Root Bootloader Unlock & Back to Stock for Motorola E4 Plus "owens"

[bcrichster]

MOTO E4 PLUS XT1776

I put this Together from some of my trial & errors plus some info from a few threads on XDA, Hope this helps you as much as me

Bootloader Unlock:
WARNING: UNLOCKING YOUR BOOTLOADER VOIDS YOUR WARRANTY.PROCEED AT YOUR OWN RISK.
NOTE: Unlocking the bootloader will Wipe/ factory reset your device, and will delete all personal data from your device such as apps, photos, messages, and settings.

INSTRUCTIONS:

1. Make sure to take a backup of your entire device data.
2. Download the Android SDK OR Download the Minimal ADB and Fastboot
   
3. Install the latest Motorola USB Drivers on your desktop found here: http://www.mymotocast.com/download/MDM?platform=windows.
4. Put your device in fastboot mode (power off, then press the power and volume down buttons simultaneously).
   
5. Open Command Prompt on androidsdk/platform-tools/ (Hold Shift and right click and press open command window here)
   
6. Connect your Phone to PC
   
7. Type this in the CMD prompt window - fastboot devices
8. If all's well, you'll get a short string return..
9. Next, type this in the CMD window - fastboot oem get_unlock_data
10. You will get a return string. Copy it. [Right Click-Mark- Mark the text by pressing the shift key-Now press Ctrl+C]
    
11. Paste all the lines together in a notepad. Remove the empty spaces ONLY.
    
12. Now go to the Motorola Site.: https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-b ..Sign in using your Google account or Motorola ID. Scroll down the page and paste the copied string in the field at step #6. Then click on ‘Can my device be unlocked?’, after which a "REQUEST UNLOCK KEY" button will appear at the bottom of page.
13. To get your unlock key, select the ‘I Agree’ option. Note: You will receive an email with your Unlock Key at the email address you used to log in there.
    
14. Important – Copy the 20-character key that Motorola sent you via email. Make sure your device is connected.
    
15. Then in CMD type: fastboot devices (To check your device is connected)
    
16. Then type: fastboot oem unlock UNIQUE_KEY
    
    NOTE: In above command, replace the word ‘UNIQUE_KEY’ with the unlock code that you got via email. Then hit enter and the unlocking process should begin. Wait for a while and soon you’ll see ‘Bootloader Unlocked’ warning on your Moto E.
    
    To relock the bootloader:
    
    Go to Fastboot and give the command -

• fastboot oem lock

Motorola Tutorial -

• https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a

Check recovery/ TWRP image:
In terminal, type or copy/paste:

• fastboot boot recovery.img

Flash recovery/TWRP image:
In terminal, type or copy/paste:

• fastboot flash recovery recovery.img

1. Now press the volume buttons (while still in fastboot mode) until ya see RECOVERY MODE, then press pwr button and it'll boot into TWRP.
2. Wipe only the caches and reboot right back to recovery. Yes, You need to do reboot recovery to help set it or the device will otherwise swap TWRP with the Stock Recovery and you'll have to reflash again.
3. Adjust TWRP Settings/preferences, like enable md5sum checking. Do NOT enable "rm -rf"..trust me, Lol.
4. Reboot Recovery last time and MAKE A BACKUP!!

OK.. When ya wipe data to remove encryption:

• Format 1st (type YES & hit enter)
• Immediately afterwards do a normal data swipe, you'll get red lettering and it'll protest and ask ya to reboot for data function but instead of a normal rebooting, you should..
• Directly reboot recovery and repeat until all red lettering and warnings cease
• Now you can install ROMs at leisure without issues

Completely back to Stock.

First get your stock firmware here, the only place to get Moto stock firmware.

• https://firmware.center/firmware/Motorola/Moto E4 Plus/Stock/
  
• https://mirrors.lolinet.com/firmware/moto/owens/official/
  
• https://androidfilehost.com/?a=show&w=files&flid=262609
• US_Cellular - https://androidfilehost.com/?fid=5862345805528054969

WINDOWS:

Then get fastboot. Google fastboot or grab the one from here, This one still works:
https://www.androidfilehost.com/?fid=962339331459002428

Copy the extracted files to you ADB/Fastboot installaton folder (usually in like, C:windows/programfiles/x86/minimal-adb_whatever)
- or -
Go to the folder where you put everything, open up a command or powershell prompt. Hold down shift, right click, "open command window here".

