So I was dumb enough to brick my OT 5038X by flashing boot image via fastboot. I'm gathering all the info I can and I'll be posting my progress here.
If you're looking for a root, just download mobogenie on PC, than KingRoot app on your phone. You'll be able to have SU in ROM Toolbox.
Here are some pictures, and what got my attention:
Is there any chance of unbricking my phone? I can't get any info on this, just a lot of people with the similar problems as me
Main problem we have here is that SP flash tool won't download. It reads back, but download is impossible, cause device disconnects when you try downloading. I tried without a battery, with a battery, with volume key down, with volume key up, and all possible hardkey combiations. I think that by soldering some of these soldering points together I can get it to work. I'll try measuring pins with multimeter for safety, so i don't burn something on my motherboard, I'll also try finding jtag pins that are in use. But I'll have to buy a "smarter" multimeter, so i dont get parallel port burnt, or phone mobo again. I have few multimeters, but all of them are cheap crappy chinese ones, and they don't read correctly.
According to MT6582 datasheet, there are 4 jtag pins, so there is just one unused pin. Hopefully I'll be able to write a program in C that will allow me to listen to the parallel port data so i can indentify which pins do what.
blazeaster said:
Main problem we have here is that SP flash tool won't download. It reads back, but download is impossible, cause device disconnects when you try downloading. I tried without a battery, with a battery, with volume key down, with volume key up, and all possible hardkey combiations. I think that by soldering some of these soldering points together I can get it to work. I'll try measuring pins with multimeter for safety, so i don't burn something on my motherboard, I'll also try finding jtag pins that are in use. But I'll have to buy a "smarter" multimeter, so i dont get parallel port burnt, or phone mobo again. I have few multimeters, but all of them are cheap crappy chinese ones, and they don't read correctly.
According to MT6582 datasheet, there are 4 jtag pins, so there is just one unused pin. Hopefully I'll be able to write a program in C that will allow me to listen to the parallel port data so i can indentify which pins do what.
Click to expand...
Click to collapse
Hello, i have one small question. How did you flash the boot img through fastboot. I want the extact command. Also if you have adb then you isn't hard bricked because the adb-daemon boots with the kernel(bootimg).
Generally the jtag is for unbricking hard-bricked devices. You know with damaged bootloaders (IBL, SBL etc). And usually the points are close to the battery connector or behind the battery connector. And think these are your jtag point. There should be some GND points that's why you have 7 pins. You can identify which pins are GND with a multimeter.
And maybe is easy to unbrick your phone vio recovery mode. Have you tried to flash a full rom or a boot img?
root-expert said:
Hello, i have one small question. How did you flash the boot img through fastboot. I want the extact command. Also if you have adb then you isn't hard bricked because the adb-daemon boots with the kernel(bootimg).
Generally the jtag is for unbricking hard-bricked devices. You know with damaged bootloaders (IBL, SBL etc). And usually the points are close to the battery connector or behind the battery connector. And think these are your jtag point. There should be some GND points that's why you have 7 pins. You can identify which pins are GND with a multimeter.
And maybe is easy to unbrick your phone vio recovery mode. Have you tried to flash a full rom or a boot img?
Click to expand...
Click to collapse
I tried, but I don't have factory update, and my phone is running factory recovery. I know my phone isn't hardbricked, but I can't unbrick it, so JTAG is an option. I flashed bootimg with "fastboot flash boot boot.img"
OK... So I didnt miss being a idiot today again. Now I dont have ADB and recovery anymore. I flashed recovery with MTK droid tools generated image. But I did realize that it may be possible to unbrick this phone with SPFlash tool. This is the error I get:
Code:
06/07/2015 20:43:22.043 FlashTool[4772][2988][DEBUG]: NandLayoutParameter::CompareIsNandLayoutMatched(): NOT MATCH: load item key(RSV_OTP), value(0xffff0200), target item key(OTP), value(0xffff0200).(.\NandLayoutParameter.cpp,139)
blazeaster said:
I tried, but I don't have factory update, and my phone is running factory recovery. I know my phone isn't hardbricked, but I can't unbrick it, so JTAG is an option. I flashed bootimg with "fastboot flash boot boot.img"
Click to expand...
Click to collapse
First of all, jtag generally it's an expesive and a more difficult way to unbrick your phone. Also with jtag you don't flash the whole firmware. You only upload to the memory a bootloader which handles the update through sp flash tool let's say. And you flash your firmware.
