Replacing the stock version of Android on a Motorola Moto G4 Plus is a complex task with many pitfalls. This guide tries to make it a little less daunting. The exact model of phone used here is the XT1642.

Top

Initial preparations

First of all, check that the phone is suitable for the procedures described here. The exact model I used is a version of the Moto G4 Plus identified by the code XT1642. Bought in Europe, it lacks the CDMA signalling used in the USA, but works perfectly well in New Zealand.

Next, make sure the phone is fully charged or close to it. An uncontrolled shutdown during the installation procedure could leave you with a bricked phone.

The phone comes with a USB cable which is used to charge it via the fast charger also included in the box. That cable is all we need to talk to it from our Mint PC. But... first we have to open the interface, and to do that we have to become a "developer".

  Tap Settings
    - Swipe all the way down to the bottom to find "About phone"
      - Swipe down to the bottom again to find "Build number"
        The magic sauce bit... tap "Build number" seven or more times. A
        message appears to confirm that you are now a developer.

Now tap Settings again and work down to the "System" section. A new entry has appeared... "Developer options". Tap it and then toggle Android debugging on.

On the PC side, you need to be running a recent version of Linux Mint. The following procedures were carried out with Mint Cinnamon 17.3. You need pgp installed to check signatures and md5sum to verify checksums. You do check the integrity of downloaded software, don't you?

Connect the phone to the PC with the cable. It is detected and dmesg shows entries like this:

[232178.713889] usb 1-2: new high-speed USB device number 17 using xhci_hcd
[232178.904792] usb 1-2: New USB device found, idVendor=22b8, idProduct=2e80
[232178.904795] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[232178.904796] usb 1-2: Product: Fastboot athene_16mp S
[232178.904797] usb 1-2: Manufacturer: Motorola Inc.
[232178.904798] usb 1-2: SerialNumber: ZY223BRSVS

lsusb shows an entry like:

 "Bus 001 Device 032: ID 22b8:2e80 Motorola PCS"

The phone is visible in Nemo (Mint's file explorer) as, e.g., mtp://[usb:001,020]/ ... but no files are visible and the df and mount commands show nothing. That doesn't matter.

Top

Accessing the phone

Some sites suggest that you install the whole Android System Developer Kit (SDK), but that is hundreds of MB in size, so let's see if we can get by with just what we need. I found that I could do all I needed with the following commands:

 > sudo apt-get install android-tools-adb

 > sudo apt-get install mtpfs

 > sudo apt-get install mtp-tools

 > sudo apt-get install android-tools-fastboot

All of these were available straight out of Mint's usual repositories; no repository had to be added. In total, they took less than 1MB.

The first command installs the adb ("Android Debug Bridge") command; this is what will let us talk to the phone from the Linux PC. Beware - if it doesn't like the parameters you entered, this command vomits its entire help file (~120 lines) all over the console, very tiresome if you are trying to find out how it works! 2>/dev/null is your friend!

Let's see what the adb command will do...

 > adb devices -l
List of devices attached
ZY223BRSVS             device usb:1-2 product:athene_f model:Moto_G__4_ device:athene_f

 > adb reboot            <--- REBOOTS PHONE

 > adb shell             <--- GETS YOU INTO A SHELL OK
  ~ # uname -a
  Linux localhost 3.10.84-g0498988-00001-g560544a #1 SMP PREEMPT Mon Apr 18 18:41:52 CDT 2016
  armv7l GNU/Linux
                         <--- "armv7l" indicates a 32-bit system

  ~ # ps                 <--- SHOWS MORE THAN 400 PROCESSES!

  ~ # exit               <--- ALL VERY FAMILIAR
  22:05:49 2720

 > adb reboot bootloader <--- BOOTS INTO THE SAME BOOTLOADER SCREEN YOU GET BY HOLDING THE
                         <--- VOLUME DOWN AND START BUTTONS SIMULTANEOUSLY.

And what about the fastboot command?...

 > fastboot reboot
< waiting for device >   <--- (FOREVER)
^C

 > fastboot getvar all
< waiting for device >   <--- (FOREVER)
^C

No hint of what is going wrong. Hmmm, what about...

 > sudo fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8952-B1.05
(bootloader) product: athene_16mp
(bootloader) board: athene_16mp
(bootloader) secure: yes
 ... and lots more ...
 >

That's it... fastboot needs root privileges.
NOTE: Once you are in bootloader mode, adb commands don't work ("device not found"), and when the phone is up and running, fastboot commands evoke no response, even when issued with root privileges.

