Trapped in fastboot mode with locked bootloader and corrupted custom ROM

Hey,
I got my FP4 today and I’m facing the same problem. I cannot unlock anymore and the phone won’t boot either. Does anyone figured anything out yet?

Nope, if your phone is not booting, the bootloader is locked and you cannot unlock you are unfortunately out of luck.
If you boot into fastboot mode and connect your phone to your PC, what does fastboot flashing get_unlock_ability return? If it returns 0 you will have to send it to get it reflashed.

1 Like

Huh that’s a bummer, it returns 0 indeed. That’s kinda unlucky I was so hyped. Thanks for the quick reply though.

Your next steps are

  1. contact FP support
  2. send your device to the repair centre in France
  3. receive a quote of ~600€ (price of a new phone)
  4. complain to FP that the repair centre doesn’t do its job properly
  5. wait 5 days
  6. receive a new quote for 30€
  7. pay
  8. ???
  9. profit
8 Likes

Thanks for the detailed info. Wow that’s crazy. About what should I complain exactly :smiley: I already contacted the support. I hope it won’t be much more than the 30€ since I’m a student and I saved all my money up to even buy this phone…

Complain might be a tad strong, but Cordon repair has a track record of wanting to replace perfectly good phones. Don’t be scared if you receive a quote for a new phone, you wouldn’t be the first. Just ask FP support why they want to replace your phone and not just reflash a factory image, whoch they should be able to do.

If you want the complete history I’ll just link to my own thread, was a wild ride :slight_smile:

30€ seems to be the standard rate they charge to fix this kind of issue, that is also what they charged me :slight_smile:

3 Likes

Thank you very much for the detailed info and shame on me for making this happen in the first place. I just wanted to enjoy a smooth /e/ experience today. But things happen, at least there are great people like you out there… Thanks a lot <3

2 Likes

I managed to set get_unlock_ability back to 1 again (with an unlocked bootloader, don’t get your hopes up) by using Magisks resetprop

adb shell su -c 'resetprop ro.boot.flash.locked 1'

…and switching the OEM toggle in developer settings back to on.
Magisk for the rescue again :metal:

We should advise people to check fastboot flashing get_unlock_ability before locking the bootloader.
It’s a bit of a hassle having to set up Magisk just to reset that flag, but beats bricking the phone. Maybe there’s another way to fix this :thinking:

14 Likes

I mentioned that (already as we diskussed this the first time) as a a imortant step in my instruction to install iodé.

1 Like

Hi there, thank you all for your contributing to this thread!
We’ve been following it closely and your feedback has not gone unheard.

There is a new package for manual installation available for download here, it’s for build 107 - the latest at time of writing. The script now addresses an error that can be introduced by installing software manually. As long as you use the latest available package, you should not be getting stuck in Fastboot mode.

As always - in case of any issues, #contactsupport
Cheers

12 Likes

Thank you very much for this!
Could you explain a bit more what the problem is? So that we understand it and the community also knows what to do in case of further problems?

I did a quick diff and here’s the most obvious change i could find:

echo "INFO: Deleting factory reset partition"
    ${FASTBOOT_BIN} erase frp

was changed to

echo "INFO: Deleting factory reset partition"
    flash_image_or_abort "${sn}" frp "${IMAGES_DIR}/frp_for_factory.img"
    flash_image_or_abort "${sn}" devinfo "${IMAGES_DIR}/devinfo_for_factory.img"

Those two images mentioned above have also been added to the included images.

Last but not least, the slot is now automatically changed to a:

echo "INFO: Activating partition slot A"
  fastboot --set-active=a

The rest seems to be mostly linting as far as I can tell :thinking:

7 Likes

Thanks for this!

Can confirm that for me the get_unlock_ability flag unexpectedly changed as well to 0, in my case when going from e/os to CalyxOS without having OEM-locked the phone at any point:

From stock to e/os

  • Fresh FP4
  • OEM unlock on untouched stock OS
  • bootloader unlock and unlock_critical
  • checking: get_unlock_ability=1
  • flashing e/os, worked fine
  • still get_unlock_ability=1
  • bootloader lock and lock_critical
  • still get_unlock_ability=1

From e/os to CalyxOS

  • bootloader unlock and unlock_critical
  • still get_unlock_ability=1
  • flashing CalyxOS
  • get_unlock_ability=0, OEM unlocking greyed out while bootloader is still unlocked (which I will not lock for now, of course, until I get that flag set back to 1)
2 Likes

So now, the big question is: how can this done easily?

In /e/OS “root debugging” can be enabled. Maybe in CalyxOS too? If yes, is it possible after enabling it to type in the adb command mentioned by @hirnsushi
and execute it without using magisk? :thinking:

Interesting. From the name of the command I have an idea what it does, but a google search only revealed some posts in the FP-forum from 2017 or so. Where did the ${FATBOOT_BIN} go?

All in all, does this in any way help to figure out what is going wrong and help to recover already bricked devices?

Doesn’t it make sense that OEM unlocking is greyed out when the bootloader is unlocked? From the wording I would think it does.

Not in iodè
Not in calyxOS

Both are privacy and security focused with verified boot. root and root debugging is not part of this philosophy…

Both are possible to root
But is not suggested and not supported and not the Default

resetprop is a feature of Magisk to change read-only properties, so no. But installing the Magisk app and fastboot booting a Magisk patched boot.img should be enough for this to work.

That’s a function declared somewhere else in the script, has been used before to flash the other partitions. It’s essentially a fancy way of saying fastboot flash foo with some error handling. ${FASTBOOT_BIN} is just a variable to point to the included fastboot.

It does, that’s why we need to set ro.boot.flash.locked to 1 so the system thinks the bootloader is locked and the toggle gets enabled.

1 Like

But only in /e/OS
Not in iodè and calyx because of verified boot. Both does not allow to boot any not signed images, recoverys or kernels

1 Like