[GUIDE] Proper H815 unbrick through QFIL (Files included) - G4 General

WARNING - This guide is only for H815 International G4 variant (official unlock available)
Much thanks to steadfasterX for the files and helping me to unbrick my device this way.
This guide is for devices in Qualcomm 9008 mode (hard brick)
1. Download this archive.
2. Install every driver/runtime and QPST from the "software_drivers" folder (do not install virtualhere_client files, those are not needed for unbricking)
3. Extract "flashing" folder.
3. If your device is not in 9008 mode already, force boot to it (tutorial in "stuff" folder in archive, or look up LG G4 EMMC shorting)
It should show up something like this when properly in 9008 mode (QHUSB_BULK in device manager means drivers are not properly installed, try again)
4. Once your device is in 9008 mode, Open QFIL, disconnect it from the computer, remove the battery and connect it back to the computer with battery removed.
5. Proceed to select the files from the "flashing" folder you extracted in QFIL, then press the "Download" button.
If all goes right, it should flash properly and your device should be able to enter download mode, then flash stock .kdz with LGUP or any other software like usual.
According to steadfasterX, this could work on other H815 variants, but DO NOT proceed if you are afraid of bricking the device completely.
For further support join #Carbon-user IRC channel on freenode [URL="https://webchat.freenode.net/?channels=Carbon-user](direct link)[/URL]

yes.
the above has been proven on several devices for ppl contacting me!
Thanks for taken the time to write down the guide
In general that may work on any H815 device but no guarantees. Most important regarding this is: ARB again. If you have ARB > 0 this will brick your device
After you have done the above you will be able to get into the Download mode again to flash whatever you like to restore.
Cheers and have fun
sfX
UPDATE: for UsU devices
UsU devices have to replace files from the UsU unlock zip:
aboot_UsU.img (UsU unlock zip) --> flashing/emmc_appsboot.mbn
laf_UsU.img (UsU unlock zip) --> flashing/laf.img
rawres_UsU.img (UsU unlock zip) --> flashing/raw_resources.img
UPDATE: added mirror link
https://www.androidfilehost.com/?fid=1322778262904000036
UPDATE: 2020-08-20 :
Main Download link from the OP has been moved to:
http://leech.binbash.rocks:8008/unbricking/qfil/h815/
--> G4-h815_fullunbrick_working_7a3ae5809224d.zip
.

steadfasterX said:
yes.
the above has been proven on several devices for ppl contacting me!
Thanks for taken the time to write down the guide
In general that may work on any H815 device but no guarantees. Most important regarding this is: ARB again. If you have ARB > 0 this will brick your device
After you have done the above you will be able to get into the Download mode again to flash whatever you like to restore.
Cheers and have fun
sfX
Click to expand...
Click to collapse
Please help!
Validating Application Configuration
Load APP Configuration
COM:3
SAHARA:True
SAHARA:E:\INSTALL\Mobile\LGg4\MBNS\mi4c\prog_emmc_firehose_8992_ddr.mbn
SEARCHPATH:E:\INSTALL\Mobile\LGg4\MBNS\mi4c
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
READBACKMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Process Index:0
Validating Download Configuration
Image Search Path: E:\INSTALL\Mobile\LGg4\MBNS\mi4c
Programmer Path:E:\INSTALL\Mobile\LGg4\MBNS\mi4c\prog_emmc_firehose_8992_ddr.mbn
Programmer Path:F:\h815_full_working_7a3ae5809224d\flashing\prog_emmc_firehose_8992_lite.mbn
Image Search Path: F:\h815_full_working_7a3ae5809224d\flashing
Image Search Path: F:\h815_full_working_7a3ae5809224d\flashing
RAWPROGRAM file path: F:\h815_full_working_7a3ae5809224d\flashing\rawprogram0.xml
PATCH file path:F:\h815_full_working_7a3ae5809224d\flashing\patch0.xml
Start Download
Program Path:F:\h815_full_working_7a3ae5809224d\flashing\prog_emmc_firehose_8992_lite.mbn
COM Port number:3
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:3
Sending NOP
ReadFile last error: 0
Response is NULL
NOP: Fail Code: 14
Unable to send FireHose NOP, Device is not in Firehose mode !
Download Fail:FireHose Fail Failed to send Firehose NOP to the phone.
Finish Download
Thanks in advance.

tithitoy said:
Please help!
Validating Application Configuration
Load APP Configuration
COM:3
SAHARA:True
SAHARA:E:\INSTALL\Mobile\LGg4\MBNS\mi4c\prog_emmc_firehose_8992_ddr.mbn
.......
Click to expand...
Click to collapse
If you do not use my files I can't help.
Sent from my LG-H815 using XDA Labs

I tried to folow this tutorial but I wasnt able to flash my g4 H815 i dont know why. Here are my logs: https://bpaste.net/show/57c550e06998

sr.arenisca said:
I tried to folow this tutorial but I wasnt able to flash my g4 H815 i dont know why. Here are my logs: https://bpaste.net/show/57c550e06998
Click to expand...
Click to collapse
keep in mind that QDL is very sensitive:
1) do not wait longer then a few seconds after you entered the QDL mode to push the files
2) if you have used it once you need to re-do the steps to enter QDL mode before flashing again
.

steadfasterX said:
keep in mind that QDL is very sensitive:
1) do not wait longer then a few seconds after you entered the QDL mode to push the files
2) if you have used it once you need to re-do the steps to enter QDL mode before flashing again
.
Click to expand...
Click to collapse
I did not wait more than 3-4 seconds in the last try and i got the same error : https://bpaste.net/show/012543a80981
Im doing it without batery if it matters.
And im stuck in that mode so i only need to connect the device to the computer to enter that mode.
Should I force the enter in that mode sorting the pins?

Your links are not working for me.

I bricked my phone by accidentally trying to install a corrupted bootloader .zip with TWRP. My phone almost totally stopped working, just giving me a black screen after turning it on, not even fastboot or the download mode worked, and I thought I was totally screwed. This was my last ditch attempt to save my G4 after days of researching and trying things I had totally written off my G4 but then I came across this. So I took apart my G4 and did the test point shorting method along with this guide AND IT WORKED. I was amazed. My phone acted weird for a little while, crashing and rebooting randomly, I think that might have been because I took it apart in an environment that is not EMC protected. But after a while everything returned to normal. Glad I don't have to buy a new phone and I can keep using my G4, which I love compared to anything that is on the market today (**** all those phones with no removable battery and SD).
Anyway thanks a lot to steadfasterX and OP and whoever else was involved in helping to create this method.

not working for me
https://bpaste.net/show/9423b4b8c0a3

ososmam said:
not working for me
https://bpaste.net/show/9423b4b8c0a3
Click to expand...
Click to collapse
Sure. If not following the guide its clear it will not work. You are missing step 2 which also installs qpst and qfil into C:\ (programs.. Qualcomm)
You're using another qfil so it can't work.
Sent from my LG-H815 using XDA Labs

steadfasterX said:
Sure. If not following the guide its clear it will not work. You are missing step 2 which also installs qpst and qfil into C:\ (programs.. Qualcomm)
You're using another qfil so it can't work.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
can you provide my with qfil it not provided i installed the qpst but cannont find qfil in the zip file

ososmam said:
can you provide my with qfil it not provided i installed the qpst but cannont find qfil in the zip file
Click to expand...
Click to collapse
Install qpst from that zip. Go into c: programs qualcomm qpst and there you find qfil.exe (I can't write down the exact path as I'm not on my pc atm but you will find it)
Sent from my LG-H815 using XDA Labs

still black screen nothing happened after finished
my device is h815p
https://bpaste.net/show/1ee73cea27f9

ososmam said:
still black screen nothing happened after finished
my device is h815p
https://bpaste.net/show/1ee73cea27f9
Click to expand...
Click to collapse
This looks better now.
What happens in the device manager when you connect the device while the screen is black?
Btw: How did you come to the situation that you need to flash with qfil??
Sent from my LG-H815 using XDA Labs

steadfasterX said:
This looks better now.
What happens in the device manager when you connect the device while the screen is black?
Btw: How did you come to the situation that you need to flash with qfil??
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
nothing detected it just vibrate when press the power button
flashed a worng rom v29 without usu support ended with this situation

steadfasterX said:
This looks better now.
What happens in the device manager when you connect the device while the screen is black?
Btw: How did you come to the situation that you need to flash with qfil??
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
finally it boot again i chanced
these 3 files laf , emmc_appsboot , raw_resources
with laf,aboot, raw_resources from h815-usu unlock files
and edited the raw-program to match these files
also change the recovery with twrp
fianaly can boot to fastboot and twrp

ososmam said:
finally it boot again i chanced
these 3 files laf , emmc_appsboot , raw_resources
with laf,aboot, raw_resources from h815-usu unlock files
and edited the raw-program to match these files
also change the recovery with twrp
fianaly can boot to fastboot and twrp
Click to expand...
Click to collapse
Sure UsU devices don't work with this files. These are for regular h815 devices or locked h815 ones.
the way you have done to make it work is correct for UsU devices.
keep in mind that when requesting help it's important to mention as many details as possible.. UsU is such an important detail..
Have fun
Sent from my LG-H815 using XDA Labs

