Warning: This unlocking method might not work on newer ZTE devices with Oreo+ and flagship devices. You have nothing to lose, but it might not do anything.
This tutorial is only for Qualcomm ZTE Devices.
Unlocking the Bootloader:
Warning: This bootloader unlocking method is not for beginners. It requires at least some knowleage on how to flash ROMS or partitions via QFIL and ADB commands. If you do not understand something here, than the tutorial might not be suitable for you. You can still try it, but at your own risk of course.
Will not work on:
Axon 7
Axon 7 Mini
Axon 9
Axon 10
Axon M
Zmax 2 (Z958)
Anything else that has Oreo, PIE or 10
The unlocking bit on those devices are stored in another partition that can't be easily modifiable
Working on: (Thanks @deadman96385)
Snapdragon 210 Processors:
ZTE Avid Plus (Z828)
ZTE Maven 2 (Z831) (code-name: chapel)
ZTE Maven 3 (Z835) (code-name: draco)
ZTE Majesty Pro Plus (Z899VL) (code-name: elden)
Unknown ZTE (code-name: forbes)
ZTE ZMAX One (Z719DL) (code-name: gemi)
ZTE Tempo X (N9137) (code-name: grayjoylite)
ZTE Grand X View 2 (K81) (code-name: helen)
ZTE Overture 3 (Z851) (code-name: jeff)
ZTE Fanfare 3 (Z852) (code-name: kelly)
ZTE ZFive G LTE (Z557BL) (code-name: lewis)
ZTE ZFive C (Z558VL) (code-name: loft)
Unknown ZTE (code-name: refuge)
ZTE N818S (code-name: sapphire/sapphire4G)
ZTE Blade Vantage (Z839) (code-name: sweet)
Snapdragon 617:
Android 5.1.1
ZTE Grand X Max 2 (Z988) (code-name: jerry)
ZTE Imperial Max (Z963U) (code-name: lily)
ZTE Max Duo LTE (Z963VL) (code-name: nancy)
ZTE Axon Max (C2016) (code-name: orchid)
ZTE Max Duo LTE (Z962BL) (code-name: tom)
Android 6.0.1
ZTE ZPAD (K90U) (code-name: gevjon)
ZTE AT&T Trek 2 (K88) (code-name: jasmine)
ZTE Grand X Max 2 (Z988) (code-name: jerry)
ZTE Axon Max (C2016) (code-name: orchid)
ZTE ZMAX Pro (Z981) (code-name: urd)
Android 7.1.1
ZTE AT&T Trek 2 (K88) (code-name: jasmine)
MSM8920/MSM8937/MSM8940/MSM8953 (Qualcomm Snapdragon 427/430/435/625):
ZTE Blade Force/ZTE Warp 8 (N9517) (code-name: warp8)
ZTE Grand X4 (Z956/Z957) (code-name: finacier)
ZTE Blade Spark (Z971) (code-name: peony)
ZTE Blade X (Z965) (code-name: proline)
ZTE Max XL/ZTE Bolton (N9560) (code-name: bolton)
Unknown ZTE (code-name: flame)
ZTE Blade X Max (Z983) (code-name: stollen)
ZTE Blade Max View (Z610DL) (code-name: violet)
ZTE Max Blue LTE (Z986DL) (code-name: florist)
ZTE AT&T Primtime (K92) (code-name: primerose)
Of course, it might work on more models that might not be listed here.
Want to watch a video instead?
https://www.youtube.com/watch?v=FdWtJKCcPh4
You will need:
A Qualcomm ZTE device (I am using a ZTE Avid Plus Z828)
A PC
Adb Commands installed
QFIL 2.0.1.9
Your QFIL firehose (emmc_firehose_8***.mbn) You can get it from here: https://github.com/programmer-collection/zte
A Hex editor (Like HxD)
Tutorial:
Hold power and volume down to boot to FTM mode
Using ADB commands, type: adb reboot EDL
Open QFIL, You should see Qualcomm HS-USB QD-Loader 9008 (COM****)
Select "Flat build"
Select your firehose (emmc_firehose_8***.mbn)
Select tools, partition manager
Click ok
We are intrested in the /devinfo partition only!
Right click devinfo only and click on "Manage Partition data"
Click on "Read Data"
Check the logs on the main window, it will show you where it will be saved (Most frequently in the Appdata/Roaming/Qualcomm folder) and the file will be named something like this: ReadData_emmc_Lun0_0x1c000_Len16384_DT_**_**_****_**_**_**.bin
Copy the file we read to somewhere like the desktop and make a backup in case it does not work.
Next, open HxD or any other hex editor
Click File>Open and select the file we copied to the desktop
You should see a layout like this:
Edit this:
41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
to this:
41 4E 44 52 4F 49 44 2D 42 4F 4F 54 21 00 00 00
01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
Go to offset 007FFE00 and repeat the same steps:
It looks like ZTE did put another ANDROID-BOOT! at this section, they thought I would not see the second one Make sure you edit that second one, otherwise the BL won't be unlocked.
