[Defy Q&A, Help & Troubleshooting] hrk:
TL;DR:

I have a "Groundhog day" green-lens defy. Likely a faulty NAND, w/o warranty, I'd like to use MultiBoot and boot from the SD card, but 2ndInit gets reset at each reboot in the "Groundhog day" effect.

/TL;DR.

After spending four days on google and XDA without success, I'm here asking for help.

I got a used Defy (MB525, Green lens) whose history I do not know. It currently boots to a Chinese ROM with the following information:

System version: Moto_Version.34.30.3601.MB525.Retail.en.SEA18
Android: 2.2.2
Modem: EPU93_U_00.59.02
kernel: 2.6.32.9-g0671d13 jfqk83@zch68lnxdroid07 #1
BPflex: UCAJRDNEMARAB1B80AA03.0R
APflex: GAS_ASIA_USAJRDNFRYORTINT_P011
Build: JEM_3.4.3-36-1

I can change the language, set up wifi, Google and everything else... but as soon as I reboot I am prompted by a factory-reset device. :eek:

I thought the issue was with the userdata partition, but I can successfully get root (through psneuter), install SuperSU, install 2ndInit (2.3) and get the green led. After a reboot I'm prompted with a factory-reset device with no trace of root (and bootmenu).

I've tried using both sbf_flash (on Linux and OSX) and RSDLite (on Windows) to flash both an European SBF and the Chinese SBF which corresponds to the above mentioned data. In either case the writing phase goes to 100% but the verify/check phase dies at CG35 (and every following CG). These attempts make a "Code corrupt" bootloader screen, but then flashing only userdata resets the "corrupt" flag and the device boots again.

It clearly has a faulty NAND, but I was hoping I could put 2ndInit + Bootmenu + Multiboot and load ROMs over the SD.

I can't make up a reason for the auto-reset at every reboot. Both manual (adb remount + push a file in /system/app) or autmated (2ndInit) changes get lost. I'm wondering if I'm missing something regarding bootloaders or CG versions.

I am not sure I can send it to Motorola under warranty, in which case I'd feel better if there was a way to "brick" it further and avoid the Chinese ROM to boot altogether (not knowing its history I don't know if it's the original ROM or if the previous author messed up with it).

Do you have any suggestions? Some tests, something to check... I've spent four days rooting, flashing SBFs and doing whatever I could find. Maybe I missed the golden egg. :)

EDIT: some more information.

- sbf_flash -r -v -d --boot gives me an error message, so it seems I am not able to dump the CG from the Defy.

>> waiting for phone: Connected.
>> downloading boot: 0.0%
RX(7): [02]ERR[1e][8a][03]
>> downloading boot: failed at b1000000/b1800000
luca@lenovo:~$

- Using APflex string id, the ROM running on the device can be only JRDNEM_U3_3.4.3-36-1_CHINESE_SIGN_SIGNED_UCAJRDNEMARAB1B80AA03A.0R_PDS03C_USAJRDNFRYORTINT_P011_A013_HWp3_Service1FF which I downloaded.

- Running smgver on the files extracted from the SBF gives me these results:

CG31.img version is 4
CG32.img version is 1
CG33.img version is 1
CG34.img version is 1
CG35.img version is 2
CG39.img version is 4
CG42.img: signature not found!
CG45.img version is 0
CG47.img version is 2
CG53.img: signature not found!
CG61.img version is 1
CG64.img version is 1
CG65.img version is 1
RDL03.img: signature not found!

- The ROM runs Froyo (2.2.2) so it should be on BL4. It is not listed in walter79's thread as there are 3.4.3-36-1.7 SEA deblur and 3.4.3-36 UAE deblur, but my ROM is 3.4.3-36.1 BLUR.

- When booted into the Chinese ROM, RSDLite [running RSDLite v5.7 Multi-Flash./ Multi-Flex tool] shows:

IMEI: [omissis]
Technology: UMTS
Software Version: JEM_3.4.3-36-1
Flex Version: UCAJRDNEMARAB1B80AA03A.0R
Bootloader Version: 0910
DRM Version: N/A

- When booted in BOOTLOADER, it shows:

IMEI/ESN/MEID: N / A
Technology: N / A
Software Version: N / A
Flex Version: N / A
Bootloader Version: v0x000910
DRM Version: N / A
AP Die ID: 1a600117177460010000d8ff0200
BP Die ID: 0000000000000000000000000000
AP Public ID: 7ace4f54571d6c6831fed219adb4fe9ce4443647
BP Public ID: 0000000000000000000000000000000000000000

And the first line shows S FLASH OMAP3630.