Hello, bricked my usu h815, flashing aboot file. Trying fix, but have error. Any chances for me
Validating Application Configuration
Load APP Configuration
COM:4
SAHARA:True
SAHARA:C:\Program Files\Qualcomm\QPST\bin\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\Program Files\Qualcomm\QPST\bin
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:True
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:True
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
READBACKMODE:5
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
Load ARG Configuration
Process Index:0
Validating Download Configuration
Image Search Path: C:\Program Files\Qualcomm\QPST\bin
RAWPROGRAM file path: C:\Program Files\Qualcomm\QPST\bin\rawprogram0.xml
PATCH file path:C:\Program Files\Qualcomm\QPST\bin\patch0.xml
Programmer Path:C:\Program Files\Qualcomm\QPST\bin\prog_emmc_firehose_8992_lite.mbn
Image Search Path: C:\Program Files\Qualcomm\QPST\bin
RAWPROGRAM file path: C:\Program Files\Qualcomm\QPST\bin\rawprogram0.xml
PATCH file path:C:\Program Files\Qualcomm\QPST\bin\patch0.xml
FireHose Configuration Cancelled
Start Download
Program Path:C:\Program Files\Qualcomm\QPST\bin\prog_emmc_firehose_8992_lite.mbn
COM Port number:4
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Enable Ack Raw Data Every 100Packets
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:4
Sending NOP
FireHose Log: Binary build date: Mar 3 2015 @ 19:29:19
FireHose Log: fh.attrs.Verbose is set to 0
FireHose Log: Chip serial num: 6178897 (0x5e4851)
FireHose Log: Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke
FireHose NOP sent successfully
Sending Configuration
Device Type:eMMC
Platform:8x26
FireHose Log: Host's hash buffer size not provided or 0; using 8192
FireHose Log: fh.attrs.MaxPayloadSizeToTargetInBytes > FIREHOSE_CHANNEL_BUFFER_SIZE
FireHose Log: Calling hotplug_poll_device('MMC')
Invalid response NAK
CONFIGURE: Fail Code 13
Failed to send the Firehose configure packet
Download Fail:FireHose Fail FireHose Fail:Failed to configure the device in Firehose mode
Finish Download

Cisuwek said:
Hello, bricked my usu h815, flashing aboot file. Trying fix, but have error. Any chances for me
Click to expand...
Click to collapse
You are not using the unbrick zip provided in the OP.
I told billion of times that using the wrong files will brick your device in a way which is unrecoverable.
Besides that: UsU devices have to replace files from the UsU unlock zip:
aboot_UsU.img (UsU unlock zip) --> flashing/emmc_appsboot.mbn
laf_UsU.img (UsU unlock zip) --> flashing/laf.img
rawres_UsU.img (UsU unlock zip) --> flashing/raw_resources.img