___________________________________________________________________________
What will this do?! The two 01s we put in this file will show to the bootloader that it was unlocked before via fastboot. Of course, we are editing it now and it was never unlocked via fastboot. This is enough to fool it
For people who don't know, on all android devices, there is the /devinfo partition that stores the information of the bootloader such as is_unlocked (aboot), is_tampered, is_verified, charger_screen_enabled, display_panel, bootloader_version, radio_version etc.
We have to modify it into saying is_unlocked and is_Critiacal_unlocked
____________________________________________________________________________________
Do not touch anything else and click File>Save
Boot your phone into EDL again.
(You might need to reopen QFIL)
Back to the partitions, right-click /devinfo again and click "Manage partition Data" again
Click "Load image"
Select the file we modified (Should be a .bin)
Wait a few seconds and restart your phone and IT SHOULD BOOT SURELY!!
Your bootloader should be unlocked!!
You cannot really tell if the Bootloader is unlocked unfortunatley. But, if TWRP boots or ROOT persists then here is your sign
TWRP is booting!
You can now ROOT, Install custom ROMs, Install Custom Recoveries, kernel modifications & More using QFIL!
You are now free
Credits to aleph security in the Unlocking the bootloader section at the bottom of the page for showing the Hex values to change: https://alephsecurity.com/2018/01/22/qualcomm-edl-2/
Firehose collection
Here is my collection of ZTE firehoses for use in this guide. I cant guarantee everyone will work but the vast majority of them should. But they are all organized by codename and my best attempt at matching codename to shipping name.
https://github.com/programmer-collection/zte
deadman96385 said:
Here is my collection of ZTE firehoses for use in this guide. I cant guarantee everyone will work but the vast majority of them should. But they are all organized by codename and my best attempt at matching codename to shipping name.
https://github.com/programmer-collection/zte
Click to expand...
Click to collapse
That is actually where I got my firehose from! I will add the link to the OP
alexenferman said:
That is actually where I got my firehose from! I will add the link to the OP
Click to expand...
Click to collapse
You may want to limit your statement of all Qualcomm zte's it won't work on anything that launched with Oreo or newer, and certain flagship devices like axon 9, 10, M, etc
deadman96385 said:
You may want to limit your statement of all Qualcomm zte's it won't work on anything that launched with Oreo or newer, and certain flagship devices like axon 9, 10, M, etc
Click to expand...
Click to collapse
Yes, you are right. It's sad that the unlocking bit is not stored in the /devinfo partition anymore. At least a lot of people with lollipop, marshmallow and probably nougat can still use this method.
Doesn't seem to be wroking with my ZTE Tempo X N9137. I trried it twice and got two septerate errors. The first was "ERROR: function: sahara_rx_data:247 Command packet length 1702240364 too large to fit" and the second was "ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes."
Here's the log file...
2020-05-18 14:21:38.733 Validating Application Configuration
2020-05-18 14:21:38.738 Load APP Configuration
2020-05-18 14:21:38.751 COM:4
2020-05-18 14:21:38.751 PBLDOWNLOADPROTOCOL:0
2020-05-18 14:21:38.751 PROGRAMMER:True
2020-05-18 14:21:38.751 PROGRAMMER:C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:21:38.751 RESETSAHARASTATEMACHINE:False
2020-05-18 14:21:38.751 SAHARAREADSERIALNO:False
2020-05-18 14:21:38.751 SEARCHPATH:C:\Users\MikeWin10\Desktop
2020-05-18 14:21:38.751 ACKRAWDATAEVERYNUMPACKETS:False
2020-05-18 14:21:38.751 ACKRAWDATAEVERYNUMPACKETS:100
2020-05-18 14:21:38.751 MAXPAYLOADSIZETOTARGETINBYTES:False
2020-05-18 14:21:38.751 MAXPAYLOADSIZETOTARGETINBYTES:49152
2020-05-18 14:21:38.751 DEVICETYPE:emmc
