First of all, check that the phone is suitable for the procedures described here. The exact model I used is a version of the Moto G4 Plus identified by the code XT1642. Bought in Europe, it lacks the CDMA signalling used in the USA, but works perfectly well in New Zealand.
Next, make sure the phone is fully charged or close to it. An uncontrolled shutdown during the installation procedure could leave you with a bricked phone.
The phone comes with a USB cable which is used to charge it via the fast charger also included in the box. That cable is all we need to talk to it from our Mint PC. But... first we have to open the interface, and to do that we have to become a "developer".
Tap Settings
- Swipe all the way down to the bottom and tap "About phone".
This shows Android version 7.0. (7.x releases are named "Nougat").
- Swipe down to the bottom again to find "Build number"
The magic sauce bit... tap "Build number" seven or more times. A
message appears to confirm that you are now a developer.
Now tap Settings again and work down to the "System" section. A new entry has appeared... "Developer options". Tap it and then toggle Android debugging on.
On the PC side, you need to be running a recent version of Linux Mint. The following procedures were carried out with Mint Cinnamon 17.3. You need pgp installed to check signatures and md5sum to verify checksums. You do check the integrity of downloaded software, don't you?
Connect the phone to the PC with the cable. It is detected and dmesg shows entries like this:
[232178.713889] usb 1-2: new high-speed USB device number 17 using xhci_hcd [232178.904792] usb 1-2: New USB device found, idVendor=22b8, idProduct=2e80 [232178.904795] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [232178.904796] usb 1-2: Product: Fastboot athene_16mp S [232178.904797] usb 1-2: Manufacturer: Motorola Inc. [232178.904798] usb 1-2: SerialNumber: ZY223BRSVS
lsusb shows an entry like:
"Bus 001 Device 032: ID 22b8:2e80 Motorola PCS"
The phone is visible in Nemo (Mint's file explorer) as, e.g., mtp://[usb:001,020]/ ... but no files are visible and the df and mount commands show nothing. That doesn't matter.
Some sites suggest that you install the whole Android System Developer Kit (SDK), but that is hundreds of MB in size, so let's see if we can get by with just what we need. I found that I could do all I needed with the following commands:
> sudo apt-get install android-tools-adb > sudo apt-get install mtpfs > sudo apt-get install mtp-tools > sudo apt-get install android-tools-fastboot
All of these were available straight out of Mint's usual repositories; no repository had to be added. In total, they took less than 1MB.
The first command installs the adb ("Android Debug Bridge") command; this is what will let us talk to the phone from the Linux PC. Beware - if it doesn't like the parameters you entered, this command vomits its entire help file (~120 lines) all over the console, very tiresome if you are trying to find out how it works! 2>/dev/null is your friend!
Let's see what the adb command will do...
> adb devices -l
List of devices attached
ZY223BRSVS device usb:1-2 product:athene_f model:Moto_G__4_ device:athene_f
> adb reboot <--- REBOOTS PHONE
> adb shell <--- GETS YOU INTO A SHELL OK
~ # uname -a
Linux localhost 3.10.84-g0498988-00001-g560544a #1 SMP PREEMPT Mon Apr 18 18:41:52 CDT 2016
armv7l GNU/Linux
<--- "armv7l" indicates a 32-bit system
~ # ps <--- SHOWS MORE THAN 400 PROCESSES!
~ # exit <--- ALL VERY FAMILIAR
22:05:49 2720
> adb reboot bootloader <--- BOOTS INTO THE SAME BOOTLOADER SCREEN YOU GET BY HOLDING THE
<--- VOLUME DOWN AND START BUTTONS SIMULTANEOUSLY.
And what about the fastboot command?...
> fastboot reboot < waiting for device > <--- (FOREVER) ^C > fastboot getvar all < waiting for device > <--- (FOREVER) ^C
No hint of what is going wrong. Hmmm, what about...