Related

Unbrick Lumia Devices

Greetings Everyone;
Like many of you: my Lumia was not working properly; therefore I tried to recover / downgrade my Lumia 535 with "Windows Phone Recovery Tool" back to Windows 8.
After Clicking "Start"... The Phone simply said: "Goodbye" and never came On again... (While going like: "WT*!?" and mad at this; I have to say it was funny).
From that point on: It simply would just show a Black Screen to me.
Requirements
- Have Windows Device Recovery Tool ("WDRT") (Get it here)
- Make sure you have a USB Cable in proper condition to ensure that the Procedure Won't Fail due to Disconnection.
Method #1 : Before Anything Else
1 ) With your USB Cable & Device Connected to PC; Go to the "Device Manager" and unninstal the QHSUSB__BULD Driver (Don't Close the Device Manager Yet).
2) Disconnect your USB Cable and Plug it again. Update the "Device Manager" in order to get your QHSUSB__BULK Driver Installed again.
3) Go to "Windows Phone Recovery Tool" and try Again. "Windows Phone Recovery Tool" should be able to complete the procedure.
Method #2 : Under "Emergency Mode"
1 ) Connect your device via USB cable.
2) Open the following folder (Considering your System drive is " C: ")
C:\Program Data\Microsoft\Packages\Products\RM-<Number>
* Where <Number> will be your device release model number.
Note: You can check Code & Release Model Number on the back of your phone by removing your battery.
Inside that folder you can see that you have some required files to recover your device from Bricked states.
i.e: the *.ffu file.
If you don't find the *.ffu file there you can try: http://www.lumiafirmware.com/
3) Now open CMD (Command Prompt) as administrator
4) And go to WDRT folder by typing:
cd C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\
for 32 bit pc, type:
cd C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool\
5) Connect your USB Cable & Device to PC
6) (Attempt to Perform a Factory Reset): In CMD (Command Prompt) Type :
thor2 -mode uefiflash -ffufile "C:\the location of the ffu\file name.ffu" -do_full_nvi_update -do_factory_reset"
7) Wait now until your phone gives a green screen
8) Back on CMD; Type:
thor2 -mode rnd -bootnormalmode
Note: Shall Step 6 fail; but you managed to flash the *.ffu file into the device (or even if that failed); try Method #1 again.
That worked perfectly for me.
Initial Steps for Manual Recovery (Incomplete; but gets you Started)
1) "dump": "gpt0.bin" & "gpt1.bin" files
2) Create a Folder on the root of your System Drive.
i.e: C:\LumiaService\
3) Create another Folder Called "Dump" inside "LumiaService" folder
4) Copy the *.ffu File found at: C:\Program Data\Microsoft\Packages\Products\RM-<Number>
to the Newly created folder [C:\LumiaService\ ]
Tip: You may want to rename the file to a shorter file name. In this tutorial I'm going to name it "rm1089.ffu" (Wich stands for my Lumia Model)
5) Open Command Prompt in Administrator Mode and Open the "Windows Phone Recovery Tool" folder.
i.e: C:\ThisComputer\User\Programs (x86)\Microsoft Care Suite\Windows Device Recovery Tool\
Note: There you should find: Thor2.exe
6) Once in that folder type the following Command to "Dump" (Extract from & Create) the following files: gpt0.bin & gpt1.bin
Note: Don't Close your Command Prompt Window After Dumping the Files (See point 6).
thor2 -mode ffureader -ffufile "C:\LumiaService\rn1089.ffu" -dump_gpt -filedir C:\LumiaService\Dump\
7) Copy the RKH Hex Number and Save it into a text document (Pref. also inside "LumiaService" folder)
i.e:
RKH: 0E9427DF118D9E27D098D13BECB6C6C89CE59F4
RKH: 0E9427DF118D9E27D098D13BECB6C6C89CE59F4
Note: You will require to create a *.hex File using the RKH; in order to Perform the manual Unbrick.
Hope this helped everyone guys without warranty.
If you still have problems; and want to dig further into Manually Unbrick I'm leaving some of my own notes on the post bellow (For Reference Only).
I think that would be a good starting point; and that it will save you some time.
Please feel free to send me information regarding how to do it "Manually" (Step-by-Step); I'll be glad to write about it.
Best Regards;
Reference For Manually Unbrick​
Thor2 Boot Modes
Boot to System
thor2 -mode rnd -bootnormalmode
Boot Into Boot Manager
thor2 -mode rnd -bootlumiabootmgr
Emergency Mode
thor2 -mode rnd -boot_edmode
USB MSC Mode
thor2 -mode rnd -bootmsc
Needless to say that you can check thor2 help file with:
thor2 /?
Problems with the *.hex File:
People who have a problem with the hex file, is because the hex file is invalid. The converter tool does not do a good job with converting bin files which are bigger than 64 KB.
To demonstrate: look at the file size of the original bin-files. Some are 60 KB and some are 74 KB. The conversion of the files with size 74 KB fails.
Look at the output hex-file in Notepad++.
Scroll to line 4098. From there on you see that all lines have an extra character. There is an odd number of digits, which is not possible with hex-values.
How to correct it?
Insert this line at linenumber 4098:
:020000042A01CF
All the next lines, except the last 3 lines start with:
:101
Replace that with:
:10
The last 3 lines should not be changed.
Save the hex-file and it will be ready to use.
Note: That line must be put at line 4098. And everything below will go down one line. Look at the lengths of the lines. In the original hex-file all lines from 4098 and below have an extra character. That is wrong. To go beyond the 64 KB limit, this extra line is needed and then the bad characters from the lines below must be removed as described.
Addittionaly:
1. The bin files in your opening post are fine, but they are probably incomplete. There are Lumia models, which have the same RKH, but they need different MPRG's. Not much we can do about now.
2. The bin files are converted to hex files. Those hex files are in your opening post. But not all of them are correct. I corrected a few of them and those are in post #76. You probably want to update the files in your opening post with these files.
Info
Tutorial it is not a complete step-by-step.
You need to sign everything as does .vpl programming (All recovery/flashing tool uses .vpl flashing).
1. Direct write .FFU will work as MSFT.
2. Writing with .Vpl file will work as OEM.
It is all same thing, but try to understand between two diff things.
Some security will get tight or can be vulnerable. (Actual I mean, OS will run with more differential)
How to get *.hex file
1) Get "bin2hex" Console Application
2) In Command Prompt go to your Bin2Hex.exe location and Copy your *.bin file there.
3) Type: bin2hex myBinFile.bin MyNewHexGile.hex
i.e: 00E9427DF118D9E27D098D13BECB6C6C89CE59F4.bin HEX.hex
The application will create the *.hex file for you.
Note: There's a chance that the new *.hex file could not be perfectly converted.
Check: Addittional Reference > Problems with *.hex files on this post (above).
Tip #1:
Use this extra FLAG in order to prevent the device to fail receiving the files through "Thor2":
-maxtransfersizekb 256
*Note: Some people reported that this value can be too high and cause flashing issues
XDA Links
Title: "Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG"
Title: "Qualcomm/Intel HEX files"
Title: "How to recover a Lumia with a malfunctioning USB port"
Hello!!! I have a problem. I can't find my device as QHSUSB_BULD. What I can do? I am desesperate
recover data
boris_urgiles said:
Hello!!! I have a problem. I can't find my device as QHSUSB_BULD. What I can do? I am desesperate
Click to expand...
Click to collapse
Is it possible to recover data from a damaged lumia?
I made a program that make this a lot easier
rgxHost said:
Greetings Everyone;
Like many of you: my Lumia was not working properly; therefore I tried to recover / downgrade my Lumia 535 with "Windows Phone Recovery Tool" back to Windows 8.
After Clicking "Start"... The Phone simply said: "Goodbye" and never came On again... (While going like: "WT*!?" and mad at this; I have to say it was funny).
From that point on: It simply would just show a Black Screen to me.
Requirements
- Have Windows Device Recovery Tool ("WDRT") (Get it here)
- Make sure you have a USB Cable in proper condition to ensure that the Procedure Won't Fail due to Disconnection.
Method #1 : Before Anything Else
1 ) With your USB Cable & Device Connected to PC; Go to the "Device Manager" and unninstal the QHSUSB__BULD Driver (Don't Close the Device Manager Yet).
2) Disconnect your USB Cable and Plug it again. Update the "Device Manager" in order to get your QHSUSB__BULK Driver Installed again.
3) Go to "Windows Phone Recovery Tool" and try Again. "Windows Phone Recovery Tool" should be able to complete the procedure.
Method #2 : Under "Emergency Mode"
1 ) Connect your device via USB cable.
2) Open the following folder (Considering your System drive is " C: ")
C:\Program Data\Microsoft\Packages\Products\RM-<Number>
* Where <Number> will be your device release model number.
Note: You can check Code & Release Model Number on the back of your phone by removing your battery.
Inside that folder you can see that you have some required files to recover your device from Bricked states.
i.e: the *.ffu file.
If you don't find the *.ffu file there you can try: http://www.lumiafirmware.com/
3) Now open CMD (Command Prompt) as administrator
4) And go to WDRT folder by typing:
cd C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\
for 32 bit pc, type:
cd C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool\
5) Connect your USB Cable & Device to PC
6) (Attempt to Perform a Factory Reset): In CMD (Command Prompt) Type :
