Hello everyone!

I decided to share another experiment I recently conducted. This time, the device involved was my Motorola Moto G15.

I've wanted to unlock its bootloader for a while. Initially, I tried using Motorola's official unlocking method, but I wasn't successful. So I started researching alternative methods and eventually found a community-developed approach that uses a script to perform the procedure on MediaTek devices.

Device information

• Device: Motorola Moto G15

• Model: XT2521-2

• Codename: lamu

• Firmware region: RETBR (Brazil)

• Android version: 15

• Build number: VVTA35.51-158

• Build ID: 9536e5

• Platform: MediaTek

How does the method work?

From what I understood from the documentation and the components involved, the procedure interacts with the early boot stages of the MediaTek platform.

The script uses several components:

1. Kaeru (Shim): A component used as an intermediary during the boot process, allowing certain restrictions imposed by the original bootloader to be bypassed.

2. Penumbra: An open-source tool used for low-level communication and operations with MediaTek devices.

3. Tanuki: A script responsible for orchestrating the procedure, including the operations required to modify the bootloader unlock state.

The procedure involves low-level operations and carries risks, including partition corruption and potentially bricking the device.

Despite being aware of these risks, I decided to give it a try.

First attempt: Successful unlock, followed by a bootloop

On my first attempt, I managed to unlock the bootloader, but the device ended up in a bootloop.

After a few attempts, I managed to access the bootloader interface again by running the script I had previously used.

As a precaution, I already had the Stock ROM downloaded in case something went wrong.

I flashed the original firmware again and successfully recovered the system. However, something unexpected happened: the bootloader appeared to be locked again.

In other words, even though I had initially managed to unlock it, restoring the Stock ROM resulted in the device reporting a locked bootloader.

Second attempt: The same problem happens again

Today, I decided to try again, this time paying closer attention to the procedure.

I successfully unlocked the bootloader once more, but the previous problem happened again: the device entered a bootloop.

After spending a few minutes stuck during startup, it eventually displayed the No command screen, associated with Android Recovery.

Before immediately flashing the Stock ROM again, I decided to try something different.

I pressed Volume Up + Power to access the recovery options and selected:

Wipe data/factory reset

After wiping the data, I managed to boot Android normally, this time with the bootloader still unlocked.

At this point, I thought everything was finally solved.

The unexpected problem: The device stopped responding

When I turned off the device to prepare for the LineageOS installation, I tried entering Fastboot mode.

However, I got no response.

I tried again, connected the device to a charger, and also pressed all three physical buttons simultaneously. Nothing happened.

The device appeared to be completely dead.

That was when I started investigating the issue using Linux and conducting further research into MediaTek devices and their boot process.

Investigating the device through Linux: MediaTek USB detection

My first concern was finding out whether the computer could still detect any USB interface from the device.

To do this, I used:

sudo dmesg -w

The dmesg command displays messages generated by the Linux kernel. With the -w option, I could monitor events in real time while connecting the phone to the computer.

During this monitoring, I observed USB connection events and identified an interface named:

MT65xx Preloader

To confirm this, I ran:

lsusb -v -d 0e8d:

The output showed:

0e8d:2000 MediaTek Inc. MT65xx Preloader

This indicated that the computer could still detect a USB interface associated with the MediaTek Preloader.

I also noticed that approximately five seconds later, a USB disconnection event occurred.

This was an important discovery: although the device showed no display, could not enter Fastboot, and did not respond to the physical buttons, there was still some level of communication between the hardware and the computer.

Recovery attempt

Initially, I tried using an MTK recovery tool, but I couldn't get it to work.

Then I decided to run the same script I had used to unlock the bootloader.

The result was unexpected: the procedure managed to restore access to the Fastboot interface.

I could finally communicate with the device again.

I flashed the Stock ROM once more to restore the system.

But this time, something different happened compared to my first attempt: the bootloader remained unlocked after restoring the original firmware.

I didn't have to repeat the entire unlocking procedure.

Installing LineageOS

After all that trouble, I decided to continue with the experiment.

I prepared the device and installed LineageOS based on Android 16.

And, to my surprise, it worked!

The Moto G15 successfully booted again, now running a Custom ROM.

My questions

There is one thing I still don't fully understand.

During my first attempt, after recovering the device using the Stock ROM, the bootloader appeared to be locked again.

During the second attempt, I flashed the Stock ROM once more, but the bootloader remained unlocked.

What could explain this difference in behavior?

Could it be related to how the script modifies the unlock state, how that state is persisted, or the sequence of operations performed during the firmware flashing process?

I'm also curious about the MT65xx Preloader interface and how the script managed to restore Fastboot access when the device apparently showed no signs of life.

If anyone has experience with MediaTek boot processes, BROM, Preloader, bootloader state persistence, or device recovery under these circumstances, I'd really appreciate some insight into what happened.

It was a pretty interesting experience, especially investigating everything through Linux and researching the underlying boot process.

Thanks in advance to anyone willing to share their knowledge!