> sudo fastboot getvar all (bootloader) version: 0.5 (bootloader) version-bootloader: moto-msm8952-B1.05 (bootloader) product: athene_16mp (bootloader) board: athene_16mp (bootloader) secure: yes ... and lots more ... >
That's it... fastboot needs root privileges.
NOTE: Once you are in bootloader mode, adb commands don't work ("device not found"),
and when the phone is up and running, fastboot commands evoke no response, even when
issued with root privileges.
Warning: This step has the effect of a factory reset on your phone. Make sure that you have taken a backup of your contacts and anything else important before you start! Not being happy to have my data in Google's hands, I had never trusted much to the phone, so I did not need to do this.
Also, make sure you know your wireless password, if you had one!
Now we get down to the serious business. Mobile phones are naturally enough secured against casual changes to the operating system; we can't do anything until we unlock the phone. "Unlocking" here doesn't mean the usual kind to free a phone for use with other providers, but OEM unlocking, without which you can't flash new operating software to its ROM. Motorola's way of managing this is to require that you:
- Know how to become a "developer"
- Know how to install and use fastboot and associated utilities
- Use fastboot to retrieve the "unlock data" (131 mostly hexadecimal characters) from the phone
- Log in to their website and submit an unlocking request along with the above unlock data
- Read portentous warnings about what you are going to do, along with a lot of legalese protecting Motorola and a reminder that your phone's guarantee will be toast
- Receive the unlocking code (twenty alphameric characters) by email
- Go through the unlocking procedure with this code
This is what we get when we ask for the unlocking data:
> sudo fastboot oem get_unlock_data [sudo] password for ed: ... (bootloader) Unlock data: (bootloader) 3A54074173011369# (bootloader) 5A33452253030D46593232F476F2045637200000# (bootloader) C30A211CFDA685682C36B491127216BCD5D9D80E# (bootloader) EFAFD400000000000000000000000000 OKAY [ 0.102s] finished. total time: 0.102s >
Good. That corresponds to what I was told to expect. (These aren't the real figures... I've jumbled them around a bit. You can't be too careful these days!) We have to concatenate them into one big string for submission to Motorola, to wit:
3A54074173011369#5A33452253030D46593232F476F2045637200000#C30A211CFDA685682C36B491127216BCD5D9D80E#EFAFD400000000000000000000000000
Now log in to Motorola's site and carry out the instructions there. You have to register with them and supply an email address which will be used to send you the unlock code. Have a temporary one ready if you don't want to give them your permanent address. When you paste the string into Motorola's form, it must be exactly as above, all on one line, and with no whitespace characters added!
Back comes the mail in due course, and the unlocking code is (again jumbled):
YVW3KSNKJDDU7Z2UZXWM
Now all that is required to unlock the phone is:
- Start the phone normally.
- Go to Settings - Developer options
- Toggle OEM Unlocking to ALLOWED (need the phone's PIN code here)
- From your PC, use your code to unlock the bootloader as below
> adb reboot bootloader > sudo fastboot oem unlock YVW3KSNKJDDU7Z2UZXWM ... (bootloader) WARNING: This command erases all user data. (bootloader) Please re-run this command to continue. OKAY [ 0.006s] finished. total time: 0.006s > sudo fastboot oem unlock YVW3KSNKJDDU7Z2UZXWM ... (bootloader) Bootloader is unlocked! Rebooting phone OKAY [ 1.045s] finished. total time: 1.045s > ... PHONE REBOOTS BACK INTO BOOTLOADER SCREEN
Now start the phone normally. The first thing you will see is a sombre black text screen warning you that the phone is unlocked and therefore can't be trusted. After a few seconds of this, the phone will start as usual, except that you have to set everything up once again to use it, your name, wireless password etc.
Incidentally, put the phone back into bootloader mode and do:
> sudo fastboot getvar iswarrantyvoid iswarrantyvoid: yes finished. total time: 0.009s >
Well, you were warned!