thor2 -mode uefiflash -ffufile "C:\the location of the ffu\file name.ffu" -do_full_nvi_update -do_factory_reset"
7) Wait now until your phone gives a green screen
8) Back on CMD; Type:
thor2 -mode rnd -bootnormalmode
Note: Shall Step 6 fail; but you managed to flash the *.ffu file into the device (or even if that failed); try Method #1 again.
That worked perfectly for me.
Initial Steps for Manual Recovery (Incomplete; but gets you Started)
1) "dump": "gpt0.bin" & "gpt1.bin" files
2) Create a Folder on the root of your System Drive.
i.e: C:\LumiaService\
3) Create another Folder Called "Dump" inside "LumiaService" folder
4) Copy the *.ffu File found at: C:\Program Data\Microsoft\Packages\Products\RM-<Number>
to the Newly created folder [C:\LumiaService\ ]
Tip: You may want to rename the file to a shorter file name. In this tutorial I'm going to name it "rm1089.ffu" (Wich stands for my Lumia Model)
5) Open Command Prompt in Administrator Mode and Open the "Windows Phone Recovery Tool" folder.
i.e: C:\ThisComputer\User\Programs (x86)\Microsoft Care Suite\Windows Device Recovery Tool\
Note: There you should find: Thor2.exe
6) Once in that folder type the following Command to "Dump" (Extract from & Create) the following files: gpt0.bin & gpt1.bin
Note: Don't Close your Command Prompt Window After Dumping the Files (See point 6).
thor2 -mode ffureader -ffufile "C:\LumiaService\rn1089.ffu" -dump_gpt -filedir C:\LumiaService\Dump\
7) Copy the RKH Hex Number and Save it into a text document (Pref. also inside "LumiaService" folder)
i.e:
RKH: 0E9427DF118D9E27D098D13BECB6C6C89CE59F4
RKH: 0E9427DF118D9E27D098D13BECB6C6C89CE59F4
Note: You will require to create a *.hex File using the RKH; in order to Perform the manual Unbrick.
Hope this helped everyone guys without warranty.
If you still have problems; and want to dig further into Manually Unbrick I'm leaving some of my own notes on the post bellow (For Reference Only).
I think that would be a good starting point; and that it will save you some time.
Please feel free to send me information regarding how to do it "Manually" (Step-by-Step); I'll be glad to write about it.
Best Regards;
Click to expand...
Click to collapse
I made a program that unbricks your device, recovers from QHSUSB_DLOAD, QHUSB_DLOAD.
It's called...
Windows Phone Unbrick Tool (WPUT)
It comes with an installer.
NOTE:
1. You should enter the license key that is provided in the License Agreement section (for checking that you are not a bot, so don't use autoinstaller!
2. You must download your emergency HEX and MBN files from lumiafirmware.com
3. You must specify the correct path to the HEX/MBN files otherwise the program will fail!
4. If the unbricking succeeds remove your battery from your device for 1 minute and put it back on
5. Charge the device for at least 30 minutes before turning it on!
6. Reflash your device with Windows Device Recovery Tool.
Download it here
b i t . l y / 2 O Y Q Z V R
(REMOVE THE SPACES)
https://forum.xda-developers.com/windows-phone-8/development/unbrick-dead-boot-lumia-jtag-t3872885
H
gmirz2005 said:
I made a program that unbricks your device, recovers from QHSUSB_DLOAD, QHUSB_DLOAD.
It's called...
Windows Phone Unbrick Tool (WPUT)
It comes with an installer.
NOTE:
1. You should enter the license key that is provided in the License Agreement section (for checking that you are not a bot, so don't use autoinstaller!
2. You must download your emergency HEX and MBN files from lumiafirmware.com
3. You must specify the correct path to the HEX/MBN files otherwise the program will fail!
4. If the unbricking succeeds remove your battery from your device for 1 minute and put it back on
5. Charge the device for at least 30 minutes before turning it on!
6. Reflash your device with Windows Device Recovery Tool.
Download it here
b i t . l y / 2 O Y Q Z V R
(REMOVE THE SPACES)
Click to expand...
Click to collapse
It support QHSUSB_BULK?
fadilfadz said:
H
It support QHSUSB_BULK?
Click to expand...
Click to collapse
Firstly you need to switch to QHSUSB_DLOAD mode.
There are some guides on the internet, search for it.
gmirz2005 said:
Firstly you need to switch to QHSUSB_DLOAD mode.
There are some guides on the internet, search for it.
Click to expand...
Click to collapse
Where? I can't find it on google.
Give me just url.
fadilfadz said:
Where? I can't find it on google.
Give me just url.
Click to expand...
Click to collapse
Alright.
So firstly fully uninstall all drivers.
(Nokia Emergency Connectivity, QHUSB_DLOAD, QHUSB_BULK)
Now disconnect the battery, if the battery is "non-removable" then dissasemble the back cover and disconnect the battery.
Now wait for 1 minute while holding the power button of your lumia (to fully drain power).
Reinsert the battery and connect it to the computer.
You should see a driver installing
"Qualcomm ++++"
Now goto WDRT
Select "My phone is not detected"
Click LUMIA
If WDRT recognized the device, you should see it.
If not then repeat all the steps as much as WDRT will finally detect.
Click the device
Start recovery process.
Done!
Ffu not signed for this device while i'm load corrected ffu for my lumia 1020
my lumia 1020 can detected by wdrt but while processing to flashing, wdrt show error code ffu not signed for this device, any solution to fix this? my lumia detected as NOKIA BOOTMGR or QUALCOMM MSM DEVICE
faisalmm_ said:
my lumia 1020 can detected by wdrt but while processing to flashing, wdrt show error code ffu not signed for this device, any solution to fix this? my lumia detected as NOKIA BOOTMGR or QUALCOMM MSM DEVICE
Click to expand...
Click to collapse
Use the THOR2 method.
gmirz2005 said:
Use the THOR2 method.
Click to expand...
Click to collapse
I've use thor2 method and qhsusb_dload, but thor2 error code 85021 send_rcv_msg_failed, I use correctedhex, hex on gpt0.bin with bin2hex, hex on lumiafirmware, but no any hex work for my device
LOG thor2
[21:51:55.775] D_MSG : THOR2 1.8.2.18
[21:51:55.775] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015
[21:51:55.775] D_MSG : Thor2 is running on Windows of version 6.2
[21:51:55.775] D_MSG : thor2.exe -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -ffufile RM875_3051.50009.1424.0003_RETAIL_apac_indonesia_1002_03_447615_prd_signed.ffu -skipffuflash
[21:51:55.775] D_MSG : Process started Mon Dec 31 21:51:55 2018
[21:51:55.792] D_MSG : Debugging enabled for emergency
[21:51:55.792] D_MSG : Initiating emergency download
[21:52:14.320] D_MSG : Using default emergency protocol
[21:52:14.320] D_MSG : ALPHA EMERGENCY FLASH START
[21:52:14.320] D_MSG : Emergency Programmer V1 version 2014.10.31.001
[21:52:14.320] D_MSG : Hex download selected
[21:52:14.320] D_MSG : Check if device in Dload
[21:52:14.323] D_MSG : Connection to DLOAD mode succeeded
[21:52:14.323] D_MSG : Get Dload parameters
[21:52:14.811] D_MSG : Sending HEX flasher to the device
[21:52:14.823] D_ERR : Sending HEX flasher to the device failed. Try to re-send.
[21:52:16.826] D_MSG : Re-sending HEX flasher to the device
[21:52:17.829] D_ERR : Message send failed with error code -1
[21:52:17.830] D_ERR : Cannot upload HEX flasher into the device
[21:52:17.830] D_MSG : Sending GO command if HEX flasher successfully uploaded.
[21:52:18.327] D_MSG : ALPHA EMERGENCY FLASH END
[21:52:25.851] D_MSG : Emergency messaging closed successfully
[21:52:25.935] D_MSG : Operation took about 30.00 seconds.
[21:52:25.969] D_ERR : THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)
Click to expand...
Click to collapse
faisalmm_ said:
I've use thor2 method and qhsusb_dload, but thor2 error code 85021 send_rcv_msg_failed, I use correctedhex, hex on gpt0.bin with bin2hex, hex on lumiafirmware, but no any hex work for my device
Click to expand...
Click to collapse
If you have the original FFU for your device, try re-downloading it and re-extracting the .hex and .mbn files
this may work...
Hi,
I have a Lumia 1020 that was running Windows 10 Mobile thinking it was a Lumia 950 XL. With this week's update, it broke and is now showing an error message "Unable to find a bootable option".
I've tried unlocking the Bootloader with WPInternals and it doesn't work (I've tried with original FFU and with L950XL FFU).
Windows Device Recovery Tool also doesn't work (it identifies a device although it doesn't name it and proceeds into the reset but stops with an error message of "Software not connected or disconnected from device").
I can't find any drivers on device manager like the ones you mention and the command line way always returns an error: 0xFA001106.
I really don't want to give up this yellow phone. I love it.
Can somebody please help?
Thank you.
Edit: the device shows up as Nokia BootMGR and it's always stuck in a "unable to find bootable option. Press key to shutdown" loop.
I just thought of something else: when I installed W10M on my Lumia, I changed it to make it appear as a Lumia 950XL. I used InterOP tools and RegEdit. Could this be related to the FFu signature problemas I'm getting today? How would I change these values?
WPInternals info: https://1drv.ms/u/s!Ag-KZVVb9pL6q5pd7wcC32KiUZzfjQ
My phone is booting to QHSUSB_BULK and i have error with thor2 commands
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode rnd -bootmsc
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode rnd -bootmsc
Process started Fri Sep 23 13:10:45 2022
Logging to file C:\Users\grego\AppData\Local\Temp\thor2_win_20220923131045_ThreadId-23132.log
Initiating do RnD operations
WinUSB in use.
Debugging enabled for rnd
Detecting UEFI responder
Device is not in Lumia UEFI mode
Reading device mode failed
THOR2_ERROR_UEFI_RESPONDER_DETECTION
THOR2 1.8.2.18 exited with error code 84017 (0x14831)