Top

Unlocking the phone

Warning: This step has the effect of a factory reset on your phone. Make sure that you have taken a backup of your contacts and anything else important before you start! Not being happy to have my data in Google's hands, I had never trusted much to the phone, so I did not need to do this.

Also, make sure you know your wireless password, if you had one!

Now we get down to the serious business. Mobile phones are naturally enough secured against casual changes to the operating system; we can't do anything until we unlock the phone. "Unlocking" here doesn't mean the usual kind to free a phone for use with other providers, but OEM unlocking, without which you can't flash new operating software to its ROM. Motorola's way of managing this is to require that you:

This is what we get when we ask for the unlocking data:

 > sudo fastboot oem get_unlock_data
[sudo] password for ed:
...
(bootloader) Unlock data:
(bootloader) 3A54074173011369#
(bootloader) 5A33452253030D46593232F476F2045637200000#
(bootloader) C30A211CFDA685682C36B491127216BCD5D9D80E#
(bootloader) EFAFD400000000000000000000000000
OKAY [  0.102s]
finished. total time: 0.102s
 >

Good. That corresponds to what I was told to expect. (These aren't the real figures... I've jumbled them around a bit. You can't be too careful these days!) We have to concatenate them into one big string for submission to Motorola, to wit:

3A54074173011369#5A33452253030D46593232F476F2045637200000#C30A211CFDA685682C36B491127216BCD5D9D80E#EFAFD400000000000000000000000000

Now log in to Motorola's site and carry out the instructions there. You have to register with them and supply an email address which will be used to send you the unlock code. Have a temporary one ready if you don't want to give them your permanent address. When you paste the string into Motorola's form, it must be exactly as above, all on one line, and with no whitespace characters added!

Back comes the mail in due course, and the unlocking code is (again jumbled):

YVW3KSNKJDDU7Z2UZXWM

Now all that is required to unlock the phone is:

 > adb reboot bootloader

 > sudo fastboot oem unlock YVW3KSNKJDDU7Z2UZXWM
...
(bootloader) WARNING: This command erases all user data.
(bootloader) Please re-run this command to continue.
OKAY [  0.006s]
finished. total time: 0.006s
 > sudo fastboot oem unlock YVW3KSNKJDDU7Z2UZXWM
...
(bootloader) Bootloader is unlocked! Rebooting phone

OKAY [  1.045s]
finished. total time: 1.045s
 >
... PHONE REBOOTS BACK INTO BOOTLOADER SCREEN

Now start the phone normally. The first thing you will see is a sombre black text screen warning you that the phone is unlocked and therefore can't be trusted. After a few seconds of this, the phone will start as usual, except that you have to set everything up once again to use it, your name, wireless password etc.

Incidentally, put the phone back into bootloader mode and do:

> sudo fastboot getvar iswarrantyvoid
iswarrantyvoid: yes
finished. total time: 0.009s
>

Well, you were warned!

Top

Installing TWRP

The stock Moto has a recovery mode, but it doesn't offer an option to flash software to the ROM, so we need to install something better. That something better is the open-source TWRP (Team Win Recovery Project), available for a huge number of Android phones. You have to download the exact version required by your phone model! Accordingly, I looked the site up and downloaded twrp-3.1.1-0-athene.img, the latest version, along with a signature file twrp-3.1.1-0-athene.asc. A quick attempt to view the signature file showed pure gibberish... it wasn't ASCII armoured, and should really have had a .sig extension. No harm, GPG doesn't mind, so...

 > gpg --verify twrp-3.1.1-0-athene.img.asc
gpg: Signature made Sun 21 May 2017 13:22:41 NZST using RSA key ID 891A43DF
gpg: Good signature from "TeamWin <admin@teamw.in>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9570 7D42 307C 9D41 D09B  F709 1D85 97D7 891A 43DF
 >

The "Good signature" will do, and we can safely proceed. Do adb reboot bootloader (less fussy than using the phone's Power On and Volume Down buttons) and then:

 > sudo fastboot flash recovery twrp-3.1.1-0-athene.img
[sudo] password for ed:
target reported max download size of 536870912 bytes
sending 'recovery' (12530 KB)...
OKAY [  0.399s]
writing 'recovery'...
(bootloader) Image not signed or corrupt

OKAY [  0.355s]
finished. total time: 0.754s

 >

Well, we know that the image file is OK, so the error message is just FUD in this case. Now, while we are still in bootloader mode, don't toggle to and activate "recovery mode", because some sort of security precaution will cause the TWRP just installed to be replaced by the stock recovery once again. Toggle to "restart bootloader" and activate it for a second time, and only afterwards enter "recovery mode" Now we arrive at the TWRP screen (...and Nemo magically starts seeing files under mtp://[usb.....], but there is still no entry in df).

