I recently discovered this, and I thought it would be of some benefit to those who are wanting to unlock, modify partitions, etc without the need to flash derpunlock.sbf or modify your photon in any way. What you need to do this:
1) fastboot for Windows or Linux
2) unlocked RDL3 (ramloader) which I am providing
The process is very simple, reboot your Motorola Photon, and hold the volume down button and power button. You will see "fastboot" on the screen, now press volume up. Connect your phone to your computer, and issue the following command which I discovered:
[email protected]:~$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
This will load the unlocked ramloader (unlocked will be displayed at the top even if your phone is locked) which is normally only loaded into ram when flashing an SBF! Amazing, I know. Now you can do all kinds of stuff and you've made no modifications, just issue a "fastboot reboot" and nothing has been modified. Now you are able to erase boot, recovery, oem unlock, etc. Here is an example after you have executed the above. This is just me restoring my default boot and recovery partitions which you can't do from your locked bootloader:
[email protected]:~$ fastboot erase recovery
erasing 'recovery'...
OKAY [ 0.739s]
finished. total time: 0.739s
[email protected]:~/Desktop/SMG$ fastboot flash recovery CG58_0x00000120.smg sending 'recovery' (8192 KB)...
OKAY [ 8.760s]
writing 'recovery'...
OKAY [ 1.013s]
finished. total time: 9.773s
[email protected]:~/Desktop/SMG$ fastboot erase boot
erasing 'boot'...
OKAY [ 0.761s]
finished. total time: 0.761s
[email protected]:~/Desktop/SMG$ fastboot flash boot CG59_0x00000130.smg
sending 'boot' (8192 KB)...
OKAY [ 8.800s]
writing 'boot'...
OKAY [ 0.697s]
finished. total time: 9.497s
good progress on it
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
4G ?
Has anyone tried this method and retained 4G?
scottgl9 said:
You can actually unlock the radio with the stock locked bootloader still in place (derpunlock.sbf flashing no longer needed):
[email protected]:~/Desktop/SMG_derpunlock$ fastboot flash rdl.bin RDL3_unlocked.smg
sending 'rdl.bin' (3072 KB)...
OKAY [ 0.193s]
writing 'rdl.bin'...
OKAY [ 0.000s]
finished. total time: 0.193s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock
...
(bootloader) Unlocking your device can permanently VOID your warranty.
(bootloader) This process cannot be reversed. If you wish to proceed,
(bootloader) reissue the unlock OEM command containing the unique ID
(bootloader) of your device: XXXXXXXXXXXXXXXX
OKAY [ 0.006s]
finished. total time: 0.006s
[email protected]:~/Desktop/SMG_derpunlock$ fastboot oem unlock XXXXXXXXXXXXXXXX
...
(bootloader) Device is already unlocked
OKAY [ 0.003s]
finished. total time: 0.003s
[email protected]:~/Desktop/SMG_derpunlock$
Click to expand...
Click to collapse
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
bigslanki said:
what would be the process coming from locked stock _6, would i just flash clock work mod, flash rom.zip then OP's inputs?
Click to expand...
Click to collapse
The process of loading the unlocked ramloader is the same regardless of your firmware, even if the bootloader is 'locked'. The ramloader is just that, its written to ram, and so when the phone is reset the code is cleared out of memory. This means to unlock your radio, you don't have to flash anything to your ram, flashing rdl.bin basically just loads the ramloader to executable memory, then jumps to it. I'm still working on figuring out how to use this to chain load a custom recovery.
Love this! Keep up the good work!
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
may you attach stock recovery here? thanks
rrusek said:
Has anyone tried this method and retained 4G?
Click to expand...
Click to collapse
+1
4G confirmed working or not?
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
dito33 said:
So can I flash CWM after this kind of unlock the bootloader and then custom rom.
Sent from my SPH-D710 using XDA
Click to expand...
Click to collapse
Not yet, you can flash it but it is not yet bootable since I haven't figured out yet how to jump to recovery from the ramloader (you'll probably get an error 2 if you flash CWM then boot to recovery). After you reset your phone, rdl.bin gets cleared out so the same protection mechanisms are still in the bootloader. It's something I'm working on.
firtermish said:
I like what I m reading. Sounds like this would be the saving grace for those photon users stuck on an electrify rom (and yeah I m one of them!). Please let us know when you get to rewrite system with a custom rom with this method!
Click to expand...