Moto G4 Plus hard brick!!!

Hello, I bricked my moto g4 plus a while ago and it does not go into fastboot and does not connect, so there is no way to install a new ROM, the only thing it does is flash the led, when I connect it on the computer it recognizes it as Qualcomm Hs-usb qdloader 9008, I saw in some places I need a blankflash for the bike g4 plus xt 1640, I tried one but it did not work. I wanted to know if anyone knows how to solve or I would have a different blankflash. Sorry for my English, I'm not American.
How did you brick your device (was it with a firmware downgrade)?
echo92 said:
How did you brick your device (was it with a firmware downgrade)?
Click to expand...
Click to collapse
No, I just decided to remove root by installing rom 6.0.1, after an update via OTA the screen went dark and it bricked.
echo92 said:
How did you brick your device (was it with a firmware downgrade)?
Click to expand...
Click to collapse
I think I just need a blank flash that works, if you know of any for the g4 plus bike I appreciate it.
https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016
Try this
---------- Post added at 03:34 PM ---------- Previous post was at 03:34 PM ----------
Do you have TWRP installed ?
zap456 said:
https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016
Try this
---------- Post added at 03:34 PM ---------- Previous post was at 03:34 PM ----------
Do you have TWRP installed ?
Click to expand...
Click to collapse
Well, I even had it bricked, as I said before it does not give a sign of life does not go into fastboot, or TWRP, I do not know what else to do.
zap456 said:
https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016
Try this
---------- Post added at 03:34 PM ---------- Previous post was at 03:34 PM ----------
Do you have TWRP installed ?
Click to expand...
Click to collapse
I had tried this method but received the following error:
C: \ Users \ Bruno \ Downloads \ blank-flash \ blankflash>. \ Qboot.exe blank-flash
Motorola qboot utility version 3.40
[0.000] Opening device: \\. \ COM4
[0.003] Detecting device
[0.003] ReadFile () failed, GetLastError () = 0
[0.506] ReadFile () failed, GetLastError () = 0
[1.010] ReadFile () failed, GetLastError () = 0
[1.011] ERROR: sahara_greet_device () -> change_mode () -> do_hello () -> IO error
[1.011] Check qboot_log.txt for more details
[1,012] Total time: 1013s
FAILED: qb_flash_singleimage () -> sahara_greet_device () -> change_mode () -> do_hello ()
-> IO error
C: \ Users \ Bruno \ Downloads \ blank-flash \ blankflash> pause
Software00 said:
I had tried this method but received the following error:
C: \ Users \ Bruno \ Downloads \ blank-flash \ blankflash>. \ Qboot.exe blank-flash
Motorola qboot utility version 3.40
[0.000] Opening device: \\. \ COM4
[0.003] Detecting device
[0.003] ReadFile () failed, GetLastError () = 0
[0.506] ReadFile () failed, GetLastError () = 0
[1.010] ReadFile () failed, GetLastError () = 0
[1.011] ERROR: sahara_greet_device () -> change_mode () -> do_hello () -> IO error
[1.011] Check qboot_log.txt for more details
[1,012] Total time: 1013s
FAILED: qb_flash_singleimage () -> sahara_greet_device () -> change_mode () -> do_hello ()
-> IO error
C: \ Users \ Bruno \ Downloads \ blank-flash \ blankflash> pause
Click to expand...
Click to collapse
Did you try the tips listed in the opening post linked by zap456? There's a section about the same error you're experiencing, where it may take several tries for Qboot to connect to your device.
1. Keep your mobile connected using USB, obviously.
2. using one hand keep power button and volume down button pressed at same time and using other hand click blank-flash.bat file.
3. It might be possible that blank-flash.bat scritps get finished earlier, in that case, keep clicking .bat file continuously, you don't need to close previous cmd window. For me it took 5-6 run to get script detect/communicate with device. Here idea is that your mobile should get detected when you press power button+volume button while blank-flash.bat file is still executing.
4. keep trying step 3 unless you dont see below logs.
Click to expand...
Click to collapse
echo92 said:
Did you try the tips listed in the opening post linked by zap456? There's a section about the same error you're experiencing, where it may take several tries for Qboot to connect to your device.
Click to expand...
Click to collapse
Yes, I tried several times.
Download the stock firmware from : https://www.androidfilehost.com/?fid=889764386195918175
And flash it using qpst or qfil and that should fix each and every problem on your phone ,
Hit the thanks button and ask if you have any questions.
zap456 said:
Download the stock firmware from : https://www.androidfilehost.com/?fid=889764386195918175
And flash it using qpst or qfil and that should fix each and every problem on your phone ,
Hit the thanks button and ask if you have any questions.
Click to expand...
Click to collapse
Would there be any tutorial how to do this?
Well, I've never really looked at this part, it's the first time a cell phone has stopped working.
zap456 said:
Download the stock firmware from : https://www.androidfilehost.com/?fid=889764386195918175
And flash it using qpst or qfil and that should fix each and every problem on your phone ,
Hit the thanks button and ask if you have any questions.
Click to expand...
Click to collapse
Would there be any tutorial how to do this?
Well, I've never really looked at this part, it's the first time a cell phone has stopped working.
zap456 said:
Download the stock firmware from : https://www.androidfilehost.com/?fid=889764386195918175
And flash it using qpst or qfil and that should fix each and every problem on your phone ,
Hit the thanks button and ask if you have any questions.
Click to expand...
Click to collapse
Ok, I've already found a tutorial, I'll try anything I notice, thanks for the help.
zap456 said:
Download the stock firmware from : https://www.androidfilehost.com/?fid=889764386195918175
And flash it using qpst or qfil and that should fix each and every problem on your phone ,
Hit the thanks button and ask if you have any questions.
Click to expand...
Click to collapse
I can not find something compatible with Qfil in the ROM folder that you passed me, I click Search, I click on the ROM folder and there is no file.
Software00 said:
I can not find something compatible with Qfil in the ROM folder that you passed me, I click Search, I click on the ROM folder and there is no file.
Click to expand...
Click to collapse
Wait let me check , do you mean that you can't find the .xml file ??
zap456 said:
Wait let me check , do you mean that you can't find the .xml file ??
Click to expand...
Click to collapse
yes bro, we are not able to detect the firehose programmer file ,the rawprogram file and the patch file in the stock firmware.
There is a firmware : https://drive.google.com/file/d/0Bx6eXSiwEdFFWXZyYjB5S0xlZWs/view
Check its contents before downloading it .
After downloading it you would require this to unzip the folder :http://www.7-zip.org/download.html I think winrar shows some error in extracting the files.
zap456 said:
There is a firmware : https://drive.google.com/file/d/0Bx6eXSiwEdFFWXZyYjB5S0xlZWs/view
Check its contents before downloading it .
After downloading it you would require this to unzip the folder :http://www.7-zip.org/download.html I think winrar shows some error in extracting the files.
Click to expand...
Click to collapse
That looks to be the same stock ROM as the NPJ25.93-14 ROM linked here? https://forum.xda-developers.com/moto-g4-plus/how-to/moto-g4-plus-xt1640-43-athene-npj25-93-t3549369
If so, I don't think it includes the required files for QFIL to successfully recover a bricked device (namely those named by Aditya_kumar), particularly if the bootloader is corrupted. You'll need a programmer.mbn for MSM8952 (our device's Snapdragon 617), probably also signed by Motorola and the various .xml files to tell QFIL what to flash. Also, programmers appear to be checking the bootloader whether they can permit a flash to occur, so we'd need a recent programmer.
I wish it were as simple as downloading QFIL and flashing a stock ROM to rescue a bricked device...
echo92 said:
That looks to be the same stock ROM as the NPJ25.93-14 ROM linked here? https://forum.xda-developers.com/moto-g4-plus/how-to/moto-g4-plus-xt1640-43-athene-npj25-93-t3549369
If so, I don't think it includes the required files for QFIL to successfully recover a bricked device (namely those named by Aditya_kumar), particularly if the bootloader is corrupted. You'll need a programmer.mbn for MSM8952 (our device's Snapdragon 617), probably also signed by Motorola and the various .xml files to tell QFIL what to flash. Also, programmers appear to be checking the bootloader whether they can permit a flash to occur, so we'd need a recent programmer.
I wish it were as simple as downloading QFIL and flashing a stock ROM to rescue a bricked device...
Click to expand...
Click to collapse
BRO, I think servicefile and flashfile(both are xml files containing info. on what to flash) included in the stock can work as rawprogram file and patch file. But the point comes as we need firehose programmer file( mbn file) too. I don't think that fsg.mbn file( only mbn fie in stock rom ) can compesate for the firehose programmer file.
I am already getting desperate, I do not know there for you but I live in Brazil the Moto G4 Plus here is 1,500 R $ when I bought it, throw it away so because of a hardbrick is very desperate, no one could solve?