You can copy/paste the entire thing and past it in your command window at one time or even type it out.... line by line.
Start by checking to see if the PC sees the device:

fastboot devices


Commands:

fastboot oem fb_mode_set
fastboot flash gpt gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash modem NON-HLOS.bin
fastboot flash fsg fsg.mbn
fastboot erase modemst1
fastboot erase modemst2
fastboot flash dsp adspso.bin
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash oem oem.img_sparsechunk.0
fastboot flash oem oem.img_sparsechunk.1
fastboot erase cache
fastboot erase userdata
fastboot erase ddr
fastboot oem fb_mode_clear
fastboot reboot


LINUX:
No drivers to stress or anything. Just extract the Firmware zip, open the folder and right-click inside to open a terminal and use these commands. They're the same thing as above, just the added word "sudo". You can copy/paste the entire thing and past it in your command terminal at one time or even type it out.... line by line.
Start by checking to see if the PC sees the device:

sudo fastboot devices


Commands:

sudo fastboot oem fb_mode_set
sudo fastboot flash gpt gpt.bin
sudo fastboot flash bootloader bootloader.img
sudo fastboot flash modem NON-HLOS.bin
sudo fastboot flash fsg fsg.mbn
sudo fastboot erase modemst1
sudo fastboot erase modemst2
sudo fastboot flash dsp adspso.bin
sudo fastboot flash logo logo.bin
sudo fastboot flash boot boot.img
sudo fastboot flash recovery recovery.img
sudo fastboot flash system system.img_sparsechunk.0
sudo fastboot flash system system.img_sparsechunk.1
sudo fastboot flash system system.img_sparsechunk.2
sudo fastboot flash system system.img_sparsechunk.3
sudo fastboot flash system system.img_sparsechunk.4
sudo fastboot flash system system.img_sparsechunk.5
sudo fastboot flash oem oem.img_sparsechunk.0
sudo fastboot flash oem oem.img_sparsechunk.1
sudo fastboot erase cache
sudo fastboot erase userdata
sudo fastboot erase ddr
sudo fastboot oem fb_mode_clear
sudo fastboot reboot


======================================
** Sources **

• https://forum.xda-developers.com/moto-e4-plus/how-to/moto-e4-qualcomm-owens-completely-to-t3743441
• https://forum.xda-developers.com/moto-e4-plus/development/twrp-twrp-moto-e4-plus-qualcomm-t3697154

If this helped or ya like my work, plz hit Thanks in the OP's (1st post).

While donating is not required to use this Guide, it's certainly appreciated.
DONATIONS:
https://www.paypal.me/bcrichster
.
.
.
.
.
.
.
.

 

[bcrichster]

mmcblk0
for unbricking Moto E4 Plus (owens).
​

Use this guide but use the mmcblk0 choices below for your specific device:
https://forum.xda-developers.com/g5/how-to/rooted-moto-g5-run-morning-post-image-t3776012/amp/

Make sure you use correct image for your specific device.
​

• XT1776: https://www.androidfilehost.com/?fid=1322778262904029878

• XT1775: (untested) uploaded by @ismail0100 https://www.mediafire.com/file/971bkqxargh97a1/mmcblk0.7z/file

UNbrick.zip by Jason M.
By now you should be able to boot from sdcard and access fastboot to boot into TWRP.
- Remove sdcard!!
- Flash below zip from TWRP recovery via PC & adb sideload.

• https://androidfilehost.com/?fid=11410932744536992953

 

[bcrichster]

Op updated with TWRP flashing info, I apologize for not having it available earlier. Hope this helps

 

[JesseKnows]

The firmware link in OP is elided : https://firmware.center/firmware/Mot... Plus/Stock/
The tools link is also elided: https://forum.xda-developers.com/sho....php?t=2317790

Pretty please, can that be fixed?

Jesse

 

[bcrichster]

The firmware link in OP is elided : https://firmware.center/firmware/Mot... Plus/Stock/
The tools link is also elided: https://forum.xda-developers.com/sho....php?t=2317790

Pretty please, can that be fixed?

