[ULTIMATE GUIDE] How To Unbrick your Moto G6 Plus - Moto G6 Plus Guides, News, & Discussion

​THIS GUIDE IS FOR THE MOTO G6 PLUS ONLY AND IT'S NOT 100% GUARANTEED TO WORK.
WORKED ON MY G6 PLUS (XT1926-7) AND SOME OTHER USERS ON WINDOWS.
THINGS YOU WILL NEED:
Motorola and Qualcomm Drivers;
BlankFlash file;
Stock ROM;
STEPS:
PART 1: PREPARING YOUR PC!!!​
STEP 1: Install Motorola and Qualcoom Drivers (Install the Qualcomm Driver according to your Windows version. Example: Win x64-> driver 64 bits, win x86-> driver 86 bits) (To find out which version of your windows you have, press the WIN + Pause Break keys and see System type session for the version.);
STEP 2: After installing the drivers, put your PC into test mode.
Open the "CMD " as Administrator and run the following commands:
bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING ON
STEP 3: Reboot your pc.
PART 2: RECOVERING THE PHONE!!!​
STEP 1: Extract the Blankflash.zip file to a folder;
STEP 2: With the Phone plugged into your PC, hold the buttons "Vol-" + "Power" for about 15 to 30 seconds, when you hear a sound like that of a USB stick being plugged, run immediately the blank-Flash.bat file, when the CMD window opens, immediately release the buttons and wait to finish the process. (You need to be quick in this step.) (If it does not work, repeat this step until the CMD does not display errors or the phone boot.)
Your device should now enter FastBoot mode.
STEP 3: Follow the walkthrough that I left in the LINK of the stock ROM, there teaches how to install the stock ROM on your phone.
OBS: Flash the stock ROM with the computer still in test mode!!!
PART 3: RECONFIGURING THE PC!!!​
STEP 1: Let's now take the PC out of the test mode and get back to normal.
Open the "CMD " as Administrator and run the following commands:
bcdedit -set loadoptions ENABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING OFF
STEP 2: Reboot your pc.
THE END!​​
SPECIAL THANKS TO:
@erfanoabdi and @vache by BlankFlash file;
@Xplorer4x4 and @ahmed.al by procedure;
@lohanbarth by Stock ROM flash procedure;
And for everyone in the group evertdev on Telegram t.me/evertdev

---

Thank you, my G6+ is functional again after hardbricking it (XT1926-3 model)!