/thread

{Moderator Announcement: Thread closed!}​
Obsolete
Refer to this guide for root. It's free.
(ROOT) ZTE Blade Z Max Z982 Free Non-UAT 2/21/19
My phone is B25 Not B20. Do you got one for my specific firmware?
The patched boot and recovery are from b20. They are working fine on my b25 system image.
Any ideas how to get the UAT for free?
Here is the MetroPCS B25 full partition update.zip designed to be flashed via recovery
https://www.androidfilehost.com/?fid=11410963190603910728
Here is some early production firmware use at your own risk
https://www.androidfilehost.com/?fid=11410963190603910729
Pulled these from a paid site to update my device, and maybe get a firehose for you guys in the process but no luck.
xxMoon said:
Using Win7 64
Here are the files you will need and may need before hand:
Need
Z982 Firmware B20 (It has the rawprogram0.xml file)
QDLoader Drivers
ADB Drivers
Patched Boot
Patched TWRP Recovery
ZTE Tool (Puts unrooted devices in EDL Mode while in DFU mode)
Uni Android Tool (This is the pay to play part :crying::crying::crying: )
ZTE DFU Drivers
Computer Prep:
1. Unpack the Z982 firmware to a folder on your desktop.
2. Install QDloader drivers
3. If you havnt already, install the adb drivers.
4. Install ZTE Tool
5. Install UAT (You need to subscribe to use thier program:crying::crying::crying
6.Put both boot.img and recovery.img into the folder where you unpacked your firmware and overwrite the existing stock ones.
7. Install ZTE DFU Drivers
8. Reboot you computer and press F8 to show the boot options.
9. Select "Disable Driver Signature Enforcement" or something like that.
Computer Prep Complete
Phone Prep
1. Unlock Developer Options and enable OEM Unlock and USB Debugging.
2. Backup all the files and apps you wish to keep to some place other than on internal storage.
3. Power off phone
4. Boot into DFU Mode by pressing Vol+, Vol-, and power.
Phone Prep Done
Watch Video
https://drive.google.com/file/d/1yvrb0nP7fEfTRAN3pQxuJAXHbvVZ8OdL/view?usp=sharing
After you flash your phone will try to boot. It probably will probably boot loop. The reason being, your current system in encrypted. So here is a list of what you have to do next.
1. Disconnect your phone from the computer.
2. Press and hold Vol+ and power until the phone restarts and vibrates. Then release power while continuing to hold vol+.
3. You will boot into TWRP. Swipe to allow modifications.
4. Select Wipe
5. Select Format Data
6. Type yes and then blue checkmark.
7. Back out and select reboot then system.
Mission Accomplished
The phone will do a the intial setup and you will have to open magisk manger which will then prompt you to install it.
Click to expand...
Click to collapse
why not using [adb reboot edl] command to boot directly into edl mode instead of using zte tool.
messi2050 said:
why not using [adb reboot edl] command to boot directly into edl mode instead of using zte tool.
Click to expand...
Click to collapse
That's what I did and can you help me with the UAT I don't have $50 for subscription. Do you know any way to get it for free? Plz help me
Chickenaa said:
That's what I did and can you help me with the UAT I don't have $50 for subscription. Do you know any way to get it for free? Plz help me
Click to expand...
Click to collapse
you just need the firehose from uni however i have no idea about where you can ind it, sorry..
messi2050 said:
you just need the firehose from uni however i have no idea about where you can ind it, sorry..
Click to expand...
Click to collapse
And how you get that FIREHOSE?
Chickenaa said:
And how you get that FIREHOSE?
Click to expand...
Click to collapse
no idea
It seems from what I could find online the file we need from uni is called 8936_020.ufl
I'm not 100% certain though
I think we have to make one.
https://cellphonetrackers.org/wp-content/uploads/8x60_msimage.mbn_.txt
How to generate the 8660_msimage.mbn
8660_msimage.mbn is released in SW by default, actually, it includes the all the boot images and partition table there. MPRG8660.hex will download this image and reset to mass-storage mode. If customers have different HW settings, such as GPIO/DDR, the default 8660_msimage.mbn may not work for them, so customers need build their own 8660_msimage.mbn by themselves with following ways.
1. Have the QPST 2.7.366 or higher version installed.
2. Make a local folder, copy sbl1/sbl2/sbl3/rpm/tz images to this folder.
3. copy the emmcswdownload.exe from C:\Program Files\Qualcomm\QPST\bin to this folder.
4. Prepare the partition_boot.xml as below and copy the partition_boot.xml to the same folder as above.
<?xml version="1.0"?>
<image>
<physical_partition number="0">
<primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">
<file name="sbl1.mbn" offset="0"/>
</primary>
<primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">
<file name="sbl2.mbn" offset="0"/>
</primary>
<primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">
<file name="sbl3.mbn" offset="0"/>
</primary>
<primary order="4" type="5" bootable="false" label="EXT" size="1000000">
<extended order="1" type="47" label="RPM" size="1000" readonly="false">
<file name="rpm.mbn" offset="0"/>
</extended>
<extended order="2" type="46" label="TZ" size="1000" readonly="false">
<file name="tz.mbn" offset="0"/>
</extended>
</primary>
</physical_partition>
</image>
5. Run the emmcswdownload.exe tool to create OEM boot image with a command below.
emmcswdownload.exe -f 8660_msimage.mbn -x partition_boot.xml -s 1G -g 4M
6. The 8660_msimage.mbn will be generated in the folder.
Additionally, I dumped the usb packets going from uni to my phone while flashing splash.img. It has the loader and the splash.img in it. But it needs to be pulled out. If anyone is capable, try it. uni_usb_dump_z982.7z
The firmware you provided only have Sbl1, it doesn't have sbl2 or sbl3. Can you help me? And one more thing do you have root on your Z982 because I think I found where the firmware is in the phone and we can copy it and keep it. I can't do it because it gives me access denied of course I don't have root but I think a person with root can do it.
The Z982 has 1 sbl. "SBL1"
Did you already root your phone?
Yep
Can you try something for me real quick? Plz
How to get the partition_boot.xml? Plz help me I need my phone root as fast as possible
Chickenaa said:
How to get the partition_boot.xml? Plz help me I need my phone root as fast as possible
Click to expand...
Click to collapse
I have just about as much an idea on how to do it as you do.

[GUIDE][UNBRICK] The Huanor GR5X fully unbrick guide

Hi mates, today i come with the unique guide for unbrick our Huanor GR5X phones
THIS GUIDE IS FOR FULLY BRICKED HUAWEI GR5/5X HONOR, ALL MODEL/VARIANT
ATENTION!!!
Files rawprogram0.xml and patch0.xml from my packcage its ONLY for the Huawei GR5 KII-L23 16GB VARIANT!!!
In order to continue with the tutorial, you must create your rawprogram and patch0 xml files
(mini tutorial bellow)
Ready? GO
1) Download my packcage (link MEGA)
2) Install QFIL Software. From my packcage, extract and move the folder 'Firmware' to C:\Program Files\Qualcomm\QPST\bin
3) Download and extract this .IMG files from ANY 5.1 full firmware UPDATE.APP for your model/variant
(Note: for KII-L23 is not necessary GPT.img)
GPT.img
BOOT.img
CUST.img
SYSTEM.img
TZ.img
MODEM.img
Place all img files in C:\Program Files\Qualcomm\QPST\bin\Firmware
4) Install Qualcomm drivers, Connect phone to pc, open Device Manager. If you see under com port Qualcomm USB loader or something along those lines. your good.
5) In QFIL software, if qualcomm driver are found it will say on top of QFIL software Qualcom USB loader 9008 (if say 9006,900E, you must put your phone into EDL mode with EDL Cable or EDL TEST POINT, google it)
6) Once you get the Qualcom USB loader 9008 on QFIL, you can continue
6) Select Build Type: click Flat Build
7) Select Programmer: browse to C:\Program Files\Qualcomm\QPST\bin\Firmware\prog_emmc_firehose_8939.mbn and select
8) Load XML: browse to C:\Program Files\Qualcomm\QPST\bin\Firmware and select "rawprogram0.xml" file, then select "patch0.xml" file.
9) Go to Tools and click Partition Manager
10) You will see a list with all files from partition table
11) To flash, you need select Boot.img in the list first, a mini windows will open, click on Load image and select the Boot.img placed on C:\Program Files\Qualcomm\QPST\bin\Firmware
Do the same with the rest of img files in THIS order
BOOT.img
CUST.img
SYSTEM.img
TZ.img
MODEM.img
12) Once you finish, close the partition manager. A message will appear and phone will reboot. If not, reboot manually
That's all enjoy!
FOR GR5 KII-L2X AND HONOR 5X KIW-L2X MODEL/VARIANT, FOLLOW THIS TUTORIAL
1) Download my packcage and exctract it
2) Open a cmd windows in 'Phyton + GPT Tools' folder
3) Type: GPTAnalyzer.py (drag and drop the GPT.img file previously downloaded from 5.1 firmware) and click Enter
4) Copy all results in cmd, paste on notepad and save as 'Partition0.xml' (start with <?xml version... and finish on </configuration>)
5) Type GPTParseTool.py -x (drag and drop the partition0.xml created) and click enter
6) Go to phyton folder and move all created files to C:\Program Files\Qualcomm\QPST\bin\Firmware
7) Now you can continue with the guide
Thats all my friends, hope you get a new life for your Huanor GR5X
PLEASE IF I HELP YOU, BUY ME A COFFE HERE
Reserved
GOOD guide!someone will need it!
my question:does it work on the locked phone?
wsdyleon said:
GOOD guide!someone will need it!
my question:does it work on the locked phone?
Click to expand...
Click to collapse
Thanks!
Locked and unlocked devices.
My dear friend, there is no python tools folder in your package. i can't unbrick my phone with your xml files, its a KLL-L21.
Best of regards.
faabricjs said:
Thanks!
Locked and unlocked devices.
Click to expand...
Click to collapse
I cant find python + GPT tools
faabricjs said:
Thanks!
Locked and unlocked devices.
Click to expand...
Click to collapse
my device is not showing up I have removed the battery and connected the usb but nothing happens only the device vibrates and huawei logo apears but nothing on my pc
Ibrahim Tariq said:
I cant find python + GPT tools
Click to expand...
Click to collapse
Here you will find all files needed and instructions
You have to open the phone and put it in EDL mode
Search Google for that
https://forum.hovatek.com/thread-31505.html
snazzyman89 said:
My dear friend, there is no python tools folder in your package. i can't unbrick my phone with your xml files, its a KLL-L21.
Best of regards.
Click to expand...
Click to collapse
Ibrahim Tariq said:
my device is not showing up I have removed the battery and connected the usb but nothing happens only the device vibrates and huawei logo apears but nothing on my pc
Click to expand...
Click to collapse
See my reply in previous post #8
---------- Post added at 02:15 AM ---------- Previous post was at 02:06 AM ----------
Can't we use Huiye Download Tool to flash all the images ?
what if i dont have system.img in my firmeware ? what should i do ? i have firehose from b321 can this be compatible with b330?
EDIT : i found the sys.img for b321
friends help me out i have KiW L21 superbricked unable to charge battery and he dont show up in device manager as qloader 9008

Possible way to unbrick a hard brick device with lock bootloader . (Not working)

