Device stuck in fastboot mode after oem re-locking

[rizzly]

First, some background. I have followed the steps in ✏ FP3: unlock the bootloader to unlock my bootloader and flashed a GSI image according to [HOW TO] Flash a custom ROM on FP3 with GSI .

At this point everything was working as expected, so I decided it would be nice to re-lock the bootloader as an extra security precaution. I did it like this:

• Disabled OEM unlocking in the android settings (In hindsight this might have been the biggest mistake)
• Rebooted into fastboot
• Ran the command fastboot oem lock

And this is where the trouble begins. When the device starts, I first briefly get the fairphone logo and then I get the following error on the screen

Your device is corrupt. It can’t be trusted and will not boot

Then it sits for 5 seconds and tries again, giving me the same error. After a lot of retries it boots into fast boot mode directly.

The only thing I can get in to is fastboot, where I’ve tried the following things:

• Choosing Recovery mode in the menu which reboots into the error screen
• fastboot oem unlock which gives me FAILED (remote: oem unlock is not allowed)
• fastboot boot twrp-3.3.1-0_k4y0z-20200202-02-fp3.img which gives me FAILED (remote: unlock device to use this command)
• fastboot flash boot boot.imgwith the stock boot image, it gives me FAILED (remote: Partition flashing is not allowed)
• fastboot reboot emergency which reboots into the error screen
• fastboot set_active to switch between the slots, both cause a reboot into the error screen

I’m presuming that what is happening is that when locked, the bootloader tries to verify the boot image, but since that has been modified, it fails.

Is there anything I can do, or am I the first lucky person to brick my device?

[NicoM]

I presume you are right: locking the bootloader probably must be done only on official ROMs…
Sadly, I think you are the first to try to do this, and you already tried everything that I would I have tried at your position.

If I remember correctly @pigpig did brick his phone but managed to unbrick it, hopefully he will be able to help you.

[rizzly]

Oh, and I guess it’s of interest that fastboot reports SECURE BOOT - disabled which might mean that it shouldn’t really verify boot, but I’m unsure.

[rizzly]

I think I fixed it! Thanks to the stock firmware dumps from TWRP installable stock firmware packages for Fairphone 3 I could run strings aboot.img | grep oem which gave me the following

oem unlock
oem unlock-go
oem lock
oem 8901_unlock
oem 8901_lock
oem device-info
oem enable-charger-screen
oem disable-charger-screen
oem off-mode-charge
oem select-display-panel
oem adb_enable

oem 8901_unlock certainly looks interesting, right?

Indeed, running fastboot oem 8901_unlock now has the device reporting as in an unlocked state and boots up my OS again (I had to wipe userdata, but that’s part of locking/unlocking anyway)!

For good measure I’ve also tried flashing vbmeta so far, which was succesfull, booting twrp and into recovery also works again.

So by the looks of it fastboot oem 8901_unlock can be used if you want to unlock the device without enabling unlocking in the android settings (or inputting the verification code). I haven’t verified this fully though.

I also don’t know if there are any differences between this unlock and regular unlock, so if you don’t have to, maybe you shouldn’t use this one. But as a last resort to unbrick your phone it’s perfect!

That said, I guess there’s no guarantee this will work for anyone else who have re-locked their phone without stock firmware, And I wonder what horrors you unleash by running oem 8901_lock. Given my experiences so far, I won’t try!

[k4y0z]

This is certainly interesting!
I wonder if this command would work on a phone that has never been unlocked before.
And if it would possibly allow unlocking without wiping data?