Henceforth the normal way to activate TWRP is to toggle to "recovery mode" in the bootloader screen.

One look at TWRP's control screen shows that there are quite a lot of things you can do, but we won't go into them here. Instead, just tap the "Reboot" button, then "System"... and we are back in the normal phone functions.

Top

Installing LineageOS

First get the required version of LineageOS. Their site has a lot of builds for a huge range of phone models, but the ones we want are here. The latest one is lineage-14.1-20170612-nightly-athene-signed.zip as I write. Have a look at the changelog... No, no! Don't go there! More than 130 changes in this build alone! How can it ever work?

...Just take the latest version and don't ask too many questions...

This was lineage-14.1-20170522-nightly-athene-signed.zip when I downloaded it. Copy it to a micro SD card and check its md5sum there against the value given on the website. Pop the micro SD card into the phone.

Now perform the following actions:-

...and then we are back at a normal home screen not totally unlike the one on the stock ROM.

Now Settings - About phone shows Android 7.1.2 and a LineageOS version as above

At this point, of course, the phone had to be set up from scratch once more. The setup procedure under LineageOS seemed from recollection to be much the same it was as under Android.

This is also the point where you restore your contacts and everything else from the backup. You did make a backup, didn't you?

Top

Tidying Up

That sombre black startup screen warning you that the unlocked phone can't be trusted quickly gets irritating. It's replacing the Motorola "Powered by Android" screen in the startup procedure for unmodified phones (and telling any thief that the phone is unlocked). There are plenty of sites offering replacements for the overwritten Motorola screen in the form of files named logo.bin. Just search the Web for "Android unlocked bootloader warning" or the like and download what you find. Then connect the phone to the USB port and:

 > adb reboot bootloader
 > cd ~/Downloads                     ...OR WHEREVER
 > sudo fastboot flash logo logo.bin
target reported max download size of 536870912 bytes
sending 'logo' (917 KB)...
OKAY [  0.032s]
writing 'logo'...
OKAY [  0.055s]
finished. total time: 0.087s
 > sudo fastboot reboot
rebooting...

finished. total time: 0.006s
 >

However, when I tried this, the result was that I still had a black screen, but with all the boilerplate text gone and only the characters "N/A" remaining, presumably a fill-in field. This happened with several versions of logo.bin dating from 2015 until I found a copy of the stock file from September 2016 which worked.

Top

Technical Stuff

The following material can be skipped over, unless you want to dig deeper.

 > sudo fastboot getvar all                             <--- BEFORE CHANGES
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8952-B1.05
(bootloader) product: athene_16mp
(bootloader) board: athene_16mp
(bootloader) secure: yes
(bootloader) hwrev: P2A
(bootloader) radio: 3
(bootloader) storage-type: emmc
(bootloader) emmc: 16GB SAMSUNG QE13MB RV=08 PV=07 FV=0000000000000007
(bootloader) ram: 2GB SAMSUNG LP3 DIE=8Gb M5=01 M6=05 M7=00 M8=1F
(bootloader) cpu: MSM8952
(bootloader) serialno: ZY223BRSVS
(bootloader) cid: 0x0032
(bootloader) channelid: 0x40
(bootloader) uid: EFAFD40000000000000000000000
(bootloader) securestate: oem_locked
(bootloader) iswarrantyvoid: no
(bootloader) max-download-size: 536870912
(bootloader) reason: Reboot mode set to fastboot
(bootloader) imei: 354117071096493
(bootloader) meid:
(bootloader) date: 06-15-2016
(bootloader) sku: XT1642
(bootloader) battid: SNN5966A
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Tue Aug 30 20:41:53 UTC 2016"
(bootloader) ro.build.fingerprint[0]: motorola/athene_f/athene_f:7.0/NPJ
(bootloader) ro.build.fingerprint[1]: S25.93-14-4/4:user/release-keys
(bootloader) ro.build.version.full[0]: Blur_Version.25.201.4.athene.reta
(bootloader) ro.build.version.full[1]: il.en.US
(bootloader) ro.build.version.qcom: LA.BR.1.3.6-01710-8976.0
(bootloader) version-baseband[0]: M8952_70030.25.03.62R ATHENE_EMEA_DSDS
(bootloader) version-baseband[1]: _CUST
(bootloader) kernel.version[0]: Linux version 3.10.84-gb9596e1 (hudsoncm
(bootloader) kernel.version[1]: @ilclbld31) (gcc version 4.8 (GCC) ) #1
(bootloader) kernel.version[2]: SMP PREEMPT Fri Mar 3 02:04:02 CST 2017
(bootloader) sbl1.git: git=MBM-NG-VB1.05-0-ge433b40
(bootloader) rpm.git: git=a970ead
(bootloader) tz.git: git=119e5b2-dirty
(bootloader) hyp.git: git=119e5b2-dirty
(bootloader) keymaster.git: git=119e5b2-dirty
(bootloader) cmnlib.git: git=119e5b2-dirty
(bootloader) aboot.git: git=MBM-NG-VB1.05-0-g8a1de8c
(bootloader) qe: qe 0/0
(bootloader) frp-state: protected (75)
(bootloader) ro.carrier: reteu
all: listed above
finished. total time: 0.077s
 >