---

Can anyone please help me and tell what I'm doing wrong? I'm unable to revive my phone even after trying this method.
Code:
**** Log buffer [000001] 2019-01-23_11:16:02 ****
[ 0.000] Opening device: \\.\COM8
[ 0.000] Detecting device
[ 0.000] ...cpu.id = 172 (0xac)
[ 0.000] ...cpu.sn = 359336856 (0x156b0b98)
[ 0.000] Opening singleimage
[ 0.000] Loading package
[ 0.016] ...filename = pkg.xml
[ 0.016] Loading programmer
[ 0.016] ...filename = programmer.elf
[ 0.016] Sending programmer
[ 0.203] Handling things over to programmer
[ 0.203] Identifying CPU version
[ 0.203] Waiting for firehose to get ready
[ 61.433] Waiting for firehose to get ready
[123.817] ...SDM630 unknown
[123.817] Determining target secure state
[123.817] Waiting for firehose to get ready
[184.784] ...secure = no
[184.847] Initializing storage
[184.847] Waiting for firehose to get ready
[245.817] Configuring device...
[245.817] Waiting for firehose to get ready
[306.826] Waiting for firehose to get ready
[367.579] Waiting for firehose to get ready
[428.267] Waiting for firehose to get ready
[489.080] Initializing storage
[489.083] Waiting for firehose to get ready
[549.380] Configuring device...
[549.380] Waiting for firehose to get ready
[610.362] Waiting for firehose to get ready
[671.339] Waiting for firehose to get ready
[732.026] Waiting for firehose to get ready
[792.759] Waiting for firehose to get ready
[853.616] Configuring device...
[853.616] Waiting for firehose to get ready
[914.847] Waiting for firehose to get ready
[976.077] Waiting for firehose to get ready
[1037.307] Waiting for firehose to get ready
[1098.537] ERROR: do_package()->do_recipe()->do_configure()->fh_send()->get_fh()->no response
[1098.537] Check qboot_log.txt for more details
[1098.537] Total time: 1098.537s
[1098.537] There were some hiccups in backup and restore.
[1098.537] Please save the following files and see a Bootloader member.
[1098.537] 1) ./qboot_log.txt
[1098.537] 2) ./backup_0x156B0B98_2019-01-23_111907.img
[1098.537]
[1098.537]
[1098.537] qboot version 3.86
[1098.537]
[1098.537] DEVICE {
[1098.537] name = "\\.\COM8",
[1098.537] flags = "0x64",
[1098.537] addr = "0x22FD74",
[1098.537] sahara.current_mode = "0",
[1098.537] api.buffer = "0x1D30020",
[1098.537] cpu.serial = "359336856",
[1098.537] cpu.id = "172",
[1098.537] cpu.sv_sbl = "1",
[1098.537] cpu.name = "SDM630",
[1098.537] storage.type = "eMMC",
[1098.537] sahara.programmer = "programmer.elf",
[1098.537] module.firehose = "0x1C841E8",
[1098.537] cpu.ver = "0",
[1098.537] cpu.vername = "unknown",
[1098.537] api.bnr = "0x1C8F228",
[1098.537] }
[1098.537]
[1098.537]
[1098.537] Backup & Restore {
[1098.537] num_entries = 32,
[1098.537] restoring = "false",
[1098.537] restore_error = "not started",
[1098.537] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1098.537] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1098.537] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1098.537] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1098.537] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1098.537] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1098.537] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1098.537] entries[07] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sp"},
[1098.537] entries[08] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_a"},
[1098.537] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1098.537] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1098.537] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1098.537] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_a"},
[1098.537] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1098.537] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_a"},
[1098.537] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1098.537] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1098.537] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_a"},
[1098.537] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1098.537] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_a"},
[1098.537] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_b"},
[1098.537] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1098.537] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1098.537] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1098.537] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_b"},
[1098.537] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1098.537] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_b"},
[1098.537] entries[27] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1098.537] entries[28] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1098.537] entries[29] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_b"},
[1098.537] entries[30] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1098.537] entries[31] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_b"},
[1098.537] simg = {
[1098.537] filename = "backup_0x156B0B98_2019-01-23_111907.img",
[1098.537] entries[00] = { size = 606912, name = "programmer.elf" },
[1098.537] }
[1098.537] }
[1098.537]

---

Thank you very much. Is funcional. but i have this problem:
Microsoft Windows [Versión 10.0.17134.648]
(c) 2018 Microsoft Corporation. Todos los derechos reservados.
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash partition gpt.bin
target reported max download size of 536870912 bytes
sending 'partition' (37 KB)...
OKAY [ -0.000s]
writing 'partition'...
(bootloader) Validating 'gpt.default.xml'
(bootloader) Committing 'gpt.default.xml'
(bootloader) - flashing 'gpt_main0.bin' to 'partition:0'
OKAY [ 0.132s]
finished. total time: 0.138s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash bootloader bootloader.img
target reported max download size of 536870912 bytes
sending 'bootloader' (9520 KB)...
OKAY [ 0.310s]
writing 'bootloader'...
(bootloader) Validating 'bootloader.default.xml'
(bootloader) Committing 'bootloader.default.xml'
(bootloader) - flashing 'xbl.elf' to 'xbl'
(bootloader) - flashing 'prov64.mbn' to 'prov'
(bootloader) - flashing 'cmnlib.mbn' to 'cmnlib'
(bootloader) - flashing 'cmnlib64.mbn' to 'cmnlib64'
(bootloader) - flashing 'abl.elf' to 'abl'
(bootloader) - flashing 'keymaster.mbn' to 'keymaster'
(bootloader) - flashing 'storsec.mbn' to 'storsec'
(bootloader) - flashing 'rpm.mbn' to 'rpm'
(bootloader) - flashing 'pmic.elf' to 'pmic'
(bootloader) - flashing 'hyp.mbn' to 'hyp'
(bootloader) - flashing 'tz.mbn' to 'tz'
(bootloader) - flashing 'devcfg.mbn' to 'devcfg'
OKAY [ 0.216s]
finished. total time: 0.526s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash logo logo.bin
target reported max download size of 536870912 bytes
sending 'logo_a' (2384 KB)...
OKAY [ 0.069s]
writing 'logo_a'...
OKAY [ 0.031s]
finished. total time: 0.116s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash boot boot.img
target reported max download size of 536870912 bytes
sending 'boot_a' (18689 KB)...
OKAY [ 0.617s]
writing 'boot_a'...
(bootloader) Preflash validation failed
FAILED (remote failure)
finished. total time: 1.003s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash dsp dspso.bin
target reported max download size of 536870912 bytes
sending 'dsp_a' (16384 KB)...
OKAY [ 0.517s]
writing 'dsp_a'...
OKAY [ 0.132s]
finished. total time: 0.648s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash oem oem.img
target reported max download size of 536870912 bytes
sending 'oem_a' (116268 KB)...
OKAY [ 3.741s]
writing 'oem_a'...
(bootloader) *****************************************************
(bootloader) WARNING: OEM images are required in the LOCKED state.
(bootloader) Flashing images can result in a non-boot condition.
(bootloader) Flash a proper OEM signed boot.img first.
(bootloader) *****************************************************
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 3.810s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash bluetooth BTFM.bin
target reported max download size of 536870912 bytes
sending 'bluetooth_a' (4556 KB)...
OKAY [ 0.163s]
writing 'bluetooth_a'...
OKAY [ 0.053s]
finished. total time: 0.216s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.0
target reported max download size of 536870912 bytes
sending 'system_a' (516968 KB)...
OKAY [ 16.642s]
writing 'system_a'...
(bootloader) *****************************************************
(bootloader) WARNING: OEM images are required in the LOCKED state.
(bootloader) Flashing images can result in a non-boot condition.
(bootloader) Flash a proper OEM signed boot.img first.
(bootloader) *****************************************************
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 16.711s
C:\Users\Universal\Downloads\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml\EVERT_OPW27.113-45_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>
Click to expand...
Click to collapse
The problem is I can not enable the OEM, I do not have access to the operating system, and neither does it let me unlock the OEM with the Motorola code. Any idea how to recover the device?

---

alangersain said:
Thank you very much. Is funcional. but i have this problem:
I can not enable the OEM, I do not have access to the operating system, and neither does it let me unlock the OEM with the Motorola code. Any idea how to recover the device?
Click to expand...
Click to collapse
Did you find a solve for this by any chance, same boat here. Thanks to the Lenovo Rescue utility..

---

Alguém encontrou a solução do bricked para o moto g6 xt1925? Preciso do blankflash ou algum modo de recuperar o moto g6!

---

can you gyz help me. I need blank flash file for MOTO G6 but i didnt find anywhere. Now i am stuck in dead motorola g6 :crying::crying:

---

Tried the blankflash on my hard brick Moto G7 Plus, but as expected, didn't work.
Code:
**** Log buffer [000001] 2019-08-18_19:22:01 ****
[ 0.000] Opening device: \\.\COM5
[ 0.002] Detecting device
[ 0.005] ...cpu.id = 204 (0xcc)
[ 0.005] ...cpu.sn = 255476381 (0xf3a429d)
[ 0.007] Opening singleimage
[ 0.014] Loading package
[ 0.016] Failed identify board. Wrong package?
[ 0.017] ERROR: error loading package
[ 0.017] Check qboot_log.txt for more details
[ 0.019] Total time: 0.020s
[ 0.020]
[ 0.020] qboot version 3.86
[ 0.020]
[ 0.020] DEVICE {
[ 0.020] name = "\\.\COM5",
[ 0.020] flags = "0x64",
[ 0.020] addr = "0x62FD54",
[ 0.020] sahara.current_mode = "3",
[ 0.020] api.buffer = "0x2A70020",
[ 0.020] cpu.serial = "255476381",
[ 0.020] cpu.id = "204",
[ 0.020] cpu.sv_sbl = "0",
[ 0.020] api.bnr = "0x29B18A0",
[ 0.020] }
[ 0.020]
[ 0.020]
[ 0.020] Backup & Restore {
[ 0.020] num_entries = 0,
[ 0.020] restoring = "false",
[ 0.020] backup_error = "not started",
[ 0.020] restore_error = "not started",
[ 0.020] }
[ 0.020]
To get a new thread for Moto G7 Plus, I've created following thread:
https://forum.xda-developers.com/g7-plus/development/hard-brick-moto-g7-plus-downgrade-t3958608
Maybe someone could help me out