Click to collapse
I already can. just do the following:
fastboot flash rdl.bin RDL3_unlocked.smg
fastboot erase system
fastboot flash system your_system_file.smg
fastboot erase boot
fastboot flash boot your_boot.smg
fastboot reboot
EDIT: file extension doesn't really matter, can be smg or img
Theres also updating from fastboot using a zip file, I'm not 100% sure if this works the same as in recovery:
update <filename> reflash device from update.zip
jortiz12885 said:
Will this be useful for the ones that flash the electrify rom on the photon?
Sent from my MB855 using XDA
Click to expand...
Click to collapse
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
herach said:
Nope. I just tried and it doesn't work. I get error on phone like below.
1c10d60
SVF:106:1:2
sec_exception: b655, eddc, eb
Anyone knows what that is?
Click to expand...
Click to collapse
At what point did you receive the error?
scottgl9 said:
At what point did you receive the error?
Click to expand...
Click to collapse
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
herach said:
After the Fastboot. It does Fastboot successfully but it gives the error on the phone screen.
Click to expand...
Click to collapse
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Lightsword1942 said:
It looks like it is some sort of security error(possibly a failed sigcheck or something).
Click to expand...
Click to collapse
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
scottgl9 said:
I'm pretty sure the reason you're receiving this error is because this RDL is from derpunlock.sbf from photon_pudding.rar. I'll post the unlocked pudding electrify ramloader.
Attached is the unlocked pudding electrify ramloader, run:
fastboot flash rdl.bin RDL3_unlocked_electrify.smg
Click to expand...
Click to collapse
Tried that. It reboots the device and the device stays on Moto Logo Dual-core Screen with nothing written on it and nothing else works.
Guys, how far you are with correct recovery.img? The one existing is not fully working.
Erasing and cleaning tools doesnt work.
Thanks
I am also not able to fully access Unlocked phone even via fastboot commands:
C:\>fastboot erase userdata
erasing 'userdata'...
FAILED (remote: not allowed)
finished. total time: 0.002s
We understand that you want a custom recovery. However, you have to stop posting it in the development section.
Long story short, I tried to flash new rom on my Mt2-L02 mate2 and failed and its bootlooping (at Huawei Ascend screen and keep rebooting) now. using the SDcard udload to load new rom don't work either. I cannot go into recovery, or boot into system.
My phone is bootloader unlocked, so I tried to flash (extract from a rom) boot.img, recovery.img and is ok but when flashing system.img, it stucked in writing 'system'... for long time.... so I tried fastboot erase system -w and get FAILED (remote: Command not allowed)... why is it so? my phone is already unlocked. I tried unlock again and flash the system.img, same problem.
So... I'm screwed?
You're not screwed. Impatient maybe. Try on a different computer if you have one. If not, update drivers and try a different port on the existing computer. Are you flashing an MT2-L02 ROM?
kimtyson said:
You're not screwed. Impatient maybe. Try on a different computer if you have one. If not, update drivers and try a different port on the existing computer. Are you flashing an MT2-L02 ROM?
Click to expand...
Click to collapse
Only have 1 pc, yes, I'm flashing MT2-L02 ROM, tried alot of version but discovered only these version rom (b408, b603, b606, b607) able to write the system.img, original out of box android version for my phone is 4.4.2. but still bootlooping after flashing boot.img, recovery.img and system.img. I think only custom recovery can save now, but there is none for this model... or maybe there is no hope for my phone? Maybe my phone got some system modified lock so that I'm not able to erase using flashboot?
C:\adb>fastboot erase cache
erasing 'cache'...
FAILED (remote: Command not allowed)
finished. total time: 0.001s
C:\adb>fastboot erase data
erasing 'data'...
FAILED (remote: Command not allowed)
finished. total time: 0.002s
C:\adb>fastboot erase system
erasing 'system'...
FAILED (remote: Command not allowed)
finished. total time: 0.001s
If I'm able to erase those, I'm might solved the bootlooping problem..
Try using this thread as reference, http://forum.xda-developers.com/asc...to-fix-soft-bricked-phone-using-twrp-t2886630. It's for a different model so just use your stock ROM in place of the L03 ROM. I'm not sure how to help beyond that. There has to be a way to return to stock on the L02.
Maybe this message is late, pls try following
http://pan.baidu.com/s/1dDpc4eP
http://www.huaweirom.com/rom/mate2/2619.html
usb flash instructions:
http://www.huaweirom.com/guide/2621.html
You may need to use google translate since all the info is in Chinese
Basically they are saying you should use B117 if B4xx not working.
