118-15-11-16 was continually nagging so I uninstalled Magisk and installed it.

Upon reboot when checking for updates I now get the following:

As your device system integrity is compromised, it is no longer eligible for software updates. Please contact customer service to re-program the device with official software.

I tried restoring to factory using Lenovo Moto smart assistant and that worked as it should. I still get the same "System integrity is compromised" error. I was under the impression that this would be reset upon doing this factory reset.

How would I get this message to be removed as I don't ever remember seeing it when this phone was rooted all this time.

Thanks

 

[minipretzel]

If I downgrade back to my last version PPSS29.118-15-11-9 the "System integrity is compromised" is NOT present.

 

[minipretzel]

Installing magisk seems to allow the ota updater to NOT report the "System integrity is compromised". As for stock, no dice.

 

[WoKoschekk]

Installing magisk seems to allow the ota updater to NOT report the "System integrity is compromised". As for stock, no dice.

without Magisk = system recognizes your unlocked bootloader
with Magisk = unlocked bootloader is hidden and OTAs and OEM-Unlock toggle are enabled, even SafetyNet check will pass.

 

[pdpantages]

I know this thread is old but I have the exact same problem.

I also restored stock roms from PPS29.118-15-11-16 using Smart assistant. I was already at this version, but I did the update anyway, as I have read that the smart assistant rescue would completely restore the phone to stock condition. But this didn't clear my "System Integrity..." message.

Just fyi, I actually ran the smart assistant commands manually... The SA failed to update my phone so I reconstructed the commands from the xml file and executed them one by one to find and fix this problem.
I re-ran the standard rescue after this and it was fine.

I noticed that my oem lock/unlock switch is enabled in my system->developer settings ( this was greyed out before).

Thing is, I do have magisk installed , as I wanted to root the phone. But this doesn't clear the message as it did for the OP.

I saw another article (thread) that recommended issuing "fastboot oem lock" twice, followed by some (re)flashing of the oem, system, and boot img files, and one final lock command. See "Using Lenovo Moto Smart Assistant to restore stock rom (and lock bootloader after)" by alexmaisa.

But the article by alexmaisa is from 2019 and is for a G5S....

Any ideas would be greatly appreciated.

 

[WoKoschekk]

I noticed that my oem lock/unlock switch is enabled in my system->developer settings ( this was greyed out before).

With magisk installed it's quiet normal.

I saw another article (thread) that recommended issuing "fastboot oem lock" twice, followed by some (re)flashing of the oem, system, and boot img files, and one final lock command. See "Using Lenovo Moto Smart Assistant to restore stock rom (and lock bootloader after)" by alexmaisa.

That's the correct way to relock your bootloader. Just follow the output lines in your cmd after executing fastboot oem lock.

 

[pdpantages]

That's the correct way to relock your bootloader. Just follow the output lines in your cmd after executing fastboot oem lock.

Thank you for the input. My bootloader was locked so the lock commands just reported this. When I ran the subsequent commands I got an error about unable to flash (bc the bootloader was locked)..... I thought maybe the original post had a typo so I switched to two "unlock" commands as the first commands. This unlocked me, and all the subsequent commands completed OK, including the final lock. But after setup I still have the System Integrity msg when I check for s/w updates under System menu.

The original post was from 2020 so possibly my version of Magisk (24.3) is the cause.?

I have most of what I want; latest stock ROMs and phone is rooted... just want to clear the problem with s/w updates.

I found another command set that that flashed the boot, system and oem twice.. I have cut these commands below. Unfortunately I don't recall where I got the bat file. It was called FLASH_OEM_LOCK.bat. Again these commands issue a lock command followed by some flash cmds which I thought would not work with the bootloader locked? Does a lock command not take effect until after reboot or something? Anyway, here they are:

fastboot oem lock
fastboot oem lock
fastboot flash oem oem.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash vendor vendor.img_sparsechunk.0
fastboot flash vendor vendor.img_sparsechunk.1
fastboot flash boot boot.img
fastboot oem lock
fastboot getvar max-sparse-size
fastboot oem fb_mode_set
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
fastboot flash dsp adspso.bin
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash vendor vendor.img_sparsechunk.0
fastboot flash vendor vendor.img_sparsechunk.1
fastboot flash oem oem.img
fastboot erase modemst1
fastboot erase modemst2
fastboot erase cache
fastboot erase userdata
fastboot erase DDR
fastboot flash fsg fsg.mbn
fastboot oem fb_mode_clear