2020-05-18 14:21:38.751 PLATFORM:8x26
2020-05-18 14:21:38.751 VALIDATIONMODE:0
2020-05-18 14:21:38.751 RESETAFTERDOWNLOAD:False
2020-05-18 14:21:38.751 MAXDIGESTTABLESIZE:8192
2020-05-18 14:21:38.751 SWITCHTOFIREHOSETIMEOUT:30
2020-05-18 14:21:38.751 RESETTIMEOUT:200
2020-05-18 14:21:38.751 RESETDELAYTIME:2
2020-05-18 14:21:38.751 METABUILD:
2020-05-18 14:21:38.751 METABUILD:
2020-05-18 14:21:38.751 FLATBUILDPATH:C:\
2020-05-18 14:21:38.751 FLATBUILDFORCEOVERRIDE:True
2020-05-18 14:21:38.751 QCNPATH:C:\Temp\00000000.qcn
2020-05-18 14:21:38.751 QCNAUTOBACKUPRESTORE:False
2020-05-18 14:21:38.751 SPCCODE:000000
2020-05-18 14:21:38.751 ENABLEMULTISIM:False
2020-05-18 14:21:38.751 AUTOPRESERVEPARTITIONS:False
2020-05-18 14:21:38.751 PARTITIONPRESERVEMODE:0
2020-05-18 14:21:38.751 PRESERVEDPARTITIONS:0
2020-05-18 14:21:38.751 PRESERVEDPARTITIONS:
2020-05-18 14:21:38.751 ERASEALL:False
2020-05-18 14:21:38.751 Load ARG Configuration
2020-05-18 14:21:38.768 Validating Download Configuration
2020-05-18 14:21:38.769 Image Search Path: C:\Users\MikeWin10\Desktop
2020-05-18 14:21:38.770 Programmer Path:C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:21:38.900 Process Index:0
2020-05-18 14:21:38.908 Qualcomm Flash Image Loader (QFIL) 2.0.1.9
2020-05-18 14:21:45.195 Start Download
2020-05-18 14:21:45.200 Program Path:C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:21:45.205 ***** Working Folder:C:\Users\MikeWin10\AppData\Roaming\Qualcomm\QFIL\COMPORT_4
2020-05-18 14:21:45.225 Binary build date: Nov 21 2017 @ 02:53:37
2020-05-18 14:21:45.226 QSAHARASERVER CALLED LIKE THIS: 'C:\Users\MikeWin10\Desktop\Qualcomm_Flash_Image_Loader_v2.0.1.9\QSaharaServer.ex'Current working dir: C:\Users\MikeWin10\AppData\Roaming\Qualcomm\QFIL\COMPORT_4
2020-05-18 14:21:45.227 Sahara mappings:
2020-05-18 14:21:45.227 2: amss.mbn
2020-05-18 14:21:45.228 6: apps.mbn
2020-05-18 14:21:45.228 8: dsp1.mbn
2020-05-18 14:21:45.228 10: dbl.mbn
2020-05-18 14:21:45.229 11: osbl.mbn
2020-05-18 14:21:45.229 12: dsp2.mbn
2020-05-18 14:21:45.229 16: efs1.mbn
2020-05-18 14:21:45.229 17: efs2.mbn
2020-05-18 14:21:45.230 20: efs3.mbn
2020-05-18 14:21:45.230 21: sbl1.mbn
2020-05-18 14:21:45.230 22: sbl2.mbn
2020-05-18 14:21:45.231 23: rpm.mbn
2020-05-18 14:21:45.231 25: tz.mbn
2020-05-18 14:21:45.231 28: dsp3.mbn
2020-05-18 14:21:45.232 29: acdb.mbn
2020-05-18 14:21:45.232 30: wdt.mbn
2020-05-18 14:21:45.232 31: mba.mbn
2020-05-18 14:21:45.233 13: C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:21:45.233
2020-05-18 14:21:45.233 14:21:45: ERROR: function: sahara_rx_data:247 Command packet length 1702240364 too large to fit
2020-05-18 14:21:45.234
2020-05-18 14:21:45.234 14:21:45: ERROR: function: sahara_main:924 Sahara protocol error
2020-05-18 14:21:45.234
2020-05-18 14:21:45.235 14:21:45: ERROR: function: main:303 Uploading Image using Sahara protocol failed
2020-05-18 14:21:45.235
2020-05-18 14:21:45.236
2020-05-18 14:21:45.236 Download Fail:Sahara Fail:QSaharaServer Failrocess fail
2020-05-18 14:21:45.239 Finish Get GPT
2020-05-18 14:23:07.631 Start Download
2020-05-18 14:23:07.634 Program Path:C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:23:07.635 ***** Working Folder:C:\Users\MikeWin10\AppData\Roaming\Qualcomm\QFIL\COMPORT_4
2020-05-18 14:24:37.656 Binary build date: Nov 21 2017 @ 02:53:37
2020-05-18 14:24:37.658 QSAHARASERVER CALLED LIKE THIS: 'C:\Users\MikeWin10\Desktop\Qualcomm_Flash_Image_Loader_v2.0.1.9\QSaharaServer.ex'Current working dir: C:\Users\MikeWin10\AppData\Roaming\Qualcomm\QFIL\COMPORT_4
2020-05-18 14:24:37.663 Sahara mappings:
2020-05-18 14:24:37.665 2: amss.mbn
2020-05-18 14:24:37.666 6: apps.mbn
2020-05-18 14:24:37.666 8: dsp1.mbn
2020-05-18 14:24:37.666 10: dbl.mbn
2020-05-18 14:24:37.667 11: osbl.mbn
2020-05-18 14:24:37.667 12: dsp2.mbn
2020-05-18 14:24:37.667 16: efs1.mbn
2020-05-18 14:24:37.668 17: efs2.mbn
2020-05-18 14:24:37.668 20: efs3.mbn
2020-05-18 14:24:37.668 21: sbl1.mbn
2020-05-18 14:24:37.669 22: sbl2.mbn
