Guide to bootloader and bricking [2025]

[koumilak]

It’s been a bit of a tricky time recently since The FP6 came out and people got their devices bricked all in a row. I realized that it’s not the first time people inadvertently bricked their new Fairphone, and a lot of info about bootloader and fastboot is scattered across the forum.

So I thought about rationalizing a bit some of this info and clarify what to do to avoid getting your phone dic:bricked, and what to do if it happens.

Simply put, (soft)bricking means that your fairphone does not boot normally anymore. The phone powers on, starts some software, but gets stuck before initializing the rest of the software. You can’t get into Android, or whatever Operating System (OS)/ROM you installed.

In some cases, you can get it running again.
However, the process might wipe all data from the phone.
So, first off: backup as often and as thorougly as possible while your phone is usable. In the dreaded alternative, let me introduce you to…

Survival guide to bricking

I intend for it to have in several parts.
I - Some basics about bootloader, fastboot, and some other things to get the lay of the land.
II - Some info to have in mind when flashing ROMs. It’s not a tutorial.
III - Some tricks and tips to try in case of a bricked device.
IV - Some thoughts about the situation and how we can do better.
And then some sources from the forum (I just realized that everyone I cited will be summoned when I post this… sorry) and beyond.

Let me end this preface by pointing out that this is a wiki, so feel free to fix the gross mistake or errand typo, and also join the conversation in the wikimetadiscussion with your thoughts and advice. There will also be a to-do list because I’m not an expert at all and couldn’t do everything.

I extend my thanks to all the users who contributed to the global discussion thus far and helped their fellow members, in particular @hirnsushi, @AnotherElk, @yvmuell amongst others.

Sources

Android studio (dev documentation)
Bootloader Overview
Bootloader unlocking
Android verified boot 2.0
A/B (seamless) system updates
Boot flow

Fairphone docs
How to manually install (stock) Android
Manage the bootloader
Get unlocking code (FP3 and newer)

Github
EDL client (github)
Loader for FP5? (github issue)

Reddit threads
Clarification about hard brick…

XDA Forums
Fairphone 5 Unbrick - Android 14…
How to reboot to EDL from fastboot

Website of popular ROMs
LineageOS
eOS
iodéOS
CalyxOS
Ubuntu Touch

FP Forum threads

FP6
FP6 unbrick: trapped in fastboot mode…

FP5

Summary

Fairphone 5 unbrick w/ Bootloader locked - Android 14(+)…
Can’t unbrick my phone running UT2K (FP5)
Phone stuck in fastboot mode, unable to install FairphoneOS (FP5)
Broken OS please help
FP5 bricked or not?
FP5 refusing to boot

FP4

Summary

Can’t flash stock FP4 ROM
Fairphone 4 locked in fastboot mode
FP4 with /e/ stuck in bootloader…
Unable to lock bootloader (FP4)
Trapped in fastboot mode […] (FP4)
Downgrading to previous patch level
Android Security Patch-already unlocked bootloader
Revert to StockOS with fastboot… (FP4)
Returning to FPOS from LOS fails (FP4)
Reinstalling Android After Installing Ubuntu Touch
Fairphone stuck in fastboot mode - bootloader unlocked (FP4)
Device not booting after flashing factory image and locking bootloader
Trying to revert to Fariphone OS but get_unlock_ability:0
Guide : Fairphone 4 stuck in Fastboot after install

FP3
Fairphone 3 unbricking
Unable to install Fairphone OS … FP3
https://forum.fairphone.com/t/fairphone-3-unlocking-without-oem-unlocking/57683

FP2
Fairphone 2 booting in EDL mode

[koumilak]

Bootloader Primer

Bootloader basics

The first software the phone starts into is (aptly named) the bootloader. As a security feature, this software verifies that the OS on your phone is safe to use and then starts it (it “loads” it).

To do that, it scans several important partitions to check that everything is as it should be. A partition is a chunk of your memory that’s reserved to special software.

system and boot are two exemples of system partitions and are updated when Android or your favorite ROM are updated. vendor is another type of partition. All your data (photos, downloaded apps..) is in userdata, a third type of partition.
The content of each partition is called partition image (when downloaded, it’s something *.img).

As a factory setting, the booloader is locked. That means that a new/untouched phone has a verified and unchanged image for each partition. That is to say, no part of the software was modified and it can’t be modified (unless from an update).
The bootloader has a security feature that cryptographically checks that the system image on the phone is authentic (from the original manufacturer, i.e. Fairphone Android OS). Unlocking the bootloader makes it bypass those checks and then the system can boot any valid OS (with which the phone will still work).