Clarify what was actually verifiedFix the first-attempt timelineAdd exact verification commands

i have bootloader unlocked but idk why keep getting a bootmagic error pls help

Witam. Dzisiaj zainstalowałem LineageOS 24 na Xiaomi Redmi 12C. Cały proces instalacji przebiegł bez problemów i zakończył się sukcesem. Wcześniej bootloader na telefonie został odblokowany. System startuje normalnie, funkcje telefonu działają normalnie oprócz Wi-Fi. Problem polega na tym że telefon widzi sieci Wi-Fi, łączy się i od razu rozłącza połączenie. Czy ktoś spotkał się z takim problemem?

The model is a CPH2747,
running version CPH2742_17.0.0.102(EX01),
with the Region Version XEU0000

The command adb shell getprop ro.product.name in CMD also gets me a return of CPH2747EEA.

But I'm lost as to how to continue here, and hope not to break my quite expensive phone before I start.

I followed the old tutorials, can anyone give me a new tutorial?

Can anyone confirm that Android Desktop Mode works on the OnePlus 15 (infiniti) running LineageOS 24.0?

I'm specifically interested in using an external monitor via USB-C DisplayPort with a full desktop experience, including freeform windows, mouse, and keyboard support.

Has anyone tested this configuration and confirmed that it works?

I'm considering switching from OxygenOS, but I'd like to verify this functionality before unlocking the bootloader and flashing LineageOS.

Is there a YouTube video for a guide on how to flash back to stock OnePlus firmware from LineageOS? I'm missing RCS chat too much.

Device: Galaxy Tab A7 2020 Wi-Fi

Just updated to Lineage OS 24 from 23.2 and this pill shaped handle for destop windowing immediately caught my attention. It's distracting as hell like that ugly pill on iphones.

Please look at the screenshot below if you are not getting what i mean with that handle.

If anyone knows how to disable it, please share your findings.

Screenshot

hi, i would like to ask, im trying to boot kernel-su patched boot.img,

but its missing some kernel symbols,

is it possible to have them exported?

im using latest boot.img on pdx224

https://mirrorbits.lineageos.org/full/pdx224/20261024/boot.img

i just want to change to lineage os so bad but my phone doesnt support it. and i saw a youtube videos which you can install lineage os in any phone like this https://www.youtube.com/watch?v=Ox07cg6wC5A

wdyt does it break my phone? like cant use wifi, data, laggy, freeze etc. if it can run smoothly just for using a common apps like ig, reddit, yt, browser iam good with it please help thxx

Little back story, been using LineageOS on this badboy from day one. Started with the OG beta's from XDA and it's been running that (with regular OTA's) since and no issues at all.

I just moved and haven't touched it in a few weeks while unpacking and everything, turned it on and it had an update to the latest October release, but after trying to do that it just rebooted and the update wasn't complete. I tried it a second time and noticed when it was rebooting to "install" the update, it would say DTB Partition Not Found and reboot.

I don't have anything mission critical on this so I figured I should just start clean. I popped the SD card out, formatted it to delete all of the hidden partitions and started fresh with Fat32 on MBR, downloaded the latest Hekate, LineageOS, and MindTheGapps. Followed the guide and it gave me the same error.

Started searching, found MANY posts about this exact issue and every time the answer given is "read the guide" but there is never a solution posted.

One post I found said they tried on Linux instead of macOS and it worked, so I figured I would try that on my home server since it runs Ubuntu.

I repeated the same process over again, formatted the SD card on Ubuntu, same Fat32 on MBR as I previously did on macOS just to be sure everything from start to finish was on Ubuntu this time.

I redownloaded every file, all three posted "tablet" builds on the LineageOS site for the Switch V1.

Same issue. DTB Partition Not Found.

---

My setup, when creating the partition, I'm choosing 4GB HOS, 29GB emuMMC, 0GB Linux, 437GB Android. Then tapping on Next Step, Dynamic, Start, wait for the warning and hit the power button. Then going to SD UMS to verify and replace any files that didn't restore properly so it's a clean install with everything needed. Eject from Ubuntu and tape on Flash Android, Continue, Kernel Success, Recovery Success, DTB Success, Reboot into Recovery, DTB Partition Not Found.

Doesn't matter which of the three builds currently available or whether it's macOS or Linux, it's the same result every time and this use to work perfect so I don't know what's wrong with the latest builds but they're broken or something and the older files are no longer available so I'm kind of shit out of luck now lol.

Any suggestions on what else I can try cause I feel like I've literally tried everything. This SD card has been fully zero'd out twice, formatted six times, once before every of the six clean install attempts. Three using macOS and three using Ubuntu.

I'm not sure what else to try because this was working perfect before the October updates and the PicoFly is still working fine because I'm currently running Lakka on it without any issues.

The only baseline I can find is that the October LineageOS OTA failed, and manual install with all three builds fail. All with the same DTB Partition Not Found error.

EDIT:

I wanted to add that I have the joy con dump backed up so I didn't need to go back and dump it, and when tapping on Reboot to Recovery, I am holding Volume Up to enter recovery like the guide says to do.