Jesse

Thank You very much for pointing that out. They did a number on is but I fixed the problem with 1st link. I still have the original FW's I can reUpload sometime later if necessary. As for fastboot, I'll have that uploaded or fixed by lunchtime plus a cpl other NON MS's fkn Windows options, Lol. Really, I don't like Windows for many important reasons. You should consider a Linux distro too, I know a beautiful & simple one for ppl coming from Windows as it' similar & ya don't need drivers and stuff for Linux. Just a thought..

 

[bcrichster]

The firmware link in OP is elided : https://firmware.center/firmware/Mot... Plus/Stock/
The tools link is also elided: https://forum.xda-developers.com/sho....php?t=2317790

Pretty please, can that be fixed?

Jesse

fixed but still needs a PC to access the site

 

[tom1957]

Can someone help. Question when restoring the Owens Build # NCRS26.58-44-9
using RSD Lite, which firmware needed to flash avoiding bricking device, it appears that there is 3 or more firmware to choose from. Thank you for your support

 

[bcrichster]

Can someone help. Question when restoring the Owens Build # NCRS26.58-44-9
using RSD Lite, which firmware needed to flash avoiding bricking device, it appears that there is 3 or more firmware to choose from. Thank you for your support

1. I don't use RDSLite for Stock installation, I just listed it with Moto's tools (Just in case)
2. Use fastboot terminal and all commands are in this thread.
3. Use the one starting with XT1776 or Sprint NCRS28-56-44 (or 56-44-3) cid50

 

[tom1957]

Thank you for your quick response. Just needed a reliable root back to stock in case of a mishap.

 

[bcrichster]

Thank you for your quick response. Just needed a reliable root back to stock in case of a mishap.

No problem, glad to help

 

[marinegundr]

I've got mine on Verizon. How do you stop it from booting to TWRP every time? I have to (from TWRP) reboot to bootloader, then choose 'start' from there in order to boot the phone.

 

[bcrichster]

Not 100% sure about Verizon, but you can try:
fastboot erase ddr
fastboot oem fb_mode_clear
fastboot reboot

 

[Member1660584]

Not 100% sure about Verizon, but you can try:
fastboot erase ddr
fastboot oem fb_mode_clear
fastboot reboot

The carrier shouldn't matter here. If he's on verizon, I would venture he has an xt1775, otherwise he wouldn't have TWRP installed, right? One of those commands should work though. I'm wondering why it's happening though. @marinegundr which recovery version are you using? 3.1.1, 3.2.1 or 3.2.2?

 

[marinegundr]

Hi, it's on 3.1.1-0 for TWRP. I bought it outright and yeah, it's an xt1775. I'd unlocked and rooted it back in December and everything was fine. Just recently I gave it to my wife (was my son's) so I tried wiping /data and /system to reflash but it didn't seem to work. Other than the wonky booting nothing changed.
I've still got everything from it backed up so I might just try and start from scratch with it in the morning.

I also just noticed this thread was for the xt1776 lol.

 

[Member1660584]

Hi, it's on 3.1.1-0 for TWRP. I bought it outright and yeah, it's an xt1775. I'd unlocked and rooted it back in December and everything was fine. Just recently I gave it to my wife (was my son's) so I tried wiping /data and /system to reflash but it didn't seem to work. Other than the wonky booting nothing changed.
I've still got everything from it backed up so I might just try and start from scratch with it in the morning.

I also just noticed this thread was for the xt1776 lol.

The XT1776 and XT1775 are mostly the same. Fastboot commands flashing stock are slightly different due to the slight difference in number of system and oem sparsechunks in the firmware is one of the most important. The op and myself just have an XT1776 and can only fully support that variant unless we have assistance from users with the XT1775. The commands @bcrichster posted should solve the problem without having to start over.
Edit: wth

 

[marinegundr]

alright, thanks a ton! Just in case, I've still got a twrp backup of the whole thing right after I unlocked it, plus one right after root. TiBu just finished so I might try fastboot in a few, and I think I'll flash your TWRP 3.2.2 also.