To install new OS (e.g. LineageOS, /e/OS, Ubuntu Touch…), one first needs to unlock the bootloader. Unlocking the bootloader implies several steps. Fairphone provides the steps to do it in the Manage the bootloader support pages.

first steps with fastboot

The interface with which you interact with the bootloader is called dic:fastboot (dedicated post to installing).

Try $ fastboot oem device-info, which tells you a bit about the current state of the device, including about the bootloader. In an otherwise untouched system, it would answer, among other things :

(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false

It can be useful to check the flag called get_unlock_ability.
A flag returns two possible values : 0 if it’s false/off/“answer is no”, and 1 if it’s true/on/“answer is yes” (flag is “raised”).
If the bootloader can be unlocked, then the command $ fastboot flashing get_unlock_ability should return 1.

This does not mean that the bootloader is unlocked yet.
The Manage the bootloader page provides more steps regarding unlocking the bootloader.

A/B slots

This section is a stub.

The A/B system is a new-ish system to manage Over-The-Air (OTA) updates. Some partitions have two sets, A and B, called slots, that are virtually duplicates of the same partition.
The system is running on one slot and the OTA update is applied to the other slot. At the end of the update, the phone reboots and the slot is switched.
That way if an update fails, one slot is always working.

Let’s say you are on slot A. An OTA update arrives and you update successfully. At the reboot, you boot into slot B with the new version. Slot A is still on the old version, untouched.
If anything happens to the system at that point and slot B is compromised or broken, the phone should be able to boot into slot A.

All this is seamless, it should be happening without user input or knowledge.

Now the A/B system is transitioning (or has already: it’s a requirement “for devices lauching with Android 11 and higher”, i.e. FP4) to a virtual A/B system where only the differences between A and B are kept, and not two complete copies as it was earlier. As far as I understand, it still works the same as two slots.

[koumilak]

Flashing essentials

Once the bootloader is unlocked, it is possible to modify the partitions that were previously untouchable, such as recovery or system.
Those partitions can be replaced them with another, user-provided *.img file in a process called flashing. It’s done through fastboot.

You can flash partitions one by one (e.g. fastboot flash system system.img) or follow a script, which is a list of commands pre-written. Depending on your computer operating system, the script will have its name end in .sh,.bat, or .command.
Essentially, it’s going to flash, or replace, each partition in the phone with the image you downloaded (for instance, stock Android from Fairphone).

At the end, the command line interface returns OKAY and the phone can reboot into the newly installed system.

You may get a warning on boot, that says that the bootloader is unlocked and that constitutes a security flaw. That is why you may want to re-lock the bootloader after flashing, which can carry risks of bricking (see next section).

Locking the bootloader safely

Locking the bootloader implies then that the system images installed in the device must correspond to the manufacturer’s: only stock Android provided by Fairphone (found here), and the “official” /e/OS provided by e-foundation, are “legit” and can be locked upon as-is. For any other OS, check the section about about AVB custom keys below.

If OEM unlocking is still active, then fastboot flashing get_unlock_ability should return 1 and the bootloader can be locked.

You need to know about rollback protection. Android does not allow locking a bootloader when the system has lower-security level than it had before.

SPL aside

Every day new vulnerabilities are discovered in Android and Google finds fixes for the most important of them. Those fixes are bundled into a monthly Android Security Bulletin. At the beginning of each month, a Security patch that address these issues is released by Google. Each and every phone manufacturer is bound to include these fixes in their subsequent updates, but it can take weeks, or months. The Security Patch Level only identifies the most recent threats that the device can handle.

In practice, you need to check the Security Patch Level (SPL) of the image you’re flashing, which is a date (e.g. 5 June 2025), and compare to the latest the phone have had installed (which is not necessarily the most recent system, it takes into account all active systems before).
It does not take into account the version of Android or the release date of the system.
You can only lock if the SPL you’re flashing is the same or newer.
To be safe, consider waiting for a brand new SPL version before trying to flash and lock, then you can’t go wrong.

Check the Manage the bootloader support page.
In the support page, you’re invited to lock_critical and then lock.

You should reboot to bootloader again between the two, before you let the system load to “userspace”.

Again, at each step before locking, make sure that fastboot flashing get_unlock_ability returns 1.

If fastboot get_unlock_ability returns 0, you need to activate OEM unlocking again by going into the OS and activating it through developer options.

AVB custom keys

This section is a stub…

For some security and privacy-oriented ROMs, leaving the bootloader unlocked is an unacceptable security risk.

So, for CalyxOS, iodéOS, and others, another solution is provided in the form of flashing AVB custom keys unto the avb_keys partition, to tell the bootloader that those keys are legit too and that it can lock the bootloader on their ROM. Sometimes, an automated script does it for you.