2020-05-18 14:24:37.669 23: rpm.mbn
2020-05-18 14:24:37.669 25: tz.mbn
2020-05-18 14:24:37.669 28: dsp3.mbn
2020-05-18 14:24:37.670 29: acdb.mbn
2020-05-18 14:24:37.670 30: wdt.mbn
2020-05-18 14:24:37.670 31: mba.mbn
2020-05-18 14:24:37.671 13: C:\Users\MikeWin10\Desktop\prog_emmc_firehose_8909.mbn
2020-05-18 14:24:37.671
2020-05-18 14:24:37.675 14:24:37: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
2020-05-18 14:24:37.675
2020-05-18 14:24:37.675 14:24:37: ERROR: function: sahara_main:924 Sahara protocol error
2020-05-18 14:24:37.676
2020-05-18 14:24:37.676 14:24:37: ERROR: function: main:303 Uploading Image using Sahara protocol failed
2020-05-18 14:24:37.676
2020-05-18 14:24:37.677
2020-05-18 14:24:37.677 Download Fail:Sahara Fail:QSaharaServer Failrocess fail
2020-05-18 14:24:37.681 Finish Get GPT
Click to expand...
Click to collapse
bernshood said:
Doesn't seem to be wroking with my ZTE Tempo X N9137. I trried it twice and got two septerate errors. The first was "ERROR: function: sahara_rx_data:247 Command packet length 1702240364 too large to fit" and the second was "ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes."
Click to expand...
Click to collapse
So I tested it on my N9137 and it’s working properly. Normally when it can’t get a hello from the device it means your driver is wrong. Sometimes windows defaults to the diagnostic driver instead of the Qdloader one and you need to change it in device manager.
On another note @alexenferman it might worth while to add to OP known working devices. I’ve tested and confirmed working on
ZTE Imperial Max (Z963U)
ZTE Tempo X (N9317)
ZTE Avid 4 (Z855)
ZTE Grand X View 2 (K81)
I will test on the ZTE Maven 3 once I get it’s battery charged
It's showing Qualcomm HS-USB QDLoader 9008 (COM4) both in Qfil and within Device manager. I reinstalled the driver and am still getting the errors. This is all happening after the steps Tools>Partition Manager>Ok
bernshood said:
It's showing Qualcomm HS-USB QDLoader 9008 (COM4) both in Qfil and within Device manager. I reinstalled the driver and am still getting the errors. This is all happening after the steps Tools>Partition Manager>Ok
Click to expand...
Click to collapse
Restart your phone in EDL mode again.
If you already did this, then it means that your driver is wrong. Try another driver from another source.
I'm assuming this also won't work on devices that shipped with older OS and were officially updated to Oreo?
I have an Axon 7 on Oreo and the normal thing is to regress them to unlock bootloader.
Anything for the ZTE Blade A462? It's based on the Snapdragon 210 SoC.
Tried on ZTE Zmax 2 (Z958) US Version (AT&T but unlocked) with Android 5.1. I had to use QFIL that comes with the latest QPST v2.7.480 to be able to successfully dump the partition data. However, there is no `/devinfo` partition. So I've no clue what to do from here.
RobboW said:
I'm assuming this also won't work on devices that shipped with older OS and were officially updated to Oreo?
I have an Axon 7 on Oreo and the normal thing is to regress them to unlock bootloader.
Click to expand...
Click to collapse
Yeah, it won't work on the Axon 7, I've asked for the article to be updated.
EonOfBlack said:
Anything for the ZTE Blade A462? It's based on the Snapdragon 210 SoC.
Click to expand...
Click to collapse
I haven't seen one for it, but you can try this one from the A460 you have a good chance of it working.
https://github.com/programmer-collection/zte/blob/master/BladeA460/prog_emmc_firehose_8909.mbn
ninegua said:
Tried on ZTE Zmax 2 (Z958) US Version (AT&T but unlocked) with Android 5.1. I had to use QFIL that comes with the latest QPST v2.7.480 to be able to successfully dump the partition data. However, there is no `/devinfo` partition. So I've no clue what to do from here.
Click to expand...
Click to collapse
Can you post a picture or a list of partitions you had?
deadman96385 said:
Can you post a picture or a list of partitions you had?
Click to expand...
