Ich konnte das Problem jetzt lösen. Es hängt damit zusammen das mein Gerät mal in der Reperatur war und ein neues Mainboard bekommen hat. Daher locked sich der bootloader immer. Hier ist beschrieben wie es dennoch geht.
[Bootloop] After LG replaced mainboard, bootloader would no longer stay unlocked (SECURE BOOT ENABLED - NO RPMB). Here's how I got root access anyway!
u/ZeGuitaristDec 9, 2016, 11:13 PM
tl;dr: N5X repaired after bootloop, now bootloader doesn't stay unlocked? Here's how to get root anyway!
THE PROBLEM
So I got my N5X repaired under warranty after it bootlooped, and I decided to keep using it. (1) However, while setting it up again I noticed the bootloader would not stay unlocked: I could get it to unlock temporarily using "fastboot oem unlock", but it would return to its locked state upon every reboot. There was also a warning in the bootloader that wasn't there before, saying:
SECURE BOOT: ENABLED (NO RPMB)
I Googled this message, and found that other N5X users had seen the same issues - always after having their mainboards replaced due to the bootloop issue:
Example 1
Example 2
Example 3
Example 4
Example 5
It seems LG neglected to flash a certain part of the mainboard firmware that allows the bootloader to remember its locked/unlocked state. Either they just forgot, or they did so willingly to make the bootloader impossible to unlock. Either way, I and many others got stuck with N5X's with bootloaders that won't unlock anymore. Thanks, LG.
THE SOLUTION
Fortunately, I found a way around this problem to get root anyway. As the bootloader is still temporarily unlockable, we can still flash the required modifications to get root access, if we do things in the right order.
This method requires you to use fastboot to install a fresh factory image on your N5X - I don't think Nexus Root Toolkit and such will work in this case.
Prerequisites: get the latest N5X factory image from Google, and make sure adb/fastboot are set up with proper drivers and such - see Heisenberg's How To to get this right.
Get a modified boot.img from this XDA thread, you need the one that matches the build you're installing - e.g. if you've got the 7.1.1 factory image from Dec 2016, get the modified boot.img for that build. We need the boot.img to disable forced encryption on first boot!
Get the latest TWRP for Nexus 5X here.
Get the latest Magisk ZIP and the matching Magisk-compatible Superuser ZIP. (**)
Everything's ready to go - boot into bootloader (Power + Vol Down), fire up fastboot, and use the following commands:
fastboot oem unlock (then unlock bootloader using your phone's Power and Vol buttons)
fastboot flash bootloader [bootloader-filename.img] (change to whatever the filename is)
fastboot reboot-bootloader
fastboot oem unlock (you'll have to do this again with every bootloader reboot, sigh...)
fastboot flash radio [radio-filename.img] (also input the correct filename)
fastboot reboot-bootloader
fastboot oem unlock (again)
fastboot flash boot [boot-modified.img] (flash the modified boot image here!)
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash recovery [TWRP.img] (input the correct filename)
fastboot format userdata
fastboot format cache
Now boot into recovery, if all is well you should get into a working TWRP! Now you can do the following:
Keep system read-only
Flash Magisk-V9 ZIP (2)
Flash phh-superuser-magisk ZIP (2)
Boot into the system. You might get a warning saying "your device is corrupt" - but the phone should still boot fine. I think it's because the bootloader is locked, so it can detect the modifications in the boot partitions. Or something. I'm not an expert. Anyways, once it's booted, you should install the phh Superuser app from the Play Store, which is compatible with the Magisk-enabled Superuser binary we flashed before.
So now, despite still having a locked bootloader, you're ready to go with your rooted Nexus 5X!
HOW TO UPDATE?
Every monthly update can be installed using factory images - however, as the bootloader is locked from the get-go, you will have to unlock the bootloader straight away again, which will wipe your data. So for now, it seems there's no way to update without having your device fully wiped.
To get around this, you could do the following (I haven't verified if this works!):
Before updating, boot into TWRP to back up /userdata - don't forget to place the backup on your PC before proceeding!
Complete the above procedure with the updated factory image
Restore the wiped /userdata partition from your TWRP backup
HOW TO HIDE ROOT?
As I said, you get a warning saying "your device is corrupt" upon booting up Android - I think this is because the bootloader is locked again with every boot, so all the integrity checks are running at boot, and the changes to boot.img can be detected.
As a result, there is no way to hide root. At least not that I know of - if someone more knowledgeable could correct me on this, that would be great! But for now, it doesn't seem that I can get Magisk hide to work, Pokemon Go won't authenticate, my banking app is angry at me, and so on...
Hope this all helps you out anyways!
(1) Yes, the bootloop might happen again, and it might be out of warranty if it does. But I'll be damned if I paid 400€ for a phone I only got to use for a year. I'll never buy LG again, but I'll use this thing until it's wasted.
(2) I'm not sure Magisk is even necessary in this step, you might be able to just use the latest systemless SuperSU ZIP. I haven't tried that though. Since the bootloader is locked, the device checks and knows during boot that security is compromised ("your device is corrupt"), hence there's no way to hide root - so Magisk is useless here. At least to my limited knowledge of these things.
das weiss noch keiner.
Empfohlener redaktioneller Inhalt
Mit Deiner Zustimmung wird hier ein externer Inhalt geladen.
Mit Klick auf den oben stehenden Button erklärst Du Dich damit einverstanden, dass Dir externe Inhalte angezeigt werden dürfen. Dabei können personenbezogene Daten an Drittanbieter übermittelt werden. Mehr Infos dazu findest Du in unserer Datenschutzerklärung.