The stock Moto has a recovery mode, but it doesn't offer an option to flash software to the ROM, so we need to install something better. That something better is the open-source TWRP (Team Win Recovery Project), available for a huge number of Android phones. You have to download the exact version required by your phone model! Accordingly, I looked the site up and downloaded twrp-3.1.1-0-athene.img, the latest version, along with a signature file twrp-3.1.1-0-athene.asc. A quick attempt to view the signature file showed pure gibberish... it wasn't ASCII armoured, and should really have had a .sig extension. No harm, GPG doesn't mind, so...
> gpg --verify twrp-3.1.1-0-athene.img.asc gpg: Signature made Sun 21 May 2017 13:22:41 NZST using RSA key ID 891A43DF gpg: Good signature from "TeamWin <admin@teamw.in>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 9570 7D42 307C 9D41 D09B F709 1D85 97D7 891A 43DF >
The "Good signature" will do, and we can safely proceed. Do adb reboot bootloader (less fussy than using the phone's Power On and Volume Down buttons) and then:
> sudo fastboot flash recovery twrp-3.1.1-0-athene.img [sudo] password for ed: target reported max download size of 536870912 bytes sending 'recovery' (12530 KB)... OKAY [ 0.399s] writing 'recovery'... (bootloader) Image not signed or corrupt OKAY [ 0.355s] finished. total time: 0.754s >
Well, we know that the image file is OK, so the error message is just FUD in this case. Now, while we are still in bootloader mode, don't toggle to and activate "recovery mode", because some sort of security precaution will cause the TWRP just installed to be replaced by the stock recovery once again. Toggle to "restart bootloader" and activate it for a second time, and only afterwards enter "recovery mode" Now we arrive at the TWRP screen (...and Nemo magically starts seeing files under mtp://[usb.....], but there is still no entry in df).
Henceforth the normal way to activate TWRP is to toggle to "recovery mode" in the bootloader screen.
One look at TWRP's control screen shows that there are quite a lot of things you can do, but we won't go into them here. Instead, just tap the "Reboot" button, then "System"... and we are back in the normal phone functions.
First get the required version of LineageOS. Their site has a lot of builds for a huge range of phone models, but the ones we want are here. The latest one is lineage-14.1-20170612-nightly-athene-signed.zip as I write. Have a look at the changelog... No, no! Don't go there! More than 130 changes in this build alone! How can it ever work?
...Just take the latest version and don't ask too many questions...
This was lineage-14.1-20170522-nightly-athene-signed.zip when I downloaded it. Copy it to a micro SD card and check its md5sum there against the value given on the website. Pop the micro SD card into the phone.
Now perform the following actions:-
- In TWRP, wipe the system, data, cache and Dalvik partitions (but NOT the internal storage)
- In TWRP, INSTALL the new ROM from the build copied to the micro SD card. Just specify the ZIP file, no need to unpack it yourself. If there is nothing in /sdcard, you may find that the SD card is mounted on /sdcard1 or the like. I don't know why. If the procedure fails with "zip signature verification failed", no matter. As long as the file on the SD card had the right md5 checksum, just start again, ignoring the signature check. The installation takes place to /system.
- The next step is normally to install some version of Gapps, i.e. a set of Google Apps, ranging from a bare minimum to the kitchen sink and everything. What you do here depends on how you intend to use the phone later. I installed nothing at this stage just to see what the phone looked like with no Google stuff at all. Of course, without the Play Store, you can't download any apps.
- In TWRP, tape the Wipe button to do a factory reset. This just wipes the data, cache and Dalvik partitions, which has already been done above, but this instruction appears at this point in many of the guides I have read, so just to be sure to be sure... Of course, this leaves /system alone.
- There is an invitation to install the TWRP App before rebooting.
- In TWRP, tap "Reboot", then "System". The phone restarts, and we get the LineageOS progress logo (a moving version of the image on their site) for about two minutes.