Click to collapse
I dumped all partitions (except cache, system and userdata), and discovered the string ANDROID-BOOT! appeared 3 times in the "aboot" partition. The first time seems to be followed by ASCII string content, but the 2nd and 3rd time it is followed by a bunch of 00s. Should I be editing these?
ninegua said:
I dumped all partitions (except cache, system and userdata), and discovered the string ANDROID-BOOT! appeared 3 times in the "aboot" partition. The first time seems to be followed by ASCII string content, but the 2nd and 3rd time it is followed by a bunch of 00s. Should I be editing these?
Click to expand...
Click to collapse
No do not edit the aboot partition, you will brick it if you flash your modified one.
deadman96385 said:
No do not edit the aboot partition, you will brick it if you flash your modified one.
Click to expand...
Click to collapse
Thanks for the alert! Here are the screenshots showing my partitions
ninegua said:
Thanks for the alert! Here are the screenshots showing my partitions
Click to expand...
Click to collapse
This means that it might be stored in the rpm partition and I don't think it's possible to unlock it on your phone :crying:
Before I realized that I modified the wrong partition myself (aboot), I bricked my phone over 2 times. Thankfully, recovery was very easy but don't try that! It won't work.
Got it to work! But now I'm a little confused on how to actually get into the bootloader. There's an option in recovery to "reboot into the bootloader" but it looks like it just reboots like normal into the system. Sorry for my ignorance. On my Nexus 7 I use fastboot to flash twrp in the bootloader.
bernshood said:
Got it to work! But now I'm a little confused on how to actually get into the bootloader. There's an option in recovery to "reboot into the bootloader" but it looks like it just reboots like normal into the system. Sorry for my ignorance. On my Nexus 7 I use fastboot to flash twrp in the bootloader.
Click to expand...
Click to collapse
Read the tutorial first. You don't need to get into the BL.
deadman96385 said:
I haven't seen one for it, but you can try this one from the A460 you have a good chance of it working.
https://github.com/programmer-collection/zte/blob/master/BladeA460/prog_emmc_firehose_8909.mbn
Click to expand...
Click to collapse
Thank you sir, I will try.
Related
Hello devs,
recently i flash my ZUK Z1 with ZUI Rom with QFIL and my phone just does not boots up in neither fastboot nor twrp recovery, as good as dead.
Only thing i can see is com port is connected and while flashing the new stock rom the following error occured :
log details :
Programmer Path:C:\cm_12.1 qpst\prog_emmc_firehose_8974.mbn
Image Search Path: C:\cm_12.1 qpst
RAWPROGRAM file path: C:\cm_12.1 qpst\rawprogram0.xml
PATCH file path:C:\cm_12.1 qpst\patch0.xml
Image Search Path: C:\cm_12.1 qpst
RAWPROGRAM file path: C:\cm_12.1 qpst\rawprogram0.xml
PATCH file path:C:\cm_12.1 qpst\patch0.xml
Start Download
Program Path:C:\cm_12.1 qpst\prog_emmc_firehose_8974.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM3 -s 13:C:\cm_12.1 qpst\prog_emmc_firehose_8974.mbn 'Current working dir: C:\Users\Mathrudev\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\cm_12.1
16:45:34: ERROR: function: sahara_rx_data:194 Unable to read packet header. Only read 0 bytes.
16:45:34: ERROR: function: sahara_main:854 Sahara protocol error
16:45:34: ERROR: function: main:265 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
Finish Download
Need assistance urgently.
Thanks in advance.
Hi, everybody!
I dealt with one glitch, I used the utility of management of block devices. I have unsuccessfully chosen the device, I have formatted all sections, respectively, I have received a brick.
Who has an experience of restoration of the loader of specifically our device? It is impossible still independently... The device was in the "Qualcomm hs-usb qdloader 9008" mode, now in the "Qualcomm hs-usb diagnostics 900e" mode
Return device in Qualcomm hs-usb qdloader 9008 mode.
QFIL utilite from packet QPST says "ERROR: function: sahara_rx_data:194 Unable to read packet header. Only read 0 bytes."
How to win this error and return the device to life? I will be grateful for any help!
Log:
Start Download
Program Path:C:\IMAGE\prog_emmc_firehose_8953_ddr.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'D:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM21 -s 13:C:\IMAGE\prog_emmc_firehose_8953_ddr.mbn 'Current working dir: C:\Users\MyUser\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\IMAGE\prog_emmc_firehose_8953_ddr.mbn
23:04:08: ERROR: function: sahara_rx_data:194 Unable to read packet header. Only read 0 bytes.
23:04:08: ERROR: function: sahara_main:854 Sahara protocol error
23:04:08: ERROR: function: main:265 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
Finish Download
The dump from the unblocked phone is necessary for restoration of my phone. I ask to help with search of a dump Asus ZenFone 3 Zoom ZE553KL (my phone is 128Gb version of built memory).