 

[marinegundr]

That didn't seem to work so I'll keep fiddling around with it.
The terminal output I'm getting is:

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot erase ddr
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:ddr: not found
erasing 'ddr'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.015s

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem fb_mode_clear
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
OKAY [ 0.009s]
finished. total time: 0.012s​

 

[bcrichster]

That didn't seem to work so I'll keep fiddling around with it.
The terminal output I'm getting is:

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot erase ddr
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:ddr: not found
erasing 'ddr'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.015s

C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem fb_mode_clear
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
OKAY [ 0.009s]
finished. total time: 0.012s​

I know that the 1st time I tried flashing a ROM, I messed something up and reinstalled FirmWare and then tried again. It took me a cpl tries but all went well without the rebooting twrp stuff, so I'm thinking that you may need to reflash the stock FW (not TiBu) and retry the Rooting/ROM process but please be careful as Verizon has many tricks to stop Root..

 

[JesseKnows]

Hello again,

I want to re-lock the device after having unlocked, installed ROMs, then installed stock per above. The bad key message looks strange, plu it seems to increase the boot time by a few seconds as one looks at that message.
This is what I saw as I tried to re-lock (after the last step "fastboot reboot" from above I had set up the stock minimally and rebooted into fastboot):

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) WARNING: This command erases all user data.
(bootloader) Please re-run this command to continue.
OKAY [ 0.200s]
finished. total time: 0.204s

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) Flash valid Android images now
(bootloader) Then re-run this command to lock
OKAY [ 0.207s]
finished. total time: 0.213s

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) Still require signed boot.img
OKAY [ 0.186s]
finished. total time: 0.190s​

But I had installed the stock boot.img as one of the steps above.

Is there as way to get to absence of any gross visible markers that the phone had been unlocked?

FWIW the phone found an update from the web and installed it. A subsequent reboot still shows "bad key".

J

 

[bcrichster]

Hello again,

I want to re-lock the device after having unlocked, installed ROMs, then installed stock per above. The bad key message looks strange, plu it seems to increase the boot time by a few seconds as one looks at that message.
This is what I saw as I tried to re-lock (after the last step 'fastboot reboot' from above I had set up the stock minimally and rebooted into fastboot):

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) WARNING: This command erases all user data.
(bootloader) Please re-run this command to continue.
OKAY [ 0.200s]
finished. total time: 0.204s

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) Flash valid Android images now
(bootloader) Then re-run this command to lock
OKAY [ 0.207s]
finished. total time: 0.213s

C:\>fastboot oem lock
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
...
(bootloader) Still require signed boot.img
OKAY [ 0.186s]
finished. total time: 0.190s​


But I had installed the stock boot.img as one of the steps above.

Is there as way to get to absence of any gross visible markers that the phone had been unlocked?

FWIW the phone found an update from the web and installed it. A subsequent reboot still shows 'bad key'.

J

Yeah.. You forgot to flash the stock FW, (all of it, not just boot.img) and THEN lock it..

 

[JesseKnows]

I do not understand. I followed the all instructions listed in OP, which flash 16 files. The phone is running stock now (well, stock + whatever it had downloaded as an update).
I was emphasizing that the steps in OP did include flashing boot.img, and was wondering why I got the message "Still require signed boot.img"

 

[JesseKnows]

I now tried to repeat the flashing, but added "fastboot oem lock begin" before everything (seemed relevant from https://forum.xda-developers.com/moto-g4-plus/how-to/relock-bootloader-t3459333). Many of the flashes failed (I skipped some sections in the log that repeat the same error):

C:\>fastboot flash gpt gpt.bin
(bootloader) Security version downgrade
(bootloader) Image primary_gpt failed validation
(bootloader) Preflash validation failed
(bootloader) Cancelling 'gpt.default.xml'

C:\>fastboot flash boot boot.img
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:boot: not found
target reported max download size of 536870912 bytes
sending 'boot' (16384 KB)...
OKAY [ 0.864s]
writing 'boot'...
(bootloader) Security version downgrade
(bootloader) Image boot failed validation
(bootloader) Preflash validation failed
FAILED (remote failure)

C:\>fastboot flash recovery recovery.img
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:recovery: not found
target reported max download size of 536870912 bytes
sending 'recovery' (16484 KB)...
OKAY [ 0.868s]
writing 'recovery'...
(bootloader) Security version downgrade
(bootloader) Image recovery failed validation
(bootloader) Preflash validation failed
FAILED (remote failure)

C:\>fastboot flash system system.img_sparsechu
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:system: not found
target reported max download size of 536870912 bytes
sending 'system' (517966 KB)...
OKAY [ 27.042s]
writing 'system'...
(bootloader) Security version downgrade
(bootloader) Image s failed validation
(bootloader) Invalid signed image
(bootloader) Preflash validation failed
FAILED (remote failure)​

And many more of the errors.