---

Hi guys, the method worked for me on my G6 Plus in Linux. The trick is that after flashing a few files, the bootloader throws an error. You have to disconnect the device and reconnect the device whenever you see an error.
To explain more clearly, the bat file that windows guys use contains all the commands one by one. Regardless of whether it fails or succeeds, the script continues and gives you the final error. You need to execute the commands manually i.e. you would type "fastboot .............." and hit enter and then the next command and so on. If it throws an error anywhere, just disconnect and reconnect and try the step again. This time, it will work

---

Moto G7 Power
Hi luiz_neto, I need some help please I've bricked two G7 Power Amazon 32 GB phones is there anyway you guys could make a blankflash for the G7 Power I saw that you made one for the G6 Plus as well I would really appreciate it I don't have access to fastboot I'm stuck in Qualcomm HS-USB QDLoader 9008.

---

masonw1999 said:
Hi luiz_neto, I need some help please I've bricked two G7 Power Amazon 32 GB phones is there anyway you guys could make a blankflash for the G7 Power I saw that you made one for the G6 Plus as well I would really appreciate it I don't have access to fastboot I'm stuck in Qualcomm HS-USB QDLoader 9008.
Click to expand...
Click to collapse
The blank flash is a file leaked from the chip manufacturer,
The blank flash will only work for a specific chip.
A mmcblk0.img can be pulled from a working device, but it must be the same model.

---

G7 Power
@sd_shadow
Thanks for the info shadow I have the XT1955-5 model I believe you said you have the same one I tried the mmcblk0.img it didn't work for me either is there anyway you can get it working I would really appreciate it.

---

Hi, i have a similar problem but not the same. Several g6 plus get the red message with the yellow lines:
No bootable A/B slot
Failed to boot linux, falling back to fastboot.
On this state, the phone doesn't flash in fastboot (normally it can't swith to fastboot). I was thinking on try blankflash it, but the phone is recognized in fastboot mode. I'd even tried removing the battery. Is there any way to make it recognize as qualcomm dead mode to try with blankflash? Any testpoint or something? It's funny that we can recover dead phones and not an almos alive phone.
Thanks in advance.

---

gringos said:
Hi, i have a similar problem but not the same. Several g6 plus get the red message with the yellow lines:
No bootable A/B slot
Failed to boot linux, falling back to fastboot.
Thanks in advance.
Click to expand...
Click to collapse
Just answering myself. To get into Qualcomm mode use the 2 testpoints at the left side of the camera.
I used the blankflash but the problem of the bootable slot goes on.

---

motorola/aljeter/aljeter:9/PPPS29.55-35-12-3/a0b9b:user/release-keys ,help dowmload
---------- Post added at 02:48 AM ---------- Previous post was at 02:27 AM ----------
motorola/aljeter/aljeter:9/PPPS29.55-35-12-3/a0b9b:user/release-keys

---

G6 Plus not work on wifi no oem unlock function
Hey Guys, my moto G6plus has a blocked bootloader and does not work on wifi internet or operator chip. The unlock oem function does not activate. How could I activate the oem function without internet or unlock the bootloader?

---

Download
blankflash.zip
for the Motorola Moto G6 Plus(Evert), by erfanoabdi
OOPS!
no mirrors found.

---

Greetings Comrade!
Please tell us whether this method will work for Motorola Moto G 6.
Not a plus, but a regular Moto G 6?

---

ZulC_Silence said:
Please tell us whether this method will work for Motorola Moto G 6.
Not a plus, but a regular Moto G 6?
Click to expand...
Click to collapse
You could use the mmcblk0 file method which is located in moto g5 thread for unbricking the device.

---

thanks, it's worked fine
I accidentally selected slot b on recovery and my phone wasn't turning on
blankflash revived the phone thanks again man
you're a life saver