Jun. 10th, 2017 09:37 pm
Pulling data from a bootlooping Nexus 5X
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
joshua0tl;dr: you can boot TWRP on some bootlooping Nexus 5Xs if you are really careful and use the image that I provide. Skip to the instructions if you don't care to hear me blather. And if you liked this, you might also like the hard mode version.
Yesterday evening, my Nexus 5X (a refurb from July 2016, after the fingerprint sensor on my original October 2015 Nexus 5X failed) succumbed to the disease that seems to take all of them: while I was at dinner, I sent someone a message, and as I hit "send", the device hung, got shot by the watchdog timer and rebooted, displayed the "Google" logo, and continued to cycle through being shot down by the WDT and rebooting over and over again. This failure mode is apparently very common in these devices, and is known as the dreaded "bootloop"; it is so widely known that the Google Store has indefinitely extended the warranty period for devices matching these symptoms, and the Nexus 5X subreddit is basically overrun by bootloop posts.
The actual root cause, as far as I can tell, is not publicly known. There has been a lot of speculation about what causes it, and what triggers it, and what exacerbates it -- and there are a lot of very hocus-pocus remedies to attempt to prolong the life of the device, or to recover from it. Indeed, information about this seems scarce even inside Google; reliable sources indicate that for a time, microkitchen refrigerators were full of Nexus 5Xs, in an attempt to stave off issues while updating the devices. All that seems to be certain is that the "bootloop" is a hardware defect. There seem to be many different syndrome families of bootloop. For instance, some devices seem to exhibit unusual behavior before they fail entirely (perhaps reporting "no SIM card", or having touchscreen issues); some devices fail in a fashion that is temperature-sensitive or voltage-sensitive (freezing the phone can give some extra life, or discharging the battery to a low percentage can also give the phone some extra time); and some devices fail in a fashion that seems to indicate storage issues (there's no temperature or other sensitivity, and the system usually crashes when trying to read from storage). There seems to be a long tail of symptoms, but the "temperature-sensitive" case seems to be the most common.
In any event, that is the bucket that mine fell in. Mine would boot into recover for about five or six seconds after being put in the freezer, but did not last long enough to mount the filesystem, let alone get data out of it. One enterprising user on XDA-Developers noted that low-battery-voltage cases caused the system to disable the Cortex-A57 (high-power, high-performance) cores, and experimented with a patched kernel that forced the phone to only run on the Cortex-A53 (low-power, low-performance) cores, and lo and behold, found that doing so allowed his phone to boot.
I tried booting his boot.img on my phone, and sure enough, it at least got to the boot progress spinner. But, really, I wanted all the data from my phone, not to boot my phone up and potentially corrupt more stuff if it crashes. So, I used mkbootimg_tools to tear apart the boot.img that he supplied, and also to tear apart a TeamWin Recovery image. Then, I glued the TWRP ramdisk into the "A53-only" boot.img using the same mkbootimg package; and after I had an A53-only-plus-TWRP boot.img, I booted that on my phone. And sure enough, TWRP booted without trouble, and I could pull data off my phone! (For good measure, I wrapped it in an ice pack while it was mirroring, just in case.)
So, if you want to replicate this, you can do it in about the following fashion:
And, with any luck, you should have booted TWRP on your phone.
Or, if you just want to recover data from your Nexus 5X that you have already fastboot oem unlocked, you can do the following. Note that I supply this as a suggestion, with no warranty, with no offer of support at all; I won't answer support inquiries, and if it breaks, you get you keep both pieces...
Yesterday evening, my Nexus 5X (a refurb from July 2016, after the fingerprint sensor on my original October 2015 Nexus 5X failed) succumbed to the disease that seems to take all of them: while I was at dinner, I sent someone a message, and as I hit "send", the device hung, got shot by the watchdog timer and rebooted, displayed the "Google" logo, and continued to cycle through being shot down by the WDT and rebooting over and over again. This failure mode is apparently very common in these devices, and is known as the dreaded "bootloop"; it is so widely known that the Google Store has indefinitely extended the warranty period for devices matching these symptoms, and the Nexus 5X subreddit is basically overrun by bootloop posts.
