I recently discovered this, and I thought it would be of some benefit to those who are wanting to unlock, modify partitions, etc without the need to flash derpunlock.sbf or modify your photon in any way. What you need to do this:
1) fastboot for Windows or Linux
2) unlocked RDL3 (ramloader) which I am providing
The process is very simple, reboot your Motorola Photon, and hold the volume down button and power button. You will see "fastboot" on the screen, now press volume up. Connect your phone to your computer, and issue the following command which I discovered:
[email protected]:~$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
This will load the unlocked ramloader (unlocked will be displayed at the top even if your phone is locked) which is normally only loaded into ram when flashing an SBF! Amazing, I know. Now you can do all kinds of stuff and you've made no modifications, just issue a "fastboot reboot" and nothing has been modified. Now you are able to erase boot, recovery, oem unlock, etc. Here is an example after you have executed the above. This is just me restoring my default boot and recovery partitions which you can't do from your locked bootloader:
[email protected]:~$ fastboot erase recovery
erasing 'recovery'...
OKAY [ 0.739s]
finished. total time: 0.739s
[email protected]:~/Desktop/SMG$ fastboot flash recovery CG58_0x00000120.smg sending 'recovery' (8192 KB)...
OKAY [ 8.760s]
writing 'recovery'...
OKAY [ 1.013s]
finished. total time: 9.773s
[email protected]:~/Desktop/SMG$ fastboot erase boot
erasing 'boot'...
OKAY [ 0.761s]
finished. total time: 0.761s
[email protected]:~/Desktop/SMG$ fastboot flash boot CG59_0x00000130.smg
sending 'boot' (8192 KB)...
OKAY [ 8.800s]
writing 'boot'...
OKAY [ 0.697s]
finished. total time: 9.497s
good progress on it
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
4G ?
Has anyone tried this method and retained 4G?
scottgl9 said:
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
Click to expand...
Click to collapse
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
bigslanki said:
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
Click to expand...
Click to collapse
The process of loading the unlocked ramloader is the same regardless of your firmware, even if the bootloader is 'locked'. The ramloader is just that, its written to ram, and so when the phone is reset the code is cleared out of memory. This means to unlock your radio, you don't have to flash anything to your ram, flashing rdl.bin basically just loads the ramloader to executable memory, then jumps to it. I'm still working on figuring out how to use this to chain load a custom recovery.
Love this! Keep up the good work!
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
may you attach stock recovery here? thanks
rrusek said:
Has anyone tried this method and retained 4G?
Click to expand...
Click to collapse
+1
4G confirmed working or not?
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
dito33 said:
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Click to expand...
Click to collapse
Not yet, you can flash it but it is not yet bootable since I haven't figured out yet how to jump to recovery from the ramloader (you'll probably get an error 2 if you flash CWM then boot to recovery). After you reset your phone, rdl.bin gets cleared out so the same protection mechanisms are still in the bootloader. It's something I'm working on.
firtermish said:
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
Click to expand...
Click to collapse
I already can. just do the following:
fastboot flash rdl.bin RDL3_unlocked.smg
fastboot erase system
fastboot flash system your_system_file.smg
fastboot erase boot
fastboot flash boot your_boot.smg
fastboot reboot
EDIT: file extension doesn't really matter, can be smg or img
Theres also updating from fastboot using a zip file, I'm not 100% sure if this works the same as in recovery:
update <filename> reflash device from update.zip
jortiz12885 said:
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
Click to expand...
Click to collapse
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
herach said:
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
Click to expand...
Click to collapse
At what point did you receive the error?
scottgl9 said:
At what point did you receive the error?
Click to expand...
Click to collapse
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
herach said:
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
Click to expand...
Click to collapse
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Lightsword1942 said:
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Click to expand...
Click to collapse
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
scottgl9 said:
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
Click to expand...
Click to collapse
Tried that. It reboots the device and the device stays on Moto Logo Dual-core Screen with nothing written on it and nothing else works.
Hallo, i have tried many time to flash a stock rom to my prime because i cannot boot it, i only have acecess to fastboot, wipe and Nvflash mod, but every time i get this message in Fastboot mod.
Code:
C:\Users\Benjamins\Desktop>fastboot flash system system.blob
sending 'system' (524288 KB)...
OKAY [ 97.339s]
writing 'system'...
FAILED (remote: (InvalidSize))
finished. total time: 159.786s
I tried many different ROM, like .15 and .28, but can't get it flashed to the prime :/
And, then i tried to format my system but then i get this message :/
Code:
C:\Users\Benjamins\Desktop>fastboot format data
formatting 'data' partition...
Formatting is not supported for filesystem with type ''.
