Motorola Moto G Power

Unlike the Motorola Moto G8 Power the Moto G Power model includes built in support for both CDMA-4GLTE and AT&T GSM network types. Otherwise the Moto G Power is very much like the Moto G8 Power. The firmware packages for the Motorola Moto G Power is code-name “sofia”.

The Moto G Power XT 2041-4 is retail US retail device but can be also sold from carriers such as US cellular and Google Fi. The XT 2041-6 is a model only sold by consumer cellular. All phones variants can support both CDMA and GSM service providers. You can buy the US version (XT2041-4) on the Motorola web or from 3rd party sources, it is the carrier unlocked Moto G Power for North America and uses a radio configured for North America optimized bands.

The Moto G Power is a 6.4" phone with a 1080x2300p resolution display. The Qualcomm SDM665 Snapdragon 665 chipset is paired with 4GB of RAM and 64GB of storage. The main camera is 16+8+8+2MP and the front facing camera is 16MP. The battery has a 5000mAh capacity.

Firmware:

Codename: #sofia
Carrier(s): Retail USA
Phone Model(s): Moto G Power XT2041-4-SS PAH30002US
Version: QPM30.80-63-6-8
Android: 10

Firmware

The phone model is XT2041-X where the X can stand for 1 to 4
The development name / moto name is called: Sofiar ( XT2041-1/3)
The development name for the US name is: Sofia ( xt2041-4 )

Known patches / updates

XT2041-4_SOFIA_RETUS_10_QPMS30.80-51-5 released 2020-07-30
XT2041-4_SOFIA_RETUS_10_QPMS30.80-51-8 released 2020-10-16
XT2041-4_SOFIA_RETUS_10_QPMS30.80-63-6-8-3 released 2020-12-16

Root

Same process and procedure as the Motorola Moto G8 Power with the exception that you will use SOFIA firmware not sofiar.

Example Sofia firmware file to download for Moto G Power

SOFIA_RETAIL_QPM30.80-63-6-8_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip

After last 2020 update

XT2041-4_SOFIA_RETUS_10_QPMS30.80-63-6-8-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip

WARNING! - Root by patching boot.img from XT2041-4_SOFIA_RETUS_10_QPMS30.80-63-6-8-3_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip obtained off of lolinet FAILED! We do not have a verified working root solution at this time. The guide below is academic if not practical. There are (2) different levels of 'root' for this device as well as many other modern Android phones. Of the two methods, the easiest if the soft root method otherwise known as the Systemless root method. Although it offers slightly less control, it is easier to implement and maintain. Here we cover the soft root method.

The bootloader is a little bit of code that tells your device's operating system how to boot up. Motorola has done the work to make sure your device has a fully optimized, certified and tested version of Android. If you are a developer, unlocking the bootloader will allow you to customize your device. See: https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a/action/auth

The Moto G Power requires the acquisition of a special unlock code you can obtain directly from Motorola company (as of 2020). This is a simple process request requiring you register with an email address and provide a special data-string from your phone. Motorola quickly responds via an automated process by providing you the unlock code to your email address.

The root process is in multiple parts. Part 1 ends with you having to request a special Unlock Key from Motorola Company. This will delay you as you cannot start Part 2 until you have received said unlock key. Fortunately, the process is automated and the reply email with your unlock code arrives within minutes, maybe less.

Magisk is an android app using a system-less root process that doesn’t tamper the system partitions while enabling root access. Magisk can also reserve online security devices to work apps properly, like any banking app, SafetyNet, etc.

Part 1: Set up communication between device and PC, query device, and request Unlock Key from Motorola for G Power

Open Settings on your phone and go to About Phone. Tap 7 times on Build Number to enable Developer Options.
Now go to Settings > System -> Advanced -> Developer Options and enable OEM Unlocking and enable USB debugging
Reboot phone
Connect USB data cable from phone to PC.
From PC linux command line type 'lsusb' and verify that the phone device is connected
From PC linux command line type 'adb devices' and verify device is listed. If not, go below to section on how to add device to adb
Wait for Android phone to prompt with the question "Allow USB debugging from this computer?" Tap YES, Always
From PC linux command line type 'adb devices' and verify device is not still 'unauthorized' (see section on 'List of devices attached Unauthorized'
Turn off your phone. Then press & hold Volume Down + Power button together.
When the Fastboot screen appears, release both buttons. Once the phone boot into Fastboot mode, connect Moto G Power to Computer.
Run 'fastboot oem get_unlock_data' - Even though 'adb devices' will NOT show the device, you can now run 'fastboot oem get_unlock_data' on the linux console to get the unlock data.
Request your UNLOCK KEY from Motorola, see section below 'Request Unlock Key from Motorola'

(Step 2 Expanded): Phone has to be connected to a network, wifi is sufficient, to enable OEM Ublocking

Part 2: Use Motorola email code to unlock bootloader

Warning! - This will factory reset the phone. Even though you are not yet flashing a firmware, Motorola has their system design to reset the phone when you unlock the bootloader, for some reason.