...and then we are back at a normal home screen not totally unlike the one on the stock ROM.
Now Settings - About phone shows Android 7.1.2 and a LineageOS version as above
At this point, of course, the phone had to be set up from scratch once more. The setup procedure under LineageOS seemed from recollection to be much the same it was as under Android.
This is also the point where you restore your contacts and everything else from the backup. You did make a backup, didn't you?
That sombre black startup screen warning you that the unlocked phone can't be trusted quickly gets irritating. It's replacing the Motorola "Powered by Android" screen in the startup procedure for unmodified phones (and telling any thief that the phone is unlocked). There are plenty of sites offering replacements for the overwritten Motorola screen in the form of files named logo.bin. Just search the Web for "Android unlocked bootloader warning" or the like and download what you find. Then connect the phone to the USB port and:
> adb reboot bootloader > cd ~/Downloads ...OR WHEREVER > sudo fastboot flash logo logo.bin target reported max download size of 536870912 bytes sending 'logo' (917 KB)... OKAY [ 0.032s] writing 'logo'... OKAY [ 0.055s] finished. total time: 0.087s > sudo fastboot reboot rebooting... finished. total time: 0.006s >
However, when I tried this, the result was that I still had a black screen, but with all the boilerplate text gone and only the characters "N/A" remaining, presumably a fill-in field. This happened with several versions of logo.bin dating from 2015 until I found a copy of the stock file from September 2016 which worked.
The following material can be skipped over, unless you want to dig deeper.
> sudo fastboot getvar all <--- BEFORE CHANGES (bootloader) version: 0.5 (bootloader) version-bootloader: moto-msm8952-B1.05 (bootloader) product: athene_16mp (bootloader) board: athene_16mp (bootloader) secure: yes (bootloader) hwrev: P2A (bootloader) radio: 3 (bootloader) storage-type: emmc (bootloader) emmc: 16GB SAMSUNG QE13MB RV=08 PV=07 FV=0000000000000007 (bootloader) ram: 2GB SAMSUNG LP3 DIE=8Gb M5=01 M6=05 M7=00 M8=1F (bootloader) cpu: MSM8952 (bootloader) serialno: ZY223BRSVS (bootloader) cid: 0x0032 (bootloader) channelid: 0x40 (bootloader) uid: EFAFD40000000000000000000000 (bootloader) securestate: oem_locked (bootloader) iswarrantyvoid: no (bootloader) max-download-size: 536870912 (bootloader) reason: Reboot mode set to fastboot (bootloader) imei: 354117071096493 (bootloader) meid: (bootloader) date: 06-15-2016 (bootloader) sku: XT1642 (bootloader) battid: SNN5966A (bootloader) iccid: (bootloader) cust_md5: (bootloader) max-sparse-size: 268435456 (bootloader) current-time: "Tue Aug 30 20:41:53 UTC 2016" (bootloader) ro.build.fingerprint[0]: motorola/athene_f/athene_f:7.0/NPJ (bootloader) ro.build.fingerprint[1]: S25.93-14-4/4:user/release-keys (bootloader) ro.build.version.full[0]: Blur_Version.25.201.4.athene.reta (bootloader) ro.build.version.full[1]: il.en.US (bootloader) ro.build.version.qcom: LA.BR.1.3.6-01710-8976.0 (bootloader) version-baseband[0]: M8952_70030.25.03.62R ATHENE_EMEA_DSDS (bootloader) version-baseband[1]: _CUST (bootloader) kernel.version[0]: Linux version 3.10.84-gb9596e1 (hudsoncm (bootloader) kernel.version[1]: @ilclbld31) (gcc version 4.8 (GCC) ) #1 (bootloader) kernel.version[2]: SMP PREEMPT Fri Mar 3 02:04:02 CST 2017 (bootloader) sbl1.git: git=MBM-NG-VB1.05-0-ge433b40 (bootloader) rpm.git: git=a970ead (bootloader) tz.git: git=119e5b2-dirty (bootloader) hyp.git: git=119e5b2-dirty (bootloader) keymaster.git: git=119e5b2-dirty (bootloader) cmnlib.git: git=119e5b2-dirty (bootloader) aboot.git: git=MBM-NG-VB1.05-0-g8a1de8c (bootloader) qe: qe 0/0 (bootloader) frp-state: protected (75) (bootloader) ro.carrier: reteu all: listed above finished. total time: 0.077s > 10:19:01 2732> adb shell athene_f:/ $ cat /proc/cpuinfo processor : 0 model name : ARMv7 Processor rev 4 (v7l) BogoMIPS : 38.00 Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 4 ...and 7 more to processor 7, then finally... Hardware : Qualcomm Technologies, Inc MSM8952 Revision : 82a0 Serial : efafd40000000000 Processor : ARMv7 Processor rev 4 (v7l) Device : athene_16mp Radio : EMEA MSM Hardware : MSM8952 athene_f:/ $ athene:/ df Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 943452 620 942832 1% /dev tmpfs 943452 0 943452 0% /mnt /dev/block/bootdevice/by-name/system 2459748 667120 1776244 28% /system /dev/block/mmcblk0p48 11349888 2668536 8595464 24% /data /dev/block/mmcblk0p46 253920 436 248244 1% /cache /dev/block/bootdevice/by-name/fsg 1968 1956 0 100% /fsg /dev/block/mmcblk0p1 96688 71256 23384 76% /firmware /dev/block/mmcblk0p30 28144 472 27020 2% /persist /dev/block/mmcblk0p12 12016 3740 7952 32% /dsp /data/media 11349888 2668536 8595464 24% /storage/emulated /mnt/media_rw/9016-4EF8 31263744 353536 30910208 2% /storage/9016-4EF8 athene:/ $ athene:/ $ mount rootfs on / type rootfs (ro,seclabel) tmpfs on /dev type tmpfs (rw,seclabel,nosuid,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755) devpts on /dev/pts type devpts (rw,seclabel,noatime,nodiratime,mode=600) proc on /proc type proc (rw,noatime,nodiratime,gid=3009,hidepid=2) sysfs on /sys type sysfs (rw,seclabel,noatime,nodiratime) selinuxfs on /sys/fs/selinux type selinuxfs (rw,noatime,nodiratime) debugfs on /sys/kernel/debug type debugfs (rw,seclabel,noatime,nodiratime) none on /acct type cgroup (rw,noatime,nodiratime,cpuacct) tmpfs on /mnt type tmpfs (rw,seclabel,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755,gid=1000) none on /config type configfs (rw,noatime,nodiratime) none on /dev/cpuctl type cgroup (rw,noatime,nodiratime,cpu) none on /dev/cpuset type cgroup (rw,noatime,nodiratime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent) pstore on /sys/fs/pstore type pstore (rw,seclabel,noatime,nodiratime) none on /dev/bfqio type cgroup (rw,noatime,nodiratime,bfqio) /dev/block/bootdevice/by-name/system on /system type ext4 (ro,seclabel,noatime,nodiratime,data=ordered) /dev/block/bootdevice/by-name/userdata on /data type f2fs (rw,seclabel,nosuid,nodev,noatime,nodiratime,\ background_gc=on,user_xattr,inline_xattr,acl,inline_data,active_logs=6) /dev/block/bootdevice/by-name/cache on /cache type ext4 (rw,seclabel,nosuid,nodev,noatime,nodiratime,\ data=ordered) /dev/block/bootdevice/by-name/fsg on /fsg type ext4 (ro,context=u:object_r:fsg_file:s0,nosuid,nodev,\ noatime,nodiratime,nobarrier) /dev/block/bootdevice/by-name/modem on /firmware type ext4 (ro,context=u:object_r:firmware_file:s0,nosuid,\ nodev,noatime,nodiratime,nobarrier,data=ordered) /dev/block/bootdevice/by-name/persist on /persist type ext4 (rw,defcontext=u:object_r:persist_file:s0,\ seclabel,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,data=ordered) /dev/block/bootdevice/by-name/dsp on /dsp type ext4 (rw,seclabel,nosuid,nodev,noatime,nodiratime,data=ordered) adb on /dev/usb-ffs/adb type functionfs (rw,noatime,nodiratime) tmpfs on /storage type tmpfs (rw,seclabel,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755,gid=1000) /data/media on /mnt/runtime/default/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\ fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6) /data/media on /storage/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,fsuid=1023,\ fsgid=1023,gid=1015,multiuser,mask=6) /data/media on /mnt/runtime/read/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\ fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=23) /data/media on /mnt/runtime/write/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\ fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7) /dev/block/vold/public:179_65 on /mnt/media_rw/9016-4EF8 type vfat (rw,dirsync,nosuid,nodev,noexec,\ noatime,nodiratime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,\ iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro) /mnt/media_rw/9016-4EF8 on /mnt/runtime/default/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\ nodiratime,fsuid=1023,fsgid=1023,gid=1015,mask=6) /mnt/media_rw/9016-4EF8 on /storage/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\ fsuid=1023,fsgid=1023,gid=1015,mask=6) /mnt/media_rw/9016-4EF8 on /mnt/runtime/read/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\ nodiratime,fsuid=1023,fsgid=1023,gid=9997,mask=18) /mnt/media_rw/9016-4EF8 on /mnt/runtime/write/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\ nodiratime,fsuid=1023,fsgid=1023,gid=9997,mask=18) athene:/ STICK A FRESH MICRO SD CARD IN THE (UNMODIFIED) PHONE, AND IT GETS SET UP WITH THE FOLLOWING STRUCTURE:- athene_f:/sdcard $ du -a 8 ./Android/media/com.android.providers.media 8 ./Android/media/com.google.android.talk 24 ./Android/media 4 ./Android/data/.nomedia 8 ./Android/data/com.google.android.music/cache 4 ./Android/data/com.google.android.music/files/._playmusicid 12 ./Android/data/com.google.android.music/files 28 ./Android/data/com.google.android.music 8 ./Android/data/com.google.android.youtube/cache/exo 8 ./Android/data/com.google.android.youtube/cache/cronet_media_cache 24 ./Android/data/com.google.android.youtube/cache 8 ./Android/data/com.google.android.youtube/files 40 ./Android/data/com.google.android.youtube 8 ./Android/data/com.google.android.apps.maps/files 8 ./Android/data/com.google.android.apps.maps/testdata 24 ./Android/data/com.google.android.apps.maps/cache/cache_r.m 32 ./Android/data/com.google.android.apps.maps/cache 56 ./Android/data/com.google.android.apps.maps 8 ./Android/data/com.google.android.videos/files/Movies 16 ./Android/data/com.google.android.videos/files 24 ./Android/data/com.google.android.videos 8 ./Android/data/com.google.android.gms/files 16 ./Android/data/com.google.android.gms 8 ./Android/data/com.google.android.tts/files/download_cache 16 ./Android/data/com.google.android.tts/files 24 ./Android/data/com.google.android.tts 8 ./Android/data/com.google.android.apps.docs/cache 8 ./Android/data/com.google.android.apps.docs/files/pinned_docs_files_do_not_edit 16 ./Android/data/com.google.android.apps.docs/files 32 ./Android/data/com.google.android.apps.docs 232 ./Android/data 264 ./Android 8 ./Music 8 ./Podcasts 8 ./Ringtones 8 ./Alarms 8 ./Notifications 8 ./Pictures 8 ./Movies 8 ./Download 8 ./DCIM/Camera 16 ./DCIM 8 ./alt_autocycle 360 . athene_f:/sdcard
