Solution to Fairphone3 bootloop
The Problem
The phone had a bootloop. It booted nearly to login, but than it stopped and rebooted.
Then thankfully there was an update available. I installed it via adb sideload.
After the update the bootloop was gone and I could enter the Lockscreen Pin, but
after affirming the PIN. The display would go dark and brought me back to the
locked screen. I tried this several time and saw sometimes the message
System-Ui keeps crashing.
My questions was: What was causing this crashing of the System-Ui?
Luckily there was a notification that said something like “your storage is nearly full”.
The Solution
I did a backup of the userdata partition via edl.py mounted that partition on a
Linux machine. I quickly saw that the partition had zero free space left. I started
to delete some files from the media/0/ folder even though I just saw the encrypted
files. After freeing some space I wrote the whole partition back via edl.py and
the system successfully booted, and I could log in again.
One last thing before we go. The bootloader was never unlocked. It is a stock phone
with stock OS.
More Detailed instructions
All work is done on an Linux Ubuntu 24.04.1 release. You should have basic understanding
of the Unix commandline and Linux in general and also you should know about the dangers of
using the root user. That being said. Lets go!
Installation and setup of needed software
clone edl client software from github
git clone https://github.com/bkerler/edl.git
cd edl
# newer commits did not work for me
git checkout eb215e7
Install required dependencies
As I did not want to mess up my python installation I created a virtual
environment. For more look at /usr/share/doc/python3.12/README.venv
mkdir ~/venv
# create the virtual environment
python3 -m venv ~/venv
# install the edl dependencies
~/venv/bin/python3 -m pip install -r requirements.txt
unload kernel modules/ModemManager
Disable stuff that (might) interfere.
sudo modprobe -r qcserial
sudo systemctl stop ModemManager
get the loader
To use edl.py you need the loader file prog_emmc_firehose_8953_ddr.mbn
(md5sum f9585f7b0bcaf83cd4b48d29f1b6d184). Which is floating around
the internet/this forum.
Reduce the data on the userdata partition
We need to free some space so the system works correctly again. We have to get the
userdata partition from the device and mount it locally on a PC.
copy userdata
Retrieve the userdata partition from your device. First we have to start the phone
in edl mode:
- First you have to power off the phone.
- Next hold volume up and volume down pressed
- plugin the PC connected USB cable into your phone.
- release volume up/down buttons after the phone vibrates
Lets get the userdata partition:
~/venv/bin/python3 ./edl.py r userdata userdata.bin --loader=prog_emmc_firehose_8953_ddr.mbn
# backup userdata
cp userdata.bin userdata.bin.bak
mount the userdata partition
To access the files we have o mount the userdata partition.
sudo mount -o loop userdata.bin /media/loop/
# see the size of your partition:
df -h /media/loop
Filesystem Size Used Avail Use% Mounted on
/dev/loop7 47G 47G 0M 100% /media/loop
access the data on the mounted partition
The mounted partition has to be accessed via root user. Be cautious using root as
you could easily screw your whole system.
# change to root user
sudo su
# get to the data where you might could delete stuff
cd /media/loop/media/0
# list the actual encrypted files with du -hs
# -- is used to ensure filenames are not interpreted as commandline switches
du -hs -- *
4,0K 1ASNvH0ZlNhBg70BJXx2c_ps0g4k1_l7
32K 2EYeXMw3f4yuzpI47iI2Wp6147t-moR8
4,0K 4sF8cnDn0xvQowAfawy_N2hEFzbgQ4W3
4,0K 6rVnZkjHiTAiAqFQrt-dijHhTxTxAbDq
472K 8CtA078kdZr8GJDqqyoIN7GLpMjT77qD
13G 8KPGVb_jVJPZ16dXvk8HY-ApDmndRRfC
4,0K ErjwBi6b4H_qy_ew90P0hZxN354pXUpN
17M gFbECu1Wo6miMpLEC4OBKH9XwyPXLIrl
4,0K IOyXAEI4ubpYEwCujE0BjjJ4JfCBcZKm
13M JOV1n1wtFeqwV-7dd4j4JQYzkLWEjrPK
4,0K lEx_LYEHu7KEOQptTQL6JIEc_oLHU_zp
4,0K misANN8WZ5uZ2qCpaJQfIpFbEWFS74lU
6,7G _NH918RlDPV4E021aq302JM50M8yb5F9
4,0K Nu4gg9bLAmAZqk1lz2O9oktYBYKXeXA4
8,4G rDchjimBjgE5sa2sFgTieiUODjDbH-fZ
998M rINlx5eo1r2XylsnCRObeCy2Y1YzFdgt
16K ytPD36erS6PZlSE9Q32AoFuU0xteOMa7
In my case I tried to figure out what is the download folder from which I could
delete stuff. I decided to delete some stuff in rINlx5eo1r2XylsnCRObeCy2Y1YzFdgt
as it could be the Download folder (but it was not – more on that later).