Check your email to obtain your unlock code from Motorola and power off your phone.
Press & hold Volume Down + Power button together to boot into Fastboot mode again.
Connect the USB cable.
From the Linux console on your PC type 'fastboot devices' and make sure your phone is listed/detected. (if device not listed you cannot continue)
Use the command 'fastboot oem unlock XXXXXXXXXXXXXXXXXXXX' replacing the X's with the digits of your personal unlock code you got from Motorola in that email.
Wait for the message of success '(bootloader) Bootloader is unlocked!' (if unlock fails check digits of code or verify how you requested)
Now your device is unlocked and all set to root.

Part 3:

Download to your PC the Motorola firmware file 'XT2041-4_SOFIA_RETUS_10_QPMS30.xx-xx-x_subsidy-DEFAULT_regulatory-DEFAULT_CFC.xml' - you can search to find a reliable source (careful of trojans, use trusted source, that's on you). Here is the tricky part, finding one that matches the exact version on your phone. see Section below on 'Firmware Image Version and Region
Download or have ready Magisk Manager as 'stub-release.apk' that you can copy from the PC to the phone in a later step, or otherwise install directly to the phone. stub-release.apk is the install file for Magisk Manager.
Double check that the phone settings in Developer Options that both are still enabled: OEM Unlocking, USB debugging. Most of the time you have to re-enable developer mode like done in Part 1.
On phone Goto Developer Options, then 'Default USB Configuration' and change to 'File Transfer'
On computer copy 'boot.img' and 'stub-release.apk' to your phone storage, path similar to 'mtp://[usb:002,012]/Internal shared storage/Download'
Connect to WiFi and Install Magisk. Allow Magisk to upgrade to full version via WiFi.
Now install Magisk Manager apk on your Moto G Power and open it stub-release.apk' (stub-release did not work in our test, used the full debug version) See section: Magisk is Confusing
Use Magisk Manager to patch the image file boot.img from the firmware you downloaded and copied to the phone. See section: Magisk is Confusing
Magisk will produce a boot-patched.img file, it can be difficult to find, if it doesnt appear try to copy it to the DCIM. Ensure it is visible and exists.
Now move the boot-patched file back to your PC. It is recommended that you rename the unpatched boot.img file to boot.img.org or something and then rename the patched file boot.img.
Turn off your phone and then boot your Moto G Power into Fastboot mode. (hold volume down and power) Once in fastboot mode you may have to press arrow keys until you see "BOOTLOADER LOGS"
With USB cable still connected make sure your phone is listed/detected. From the Linux console on your PC type 'fastboot devices'
From PC linux command line type 'fastboot flash boot boot.img'
After flashing, you can reboot your phone to the system
Use an App like RootCheck to ensure root super user is enabled. example 'Root Check_v4.4.1.0_apkpure.com.apk'

Linux adb and fastboot

Android Debug Bridge, aka ADB, is a tool that helps in sending basic Linux commands and a variety of Android Specific commands from PC to the connected Android devices.

In all, it is a versatile command line tool that allows you to communicate with a device.It is used to manage either an emulator instance or an actual Android device.

It is a part of the Android SDK and is made up of three components: A Client, a Daemon, and a server. It works when the device is powered on and booted into OS or Recovery.

FasttBoot is a tool that makes it possible for you to flash any partition on an Android device like system, recovery, Cache, boot, and other useful tasks.

With the help of this tool, you can flash the custom-built .img files via fastboot. It is a special diagnostic and engineering protocol that you can boot your Android device into.

While in Fastboot, you can modify the file system images from a computer over a USB connection. It also requires software from the Android SDK and different USB Drivers for Windows Computers.

how to add device to adb

Use some commands and make this happen, look at the examples here:

$ lsusb
Bus 002 Device 004: ID 22b8:2e80 Motorola PCS

That shows the phone is connected and recognized by USB

Install 'adb'

$ apt-get install android-sdk-platform-tools-common

To get adb to see the Android, make sure you have a 'plugdev' group in the /etc/groups

$ sudo vigr

If not, you need to add it

$ sudo groupadd plugdev

Add yourself (your logged in username) to the plugdev

$ sudo vigr

Get device ID

$ lsusb

Then the first part of the 4 digit colon 4 digit number set (the first 4 numbers before the colon) is the ID you need

$ sudo touch /etc/udev/rules.d/51-android.rules

Add this line to the new file

SUBSYSTEM=="usb", ATTR{idVendor}=="22b8", MODE="0666"

Notice that the '22b8' is the device ID from lsusb, replace that with your actual device ID

$ sudo chmod a+r /etc/udev/rules.d/51-android.rules
$ sudo service udev restart
$ adb devices 
List of devices attached 
ZXXXXXXXXX      unauthorized

List of devices attached Unauthorized

The adb devices command will show that the phone device is unauthorized if you have not yet responded to the prompt on the Moto G Power phone itself that comes up when the phone is properly connected, USB debugging is active.

On the Moto G Power phone Android asks "Allow USB debugging from this computer?" After "YES"

$ adb devices 
List of devices attached 
ZXXXXXXXXX      device

Request Unlock Key from Motorola

You should have received an email with your Unlock Key. Inside the email is a unique 20-character alphanumeric code that you will use to unlock your device. Sometimes it may be difficult to find a firmware to download that is current with what you have on the phone already. This is why it is important to NOT LET THE PHONE update firmware prior to you attempting to root.

To get the unlock data from the phone issue the following command while phone is connected via USB cable

$ fastboot oem get_unlock_data

You will get 5 lines of characters, mostly numbers, and the last line will be all zeros. You have to combine all those lines into one large string of those characters and submit that to Motorola.

Register to motorola, provide that code, then wait for the reply email. Detailed information about the process can be obtained from visiting UNLOCK YOUR BOOTLOADER.

Firmware Image Version and Region

The boot.img is patched, but the rest of the firmware files are not modified. So if you patch a boot.img from a firmware version different from your own installed version, this could brick the phone or cause other issues.

Update: added new source for firmware. see: https://mirrors.lolinet.com/firmware/moto/sofia/official/RETUS/

RETUS = Retail, United States. sofia (not sofiar) is for the Moto G Power (not the G8 Power).

Motorola versions with these models is problematic, as there are variants. Here is a command to help you identify what your phone model and version currently is:

fastboot getvar all

Study the output to help you determine what firmware file you need to download and use.

Magisk is Confusing

Once you copy Magisk Manager installer to the phone and click on the stub-release.apk file (Magisk Manager installer) you will be advised that the Google will block the install as it is from an unrecognized source. You can go to settings from this warning dialog and allow the installation. Now the installer will launch and ask if you wish to install the full version of Magisk Manager. This you want to do.

The Magisk Manager interface is confusing. You are presented with two main options under Home

Magisk - Install
Manager - Install

Tap the Install option next to 1. Magisk, then on the next screen under -Method choose "Select and Patch a File" then browse to the download directory and select the boot.img.

Not a lot for confirmation of success messages. You just have to assume it worked. Now navigate back to the download folder and see if there is a duplicate boot image files with the denotation in the file name "patched." As an example it might look like this:

magisk_patched_fZTDA.img

What we have done is to take the boot.img file from the archive we downloaded, which is on the computer, and copied it to the Android where we use the app Magisk to patch the boot image file. Once patched, we then move it back to the computer and put it in with the firmware files that we extracted from that firmware archive. However, it will need to be renamed boot.img and replace the unpatched boot.img file. Keep a backup of the unpatched boot.img simply by renaming it something like boot.img.bak or boot.img.org or boot.img.unpatched. The patched version will be renamed boot.img and will be standing by in the folder and ready for the flash process.

It seems like extra work to have to copy the boot.img file to the phone just to patch it and move it back to the computer again, however, in this method we use Magisk which is an Android app to do the work, and that is performed on the phone as the app runs on the phone. However, the flash process reads from the firmware files on the PC when it writes to the phone.

The working directory on the computer for the firmware files that were extracted from the archive might be a path something like this example:

~/Downloads/Moto G Sofia 10-30-80-63-6-8

Keep Root / Root preservation even after OTA Updates

You’ll usually lose your root access when you install an operating system OTA (Over the Air) update. On many devices, having root will prevent OTAs from downloading and flashing. On some devices it will actually download, but you would need a tool like FlashFire to successfully flash it. On other devices, it will not actually download, so you’d have to get the OTA file some other way.

No good answer here. Try to avoid OTA Updates.

Try to use FlashFire to Flash an OTA Update, Without Losing Root. Untested.

TWRP is probably needed to Flash an update over an already patched firmware.

Online Banking Complains the Device is Rooted

You are foolish if you are using an Android phone and app to do online banking. Don't do that. That is your money. These little junk phones are not secure root or not, they are not secure.

Go set up a secure computer and do your online banking.

But how does it (the banking app) or any other complaining app know the phone is rooted? This has to do with "SafetyNet" and the struggle between Magisk Hide and Google.

Google's SafetyNet technology is supposed to be triggered when it notices a rooted device, but MagiskHide does its best to keep applications from being aware that the phone has root. SafetyNet is Google's way to counter the MagiskHide and aggressively root out the rooted status of the phone.

After a March 2020 update to SafetyNet Magisk developer John Wu isn't convinced he'll find a solution that would keep Magisk intact once Google fully implements the change. MagiskHide will continue to conceal root, but it might soon not hide the fact that your bootloader is unlocked anymore, since that's what SafetyNet checks for.

bootloader mode

The phone needs to be booted into “Bootloader mode” to use the Fastboot commands. It enables access on all your device partitions. When you’re working on the bootloader mode, ADB commands will no longer work, as the device is not booted into Android OS.

To use developer tools like fastboot and adb you have to enable developer mode on the android phone and Enable USB Debugging, to do so, You’ll need to enable Android developer options:

Settings -> About -> Build Number and Tap for 7 times.
Observer "You’re a developer now.”
Settings -> Developer Options -> USB debugging and enable it.

A word on fastboot oem unlock: Running the unlock command in the command prompt will wipe your entire data on the phone.

The boot image contains the kernel of your device. You can use the Fastboot Flash boot command to replace the stock kernel with a custom kernel.

fastboot flash boot bootimage.img

FOR TESTING A KERNEL IMAGE without overwriting anything on the phone... ie playing it safe... boot with a host-side kernel image. This command allows you to download a kernel image (and optional root filesystem image) and boot the phone with those, instead of using the kernel and rootfs in the boot flash partition. It is very useful while developing a kernel or modifying the rootfs.

 fastboot boot < kernel > [ < ramdisk > ]

The difference is that you exclude the word "flash" therefore not actually writing over the boot.img on the phone while still booting from an alternative boot.img.

TWRP Custom Recovery Advantages

You can install TWRP. When you install a custom recovery such as TWRP on the Android phone you replace the stock recovery with the custom recovery.

fastboot flash recovery twrp.img

SIP-based calling

Motorola / Lenovo has purposely removed SIP support from the native dialer. This is a part of Android that Motorola has removed. Even though you should be able to use the native dialer to make VoIP SIP calls, you cannot because of this decision by Motorola / Lenovo to take away your freedom.

You can use 3rd party SIP dialers.

Zoiper softphone, there are only 6 steps needed to have your device up and running.

Troubleshooting

Switching from a carrier rom to an unlocked version won't SIM unlock a phone.

All Motorola firmware comes with two xml files, flashfile.xml and servicefile.xml ( simply flash and service ) with the difference being that the the flash file will wipe the device and the service file does not while both install the firmware.

Flash Full ROM

Flash full ROM using LMSA rescue is the simplest method.

before flashing a boot.bin

run the command

fastboot boot boot.bin

or whatever your boot.bin is called and this will test your patched file. The phone needs to be booted into “Bootloader mode” to use the Fastboot commands. It enables access on all your device partitions.

You can also open MAGISK and use direct install.

blankflash

Use to try to unbrick. ref How to Fix Motorola Hard Bricked Devices. Motorola Moto devices are all based on the Qualcomm chip. Qualcomm has a mode on the device that it will enter if it becomes hard bricked and it is known as Qualcomm download mode. Download the correct blankflash zip for your device.

touchscreen does not work after flash

If the touchscreen didn't work then that usually means you flashed a different version of the kernel / signed differently. If you can get the stock boot.img and flash it...it should recover itself also.

Rescue and Smart Assistant (LMSA)

Requires Micro$oft Windows. Lenovo chooses to ignore Mac and Linux users.

Requires lots of registration. Apparently your Lenovo account and your Motorola account is not enough, this fucking app requires you to register yet another asshole Lenovo ID just to use it. The software calls on chromium engine to load the registration page which seems to fail, so you will be lucky if you can even get past this step in this asshole piece of shit Lenovo pile of steaming turd mess.

If your device does not power on, has serious software issues, or you forgot your PIN, reinstalling the device firmware with the Lenovo Rescue and Smart Assistant (LMSA) tool could resolve the issue and avoid having to repair or replace your device. Online the tool is often referred to as LMSA for short. Compatible Windows 7 or 10 having to be 64 bit. Rescue and Smart Assistant (LMSA) is an official tool installs on PC. Can help to manage smart device (include all Lenovo android phone, MOTO phone, Lenovo tablet ) data, flash smart device software, and more Lenovo support functions.

LMSA does not work though a virtualbox or other virtualization environment. It is not recommended via Wine. Sadly, it requires a PC with a direct installation of Windowze.

Lenovo Rescue and Smart Assistant (LMSA) and files. You will also need crappy .Net Framework 4.5. (because Lenovo can't hire real coders). Also, the basic framework Micro$oft provides for running binaries is insufficient, as it seems necessary to install the full developer version if you get an error from the Lenovo installer stating it cannot detect the presence of dot-net framework.

you must install the Motorola Device Manager/USB drivers in addition to LMSA, otherwise LMSA will incorrectly insist your phone is not in fastboot flash mode if you have to resort to rescuing from fastboot mode.

External Resources