Thanks to all responded!
My Phone wont turn on too. Have you fix yours?
Hello,
First of all sorry if this is not the correct category. I have a lenovo k5 play from which I forgot the unlock pattern. Normally I go in recovery mode and do a Hard reset. Unfortunately this phone does not have any Hard reset option, and I can use only the fastboot but the bootloader is locked and OEM also. I found this article which explains how to flash a qualcomm device with an EDL cable. Using an improvised EDL cable I was able to connect the device in qualcomm mode and got recognized by QFIL. Selecting the files and hitting download, the flash process fails with this error: "Download Fail:FireHose Fail FHLoader Fail:The system cannot find the file specified". I suspect that the firmware is not good, is my first time doing this. Is there anything I can do, maybe a firmware that is compatible with this device or another flashing software?'
This is the full log from QFIL:
Code:
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
SEARCHPATH:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM file path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\rawprogram0.xml
PATCH file path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\patch0.xml
Programmer Path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
Process Index:0
Image Search Path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM file path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\rawprogram0.xml
PATCH file path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\patch0.xml
Start Download
Program Path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Users\User\Desktop\Qualcomm_Flash_Image_Loader_v2.0.0.5\QSaharaServer.exe -p \\.\COM3 -s 13:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn 'Current working dir: C:\Users\User\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
16:02:07: Requested ID 13, file: "C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn"
16:02:07: 401572 bytes transferred in 0.234000 seconds (1.6366MBps)
16:02:07: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
16:02:07: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Download Fail:FireHose Fail FHLoader Fail:The system cannot find the file specified
Finish Download
Thanks.
Solved! I used another version of QFIL and it flashed successfully the firmware. I followed this tutorial https://forum.xda-developers.com/le-max-2/how-to/guide-hard-brick-fix-qualcomm-hs-usb-t3492949
please share this firmware with us ,.......
thank you
limiteddata said:
Hello,
First of all sorry if this is not the correct category. I have a lenovo k5 play from which I forgot the unlock pattern. Normally I go in recovery mode and do a Hard reset. Unfortunately this phone does not have any Hard reset option, and I can use only the fastboot but the bootloader is locked and OEM also. I found this article which explains how to flash a qualcomm device with an EDL cable. Using an improvised EDL cable I was able to connect the device in qualcomm mode and got recognized by QFIL. Selecting the files and hitting download, the flash process fails with this error: "Download Fail:FireHose Fail FHLoader Fail:The system cannot find the file specified". I suspect that the firmware is not good, is my first time doing this. Is there anything I can do, maybe a firmware that is compatible with this device or another flashing software?'
This is the full log from QFIL:
Code:
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
SEARCHPATH:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM file path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\rawprogram0.xml
PATCH file path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\patch0.xml
Programmer Path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
Process Index:0
Image Search Path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst
RAWPROGRAM file path: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\rawprogram0.xml
PATCH file path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\patch0.xml
Start Download
Program Path:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Users\User\Desktop\Qualcomm_Flash_Image_Loader_v2.0.0.5\QSaharaServer.exe -p \\.\COM3 -s 13:C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn 'Current working dir: C:\Users\User\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn
16:02:07: Requested ID 13, file: "C:\Users\User\Documents\k5play_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST\L38011_CN_OPEN_USER_Q00011.0_O_ZUI_3.7.033_ST_180413_qpst\prog_emmc_firehose_8937_ddr.mbn"
16:02:07: 401572 bytes transferred in 0.234000 seconds (1.6366MBps)
16:02:07: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
16:02:07: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Download Fail:FireHose Fail FHLoader Fail:The system cannot find the file specified
Finish Download
Thanks.
Solved! I used another version of QFIL and it flashed successfully the firmware. I followed this tutorial https://forum.xda-developers.com/le-max-2/how-to/guide-hard-brick-fix-qualcomm-hs-usb-t3492949
Click to expand...
Click to collapse
Do you mean using the "FlashOne1.9" instead of QFil ? But it only accept .zip file !?
I have been using QFil V2019, V2011 and V2005 but still failed !
Thanks
Qualcomm_Flash_Image_Loader_v1.0.0.2 did the job !
The shared ROM is CN (Chinese) version and the no GSM connection.
Still cannot find a global version after a lot googling...........
Switch To EDL fail
When the flashing process, there was an error
"Download Fail: Switch To EDL FailFailed to Switch to Emergency Download mode"
What should I do?
Use Qualcomm Flash Image Loader v1.0.0.2 -
this is the only version that works fine
cwm/twrp for K5 play
I had the bootloader being unlocked after receiving the unlock_bootloader.img file from Lenovo recently.
But I still cannot find a usable custom recovery (CWM or Twrp) from twrp.me nor unofficialtwrp.com.
