23
Dec
bootloader_unlock

As a follow up to our recent PSA on bootloader quirks with GPE devices, we thought it would be a good idea to shed some light on a bootloader anomaly which affects both Nexus and GPE devices. Recently, there have been changes to the way unlocking happens behind the scenes. These changes can result in a device that infinitely boots into recovery.

Traditionally, when you decide to unlock and flash a custom recovery, the procedure goes something like this:

  • You type "fastboot oem unlock" from the command line.
  • A warning appears on your device's screen informing you that you're about to void your warranty by proceeding with the unlock.
  • You confirm that you do indeed want to proceed.
  • The bootloader wipes your device's data and cache, then switches to an unlocked state.
  • You flash a custom recovery like ClockworkMod or TWRP.
  • You reboot your device and you're done.

oem_unlock

A lot of people perform these steps as soon as they get their device, before booting it for the first time. Unfortunately, on the Nexus 4 (as of bootloader version MAKOZ30d), Nexus 5, 2013 Nexus 7, G Pad 8.3 GPE, and Z Ultra GPE, the bootloader doesn't wipe data as it has on past devices. Instead, it depends on stock recovery to do that the next time you reboot. If you unlock, then immediately flash a custom recovery, this can, and most likely will, cause headaches. Here is how things could play out:

  • You confirm you want to proceed.
  • The bootloader unlocks, then modifies the device's boot chain to force booting to stock recovery upon the next reboot.
  • You flash a custom recovery, which overwrites the stock one.
  • You reboot, and your device force-boots to the custom recovery you just flashed.
  • It sits waiting for input from you.
  • Thinking something is weird, you reboot and your device continues force booting into recovery indefinitely.

When the boot chain is changed during the unlock process, instructions are set which tell stock recovery to wipe the data and cache partitions and set the chain back to normal boot procedure. Custom recoveries don't seem to interpret these instructions correctly and one of two things usually happen:

  • Your custom recovery just sits waiting for input, pretending there are no pre-existing instructions for it. Rebooting will just force-boot to recovery again.
    How to fix: To break this impasse, you'll have to flash stock recovery and reboot. Data and cache will be properly wiped and the boot chain will be reset. At that point, all is well and you can flash a custom recovery.
  • The custom recovery actually interprets the instructions, wipes data and cache, sets the boot chain back to normal, but then your ROM gets stuck in a boot loop at the boot animation.
    How to fix: This can be rectified by simply booting into fastboot mode, then running "fastboot format" on the userdata and cache partitions.

Moving forward, if you want to avoid this situation entirely, the best procedure to use is as follows:

  • Unlock your bootloader, but do not flash your custom recovery yet.
  • Reboot.
  • Your device will force-boot into stock recovery, wipe data and cache, then reboot again.
  • Let the device boot all the way to the welcome screen.
  • Reboot back into fastboot mode.
  • Flash the custom recovery.
  • Reboot.

We hope this will save some of you the time and frustration of troubleshooting this yourselves. Truth be told, it would be nice if Google informed us of changes like this when devices launch. That said, it seems that there is instead an assumption that we'll just catch on and we're smart enough to figure it out on our own. Thankfully, that's exactly the case.

Shawn De Cesari
Shawn is a web developer by day and XDA's resident archivist for Nexus and Google Play Edition device OTA updates by night. When not immersing himself in code or Android, he can be found hunting down antique signs, taking road trips, listening to music, or playing video games. His phone of choice is a Sony Z Ultra Google Play Edition.
  • S Mahmood Alawi

    the recovery reboot is caused a file on the data partition, right??
    just delete it through the custom recovery/adb and you should boot fine... (i hope)

    i have an HTC One X.... this also explains how my 1st ever backup had all my /data after i unlocked it.. it's because i rebooted into the recovery 1st *victory*

    • http://www.androidpolice.com/ Shawn De Cesari

      No, it's not a file on the /cache or /data partition. As best we can tell, the boot chain is actually modified somehow. Clearing data and cache manually will not stop the device from force-booting into recovery. If you're stuck in that situation, the only way around it seems to be to flash stock recovery.

      It wouldn't make sense to set a /cache/recovery/command file at bootloader level because that means you could just do an oem unlock, then format cache before rebooting, and you'd be able to unlock your bootloader without wiping data. That would be kind-of bad. If the bootloader is going to rely on stock recovery to do the data/cache wipe on unlock, they have to have some way that can't be worked around by wiping the partitions yourself before rebooting.

      • S Mahmood Alawi

        in that case then,... you can make a backup 1st using a custom recovery,
        flash stock recovery then back to custom to restore your backup.

        also, it's not /cache/recovery/command
        but something like /data/.cold_boot

        • http://www.androidpolice.com/ Shawn De Cesari

          I haven't personally tested that, but you're probably right unless they somehow turn off read access to the data partition until stock recovery wipes it. I"m not sure. Not sure how they'd do that, but it seems to me like someone at Google would have thought of that possibility. That's a great point.