Disclaimer :
I'm not responsible for bricked devices, dead SD cards. This guide have not tested by anyone yet and because of that have a high chance to damage your device .Please think twice before deciding to do this guide !!!
Hello all, I was successful to extract the ofp firmware for the CN and GLOBAL version. The firmware is kind of QFIL based firmware and include patch0.xml , rawprogram0.xml , prog_firehose_ddr.elf that can be loaded on the Qualcomm QFIL tool for flashing a stock rom on EDL mode .
I do not have this phone yet so this is not tested by me but it should work .
This should work on bricked devices with locked bootloader .
This is not a full guide as I haven't tested it yet, but I will share you of my idea. I suggest to not try this if your not in hard brick and the bootloder is not locked .
Warning- This process will wipe your internal storage .
1. Extract the firmware and the 1-Qualcomm USB Driver + QFIL.7z.
2. You should install the Qualcomm USB Driver
3. Install QPST.2.7.480 , move the firmware to C:\Program Files (x86)\Qualcomm\QPST\bin .
4. Run as administration the QFIL software ,it found on C:\Program Files (x86)\Qualcomm\QPST\bin .
5. Click on the Configuration tab and then on the FireHose configuration .
6. Click on the Device Type and choose ufs .
7. Tick the "Reset after Download" and press OK.
8. Tick the flat boot circle option .
9. Click Browse on the Programmer Path and choose prog_firehose_ddr.elf in the firmware file .
10. Click Load XML and choose "rawprogram0.xml" and then choose "patch0.xml" .
Open windows device manger, boot you phone to EDL by connecting a cable to you PC and then press and hold power bottom and volume + bottom .You should see Qualcomm HS-USB QDLoader 9008, It is really important to be on QDLoader 9008 .Do not try to proceed to 11 if it does not show as QDLoader 9008 .
11. you will see the Port on the QFIL software and then choose Download .
Download -
Qualcomm USB Driver + QFIL - https://mega.nz/file/pU8FRILJ#y54f4lnq6p3T7TCITGyWRw0Kuf4ymgOt4srQ654NqUo
Extracted RMX1931EX_11_A.09 OFP (Global firmware) - https://mega.nz/file/YQ80wSwB#wflYZ-hI5O96QjTq4oc4pnovn6UoAtry2lHn7ThmbLo
CHECK MD5 !!! - 58A5C6D75787029B664FD5583F265872
Extracted RMX1931_11_A.11 OFP (CN firmware) - https://mega.nz/file/lMMlQK4K#bOCrQrg7tkKj2n6VNhS__4bBQw1RdsxTSI5XrzRpMG0
CHECK MD5 !!! - A0CCED006DF8FC0B06B0669A8325883F
Please download the firmware according to your realme x2 pro model, This probably wont work and may damage your device if you have a CN model and try flash a EU firmware and the opposite EU model and try flash a CN firmware .
UPDATE-
After long testing it seem that we can not write to or read from this phone without the realme tool, It must have a special code . I will stop searching for a way because it seems impossible without the Realme tool.
Thanks to @shilpakar7, @Designguru and @iamkgehlot for testing tools and files for many hours .
English is not my native language, please excuse any errors on my part.
Reserved
Fingers crossed ? if it works, it's going to help alot of folks!
luisarriaga said:
Fingers crossed ? if it works, it's going to help alot of folks!
Click to expand...
Click to collapse
Yes I know, It also will remove the fear of hard brick when locking the bootloder .
Furthermore if it will work for the realme x2 pro, it will work on many Realme devices that have a snapdragon CPU including the realme x2 .I just need to extract the ofp firmware of each device .
Yes absolutely! It's the only android smartphone I never unlocked the bootloader, first of all because of loosing FP if you install twrp, and there's the risk of relocking it. Let's wait for some feedback ?
Here is what I have currently
ERROR: function: sahara_rx_data:277 Unable to read packet header. Only read 0 bytes.
ERROR: function: sahara_main:983 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
Designguru said:
Here is what I have currently
ERROR: function: sahara_rx_data:277 Unable to read packet header. Only read 0 bytes.
ERROR: function: sahara_main:983 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
Click to expand...
Click to collapse
Try to immediately start flashing(choose Download ) after you have put your phone into EDL mode .Also does you see Qualcomm HS-USB QDLoader 9008 on windows device manager ?
or965 said:
Try to immediately start flashing(choose Download ) after you have put your phone into EDL mode .Also does you see Qualcomm HS-USB QDLoader 9008 on windows device manager ?
Click to expand...
Click to collapse
Here is another problem I'm seeing. I put all the files in C:\ as per your instructions. When I download from QFIL, it shows Working Folder is C:\Users\<username>\AppData\Roaming\Qualcomm\QFIL\COMPORT_3. I copied over all the files into this folder as well and am seeing the errors posted earlier.
Yes I'm showing HS-USB QDLoader 9008 (COM#)
Designguru said:
Here is another problem I'm seeing. I put all the files in C:\ as per your instructions. When I download from QFIL, it shows Working Folder is C:\Users\<username>\AppData\Roaming\Qualcomm\QFIL\COMPORT_3. I copied over all the files into this folder as well and am seeing the errors posted earlier.
Yes I'm showing HS-USB QDLoader 9008 (COM#)
Click to expand...
Click to collapse
Try uninstall the qfil and install this version https://mega.nz/file/hFdDDKBK#szUu2TqPdd6VO_XLKfYIu9pJ6yYT0LbaeZqTaIEQ8Fo
put the firmware on C:\Program Files (x86)\Qualcomm\QPST\bin
or965 said:
Try uninstall the qfil and install this version https://mega.nz/file/hFdDDKBK#szUu2TqPdd6VO_XLKfYIu9pJ6yYT0LbaeZqTaIEQ8Fo
put the firmware on C:\Program Files (x86)\Qualcomm\QPST\bin
Click to expand...
Click to collapse
Done. Here is where it fails now
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
-------------------------------------------------------------------------------------------
19:17:51: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
19:17:51: DEBUG: XML FILE (115 bytes): CharsInBuffer=315-115=200
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
-------------------------------------------------------------------------------------------
19:17:51: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
19:17:51: DEBUG: XML FILE (94 bytes): CharsInBuffer=200-94=106
-------------------------------------------------------------------------------------------
Designguru said:
Done. Here is where it fails now
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
-------------------------------------------------------------------------------------------
19:17:51: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
19:17:51: DEBUG: XML FILE (115 bytes): CharsInBuffer=315-115=200
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
-------------------------------------------------------------------------------------------
19:17:51: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
19:17:51: DEBUG: XML FILE (94 bytes): CharsInBuffer=200-94=106
-------------------------------------------------------------------------------------------
Click to expand...
Click to collapse
Maybe we should try to use other software to flash ,try to download this - https://mega.nz/file/tM9CDIbS#BOqaetCpD2NKEjXPLO_EGB9RHTcTTY0HMpRzMqYVhDA
Unpack and open MiPhone20160401, click next and then install this driver software anyway ,go to
C:\Program Files\Xiaomi\MiPhone and run MiFlash, click browse and choose the folder of the firmware ,boot into edl mode ,click refresh and when you see the device click flash ,if you have an error, try to go to the firmware and change setting.xml name to flash_local.xml and try to flash again .
or965 said:
Maybe we should try to use other software to flash ,try to download this - https://mega.nz/file/tM9CDIbS#BOqaetCpD2NKEjXPLO_EGB9RHTcTTY0HMpRzMqYVhDA
Unpack and open MiPhone20160401, click next and then install this driver software anyway ,go to
C:\Program Files\Xiaomi\MiPhone and run MiFlash, click browse and choose the folder of the firmware ,boot into edl mode ,click refresh and when you see the device click flash ,if you have an error, try to go to the firmware and change setting.xml name to flash_local.xml and try to flash again .
Click to expand...
Click to collapse
When I hit flash, here is what I get under status
"The filename,directory name, or volume label syntax is incorrect (0x8007007b: Open programmer "MPRG*hex")
what about using qpst tool as mentioned in https://www.getdroidtips.com/stock-rom-realme-x2-pro/ Method 3. The above mentioned url contains guide for chinese ROM but since you have ofp firmware for global version. Will this method work?
it fails during dowload process. I have attached the log.
Total to be tansferd with <program> or <read> is 8.98 GB
09:09:35: INFO: Sending <configure>
09:09:35: INFO: TARGET SAID: 'INFO: Binary build date: May 17 2019 @ 23:12:26'
09:09:35: INFO: TARGET SAID: 'INFO: Binary build date: May 17 2019 @ 23:12:26
'
09:09:35: INFO: TARGET SAID: 'INFO: Chip serial num: 1387265276 (0x52affcfc)'
09:09:35: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
09:09:35: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
09:09:35: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
09:09:35: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
09:09:35: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information
Writing log to 'C:\Users\Pawan-PC\AppData\Roaming\Qualcomm\QFIL\COMPORT_4\port_trace.txt', might take a minute
Log is 'C:\Users\Pawan-PC\AppData\Roaming\Qualcomm\QFIL\COMPORT_4\port_trace.txt'
Download Fail:FireHose Fail:FHLoader Failrocess fail
Finish Download
or965 said:
Maybe we should try to use other software to flash ,try to download this - https://mega.nz/file/tM9CDIbS#BOqaetCpD2NKEjXPLO_EGB9RHTcTTY0HMpRzMqYVhDA
