Question [SOLVED] Stuck at boot on a locked device - Asus Zenfone 9

I have flashed (fastboot method) twrp.img to my locked device and now I'm stuck at boot. At first I was getting boot loop and "corrupt" message (g.co/ABH). Luckily, I could still access fastboot mode. By looking around, I managed to remedy that a bit by:
Code:
$ wget https://dlcdnets.asus.com/pub/ASUS/ZenFone/AI2202/UL-ASUS_AI2202-ASUS-33.0804.2060.100-1.1.1-2302-user.zip
$ unzip *zip
$ payload_dumper payload.bin
$ for i in boot dtbo vendor_boot vbmeta vbmeta_system
do
fastboot flash $i output/$i.img
done
$ fastboot reboot fastboot
# these will fail due to resizing partitions on a locked device
$ for i in system system_ext product odm vendor
do
fastboot flash $i output/$i.img
done
Resizing partition ... (Can't in locked state)
Now I get bootloader, fastbootd, and stock recovery. Wiping/resetting in recovery mode almost succeeds:
Code:
misc_vab_msg.version: 0x2
misc_vab_msg.magic: ...
misc_vag_msg.merge_status: 0x0
misc_vag_msg.source_slot: 0x1
-- Wiping data...
E:Open failed: /metadata/ota: No such file or directory
-- Clean boot sound files...
Formatting /data...
Formatting /metadata...
-- Data wipe complete.
At this point, restarting the system results in the device turning itself off a few seconds after the ASUS logo.
My phone is on stock firmware 33.0804.2060.100 (android 13). Could someone kindly help me and tell me what to do next?
Here's all the info I can get now:
Code:
$ fastboot oem device-info
(bootloader) Verity mode: false
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) Device authorized: false
(bootloader) Device authorized2: false
(bootloader) WaterMask unlock: N
(bootloader) XBL:
(bootloader) ABL: 0.0.029.0-WW-user
(bootloader) SSN: ...
(bootloader) ISN: ...
(bootloader) IMEI: ...
(bootloader) IMEI2: ...
(bootloader) CID: ASUS
(bootloader) COUNTRY: EU
(bootloader) Project: DAVINCI
(bootloader) DT ID: 66
(bootloader) SB: Y
(bootloader) SBNR: Y
(bootloader) DDR Manufacturer ID: 1
(bootloader) DDR Device Type: 8
(bootloader) TotalDMCounter: 0
(bootloader) DMCounter: 0
(bootloader) SlotARetryCounter: 0
(bootloader) SlotAUnbootableCounter: 0
(bootloader) SlotBRetryCounter: 0
(bootloader) SlotBUnbootableCounter: 0
(bootloader) BOOT_COUNT: 0
(bootloader) LOCK_COUNT: 0
(bootloader) Check_APDP: 1
(bootloader) rawdump_en: false
(bootloader) force start logcat-asdf: false
(bootloader) Current Slot: a
(bootloader) Slot_a bootable: Bootable
(bootloader) AVB Verity: Enable
(bootloader) Verify vbmeta ret: 0
(bootloader) ABL_FTM: FALSE
(bootloader) UART-ON Status: false

---

I have a feeling that I'm not using the right image for this purpose. I don't know how to get my hands on a RAW image. I keep reading about some android beta page, but just can't find a link for Zenfone 9.

---

You dont need any raw fw, flash stock recovery and reboot:
fastboot flash recovery recovery.img
Download Data package from February 25th.
Size of the data package: 100 MB. Free transfer of up to 6 GB of photos, videos and documents. Send large files via email or a link to share. No registration, no ads, just simple file sharing!
filetransfer.io
Recovery from UL-ASUS_AI2202-ASUS-33.0804.2060.100

---

@NisseGurra thanks for your input. I checked the md5sum of your recovery image and the one I extracted from the payload.bin. They are indeed the same. I have flashed it alright:
Code:
$ fastboot flash recovery recovery.img
Sending 'recovery' (102400 KB) OKAY [ 3.396s]
Writing 'recovery' OKAY [ 0.162s]
Finished. Total time: 3.570s
Now, what should I do? reboot to bootloader -> recovery? then what?
Because still letting the device boot normally will lead to its shutdown in 20 seconds.