For instance, the automated installation for iodéOS takes care of that. Their documentation mentions that locking of the bootloader is supported by the installation script. For manual installation, please refer to the documentation provided by iodéOS.

For now, we are not aware of any way to relock the bootloader on LineageOS, /e/OS (community builds), Ubuntu Touch, and SailfishOS.

[koumilak]

Intro to Unbrick

If you cannot boot into your OS and you cannot flash new system images, you are now in unbrick territory…
The tools at our disposal vary depending in the device, from low-hanging up:

• unlock flashing before flashing (All)
• ignore flashing ability and flashing regardless (FP5)
• use firehose in EDL mode (FP2/FP3(+) for now)
• get the device back to Fairphone (All, for a fee)
• use your phone as a paperweight, it’s really a brick (for now…)

In a brick situation, in a situation where user data is unimportant or backed up, it might be possible to try to “nuke” everything and start from scratch.
Our goal here is to navigate the hurdles to manually install Android OS directly from Fairphone. Once in “safe” waters, you can go and do whatever you want.

Fastboot solutions

In this situation, your phone does not boot to OS and you cannot flash new images. The flashing command or script fails. However, you can still access dic:fastboot.

First and foremost, get into fastboot mode and see where you stand :
fastboot oem device-info

The output tells your if your bootloader is unlocked or not:
(bootloader) Device unlocked: false (this means it’s locked)
(bootloader) Device critical unlocked: false

Check the output of fastboot flashing get_unlock_ability, it should return 0or 1.
If it’s 0, then it’s most probably game over. Contact the support and pay to get it unlocked by Fairphone.
FP5 Android 14(+): Try fastboot oem allow-flashing and run the script after having modified the integrity check and the lock check: see relevant post.

If it’s 1, continue on:
The easiest would be to try to unlock the bootloader $ fastboot flashing unlock.

If it works, then fastboot oem device-info should be returning
(bootloader) Device unlocked: true (this means it’s unlocked)
Try the flashing/script again.

EDL mode

A security firm has done a deep dive on this little known flashing tool, which is sort of a industrial secret. The broader Android user community owe them a lot of this info.

EDL stands for Emergency DownLoad, and is a Qualcomm feature used by phone manufacturers to unbrick devices.
Since it’s very low level (close to the hardware), it depends on a specific file called loader, also called firehose, that works with only one model (sometimes all the models that have a specific chip).
Also, those loaders are not for public access, so the ones we have, are leaked to us by industry insiders.

At this stage, we have EDL loaders for the fairphone 2 and fairphone 3.
Thus this technique, where all else has failed, cannot be used for the other models until a loader appears in the wild.

The first step would be accessing the “secret” EDL mode on the phone:
EDL mode is entered by creating a short-circuit between two specific points.
EDL mode can be triggered by an adb command (which is ironic since we only need it when out of system), or by fastboot fastboot oem edlor fastboot reboot-edl, or some funny business.
Lastly, EDL mode can be triggered by an EDL cable or with a modified usb cable.
When in EDL mode, the phone identifies itself to the computer as a specific device and not as fairphone (qdloader 9008)

On the computer side, we need bkerler’s edl tool or some similar software.

TBC

The Cordon connection

Cordon Electronics is a third-party company that partners with Fairphone to operate as its official service center. https://support.fairphone.com/hc/en-us/articles/17750098804370-Fairphone-5-Repair-Price-list-and-FAQ-Cordon-Repair-Center

On its website, Cordon Group provides links to both its own “SAV Cordon Group” service and the “My Repair by SBE” platform. In fact, both services are operated under the leadership of Olivier Goullet de Rugy, who serves as General Manager within the Cordon Group.

Apparently we can pay “Cordon” to unbrick our devices, in the 30-50€ range.

Contact Fairphone support to arrange for an unbrick. “Cordon” will take care of it.

[koumilak]

A path forward

What now? What can we plan for, ask for, hope for?

First, we might need to investigate and understand the full list of fastboot commands and how they can help us with our problem.
For instance, how fastboot oem allow-flashing works and why it works on a locked bootloader, and why it’s only on certain versions of the FP5 only (across the whole web, the only occurrences of it are about FP5).

We can ask for best practices to reduce risk of bricking while following guides.
In particular, a lot of bricking occurs between lock_critical and lock because the devices boots into system (the OS, normal reboot), whereas it should directly boot into bootloader (to go back to fastboot mode).

Systematize checking unlock_ability before locking the bootloader.

Maybe make the script check itself unlock_ability before locking? Or maybe a simple GUI companion could help?

Stay on the lookout for EDL loaders/firehose files for FP4, FP5 and FP6. These can help in the direst of situations.

Please also check out Psiko’s thoughts, some of which could sound… radical.
Let’s talk about it in the wikimetadiscussion !