[Moto Z Play Guides, News, & Discussion] benzinerwin:
work in progress! (not working yet)

Current status: does not work (but should!), exact reason unknown (to me).

If you managed to "brick" your MOTO Z Play it enters a fail-safe mode as a last resort provided by the chipset manufacturer (Qualcomm). There are packages out there called "blank-flash" that use this mode to restore a proper bootloader that in turn re-enables the use of the fastboot method to write the other flash files and restore full operation - provided the personalized partitions are still present and in good health (or you have a backup of them at hand).

Look at this thread and download the Nougat file. It contains "blank-flash" files. These "should work" but they don't (any more). As I don't have a Z Play, I cannot research the matter myself and instructing helpful others via email exchange is ... complicated.

The thing with failing updates/flash packages is that they usually fail because they do not allow downgrading - even if they allow downgrading of some sort (e.g. OS), they may limit downgrading the second stage bootloader, the signed GPT (partitioning table) etc. As I don't know if and what's the case with the Z Play, I just assumed that *if* it works, it may require the most recent files.

If you run the blank-flash files (qboot) with --debug=2 option you see that after the programmer code is sent to the phone it doesn't send a valid / expected response and ultimately causes the process to fail.

There are many programmer files out there. Most do not work, because they need to be digitally signed with the proper keys. Some are signed with Quallcomm-keys, some with Lenovo-, Motorola- and other with test-keys. And then again, they have to fit with the qboot program that's sending the data to be flashed.

A blankflash archive consists of the following files:

qboot, blank-flash.sh ; Linux

qboot.exe, qboot.dll, blank-flash.bat ; Windows

singleimage.bin ; Both

There are different versions of the qboot program. I've found the versions 2.4, 3.37 and 3.40.

The file "singleimage.bin" contains the flash files and directions crammed into a single file, thus the name:

cmnlib.mbn

cmnlib64.mbn

devcfg.mbn

emmc_appsboot.mbn

gpt_main0.bin

index.xml

keymaster.mbn

programmer.mbn

prov.mbn

rpm.mbn

sbl1.mbn

singleimage.default.xml

singleimage.pkg.xml

tz.mbn

The XML files contain the instructions (the 'recipe'):

index.xml:

<?xml version="1.0"?>
<index>
<board id="70" name="MSM8953" storage.type="eMMC"/>
<package compatible="cpu.name:MSM8953 protocol:qboot" filename="singleimage.pkg.xml"/>
</index>

singleimage.pkg.xml:

<?xml version="1.0"?>
<package>
<programmer filename="programmer.mbn"/>
<recipe filename="singleimage.default.xml"/>
</package>

singleimage.default.xml:

<?xml version="1.0" ?>
<recipe>
<configure MemoryName="eMMC"/>

<!-- Flash GPT -->
<print what="Flashing GPT..."/>
<flash partition="partition:0" filename="gpt_main0.bin" verbose="true"/>

<print what="Re-initializing storage..."/>
<storage operation="reinit"/>

<!-- Flash bootloader -->
<print what="Flashing bootloader..."/>
<flash partition="aboot" verbose="true" filename="emmc_appsboot.mbn"/>
<flash partition="rpm" verbose="true" filename="rpm.mbn"/>
<flash partition="tz" verbose="true" filename="tz.mbn"/>
<flash partition="devcfg" verbose="true" filename="devcfg.mbn"/>
<flash partition="cmnlib" verbose="true" filename="cmnlib.mbn"/>
<flash partition="cmnlib64" verbose="true" filename="cmnlib64.mbn"/>
<flash partition="keymaster" verbose="true" filename="keymaster.mbn"/>
<flash partition="prov" verbose="true" filename="prov.mbn"/>
<flash partition="sbl1" verbose="true" filename="sbl1.mbn"/>
</recipe>

These files usually do not need to be modified.

programmer.mbn is the flash application that is sent to the phone.

I've compiled the following package, including all the qboot executables:

http://frickelbude.net/moto/blankflash[addison][D61DC5C7][25.211.10][1.07][2017-04-13].zip

D61DC5C7: crc32-checksum of programmer.mbn file (original, motorola signed) (find others here)

25.211.10: firmare package origin of the bootloader files

1.07: bootloader version

2017-04-13: time stamp of bootloader file

This didn't work with recently bricked Z Play phones as some testers confirmed. We also tried all the different programmer executables linked above just to be sure but no luck.

Outlook: you may want to try out Qualcomms QFIL (part of QPST package) (look e.g. at the download section of androidbrick).

However, that requires some handywork - you need to build some XML files, provide the proper programmer file etc. Maybe grab a firmware package e.g. for a Xiaomi phone that has all these files and try and deduce a proper layout for your Z play... and hope, any of the programmer files will actually run and communicate with the pc end.

(Usually the blank-flash files operate in 'sahara' mode/protocol and send the programmer.mbn to the phone. Then it waits for a positive response from the phone to enter 'firehose' mode in order to send all the flash data...)

/update 2017-06-10 a

I've created a blank-flash package based on the files [MENTION=7086186]lozada81[/MENTION] linked below:

bootloader files extracted from: OTA tester Android 7.1.1 BRASIL patch june - Blur_Version.26.1.22.addison.retail.en.US.zip

blank-flash package: http://frickelbude.net/moto/blankflash[addison][D61DC5C7][26.1.22][C1.12][2017-05-22].zip

(Bootloader version: C1.12, GPT layout version: 0x000A)

/update 2017-06-10 b

Same package as above, but with a

different programmer.mbn

, taken from an older blank-flash package that came with an Android 6.0.1 package [MENTION=7086186]lozada81[/MENTION] linked below.

http://frickelbude.net/moto/blankflash[addison][C0A0D740][26.1.22][C1.12][2017-05-22].zip

Well, it either fails with the infamous io-error or it finally works.. please test & report back!