10:19:01 2732> adb shell
athene_f:/ $ cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 38.00
Features        : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xd03
CPU revision    : 4

...and 7 more to processor 7, then finally...

Hardware        : Qualcomm Technologies, Inc MSM8952
Revision        : 82a0
Serial          : efafd40000000000
Processor       : ARMv7 Processor rev 4 (v7l)
Device          : athene_16mp
Radio           : EMEA
MSM Hardware    : MSM8952
athene_f:/ $

athene:/ df
Filesystem                           1K-blocks    Used Available Use% Mounted on
tmpfs                                   943452     620    942832   1% /dev
tmpfs                                   943452       0    943452   0% /mnt
/dev/block/bootdevice/by-name/system   2459748  667120   1776244  28% /system
/dev/block/mmcblk0p48                 11349888 2668536   8595464  24% /data
/dev/block/mmcblk0p46                   253920     436    248244   1% /cache
/dev/block/bootdevice/by-name/fsg         1968    1956         0 100% /fsg
/dev/block/mmcblk0p1                     96688   71256     23384  76% /firmware
/dev/block/mmcblk0p30                    28144     472     27020   2% /persist
/dev/block/mmcblk0p12                    12016    3740      7952  32% /dsp
/data/media                           11349888 2668536   8595464  24% /storage/emulated
/mnt/media_rw/9016-4EF8               31263744  353536  30910208   2% /storage/9016-4EF8
athene:/ $