---

lordbit said:
@NisseGurra thanks for your input. I checked the md5sum of your recovery image and the one I extracted from the payload.bin. They are indeed the same. I have flashed it alright:
Code:
$ fastboot flash recovery recovery.img
Sending 'recovery' (102400 KB) OKAY [ 3.396s]
Writing 'recovery' OKAY [ 0.162s]
Finished. Total time: 3.570s
Now, what should I do? reboot to bootloader -> recovery? then what?
Because still letting the device boot normally will lead to its shutdown in 20 seconds.
Click to expand...
Click to collapse
Seems something got messed up.
You have some options: find an recovery that have adb sideload support: flash the stock fw from it,
adb sideload xxx.zip
Option 2
Repack the stock fw (use payload dumper to extract all img), create an folder with all extracted img and add adb.exe, fastboot.exe, AdbWinApi.dll, AdbWinUsbApi.dll and install.bat (attached, rename to .bat)
Connect phone, enter fastboot and click on the bat file, it should install full rom.

---

Thanks! I will try it.

---

I tried your second method. Most of the images got flashed alright, except these ones:
Code:
Sending 'odm' (1248 KB) OKAY [ 0.055s]
Writing 'odm' FAILED (remote: '(odm_a) No such partition')
fastboot: error: Command failed
Sending sparse 'product' 1/4 (524236 KB) OKAY [ 19.285s]
Writing 'product' FAILED (remote: 'Partition not found')
fastboot: error: Command failed
Sending sparse 'system' 1/7 (524232 KB) OKAY [ 19.632s]
Writing 'system' FAILED (remote: 'Partition not found')
fastboot: error: Command failed
Sending 'system_ext' (386600 KB) OKAY [ 14.180s]
Writing 'system_ext' FAILED (remote: '(system_ext_a) No such partition')
fastboot: error: Command failed
Sending sparse 'vendor' 1/3 (524176 KB) OKAY [ 18.675s]
Writing 'vendor' FAILED (remote: 'Partition not found')
fastboot: error: Command failed
Sending 'vendor_dlkm' (73448 KB) OKAY [ 2.577s]
Writing 'vendor_dlkm' FAILED (remote: '(vendor_dlkm_a) No such partition')
fastboot: error: Command failed
I think those should be flashed after a
Code:
fastboot reboot fastboot
But in that case, the "flash" command will try to resize the partitions and I get an error that says "Resizing in a locked state of the device is not possible". I am paraphrasing here.

---

Option 3, install https://forum.xda-developers.com/t/paranoid-android-topaz-alpha-1-asus-zenfone-9.4557631/
Use the suggested image way. It install new recovery, if i rember correct it has adb support
Reboot recovery and use option2
​

---

@NisseGurra sorry if my question seems dumb. But I have not unlocked my bootloader (when I had the chance). Do these recovery.img methods with adb work for me?

---

lordbit said:
@NisseGurra sorry if my question seems dumb. But I have not unlocked my bootloader (when I had the chance). Do these recovery.img methods with adb work for me?
Click to expand...
Click to collapse
If you bootloader is locked so you cant flash anything not signed by Asus, no twrp etc, So strange it got messed up

---

Yeah it's weird that you could flash anything at all, that isn't signed
anyway, it seems like you where able to flash the asus recovery?
can you boot it?
If so try booting it and tipe "adb reboot sideload" if everything goes well it should reboot and allow you to sideload unmodified (asus signed) .zips, do this
Also consider data wipe from recovery

---

Darkmasterhk said:
Yeah it's weird that you could flash anything at all, that isn't signed
anyway, it seems like you where able to flash the asus recovery?
can you boot it?
If so try booting it and tipe "adb reboot sideload" if everything goes well it should reboot and allow you to sideload unmodified (asus signed) .zips, do this
Also consider data wipe from recovery
Click to expand...
Click to collapse
1. I pressed power button + vol-up, ended up in "bootloader" menu.
2. Chose "Recovery mode"
3. At this point, on my laptop, I executed "adb reboot sideload" as you suggested.
However, I am prompted with an error that this device is unauthorized.
Code:
adb devices
List of devices attached
N...P unauthorized
How can I "authorize" this? When I had access to fully-booted system, I just needed to confirm some dialogue. Here there is no question.

---

Aww that's bad, I don't know how to allow a device from recovery, sorry.
Usually, if it worked under Android itself, it works in recovery as well.
Just to make sure, it worked under Android, right?
I assume u use a Linux system and I somehow had trouble under Linux, with adb and authorization

---

Yes, "adb" did work between my Linux system and phone before it gets stuck in this mode.

---

I managed to fix the problem by using a RAW image from romdevelopers. Extracted the content of the zip file and executed "flashall_AFT.cmd" on a Windows machine with the right drivers installed.
For the record, these posts [1][2] are pretty close to what I did.
Thank you both for your support.
EDIT:
I converted the "flashall_AFT.cmd' to "flashall_AFT.sh", so I could be able to achieve the same on a Linux system. USE IT AT YOUR OWN RISK.