FAILED ()
finished. total time: 0.014s
Then i have access to Nvflash mod, could anyone provide a way to flash a ROM this way maybe?
Thanks in advance
butbhgyt said:
Hallo, i have tried many time to flash a stock rom to my prime because i cannot boot it, i only have acecess to fastboot, wipe and Nvflash mod, but every time i get this message in Fastboot mod.
Code:
C:\Users\Benjamins\Desktop>fastboot flash system system.blob
sending 'system' (524288 KB)...
OKAY [ 97.339s]
writing 'system'...
FAILED (remote: (InvalidSize))
finished. total time: 159.786s
I tried many different ROM, like .15 and .28, but can't get it flashed to the prime :/
And, then i tried to format my system but then i get this message :/
Code:
C:\Users\Benjamins\Desktop>fastboot format data
formatting 'data' partition...
Formatting is not supported for filesystem with type ''.
FAILED ()
finished. total time: 0.014s
Then i have access to Nvflash mod, could anyone provide a way to flash a ROM this way maybe?
Thanks in advance
Click to expand...
Click to collapse
you cant flash blobs with androidroot custom bootloader. Read the instructions and the thread with more attention next time.
tip: blobunpack
sent from my tf201
Guys, how far you are with correct recovery.img? The one existing is not fully working.
Erasing and cleaning tools doesnt work.
Thanks
I am also not able to fully access Unlocked phone even via fastboot commands:
C:\>fastboot erase userdata
erasing 'userdata'...
FAILED (remote: not allowed)
finished. total time: 0.002s
We understand that you want a custom recovery. However, you have to stop posting it in the development section.
Hi.
After I've tried to install a custom rom, I've done a very big mistake. Now I can't boot the tab, and if I try to go in recovery or wipe data through fastboot i get the fatally error "unrecoverable bootloader error 0x00000000". I haven't any nvflash backup and have the JB bootloader (10.6.1.8). The only thing that works are the APX mode and the fastboot. I'm feeling a very idiot because i bought it yesterday.
Now, what can I do? Dump it and f**k myself? :crying:
Sorry for my bad english, thank you for your help.
I realized I'm screwed. But I've tried something...
When I go run the fastboot mode and delete a partition, for example:
Code:
fastboot erase recovery
works, and after I can run other command. But if I use:
Code:
fastboot flash recovery recovery.img
seems it works, in fact the output is
Code:
sending 'recovery' (5378 KB)...
OKAY [ 2.431s]
writing 'recovery'...
OKAY [ 1.739s]
finished. total time: 4.170s
but it's stucked and I need to reboot manually.
Any idea?
Kito92 said:
I realized I'm screwed. But I've tried something...
When I go run the fastboot mode and delete a partition, for example:
Code:
fastboot erase recovery
works, and after I can run other command. But if I use:
Code:
fastboot flash recovery recovery.img
seems it works, in fact the output is
Code:
sending 'recovery' (5378 KB)...
OKAY [ 2.431s]
writing 'recovery'...
OKAY [ 1.739s]
finished. total time: 4.170s
but it's stucked and I need to reboot manually.
Any idea?
Click to expand...
Click to collapse
I have the same. Im on an ICS bootloader due to having to run nvflash to get it back to that point.
I have fastboot access i can send a recovery image over to it (twrp 2.5 ics.img) however when i reboot it i dont see the recovery!
PLEASE PLEASE PLEASE Someone help
Hello. Today i tried to flash the phone to the stock ROM twice but it didnt work probably cause unlocked bootloader and custom recovery (TWRP).
So i brick the phone and now i cant access the rom or the recovery. All i can do is access the fastboot mode. I tried to install the new recovery through fastboot but it doesnt work.
I tried the twrp 3.0.2.0 and 3.0.1.0 for yuga.
Code:
C:\Users\Kubo\Downloads\platform-tools>fastboot flash recovery recovery.img
target didn't report max-download-size
sending 'recovery' (10704 KB)...
OKAY [ 0.342s]
writing 'recovery'...
FAILED (remote: Command not allowed)
finished. total time: 0.347s
Tried various of commands that i found on google and this forum but nothing worked. I unlocked the bootloader before when i was installing various of custom roms. Could somehow stock rom affect the bootloader when i was flashing through flashtool ? I tried to only boot the recovery from the img, the command worked but the recovery did not boot.
Code:
C:\Users\Kubo\Downloads\platform-tools>fastboot boot recovery.img
downloading 'boot.img'...
OKAY [ 0.341s]
booting...
OKAY [ 0.033s]
finished. total time: 0.378s
Tried to check the status of bootloader but the command is just showing ... and nothing happend. Tried to get the IMEI through fastboot getvar command but no output is given. Im desperate. Sorry for english not my native language. I'll appreciate all the help.