          • S Mahmood Alawi

            simple... corrupt the partition table... :p

          • http://www.androidpolice.com/ Shawn De Cesari

            I wouldn't be shocked if that's exactly what they do. That could also explain why, even when a custom recovery does interpret the instructions, the data/cache wipe results in a ROM that just bootloops until you either fastboot format both partitions or use stock recovery to wipe data/cache.

  • Jamin

    Had exactly the bootloop with my 2013 Nexus 7 after I unlocked it 2 months ago. Just had to do a full wipe and everything worked. Thank ap for this article.

  • Vijay

    I had the same issue with Nexus 5. It was the first thing I had done with the phone, but it did not boot into TWRP instead was looping through boot animation. The hard part was figuring out that unless you plug into a AC charger we cannot enter fastboot again in that scenario. As usual XDA saved the day :)

    • Pate5509

      мʏ вɛѕт ғʀιɛɴɖ'ѕ αυɴт мαĸɛѕ $76/нʀ օɴ тнɛ ʟαքтօք. ѕнɛ нαѕ вɛɛɴ ғιʀɛɖ ғօʀ 7 мօɴтнѕ вυт ʟαѕт мօɴтн нɛʀ ιɴƈօмɛ աαѕ $2068з ʝυѕт աօʀĸιɴɢ օɴ тнɛ ʟαքтօք ғօʀ α ғɛա нօυʀѕ. нαʋɛ α քɛɛĸ αт тнιѕ ѕιтɛ fox200&#46com

    • Cory_S

      Ah... Now I remember I had the exact same issue when I first got my nexus 5. I ended up having to flash a stock system image to get it working again.

  • http://j.mp/slayerXcore Josh K (SlayerXcore)

    Fastboot -w flash recover recovery.img. problem solved

    • http://www.androidpolice.com/ Artem Russakovskii

      You mean custom recovery or back to stock? Because the stock recovery may not be available at the time, I had to wait for someone to upload it for the G Pad 8.3 GPE to get it to boot again.

      • http://j.mp/slayerXcore Josh K (SlayerXcore)

        Upon flashing the custom recovery
        My method streamlines unlocking and flashing

        boot to bootloader
        "fastboot oem unlock"
        wait for phone prompt, select unlock
        wait for it to unlock
        "fastboot -w flash recovery recovery.img"
        reboot
        add files to sdcard/internal storage (due to the fact unlock wipes internal sotrage)
        reboot to bootloader, select recovery,
        Happy flashing.

        • http://www.androidpolice.com/ Shawn De Cesari

          fastboot -w won't help you in this case. It's about more than wiping data/cache. It's about restoring the boot chain to normal, and that appears to only be achievable via stock recovery.

          • http://j.mp/slayerXcore Josh K (SlayerXcore)

            if you have a nexus 5 you don't mind wiping I would say try it, I only have a galaxy nexus and no android tablets currently so I can not do this on a newer device. I know it works on the gnex with the latest stock firmware that has been relocked.

          • http://www.androidpolice.com/ Shawn De Cesari

            Yes, the Galaxy Nexus is not affected by this issue. It's only newer Nexus and GPE devices that have this.

          • http://j.mp/slayerXcore Josh K (SlayerXcore)

            ok so to play devils advocate do you have a device new enough to test this on?

          • sweenish

            That's not really how you play devil's advocate.

          • http://j.mp/slayerXcore Josh K (SlayerXcore)

            Perhaps not but until someone with one of the mentioned devices that is completely stock and locked or relocked tries to either prove or disprove what I'd said it's just theory

        • http://www.androidpolice.com/ Artem Russakovskii

          I'll tell you one thing - I have fastboot wipe cache and fastboot wipe userdata, and that didn't fix my G Pad issue at the time. The only thing that did was reflashing the stock recovery.

    • http://www.androidpolice.com/ Shawn De Cesari

      fastboot -w won't help you in this case because it's about more than doing a data/cache wipe. It's about resetting the boot chain to normal, which appears to only be achievable via stock recovery.

  • Kenneth Qvarfordt

    This was the first thing that happened to me when I just got my Nexus 5. First thing I did was get it soft bricked lol. It even gave me one of those OMG-What-do-I-do-now?! kind of moments.. Since I wasn't totally sure what was wrong I just flashed the whole nexus image straight of the bat and obviously it restored my recovery in the process and everything was working as intended from there on.

    Google should fix this though. I'd prefer if the unlock thing forced a reboot instead of waiting for the user to be able to mess things up like this. Would make a whole lot more sense.