athene:/ $ mount
rootfs on / type rootfs (ro,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,noatime,nodiratime,mode=600)
proc on /proc type proc (rw,noatime,nodiratime,gid=3009,hidepid=2)
sysfs on /sys type sysfs (rw,seclabel,noatime,nodiratime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,noatime,nodiratime)
debugfs on /sys/kernel/debug type debugfs (rw,seclabel,noatime,nodiratime)
none on /acct type cgroup (rw,noatime,nodiratime,cpuacct)
tmpfs on /mnt type tmpfs (rw,seclabel,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755,gid=1000)
none on /config type configfs (rw,noatime,nodiratime)
none on /dev/cpuctl type cgroup (rw,noatime,nodiratime,cpu)
none on /dev/cpuset type cgroup (rw,noatime,nodiratime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent)
pstore on /sys/fs/pstore type pstore (rw,seclabel,noatime,nodiratime)
none on /dev/bfqio type cgroup (rw,noatime,nodiratime,bfqio)
/dev/block/bootdevice/by-name/system on /system type ext4 (ro,seclabel,noatime,nodiratime,data=ordered)
/dev/block/bootdevice/by-name/userdata on /data type f2fs (rw,seclabel,nosuid,nodev,noatime,nodiratime,\
background_gc=on,user_xattr,inline_xattr,acl,inline_data,active_logs=6)
/dev/block/bootdevice/by-name/cache on /cache type ext4 (rw,seclabel,nosuid,nodev,noatime,nodiratime,\
data=ordered)
/dev/block/bootdevice/by-name/fsg on /fsg type ext4 (ro,context=u:object_r:fsg_file:s0,nosuid,nodev,\
noatime,nodiratime,nobarrier)
/dev/block/bootdevice/by-name/modem on /firmware type ext4 (ro,context=u:object_r:firmware_file:s0,nosuid,\
nodev,noatime,nodiratime,nobarrier,data=ordered)
/dev/block/bootdevice/by-name/persist on /persist type ext4 (rw,defcontext=u:object_r:persist_file:s0,\
seclabel,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,data=ordered)
/dev/block/bootdevice/by-name/dsp on /dsp type ext4 (rw,seclabel,nosuid,nodev,noatime,nodiratime,data=ordered)
adb on /dev/usb-ffs/adb type functionfs (rw,noatime,nodiratime)
tmpfs on /storage type tmpfs (rw,seclabel,noatime,nodiratime,size=943452k,nr_inodes=176303,mode=755,gid=1000)
/data/media on /mnt/runtime/default/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\
fsuid=1023,fsgid=1023,gid=1015,multiuser,mask=6)
/data/media on /storage/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,fsuid=1023,\
fsgid=1023,gid=1015,multiuser,mask=6)
/data/media on /mnt/runtime/read/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\
fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=23)
/data/media on /mnt/runtime/write/emulated type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\
fsuid=1023,fsgid=1023,gid=9997,multiuser,mask=7)
/dev/block/vold/public:179_65 on /mnt/media_rw/9016-4EF8 type vfat (rw,dirsync,nosuid,nodev,noexec,\
noatime,nodiratime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,\
iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/mnt/media_rw/9016-4EF8 on /mnt/runtime/default/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\
nodiratime,fsuid=1023,fsgid=1023,gid=1015,mask=6)
/mnt/media_rw/9016-4EF8 on /storage/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,nodiratime,\
fsuid=1023,fsgid=1023,gid=1015,mask=6)
/mnt/media_rw/9016-4EF8 on /mnt/runtime/read/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\
nodiratime,fsuid=1023,fsgid=1023,gid=9997,mask=18)
/mnt/media_rw/9016-4EF8 on /mnt/runtime/write/9016-4EF8 type sdcardfs (rw,nosuid,nodev,noexec,noatime,\
nodiratime,fsuid=1023,fsgid=1023,gid=9997,mask=18)
athene:/

STICK A FRESH MICRO SD CARD IN THE (UNMODIFIED) PHONE, AND IT GETS SET UP WITH THE FOLLOWING STRUCTURE:-

athene_f:/sdcard $ du -a
8       ./Android/media/com.android.providers.media
8       ./Android/media/com.google.android.talk
24      ./Android/media
4       ./Android/data/.nomedia
8       ./Android/data/com.google.android.music/cache
4       ./Android/data/com.google.android.music/files/._playmusicid
12      ./Android/data/com.google.android.music/files
28      ./Android/data/com.google.android.music
8       ./Android/data/com.google.android.youtube/cache/exo
8       ./Android/data/com.google.android.youtube/cache/cronet_media_cache
24      ./Android/data/com.google.android.youtube/cache
8       ./Android/data/com.google.android.youtube/files
40      ./Android/data/com.google.android.youtube
8       ./Android/data/com.google.android.apps.maps/files
8       ./Android/data/com.google.android.apps.maps/testdata
24      ./Android/data/com.google.android.apps.maps/cache/cache_r.m
32      ./Android/data/com.google.android.apps.maps/cache
56      ./Android/data/com.google.android.apps.maps
8       ./Android/data/com.google.android.videos/files/Movies
16      ./Android/data/com.google.android.videos/files
24      ./Android/data/com.google.android.videos
8       ./Android/data/com.google.android.gms/files
16      ./Android/data/com.google.android.gms
8       ./Android/data/com.google.android.tts/files/download_cache
16      ./Android/data/com.google.android.tts/files
24      ./Android/data/com.google.android.tts
8       ./Android/data/com.google.android.apps.docs/cache
8       ./Android/data/com.google.android.apps.docs/files/pinned_docs_files_do_not_edit
16      ./Android/data/com.google.android.apps.docs/files
32      ./Android/data/com.google.android.apps.docs
232     ./Android/data
264     ./Android
8       ./Music
8       ./Podcasts
8       ./Ringtones
8       ./Alarms
8       ./Notifications
8       ./Pictures
8       ./Movies
8       ./Download
8       ./DCIM/Camera
16      ./DCIM
8       ./alt_autocycle
360     .

athene_f:/sdcard
Top