Hello guys,
I tried to root my sony xeperia z4 tablet+ lte and I followed this instruction:
theunlockr.com/2015/09/19/how-to-root-the-sony-xperia-z4-tablet
After I unlocked the bootloader and I did the following step:
"6. Type in the following command into the Command Prompt Window and press Enter:
fastboot flash boot boot.img"
C:\Users\Gmer07\Desktop>fastboot flash boot boot.img
target didn't report max-download-size
sending 'boot' (17056 KB)...
OKAY [ 0.390s]
writing 'boot'...
OKAY [ 0.167s]
finished. total time: 0.562s
does my tablet not start anymore... I dont know what to do.. I bought the tablet this week
syrius007 said:
Hello guys,
I tried to root my sony xeperia z4 tablet+ lte and I followed this instruction:
theunlockr.com/2015/09/19/how-to-root-the-sony-xperia-z4-tablet
After I unlocked the bootloader and I did the following step:
"6. Type in the following command into the Command Prompt Window and press Enter:
fastboot flash boot boot.img"
C:\Users\Gmer07\Desktop>fastboot flash boot boot.img
target didn't report max-download-size
sending 'boot' (17056 KB)...
OKAY [ 0.390s]
writing 'boot'...
OKAY [ 0.167s]
finished. total time: 0.562s
does my tablet not start anymore... I dont know what to do.. I bought the tablet this week
Click to expand...
Click to collapse
Android version ?
Firmware version ?
@AndroPlus kernel version?(make sure you downloaded the correct version for you tablet model: SGP 771 for the LTE)
Windows version
In command prompt Type fastboot Devices, if there is no number the windows driver not correctly installed
After unlocking the bootloader did you make a reboot ? (If so you should not enable MyXperia)
you better follow the advice on Androplus' website
There are different kernels for SONYs ROMs.
You should first update to the latest SONY ROM.
Then flash a recovery (also from Androplus) and then the latest kernel (aka boot.img, easier from recovery).
You also need to flash SuperSU - follow the instructions on Androplus' website.
Current status of my phone:
I unlocked my bootloader via @huaweihax method (SLOCK). I couldn't install the 4pda zip thingy that unlocks your bootloader permanently and prevents EMUI 9 from locking your bootloader. Is there any alternatives for that?
I want to install Android 11 on my phone.
My phone is ANE-LX1 (vendor: hw, region: eu).
How can I install LineageOS 18 without losing my unlocked bootloader and my root?
Currently I have EMUI 8 installed with May 2018 security patch.
I have Magisk installed (that app gives me root access).
With the help of ROM Manager I booted into 3.2.1-0 Catuva21 TWRP recovery and finally, I could flash that 4pda zip file! ROM Manager is not neeeded but it makes things easier.
Hmmm, apperantly it was supposed to factory reset my device but I think I selected the wrong thing on my device. I guess what you choose is highlighted in white and not red. Here's the output of fastboot:
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem unlock TishSerg_For4pda
...
(bootloader) The device will reboot and do factory reset...
FAILED (status read failed (Unknown error))
finished. total time: 38.370s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem unlock TishSerg_For4pda
...
FAILED (remote: already fastboot unlocked)
finished. total time: 0.012s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot reboot
rebooting...
finished. total time: 0.027s
Should I be worried about this?
If you have flashed theTishSerg_For4pda zip you should be able to do
fastboot oem unlock TishSerg_For4pda
which should give you the warning screen with the red and white yes/no options.
I upgraded from stock 8.0 to stock 9.1 (dload method) and was able to unlock my bootloader again using the same command. I could then flash LOS 17.
Edit: if I remember correctly, I flashed the zip with a TWRP-oreo-smart.img recovery.
An3skmbi said:
If you have flashed theTishSerg_For4pda zip you should be able to do
fastboot oem unlock TishSerg_For4pda
which should give you the warning screen with the red and white yes/no options.
I upgraded from stock 8.0 to stock 9.1 (dload method) and was able to unlock my bootloader again using the same command. I could then flash LOS 17.
Edit: if I remember correctly, I flashed the zip with a TWRP-oreo-smart.img recovery.
Click to expand...
Click to collapse
Thanks!
Yap, I figured this out eventually. If anyone else is looking to do this, follow this!