Unpack and open MiPhone20160401, click next and then install this driver software anyway ,go to
C:\Program Files\Xiaomi\MiPhone and run MiFlash, click browse and choose the folder of the firmware ,boot into edl mode ,click refresh and when you see the device click flash ,if you have an error, try to go to the firmware and change setting.xml name to flash_local.xml and try to flash again .
Click to expand...
Click to collapse
Let me provide a couple of tips here: When pointing to the path of your extracted files in C : copy paste the path directory using the mouse.
If you have a firehose connection error , disconnect the usb cable and reconnect only to a usb2 port ( use a hub if needed) QPST can be setup to not start until you connect the phone.
Next, if facing a signature issue. temporarily disable antivirus and firewall and Windows signature enforcement if absolutely necessary.
This can all be easily re enabled afterwards.
If you face any other issues, refer to my old guide for troubleshooting ideas. here for additional things to try. I have personally helped possibly over a hundred people unbrick their phone
These steps are identical for most qualcomm phones. obviously use only qfil repair files made for your device and not from my link.
PS : Firehose fail error does not necessarily mean that the process will fail, just wait longer, up to 15 to 20 minutes, sometimes you will get that error and it will sort itself out. restart the process all over again, but wait for 15 minutes on each attempt. Also disconnect peripheral devices from other usb ports. it is very important that you use a USB 2 port or a usb hub.
Once the rom is restored the phone should reboot to the set screen up on it's own.
tsongming said:
Let me provide a couple of tips here: When pointing to the path of your extracted files in C : copy paste the path directory using the mouse.
If you have a firehose connection error , disconnect the usb cable and reconnect only to a usb2 port ( use a hub if needed) QPST can be setup to not start until you connect the phone.
Next, if facing a signature issue. temporarily disable antivirus and firewall and Windows signature enforcement if absolutely necessary.
This can all be easily re enabled afterwards.
If you face any other issues, refer to my old guide for troubleshooting ideas. here for additional things to try. I have personally helped possibly over a hundred people unbrick their phone
These steps are identical for most qualcomm phones. obviously use only qfil repair files made for your device and not from my link.
PS : Firehose fail error does not necessarily mean that the process will fail, just wait longer, up to 15 to 20 minutes, sometimes you will get that error and it will sort itself out. restart the process all over again, but wait for 15 minutes on each attempt. Also disconnect peripheral devices from other usb ports. it is very important that you use a USB 2 port or a usb hub.
Once the rom is restored the phone should reboot to the set screen up on it's own.
Click to expand...
Click to collapse
can you please check my log mentioned above.
Edit:
Now the QFIL says download succeed (command prompt flashes for few seconds) but it doesn't flash the firmware , since i am stuck in same problem.(bootloop displaying " your recover/bootloader has been destroyed...").
Here is my log
https://pastebin.com/vYjC5rxq
And here is my log from C:\Users\Pawan-PC\AppData\Roaming\Qualcomm\QFIL\COMPORT_5 port_tra
ce.txt
https://pastebin.com/2VynsCD7
shilpakar7 said:
can you please check my log mentioned above.
Edit:
Now the QFIL says download succeed (command prompt flashes for few seconds) but it doesn't flash the firmware , since i am stuck in same problem.(bootloop displaying " your recover/bootloader has been destroyed...").
Here is my log
First just a friendly tip, when people spend time helping at the very least, click the thank you button otherwise what is their motivation? When posting logs, post it as an attachment ( XDA Rules) its clutters threads.
The bootloader destroyed is no big deal, it's resolved by flashing the boot image. The real issue is the key mismatch error. You need to use the fastboot rom only from your device model. Example : Global versus Chinese.
Finally, I do not own that phone so there isn't ,much more I can contribute. However, I am, certain that you will eventually solve it, try another fastboot rom, be patient ( this could take days the first time) and take notes, so when you are finished you can help other people.
I would suggest that you contact others within the realme community that have had bricks. for example I have seen that people have had success with other real me 3s. You may better off joining Telegram and connecting with user's on the Global scale. You can find telegram groups by searching keywords.
Finally, @or965 stated that he successfully restored his phone that is identical to yours...I think. I would definitely speak with him and if he helps you unbrick your phone, I would absolutely buy him a beer.
Good Luck.
Click to expand...
Click to collapse
ok thank you for your advice, I will definitely take it as a reminder. I have uploaded the log file to pastebin.com and postel the url link. Since you don't personally have the device, I shouldn't have asked for more help. Anyways thank you for your valuable time. Since this is so frustating, I guess i will just send it to service center for repair.
tsongming said:
shilpakar7 said:
can you please check my log mentioned above.
Edit:
Now the QFIL says download succeed (command prompt flashes for few seconds) but it doesn't flash the firmware , since i am stuck in same problem.(bootloop displaying " your recover/bootloader has been destroyed...").
Here is my log
First just a friendly tip, when people spend time helping at the very least, click the thank you button otherwise what is their motivation? When posting logs, post it as an attachment ( XDA Rules) its clutters threads.
The bootloader destroyed is no big deal, it's resolved by flashing the boot image. The real issue is the key mismatch error. You need to use the fastboot rom only from your device model. Example : Global versus Chinese.
Finally, I do not own that phone so there isn't ,much more I can contribute. However, I am, certain that you will eventually solve it, try another fastboot rom, be patient ( this could take days the first time) and take notes, so when you are finished you can help other people.
I would suggest that you contact others within the realme community that have had bricks. for example I have seen that people have had success with other real me 3s. You may better off joining Telegram and connecting with user's on the Global scale. You can find telegram groups by searching keywords.
Finally, @or965 stated that he successfully restored his phone that is identical to yours...I think. I would definitely speak with him and if he helps you unbrick your phone, I would absolutely buy him a beer.
Good Luck.
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Designguru said:
When I hit flash, here is what I get under status
"The filename,directory name, or volume label syntax is incorrect (0x8007007b: Open programmer "MPRG*hex")
Click to expand...
Click to collapse
Please crate a folder Realme_x2_pro on your root C drive and move the firmware to it,then rename the firmware to RMX1931EX_11_A_09 and try to flash with miflash like I write in the last message .
shilpakar7 said:
can you please check my log mentioned above.
Edit:
Now the QFIL says download succeed (command prompt flashes for few seconds) but it doesn't flash the firmware , since i am stuck in same problem.(bootloop displaying " your recover/bootloader has been destroyed...").
Here is my log
https://pastebin.com/vYjC5rxq
Click to expand...
Click to collapse
Please crate a folder Realme_x2_pro on your root C drive and move the firmware to it,then rename the firmware to RMX1931EX_11_A_09 .
try to download this - https://mega.nz/file/tM9CDIbS#BOqaetCpD2NKEjXPLO_EGB9RHTcTTY0HMpRzMqYVhDA
Unpack and open MiPhone20160401, click next and then install this driver software anyway ,go to
C:\Program Files\Xiaomi\MiPhone and run MiFlash, click browse and choose the folder of the firmware ,boot into edl mode ,click refresh and when you see the device click flash.
Finally said:
@or965[/user] stated that he successfully restored his phone that is identical to yours...I think. I would definitely speak with him and if he helps you unbrick your phone, I would absolutely buy him a beer.
Click to expand...
Click to collapse
I did not have this device yet so I do not successfully restored my phone .
or965 said:
Please crate a folder Realme_x2_pro on your root C drive and move the firmware to it,then rename the firmware to RMX1931EX_11_A_09 and try to flash with miflash like I write in the last message .
Please crate a folder Realme_x2_pro on your root C drive and move the firmware to it,then rename the firmware to RMX1931EX_11_A_09 .
try to download this - https://mega.nz/file/tM9CDIbS#BOqaetCpD2NKEjXPLO_EGB9RHTcTTY0HMpRzMqYVhDA
Unpack and open MiPhone20160401, click next and then install this driver software anyway ,go to
C:\Program Files\Xiaomi\MiPhone and run MiFlash, click browse and choose the folder of the firmware ,boot into edl mode ,click refresh and when you see the device click flash.
I did not have this device yet so I do not successfully restored my phone .
Click to expand...
Click to collapse
this method also not working. The status tab on MiFlash displays same message as mentioned by designguru

Categories

Resources