 

[WoKoschekk]

@pdpantages That's the way to relock the bootloader and get the status "oem_locked":

1. Flash the current complete firmware
2. !!! THIS STEP IS HIGHLY RECOMMENDED !!!
If your bootloader will be relocked successfully after these steps, you won't have any options to fix errors! So, this is your last chance...
Important functions to check: are you able to boot into system, mobile (data) connections, Wifi
boot into system and check everything's working fine.
3. Are you really sure everything`s fine?
4. *** The following shows fastboot commands + output for a better understanding of what we are doing here. I took them from the last relock of my Moto G6 ***
Reboot into bootloader and run these commands:

########################################################################
# new lines beginning with "#" are comments and should not be executed!!
########################################################################

$ fastboot oem lock
...
(bootloader) WARNING: This command erases all user data.
(bootloader) Please re-run this command to continue.
OKAY [  0.001s]
finished. total time: 0.001s
$ fastboot oem lock
...
(bootloader) Flash valid Android images now
(bootloader) Then re-run this command to lock
OKAY [  0.002s]
finished. total time: 0.002s

# no need to flash the whole firmware (= valid Android images) again since we already did it in step 1.. Skip it and run lock command again.

$ fastboot oem lock
...
(bootloader) Still require signed boot.img
OKAY [  0.001s]
finished. total time: 0.001s

# ATTENTION: Cannot be skipped as we did before! Bootloader needs signed boot.img a second time!

$ fastboot flash boot boot.img
target reported max download size of 534773760 bytes
sending 'boot' (22528 KB)...
OKAY [  0.919s]
writing 'boot'...
OKAY [  0.518s]                    
finished. total time: 1.438s
$ fastboot oem lock
...
(bootloader) Still require signed system.img and/or oem.img
OKAY [  0.001s]
finished. total time: 0.001s

# ATTENTION: Cannot be skipped as we did before! Bootloader needs signed system/oem.img AND vendor.img (it's also signed since it contains sensitive firmware data, too) a second time!

$ fastboot flash system system.img_sparsechunk*
target reported max download size of 534773760 bytes
sending 'system' (262140 KB)...
OKAY [  9.463s]
writing 'system'...
OKAY [  5.836s]
finished. total time: 15.300s

(...flashing all other sparse images of system...)

$ fastboot flash vendor vendor.img_sparsechunk*
target reported max download size of 534773760 bytes
sending 'vendor' (254668 KB)...
OKAY [  8.950s]
writing 'vendor'...
OKAY [  5.484s]
finished. total time: 14.434s

( ...flashing all other sparse images of vendor...)

$ fastboot flash oem oem.img
target reported max download size of 534773760 bytes
sending 'oem' (153181 KB)...
OKAY [  5.566s]
writing 'oem'...
OKAY [  4.727s]
finished. total time: 10.294s

# now bootloader is satisfied and can be locked (yeah!!)

$ fastboot oem lock
...
(bootloader) Lock complete! Flash signed images after reboot if needed
OKAY [  0.163s]
finished. total time: 0.163s

 

[pdpantages]

Thank you kindly for the into. The notes in particular clarified things for me quite a bit, and I understand that issuing the unlock commands as I did was incorrect. I will try it shortly and report the success or failure of my attempt.

My bl is currently locked- my intent is to unlock it (2 commands) , let the phone reset and boot, verify with "fastboot flashing get_unlock_ability" that it is in fact unlocked, and start your procedure from there...

Thank you again for the help. I expect your post will be helpful to others too.

 

[pdpantages]

I will try it shortly and report the success or failure of my attempt.

So I did as promised. The basic answer is that it worked as described. A few notes follow; things I wonder about and error msgs I saw.