The actual root cause, as far as I can tell, is not publicly known. There has been a lot of speculation about what causes it, and what triggers it, and what exacerbates it -- and there are a lot of very hocus-pocus remedies to attempt to prolong the life of the device, or to recover from it. Indeed, information about this seems scarce even inside Google; reliable sources indicate that for a time, microkitchen refrigerators were full of Nexus 5Xs, in an attempt to stave off issues while updating the devices. All that seems to be certain is that the "bootloop" is a hardware defect. There seem to be many different syndrome families of bootloop. For instance, some devices seem to exhibit unusual behavior before they fail entirely (perhaps reporting "no SIM card", or having touchscreen issues); some devices fail in a fashion that is temperature-sensitive or voltage-sensitive (freezing the phone can give some extra life, or discharging the battery to a low percentage can also give the phone some extra time); and some devices fail in a fashion that seems to indicate storage issues (there's no temperature or other sensitivity, and the system usually crashes when trying to read from storage). There seems to be a long tail of symptoms, but the "temperature-sensitive" case seems to be the most common.
In any event, that is the bucket that mine fell in. Mine would boot into recover for about five or six seconds after being put in the freezer, but did not last long enough to mount the filesystem, let alone get data out of it. One enterprising user on XDA-Developers noted that low-battery-voltage cases caused the system to disable the Cortex-A57 (high-power, high-performance) cores, and experimented with a patched kernel that forced the phone to only run on the Cortex-A53 (low-power, low-performance) cores, and lo and behold, found that doing so allowed his phone to boot.
I tried booting his boot.img on my phone, and sure enough, it at least got to the boot progress spinner. But, really, I wanted all the data from my phone, not to boot my phone up and potentially corrupt more stuff if it crashes. So, I used mkbootimg_tools to tear apart the boot.img that he supplied, and also to tear apart a TeamWin Recovery image. Then, I glued the TWRP ramdisk into the "A53-only" boot.img using the same mkbootimg package; and after I had an A53-only-plus-TWRP boot.img, I booted that on my phone. And sure enough, TWRP booted without trouble, and I could pull data off my phone! (For good measure, I wrapped it in an ice pack while it was mirroring, just in case.)
So, if you want to replicate this, you can do it in about the following fashion:
$ git clone https://github.com/xiaolu/mkbootimg_tools $ mkbootimg_tools/mkboot bootelx1.20.img bootelx1.20 $ mkbootimg_tools/mkboot twrp-3.1.0-0-bullhead.img twrp-3.1.0-0-bullhead $ cp twrp-3.1.0-0-bullhead/ramdisk.packed bootelx1.20/ $ mv bootelx1.20/ramdisk bootelx1.20/ramdisk.old $ cp -R twrp-3.1.0-0-bullhead/ramdisk bootelx1.20/ramdisk $ mkbootimg_tools/mkboot bootelx1.20 twrp-bootelx-1.20.img $ fastboot boot twrp-bootelx-1.20.img
And, with any luck, you should have booted TWRP on your phone.
Or, if you just want to recover data from your Nexus 5X that you have already fastboot oem unlocked, you can do the following. Note that I supply this as a suggestion, with no warranty, with no offer of support at all; I won't answer support inquiries, and if it breaks, you get you keep both pieces...
- Either make an A53-only TWRP boot.img, as described above, or download mine.
- Boot your Nexus 5X to the bootloader (volume down plus power).
- From your PC, fastboot boot twrp-3.1.0-0-bullhead-jwise-a53-only.img
- TWRP should boot. If it doesn't, your phone doesn't have the same bootloop syndrome as mine; sorry. Maybe try freezing yours. Or heating it. Or putting it under a BGA rework station. Or...
- You should be able to use TWRP normally, and if you have a plan for that, you can stop here and do whatever it is that you wanted to do. But if, like me, you want to dump the entire flash image, you can continue on: unlock the flash in TWRP by putting in your password or pattern.
- In TWRP, tap on 'mount', and uncheck 'user data' (or whatever it is that gets you /data).
- In one terminal on your PC, run adb forward tcp:8888 tcp:8888.
- In the same terminal, run adb shell; and then in the shell session (on your device), run nc -l -p 8888 < /dev/block/dm-0. This prepares the phone to back up the (unencrypted!) /data partition.
- Now, in the other terminal on your computer, run nc localhost 8888 > nexus-5x-backup. This will create a very large file; about 25GB, if you have a 32GB phone. If you want to get all fancy, you can install the bar tool to get a progress bar, and run something like nc localhost 8888 | bar -s 27283929088 > nexus-5x-backup.
- In about 45 minutes, you'll have a file containing an ext4 filesystem that you can mount or do whatever you like with; you can mount it with something like mount -o ro,loop nexus-5x-backup mnt/.
- Thank your little Nexus 5X for surviving long enough to get the rest of your photos off of it. Go back to cursing out some beancounter at LG who knew of this defect for ages, and who hasn't approved a board spin to fix it; live in hope that the class action lawsuit will make them think twice about doing this next time. Enjoy walking around with a tablet in your pocket instead of a phone for a few days until the new phone arrives, and start thinking about what you'll get next.
Tags: