"You device is corrupt" shown on boot after installing Grapheneos.

alci

Hi all,

I just bought a Pixel 7 pro, just for installing GrapheneOS.
After several failed attemps to install via WebUSB (cause I had no standard Android with plain Chrome browser, nor a Windows PC, and Chromium on Ubuntu does not support WebUSB), I finally succeded to install via the good old command line.

So far so good.
I verified that the install is ok with Auditor, that "successfully performed strong paired verification and identity confirmation".

BUT...

on reboot, my device shows a red "You device is corrupt" warning and waits for confirmation before booting.
I don't think this is the intended result, as, as far as I understand, the main point of restricting GrapheneOS to Pixels is to allow verified boot with a custom ROM.

So... is this expected ? If not, what can be my problem and how should I proceed to correct this ?

Thanks in advance
Franck

epic_gos_user

No, it is not expected. The "your device is corrupt" is the dm_verity driver error message IIRC. (Here is the article on verified boot with a flowchart). What you are seeing is the red eio screen.

There are 2 reasons:

Either the verification driver glitched out and believes the system is corrupted when it actually isn't (had this happen to me once)
Or the system is actually corrupted and will not work with stability.

In either case, best course of action from this is to just reflash the system. Back up data (if you have any, that is), then attempt the flash process again. Make sure to let the device do the entire process, do not touch or unplug until you see the terminal prompt again and it is 100% done. And verify the download with signify, it takes less time than most people think (at most 30 seconds) and rules out the possibility of the download being corrupt (if it fails to verify, redownload again).

On normal boot, only yellow screen (You are loading a different operating system) with hash should show up. Orange (bootloader unlocked) or red (device corrupt) should never show up during normal operation

alci

epic_gos_user

Ok, I reflashed the device, didn't omit any step, and all went fine.
I used the cheetah-factory-2022111000.zip image.
signify-openbsd passed the verification just fine.
I used fastboot 33.0.3-8952118.

The only time I diverged from the instructions is when rebooting to fastbootd in the middle of the flash_all.sh script : I had to confirm reboot on device, while the doc says "avoid to interact with the device".

But at the end of the process, I still get the "Your device is corrupt. It can't be trusted and may not work properly" red warning (and the the opther OS yellow warning, which is expected).

Otherwise the device works fine. Auditor confirms all is alright.

Any idea ?

alci

alci
I finally got it to work !
In fact I had a first failed installation attempt, using a Chrome fork that was not fully compatible with the WebUSB installation process (the browser crashed in the middle of the process).
It seems that this did put the device in "eio mode", and the device stays in this mode until a "successful update"...
(see https://source.android.com/docs/security/features/verifiedboot/verified-boot)

So i reinstalled stock Google Android, and this seems to have cleared the eio mode.
Then I followed the whole Grapheneos installation process (command line mode), and then it was successful.
Also, it did reboot gracefully to Fastbootd mode, which was not the cas when the eio mode was on (and explain why I had a difference in the process with the doc).
So this is solved.
Thanks a lot.

meiklmue

alci Hi, I am facing the same problem and found this threat with the search. How do you flash stock Android? I am not very experienced with that whole flashing stuff...

MetropleX

meiklmue

To flash stock back you can use this tool: https://flash.android.com/welcome

Don't forget to connect your phone back to the web installer and remove the verified boot key flashed by GrapheneOS:

Installation of the stock OS via the stock factory images is similar to the process described above but with Google's web flashing tool. However, before flashing and locking, there's an additional step to fully revert the device to a clean factory state.

The GrapheneOS factory images flash a non-stock Android Verified Boot key which needs to be erased to fully revert back to a stock device state. Before flashing the stock factory images and before locking the bootloader, you should erase the custom Android Verified Boot key to untrust it.

Source: https://grapheneos.org/install/web#replacing-grapheneos-with-the-stock-os