    • Matthew Wu

      I did the exact same thing with my first batch NEXUS 5, I was so glad it was a nexus at that moment.

  • Ray

    I don't ever remember having this issue with my N5. First thing I did was unlock the bootloader, flashed CWM, then rebooted. Phone booted fine. No problems ever since.

  • Alex

    If it ever happens, just flash tarp, you'll see a password screen, just cancel out of it, press wipe, FORMAT DATA, once done, just also factory reset on main screen of Wipe. Reboot. Done.

    • Alex

      Flash twrp*

  • xnifex

    This explains why I was stuck at the boot animation this weekend when rooting my brother's Nexus 4. Thanks!

  • Kevin Cernekee

    "Unfortunately, on the Nexus 4 (as of bootloader version MAKOZ30d), Nexus 5, 2013 Nexus 7, G Pad 8.3 GPE, and Z Ultra GPE, the bootloader doesn't wipe data as it has on past devices."

    Normally "fastboot oem unlock" will wipe the data partition before allowing the operator to load any custom images. This makes it harder for a malicious person with temporary physical access to the device to extract private data, or to tamper with system files undetected.

    If the operator is allowed to unlock the bootloader, then immediately install a custom recovery and boot it, that eliminates the safeguard and creates a security hole. With a custom recovery running it is trivial to get a shell through adb, mount /data or /system, and dump/modify arbitrary files. Then, optionally, relock the bootloader so the device's owner does not realize what happened.

    I ran through the following procedure on a Nexus 5 but did not see any evidence that the sequence had changed:

    0) Bootloader is currently unlocked.

    1) Download the latest factory build KOT49H (Android 4.4.2) with bootloader HHZ11k.

    2) Run flash-all.sh to install the latest radio/bootloader/recovery/kernel/system/userdata images.

    3) fastboot oem lock

    4) Automatic reboot to System.

    5) Complete the setup wizard, install a couple of apps, etc.

    6) Reboot to bootloader.

    7) fastboot oem unlock.

    8) The bootloader prompted me to wipe the device; I said yes.

    9) Bootloader said "erasing" and fastboot returned successfully after ~15s.

    10) Without rebooting, install CWM Recovery and start it up from the menu.

    11) Try to mount /data - failed, partition is empty.

    12) Reboot via CWM menus. Stuck on Nexus boot animation.

    13) Reboot via three-finger reset. Boots to system again, still stuck on animation.

    14) Reboot to CWM Recovery and format /data + /data/media (i.e. put a real ext4 filesystem there, not just unformatted space).

    15) Reboot to system; setup wizard eventually comes up.

    Is there perhaps a newer version of the Nexus 5 bootloader that is affected by this?

    • Varun

      Hi,

      I know this is quite a old thread but the flaw in Nexus 4 could save my day or could be a blessing in disguise... your inputs will be very valuable.

      Alright, my pickle I have landed myself is :

      1. I am having a Nexus 4, with boot loader MAKOZ30d, the bootloader is locked by the OEM and i havent rooted or flashed recovery to a custom recovery (yet).

      2. I also didnt take backup of my pictures from internal sdcard, which i am desperately trying to recover now.

      3. My phone (after a full battery drain), upon charging is ending up and stuck at the boot screen/logo with google circles...

      This is the only place where i see that unlocking the bootloader will not wipe the user data..

      Therefore, I am planning to do the following after reading this thread.

      1. Boot into fastboot
      2. fastboot oem unlock (hope it doesnt wipes my sdcard)
      3. become root and mount the /data partition on my local disk and copy data (how do i do that ?)
      need your help here ...i dont want to reboot and get into stock recovery as reboot would wipe the data..

      4. After data copy, reboot , then install custom recovery...

      Any suggestions from your side? Also, can you let me know the details if I can do step 3 without getting into recovery/after rebooting or using adb.

      Thanks in advance.

      Varun

  • Jon Brashear

    What about if you use the wugfresh toolkit?

  • steven

    I want to know whether reboot wipes my phone data. I want to restore contacts that are lost from a recent OS update and I purchased Myjad Android Contact Recovery. However it requires phone to be rooted before recovery. I want to whether I will permanently lose contacts. Please Advice.

  • fjleon

    well, crap, i just ran into this too late. i always boot after unlocking the bootloader but i thought this time, hey, why not just installing twrp and save some time...

    Well, needless to say, i had to format data right from inside twrp and lost my helium backup and had to install everything again and lost EVERYTHING.

    i don't know why the backup google makes sucks so hard, only google apps gets reinstalled, so you have to go to google play and download everything, and game progress is lost...

  • KENNY

    What if my bootloader doesnt unlock? When i put "fastboot oem unlock" it DOES NOT WORK!! ANY HELP?