Too bad..................
TWRP for K5 play L38011
An updated TWRP 3.3.0 for Lenovo K5 Play L38011 was found.
I installed this TWRP and then rooted by magisk 20.
TWRP link :
https://unofficialtwrp.com/update-unofficial-twrp-3-3-0-for-lenovo-k5-play/
I unfortunately flashed chinese rom without backup now no network is available.let me know if anyone finds a patch for it or global rom link please.
Obing said:
Qualcomm_Flash_Image_Loader_v1.0.0.2 did the job !
The shared ROM is CN (Chinese) version and the no GSM connection.
Still cannot find a global version after a lot googling...........
Click to expand...
Click to collapse
Let me know if u were able to fix network.i have same problem.
sorry, bad news
the machine became bricked after restoring by twrp..
I sent it back to service center (still under warranty period)
I had the phone back after a month with new IMEI
Will try to root it again at a later time
It's rather difficult to find much info for this phone except bad comments from users.
Hi! I have accidentally flashed the 5A Rom on my 7A rom. I was going to change my rom from a China Rom to a Global Rom. I have successfully unlocked the bootloader. However, I forgot that I purchased a 7A (oopsie xD) and instead downloaded the latest global fastboot rom for the 5A.
I was trying to reflash using MiFlashTool, but it asks for an EDL Authorization.. I also tried to flash using QFIL but to no avail as it keeps on throwing error that the header cannot be read.
I tried to bypass the EDL by downloading the oldest available fastboot rom for the 7A and used its firehose programmer file with the latest 7A rom and flashing it using QFIL. It has not shown the previous error I have mentioned, but another error has popped that it cannot find a file specified.
Any replies would be really appreciated.
Thanks!
EDIT: Here's the log file of the QFIL when trying to flash my phone using the programmer file of the Redmi 7A MIUI 10.2.4.0 Global Fastboot Rom.
If someone knows how to patch or force the programmer file to bypass the EDL Authorization, please help Thanks!
Code:
Validating Application Configuration
Load APP Configuration
COM:20
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\prog_emmc_firehose_8937_ddr.mbn
RESETSAHARASTATEEMACHINE:False
SEARCHPATH:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:True
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
AUTOPRESERVEPARTITIONS:False
PARTITIONPRESERVEMODE:0
PRESERVEDPARTITIONS:0
PRESERVEDPARTITIONS:
ERASEALL:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images
RAWPROGRAM file path: C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\rawprogram0.xml
PATCH file path:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\patch0.xml
Programmer Path:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\prog_emmc_firehose_8937_ddr.mbn
Process Index:0
Start Download
Program Path:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\prog_emmc_firehose_8937_ddr.mbn
***** Working Folder:C:\Users\Vaio\AppData\Roaming\Qualcomm\QFIL\COMPORT_20
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Users\Vaio\Downloads\xiaomi\QFIL-QualcommFlashImageLoader-v2.0.1.1\QSaharaServer.ex'Current working dir: C:\Users\Vaio\AppData\Roaming\Qualcomm\QFIL\COMPORT_20
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\prog_emmc_firehose_8937_ddr.mbn
22:52:46: Requested ID 13, file: "C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\prog_emmc_firehose_8937_ddr.mbn"
22:52:47: 455388 bytes transferred in 0.281000 seconds (1.5455MBps)
22:52:47: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
22:52:47: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
***** Working Folder:C:\Users\Vaio\AppData\Roaming\Qualcomm\QFIL\COMPORT_20
Download Fail:FireHose Fail:FHLoader Fail:The system cannot find the file specified
Finish Download
Image Search Path: C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images
RAWPROGRAM file path: C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\rawprogram0.xml
PATCH file path:C:\Users\Vaio\Downloads\xiaomi\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn_50db06715d\pine_images_V11.0.5.0.PCMCNXM_20200304.0000.00_9.0_cn\images\patch0.xml
bad
I am relatively new to flashing ROMs. I did have success with my old Nexus 6P. First I loaded Ubuntu Touch (clunky), then LineageOS 18 (poor performance), then LineageOS 17 (worked well), and finally Oreo 8.1 from eFoundation (completely degoogleized...works well). But then I decided to try LineageOS on my Lenovo Tab 4 8 (TB-8504F) and that didn’t go so well. Right now it will not shut down and all it will do is boot to fastboot mode. I can issue fastboot commands and boot into TWRP...I found 2 different versions of TWRP that apparently have been modified to work on the TB-8504 and tried both:
twrp-3.2.3-0-TB-8504x.img
twrp-3.3.1-1-TB8504.img
and I’ve tried 2 different versions of LineageOS
lineage-17.1-20210408-UNOFFICIAL-TB8504.zip
lineage-18.1-20220223-UNOFFICIAL-TB8504.zip
When I try to adb sideload one of these ROMs, TWRP gets stuck at
Patching system image unconditionally…
The attached images show the results of Advanced Wipe (system, cache, and data), Format Data, and ADB Sideload attempts.