Procedure: Not exactly as outlined above; my boot loader was locked so I issued some unlock commands:
rigel:/home/pdp/adb>fastboot oem unlock (bootloader) invalid boot state OKAY [ 0.006s] Finished. Total time: 0.006s rigel:/home/pdp/adb>fastboot oem unlock (bootloader) invalid boot state OKAY [ 0.001s] Finished. Total time: 0.001s rigel:/home/pdp/adb>fastboot flashing unlock (bootloader) WARNING: This command erases all user data. (bootloader) Please re-run this command to continue. OKAY [ 0.001s] Finished. Total time: 0.001s

So, I got errors trying oem unlock but "flashing unlock" worked and the phone booted when I entered the second one. Not sure if this is an issue or not.

Errors: I got a "not found" error with each img I flashed. I was a bit nervous about this as it looked like partition names were "not found". But despite this, the commands appeared to work so I carried on.

rigel:/home/pdp/adb> fastboot flash boot boot.img (bootloader) is-logical:boot: not found Sending 'boot' (22528 KB) OKAY [ 0.901s] Writing 'boot' OKAY [ 0.381s] Finished. Total time: 1.675s

In the end, everything worked as expected- the "System Integrity..." message was gone from the Software update setting, and the also the boot-time warming about unlocked bootloader was gone (I have seen many posts claiming it is not possible to clear this message).

Magisk: After all that, I still wanted to root my phone... I thought i would be able to install Magisk using twrp.
I tried booting into twrp recovery using adb (not flashing recovery.img ) but this didn't work. So in the end I unlocked my bootloader again. (required the unlock key) to install Magisk.

with Magisk = unlocked bootloader is hidden and OTAs and OEM-Unlock toggle are enabled, even SafetyNet check will pass.

I was hoping the above would apply to me but it didn't; I now see the "System Integrity message" again in my software update settings. It is manageable- if I really want a software update I now know how to revert the phone to stock. Now that I am rooted I can make backups with Titanium Backup which was my primary motive for rooting in the first place .

Thank you again for the help, WoKoschekk , it is much appreciated.

 

[WoKoschekk]

Not sure if this is an issue or not.

It seems to be an issue because oem unlock does work for me. But as long as your bootloader is unlocked it does not matter.

and the also the boot-time warming about unlocked bootloader was gone (I have seen many posts claiming it is not possible to clear this message)

It happens on Moto G6+ devices but not on our device.

Errors: I got a "not found" error with each img I flashed. I was a bit nervous about this as it looked like partition names were "not found".

This is related to the new fastboot versions that are used to flash devices with a partition /super. It contains /system, /vendor and some others and they are called "logical partitions". Moto G6 does not use a /super partition and you can ignore that check by fastboot.

 

[pdpantages]

This is related to the new fastboot versions that are used to flash devices with a partition /super. It contains /system, /vendor and some others and they are called "logical partitions". Moto G6 does not use a /super partition and you can ignore that check by fastboot.

OK thank you again. I see now that I get this error when I flash from Linux, but not Windows 10....

In case it might help someone here are my linux versions:

rigel:/home/pdp/adb>fastboot --version fastboot version 31.0.2-android-tools Installed as /usr/bin/fastboot rigel:/home/pdp/adb>adb --version Android Debug Bridge version 1.0.41 Version 31.0.2-android-tools Installed as /usr/bin/adb[/FONT]

 

[WoKoschekk]

OK thank you again. I see now that I get this error when I flash from Linux, but not Windows 10....

In case it might help someone here are my linux versions:

rigel:/home/pdp/adb>fastboot --version fastboot version 31.0.2-android-tools Installed as /usr/bin/fastboot rigel:/home/pdp/adb>adb --version Android Debug Bridge version 1.0.41 Version 31.0.2-android-tools Installed as /usr/bin/adb[/FONT]

What version is installed on your Windows system? If you don't get any "error" like that you are not using the latest version of fastboot. SDK Platform Tools

 

[pdpantages]

What version is installed on your Windows system? If you don't get any "error" like that you are not using the latest version of fastboot. SDK Platform Tools

Adb version 1.0.39
fastboot version 0.0.1-4500957

I don't like to use windows but I ran Motorola Rescue & Smart Assistant tool there... If I have to use windows again I will update it.