Attempting "fastboot oem lock" again failed with

(bootloader) Still require signed boot.img​

The phone seems to work but needed setup again (likely because of "fastboot erase userdata"). It still claims to be on the January 2018 build, which is the update I had let download and install. It's now installing the March update.

Edit: since I have an untouched twin to this phone, with the latest firmware updates, is there a way to extract the correct boot.img file (without impacting the other phone's security) so I can flash it to the device that I want to lock?

 

[bcrichster]

I now tried to repeat the flashing, but added 'fastboot oem lock begin' before everything (seemed relevant from https://forum.xda-developers.com/moto-g4-plus/how-to/relock-bootloader-t3459333). Many of the flashes failed (I skipped some sections in the log that repeat the same error):

C:\>fastboot flash gpt gpt.bin
(bootloader) Security version downgrade
(bootloader) Image primary_gpt failed validation
(bootloader) Preflash validation failed
(bootloader) Cancelling 'gpt.default.xml'

C:\>fastboot flash boot boot.img
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:boot: not found
target reported max download size of 536870912 bytes
sending 'boot' (16384 KB)...
OKAY [ 0.864s]
writing 'boot'...
(bootloader) Security version downgrade
(bootloader) Image boot failed validation
(bootloader) Preflash validation failed
FAILED (remote failure)

C:\>fastboot flash recovery recovery.img
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:recovery: not found
target reported max download size of 536870912 bytes
sending 'recovery' (16484 KB)...
OKAY [ 0.868s]
writing 'recovery'...
(bootloader) Security version downgrade
(bootloader) Image recovery failed validation
(bootloader) Preflash validation failed
FAILED (remote failure)

C:\>fastboot flash system system.img_sparsechu
(bootloader) slot-count: not found
(bootloader) slot-suffixes: not found
(bootloader) slot-suffixes: not found
(bootloader) has-slot:system: not found
target reported max download size of 536870912 bytes
sending 'system' (517966 KB)...
OKAY [ 27.042s]
writing 'system'...
(bootloader) Security version downgrade
(bootloader) Image s failed validation
(bootloader) Invalid signed image
(bootloader) Preflash validation failed
FAILED (remote failure)​


And many more of the errors.

Attempting 'fastboot oem lock' again failed with

(bootloader) Still require signed boot.img​


The phone seems to work but needed setup again (likely because of 'fastboot erase userdata'). It still claims to be on the January 2018 build, which is the update I had let download and install. It's now installing the March update.

Edit: since I have an untouched twin to this phone, with the latest firmware updates, is there a way to extract the correct boot.img file (without impacting the other phone's security) so I can flash it to the device that I want to lock?

There is a newest version in the afh section also linked in OP.. This here, maybe get the latest one and try again.
https://androidfilehost.com/?a=show&w=files&flid=262609

 

[marinegundr]

I know that the 1st time I tried flashing a ROM, I messed something up and reinstalled FirmWare and then tried again. It took me a cpl tries but all went well without the rebooting twrp stuff, so I'm thinking that you may need to reflash the stock FW (not TiBu) and retry the Rooting/ROM process but please be careful as Verizon has many tricks to stop Root..

Thanks, I'll give that a shot. I got this phone off of Amazon unlocked (no amzn ads) so it never had vzw stuff on it to begin with. Now my xt1254 used to be locked down till I finally broke the big Red chains off of it. Now it's running RR Nougat. I might eventually try RR on the e4, but it's my wife's and she just wants a phone and occasionally browse the web lol.

Do you think I'll need the latest TWRP? It's on 3.1.1 and I did not see any links on your guide for the 3.2.2 version.

 

[bcrichster]

Thanks, I'll give that a shot. I got this phone off of Amazon unlocked (no amzn ads) so it never had vzw stuff on it to begin with. Now my xt1254 used to be locked down till I finally broke the big Red chains off of it. Now it's running RR Nougat. I might eventually try RR on the e4, but it's my wife's and she just wants a phone and occasionally browse the web lol.

Do you think I'll need the latest TWRP? It's on 3.1.1 and I did not see any links on your guide for the 3.2.2 version.

The word 'Twp v3.2.2' actually IS the link, try that