[Moto X4 Guides, News, & Discussion] oxwilder:
I'm trying to return my Moto X4 to stock after having rooted it about a year ago, and I managed to load an image onto it that killed the wifi/sim. Then in a kind of desperate attempt to find the right ROM, I managed to flash it with something that locked the bootloader in such a way that I can no longer unlock it.

I only ever used Payton roms and usually only Payton Fi releases (mine's a Google Fi). All the searching I've done has turned up answers like "adb sideload a blur image," which I haven't been successful with, or "flash it back to the stock firmware," which is of course what I'm trying to do but can't unlock the bootloader.

I'll include my getvar deets and a typical flashing log below.

I'd really appreciate someone helping me troubleshoot this so I can get it working. I'm giving the phone to my mom so she can do things like video chat with my daughter or, ha, receive pictures in her texts (she has some ancient Samsung).

Thanks in advance everyone.

getvar all
(bootloader) kernel: uefi
(bootloader) version-bootloader: MBM-3.0-uefi-641a15b-171214
(bootloader) product: payton
(bootloader) board: payton
(bootloader) secure: yes
(bootloader) hwrev: P4
(bootloader) radio: NA
(bootloader) storage-type: eMMC
(bootloader) emmc: 32GB SAMSUNG DD68MB RV=08 PV=02 FV=0000000000000002
(bootloader) ufs: N/A
(bootloader) ram: 3GB SAMSUNG LP4x DIE=12Gb M5=01 M6=06 M7=00 M8=0E
(bootloader) cpu: SDM630 1.0 (2)
(bootloader) serialno: ZY224KQL3Q
(bootloader) cid: 0x0032
(bootloader) channelid: 0x8d
(bootloader) uid: 0AE7B196
(bootloader) securestate: flashing_locked
(bootloader) verity-state: logging (0)
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 536870912
(bootloader) reason: Reboot mode set to fastboot
(bootloader) imei: 356484081130730
(bootloader) meid:
(bootloader) date: 10-20-2017
(bootloader) sku: XT1900-1
(bootloader) carrier_sku:
(bootloader) battid: SNN5995A
(bootloader) battery-voltage: 4355
(bootloader) iccid: 8901260971113394207
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) ro.build.fingerprint[0]: motorola/payton_fi/payton_sprout:8
(bootloader) ro.build.fingerprint[1]: .0.0/OPW27.57-25-2/2:user/release-
(bootloader) ro.build.fingerprint[2]: keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.27.21.2.payton_fi.go
(bootloader) ro.build.version.full[1]: ogle_fi.en.US
(bootloader) ro.build.version.qcom: <not found>
(bootloader) version-baseband: <not found>
(bootloader) kernel.version[0]: Linux version 4.4.78-perf-g0d9dbc8-00001
(bootloader) kernel.version[1]: -g01d2530 (hudsoncm@ilclbld35) (gcc vers
(bootloader) kernel.version[2]: ion 4.9.x 20150123 (prerelease) (GCC) )
(bootloader) kernel.version[3]: #1 SMP PREEMPT Thu Dec 14 09:42:35 CST 2
(bootloader) kernel.version[4]: 017
(bootloader) git:abl: MBM-3.0-uefi-641a15b-171214
(bootloader) git:xbl: MBM-3.0-uefi-dfccc3a-171214
(bootloader) git:pmic: MBM-3.0-uefi-dfccc3a-171214
(bootloader) git:rpm: MBM-3.0-uefi-245b046-171214
(bootloader) git:tz: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:hyp: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:devcfg: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:cmnlib: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:cmnlib64: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:keymaster: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:prov: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) git:storsec: MBM-3.0-uefi-eee7f2d-dirty-171214
(bootloader) qe: "qe 0/0"
(bootloader) frp-state: no protection (0)
(bootloader) ro.carrier: retus
(bootloader) current-slot: _a
(bootloader) running-bl-slot: _a/_a
(bootloader) running-boot-lun: 0
(bootloader) slot-suffixes: _a,_b
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: no
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 0
all: listed above
finished. total time: 0.182s

Log here:

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot oem fb_mode_set
...
OKAY [ 0.011s]
finished. total time: 0.013s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash partition gpt.bin
target reported max download size of 536870912 bytes
sending 'partition' (37 KB)...
OKAY [ 0.002s]
writing 'partition'...
(bootloader) Validating 'gpt.default.xml'
(bootloader) Committing 'gpt.default.xml'
(bootloader) - flashing 'gpt_main0.bin' to 'partition:0'
OKAY [ 0.114s]
finished. total time: 0.117s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash bootloader bootloader.img
target reported max download size of 536870912 bytes
sending 'bootloader' (9520 KB)...
OKAY [ 0.311s]
writing 'bootloader'...
(bootloader) Validating 'bootloader.default.xml'
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) flash permission denied
(bootloader) Cancelling 'bootloader.default.xml'
FAILED (remote failure)
finished. total time: 0.369s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash modem NON-HLOS.bin
target reported max download size of 536870912 bytes
sending 'modem_a' (95999 KB)...
OKAY [ 2.751s]
writing 'modem_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 2.756s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash fsg fsg.mbn
target reported max download size of 536870912 bytes
sending 'fsg_a' (5508 KB)...
OKAY [ 0.212s]
writing 'fsg_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 0.221s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot erase modemst1
erasing 'modemst1'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.004s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot erase modemst2
erasing 'modemst2'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.003s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash bluetooth BTFM.bin
target reported max download size of 536870912 bytes
sending 'bluetooth_a' (4540 KB)...
OKAY [ 0.171s]
writing 'bluetooth_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 0.180s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash dsp dspso.bin
target reported max download size of 536870912 bytes
sending 'dsp_a' (16384 KB)...
OKAY [ 0.536s]
writing 'dsp_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 0.543s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash logo logo.bin
target reported max download size of 536870912 bytes
sending 'logo_a' (2282 KB)...
OKAY [ 0.109s]
writing 'logo_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 0.120s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash boot boot.img
target reported max download size of 536870912 bytes
sending 'boot_a' (19853 KB)...
OKAY [ 0.641s]
writing 'boot_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 0.648s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.0
target reported max download size of 536870912 bytes
sending 'system_a' (516147 KB)...
OKAY [ 14.299s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 14.305s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.1
target reported max download size of 536870912 bytes
sending 'system_a' (514107 KB)...
OKAY [ 14.325s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 14.330s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.2
target reported max download size of 536870912 bytes
sending 'system_a' (516207 KB)...
OKAY [ 12.610s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 12.615s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.3
target reported max download size of 536870912 bytes
sending 'system_a' (522175 KB)...
OKAY [ 12.093s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 12.099s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.4
target reported max download size of 536870912 bytes
sending 'system_a' (523085 KB)...
OKAY [ 11.982s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 11.988s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.5
target reported max download size of 536870912 bytes
sending 'system_a' (512470 KB)...
OKAY [ 11.628s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 11.633s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.6
target reported max download size of 536870912 bytes
sending 'system_a' (437037 KB)...
OKAY [ 9.984s]
writing 'system_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 9.990s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system system.img_sparsechunk.7
error: cannot load 'system.img_sparsechunk.7': No such file or directory

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash system_b system_other.img
target reported max download size of 536870912 bytes
sending 'system_b' (134369 KB)...
OKAY [ 3.045s]
writing 'system_b'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 3.051s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot flash oem oem.img
target reported max download size of 536870912 bytes
sending 'oem_a' (39488 KB)...
OKAY [ 1.129s]
writing 'oem_a'...
(bootloader) flash permission denied
FAILED (remote failure)
finished. total time: 1.137s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot erase carrier
erasing 'carrier'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.005s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot erase userdata
erasing 'userdata'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.004s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot erase ddr
erasing 'ddr'...
(bootloader) Permission denied
FAILED (remote failure)
finished. total time: 0.004s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>fastboot oem fb_mode_clear
...
OKAY [ 0.003s]
finished. total time: 0.004s

C:\adb\ROMs\XT1900-1_PAYTON_FI_8.0.0_OPW27.57-25-2_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml>pause1>nul