Ensure to use -- on the rm command to separate commandline switches from filenames.
Eg. if the filename is something like -rfwerfslkeMKAE you might enable some
commandline switches you do not like.
Lets check:
df -h /media/loop
Filesystem Size Used Avail Use% Mounted on
/dev/loop7 47G 47G 739M 99% /media/loop
Thats good enough for me.
write the userdata partition back to the device
exit # exit root user
sudo umount /media/loop
# write modified userdata partition back to the device
~/venv/bin/python3 ./edl.py w userdata userdata.bin --loader=prog_emmc_firehose_8953_ddr.mbn
boot the smartphone
Disconnect from USB cable and push Power button until it vibrates. Now after booting I could
log in and there was no more System-Ui crashing. I think the bootloop whould also have
disappeared if I did not do the system update before.
Conclusion
As I could now log in I enabled the developer settings and allowed adb to access the
phone from the commandline to see whats been deleted.
Here is the encrypted filenames from before
du -hs -- *
4,0K 1ASNvH0ZlNhBg70BJXx2c_ps0g4k1_l7
32K 2EYeXMw3f4yuzpI47iI2Wp6147t-moR8
4,0K 4sF8cnDn0xvQowAfawy_N2hEFzbgQ4W3
4,0K 6rVnZkjHiTAiAqFQrt-dijHhTxTxAbDq
472K 8CtA078kdZr8GJDqqyoIN7GLpMjT77qD
13G 8KPGVb_jVJPZ16dXvk8HY-ApDmndRRfC
4,0K ErjwBi6b4H_qy_ew90P0hZxN354pXUpN
17M gFbECu1Wo6miMpLEC4OBKH9XwyPXLIrl
4,0K IOyXAEI4ubpYEwCujE0BjjJ4JfCBcZKm
13M JOV1n1wtFeqwV-7dd4j4JQYzkLWEjrPK
4,0K lEx_LYEHu7KEOQptTQL6JIEc_oLHU_zp
4,0K misANN8WZ5uZ2qCpaJQfIpFbEWFS74lU
6,7G _NH918RlDPV4E021aq302JM50M8yb5F9
4,0K Nu4gg9bLAmAZqk1lz2O9oktYBYKXeXA4
8,4G rDchjimBjgE5sa2sFgTieiUODjDbH-fZ
118M rINlx5eo1r2XylsnCRObeCy2Y1YzFdgt # <-- here I deleted files
16K ytPD36erS6PZlSE9Q32AoFuU0xteOMa7
Now via adb on the decrypted partition on the smartphone:
FP3:/storage/emulated/0 $ du -hs -- *
4.0K Alarms
6.6G Android
4.0K Audiobooks
12G DCIM
4.0K Documents
17M Download
13M Movies
472K Music
4.0K Notifications
118M Pictures # <-- here I deleted something
4.0K Podcasts
4.0K Recordings
4.0K Ringtones
7.3G signal
As it turns out I deleted some pictures that might be valuable. So I had to redo
the process of modifying the userdata partition on my PC.
I recreated the userdata.bin from my userdata.bin.bak
cp userdata.bin.bak userdata.bin
I ended up deleting one 3.6G signal backup file. I narrowed it down on the timestamps
of the files in the signal directory and the size of the signal directory on
the smartphone to later find it on the encrypted partition image. Finally, I
transferred the modified partition again.
Hope that helps someone in the future!