After those failures I decided to try flashing a stock ROM using QFIL (yet another learning curve lol). I’ve only been able to find one stock ROM:
Lenovo_Tab_4_8_TB-8504F_USR_S001019_1909091114_Q12000_ROW_QPST
I have found several other links to stock ROMs but they pointed to non-existent pages or pages that said I wasn’t authorized to download. Here is the log I get when I try downloading in QFIL:
022-03-08 18:31:52.649 Start Download
2022-03-08 18:31:52.650 Program Path:C:\Users\xxxxxxxx\DeleteMe\LenovoTB-8504F\StockFlashingFiles\StockRom\Lenovo_Tab_4_8_TB-8504F_USR_S001019_1909091114_Q12000_ROW_QPST\Firmware\prog_emmc_firehose_8917_ddr.mbn
2022-03-08 18:31:52.652 ***** Working Folder:C:\Users\xxxxxxxx\AppData\Roaming\Qualcomm\QFIL\COMPORT_3
2022-03-08 18:33:22.708 Binary build date: Jun 25 2019 @ 03:16:15
2022-03-08 18:33:22.709 QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\xxxxxxxx\AppData\Roaming\Qualcomm\QFIL\COMPORT_3
2022-03-08 18:33:22.709 Sahara mappings:
2022-03-08 18:33:22.710 2: amss.mbn
2022-03-08 18:33:22.711 6: apps.mbn
2022-03-08 18:33:22.712 8: dsp1.mbn
2022-03-08 18:33:22.713 10: dbl.mbn
2022-03-08 18:33:22.713 11: osbl.mbn
2022-03-08 18:33:22.714 12: dsp2.mbn
2022-03-08 18:33:22.715 16: efs1.mbn
2022-03-08 18:33:22.716 17: efs2.mbn
2022-03-08 18:33:22.716 20: efs3.mbn
2022-03-08 18:33:22.718 21: sbl1.mbn
2022-03-08 18:33:22.719 22: sbl2.mbn
2022-03-08 18:33:22.720 23: rpm.mbn
2022-03-08 18:33:22.720 25: tz.mbn
2022-03-08 18:33:22.721 28: dsp3.mbn
2022-03-08 18:33:22.722 29: acdb.mbn
2022-03-08 18:33:22.723 30: wdt.mbn
2022-03-08 18:33:22.723 31: mba.mbn
2022-03-08 18:33:22.724 13: C:\Users\xxxxxxxx\DeleteMe\LenovoTB-8504F\StockFlashingFiles\StockRom\Lenovo_Tab_4_8_TB-8504F_USR_S001019_1909091114_Q12000_ROW_QPST\Firmware\prog_emmc_firehose_8917_ddr.mbn
2022-03-08 18:33:22.725
2022-03-08 18:33:22.726 18:33:22: ERROR: function: sahara_rx_data:276 Unable to read packet header. Only read 0 bytes.
2022-03-08 18:33:22.728
2022-03-08 18:33:22.729 18:33:22: ERROR: function: sahara_main:982 Sahara protocol error
2022-03-08 18:33:22.730
2022-03-08 18:33:22.730 18:33:22: ERROR: function: main:320 Uploading Image using Sahara protocol failed
2022-03-08 18:33:22.731
2022-03-08 18:33:22.732
2022-03-08 18:33:22.733 Download Fail:Sahara Fail:QSaharaServer Failrocess fail
2022-03-08 18:33:22.733 Finish Download
I've also attached this log as a text file, thinking that may be easier to read .
Any help resolving this would be greatly appreciated!
Thanks,
Rich
I'm still hoping that someone can help me out with this, so I'm going to give this a bump. Any ideas?
Thanks,
Rich
Hey, just saw this post now. I am having exactly the same issue with the LineageOS and Ressurection Remix OS images. I was able to restore to stock using the Lenovo Restore and Smart Assistant app.
I was able to flash the crDroid 6.x image however and I am giving that a try. Might experiment getting one of the other installed later.
justinbyoung said:
Hey, just saw this post now. I am having exactly the same issue with the LineageOS and Ressurection Remix OS images. I was able to restore to stock using the Lenovo Restore and Smart Assistant app.
I was able to flash the crDroid 6.x image however and I am giving that a try. Might experiment getting one of the other installed later.
Click to expand...
Click to collapse
Thanks so much justinbyoung! This is obviously just a cheap tablet and doesn't mean that much to me, especially since I managed to crack the screen a couple of years ago. But it's a great one to learn on. Based on your post I downloaded and installed the Lenovo Restore and Smart Assistant app and was finally able to get back to the stock rom.
Thanks!
Rich