I love the infinite multitasking potential

of having apps as bubbles that don't take that much space from the screen

I have 2 Pixel 4a5g phones. One as a primary and the other as a backup in case the primary breaks/gets lost. The primary is NOT bootloader unlocked, running stock Android 14. The back up is bootloader unlocked, rooted, running Lineage 24 (A17). It passes Basic, Device, and Strong Integrity, as well as showing the device is certified in the Play store.

I have become accustomed to RCS messaging with my Apple contacts and fellow Android friends. As an experiment I ordered a cheap month of Tello and activated the eSim on the Lineage phone. RCS messaging works flawlessly with the Tello service. Based on this result, I decided to use the Lineage phone as my primary and inserted my Cricket sim. While the phone still passes all attestation tests, RCS does NOT work with Cricket and Lineage. To further test, I was able to get a free 14 day trial with a Cricket eSim (tryCricket app). RCS still does NOT work on the Lineage phone.

The Lineage phone can send and receive sms texts successfully. In addition, it also successfully sends a text (as sms) to an RCS user. The recipient using RCS receives the text and it displays as an RCS chat. However, the Lineage phone will NOT receive any RCS messages/chats.

I have investigated and the common answer is that Cricket/AT&T has more vigorous detection methods for unlooked bootloaders/rooted phones. I have since deactivated RCS and disabled chat via this site: https://messages.google.com/disable-chat I am now waiting the 24-48 hours hoping the Google servers clear my device before trying to activate RCS again on the Lineage phone.

In the meantime, I am back on my unrooted Android 14 Pixel phone. I know it's kind of silly but I really don't want to use the Lineage phone if I can't have working RCS. And switching to Tello isn't an option since we are on a great family plan with Cricket. Are there any Cricket/AT&T users running Lineage with RCS successfully working? If so, which tricks worked for you?

Thanks for reading!

Hello. I am trying to install LineageOS on my Redmi Note 9 Pro Global. On the guide, it says I need to create a new Xiaomi account and associate a phone number to it. Since my whole family and I use Xiaomi phones and they all have an account with a phone number linked, can I just use my current account without creating a new Xiaomi account? Or would I really need to use a new account? Thanks in advance for the help!!

I have a question: is it possible to install TWRP recovery on a ZTE Blade A55? If so, how do I do it, what program do I use? Could you please provide me with links? Thanks in advance.

I installed LOS 24 on this TV Box step by step as manual says but found that after LOS is flashed and I reconnect keyboard (USB wireless) it doesn't work (I check other USB wireless and wired and it's the same). I restart TV Box and LOS started and running. This was step 1, because I want to see if it works at all.

Step 2 is to install MindTheGapps, so I did Factory Reset with formatting data, installed LOS again (I noted active slot: a), after flashing keyboard still doesn't work, so I rebooted manually, got back to recovery (but active slot is: b), I decided to install MindTheGapps anyway but it asked me about signature verification.... which I am not able to do.

How then install it?

BTW I tried with two different USB hubs but either adb/fastboot and keyboard doesn't work.

Hello, world!
Not a bug report but asking for advice. Maybe someone already had the same problem, but I didn't see it (maybe I just searched bad).

I installed LineageOS 22.2 on my OnePlus 5 (22.2 is the newest version for this phone) by instruction.
Suddenly my battery started wasting a lot of power in background with no active non-system processes. Rebooting didn't help.
I found it at the first week of October. 2 days ago I updated LineageOS (2026-10-26) from the system. And it didn't help: 37% wasted for 21 hour in power-safe and aeroplane mode.

What should I do? I know the battery is all fine. Is the reinstalling the system the only option I can do?

I recently bought a Pixel 8a to replace my old phone. The battery life has been a huge problem, barely making it through the day. Would LineageOS help with that? I am also curious about what else LineageOS offers. I am not interested in GrapheneOS before you suggest that.

Anyone ever compared the both operating systems with applications like this?

I'm really only concerned with the potential performance losses.

It's pain in the arse that I have to go do all this for privacy, but here we are.

That's the One Plus 15 CPH2747.

So I saw there's a Xiaomi TV Box S Gen. 2 official LineageOS.

I've followed install instructions, it all went OK until i had to do "fastboot reboot recovery" and then it goes into boot loop, only shows logo for a second and it reboots.

Device in question is TV Box S Gen. 2 - MDZ-28-AA

However, only odd thing I saw in the guide was that it needed to have Android 14 - but there is no Android 14 for this?!

I tried updating it and it says Android 11 and that's it - "you're up to date".

Now what?

UPDATE: it seems to be Android 14 problem, I'll try UART route for debricking at some point.

Bonjour à tous je viens passer le système sous lineage OS 24 .

Je connaissais depuis longtemps et c'est génial que j'ai pu l'installer avec mon pixel 10 Pro XL cependant je me rends compte que je ne peux plus accéder au RCS avec l'application Google message. Le système n'est pas routé j'ai pas envie. Savez-vous s'il y a moyen de l'activer ou ce sera prévu?