Also if you find a factory pdate you can flash it through recovery. Was the boot.img faulty?
Boot image I used for flashing was for 5038D i think, there's not much of a difference between these two phones, but still it was enough to f*ck up my phone. I managed to get SP flash tools to the next level (luckily I have valid scatter file), but now I'm getting an error :
Anyway I want to find out where and what are the exact pins for JTAG, so I can help people who got hard bricked. It's not expensive if its possible to do it without extra tools. I hope i can do something by listening to paralell :/ I mentioned multimeter, I want to check if there's an power pin on jtag, so i dont get phone or parallel port burned.
Also there is no stock rom available for download, but there is source code on alcatel site.
blazeaster said:
Boot image I used for flashing was for 5038D i think, there's not much of a difference between these two phones, but still it was enough to f*ck up my phone. I managed to get SP flash tools to the next level (luckily I have valid scatter file), but now I'm getting an error :
Anyway I want to find out where and what are the exact pins for JTAG, so I can help people who got hard bricked. It's not expensive if its possible to do it without extra tools. I hope i can do something by listening to paralell :/ I mentioned multimeter, I want to check if there's an power pin on jtag, so i dont get phone or parallel port burned.
Also there is no stock rom available for download, but there is source code on alcatel site.
Click to expand...
Click to collapse
I have done some research for jtag recently and usually you want a dev board to access the cpu of the phone. Maybe you can do it with the parallel but I'm not sure. With a dev board it's easier. Also we can make our dev board for jtaging and we can load on it openocd. It's a very good software fordebugging and jtaging.
Also there are many cheap boards in the web for example bus pirate (35$).
And there no Vcc pins or power pins in jtag. You power your phone from battery or from external power. There only TDI, TDO, TMS, TCK, TRST(optional).
root-expert said:
I have done some research for jtag recently and usually you want a dev board to access the cpu of the phone. Maybe you can do it with the parallel but I'm not sure. With a dev board it's easier. Also we can make our dev board for jtaging and we can load on it openocd. It's a very good software fordebugging and jtaging.
Also there are many cheap boards in the web for example bus pirate (35$).
And there no Vcc pins or power pins in jtag. You power your phone from battery or from external power. There only TDI, TDO, TMS, TCK, TRST(optional).
Click to expand...
Click to collapse
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.
blazeaster said:
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.
Click to expand...
Click to collapse
I'm happy to hear that you can unbrick your phone. But it would be nice to do some research how to jtag different phones. I know that it is difficult but as I understood your a hardware guy and you can solder wires to phones etc. So if you want I can help you to start a R&D thread with information...
Thanks for all the info. I'll order a bus pirate, regardless of this method I'll try with the parallel port. I definitely need one, cause I mess around with hardware a lot. I'm also willing to learn, so message me if you will with some interesting material. We can start a thread, why not. But let me do something concrete first.
blazeaster said:
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.
Click to expand...
Click to collapse
progress on this?? Have you tried to back it up??? can you upload the back up to help others.
[email protected] said:
progress on this?? Have you tried to back it up??? can you upload the back up to help others.
Click to expand...
Click to collapse
I would like to know also if there has been a solution.
Pop d5 5038a no stock frimware in the web
Alcatel4037N said:
I would like to know also if there has been a solution.
Click to expand...
Click to collapse
you cannot find the stock firmware of this phone anywhere. if you bricked this phone you cannot unbricked it. none has ever unbrick this damn phone..... mine is just sitting in my cabinet still bricked untill now
[email protected] said:
you cannot find the stock firmware of this phone anywhere. if you bricked this phone you cannot unbricked it. none has ever unbrick this damn phone..... mine is just sitting in my cabinet still bricked untill now
Click to expand...
Click to collapse
What about Furious Gold? h t t p : // w w w .furiousgold . com /en/ module/ mtk-code-reader
The phone is not hardware-brick, but is lock by software. There got to be a way to bypass or pause the software for locking the USB port. I do not know if it could be possible but connecting the on-board memory to a USB adapter reader with the phone completely off. I am sure there is a way!
Can i do anything if my lg g6:
can't access fastboot and download mode
won't load into rom (they may not be one afterall xD)
is only stuck on lg g6 thinq logo
pc doesnt see the device when plugging in
only thing i can do is hold power and volume- buttom to do a factory reset which is the way to access twrp (which is not loading in)
bootloader is unlocked
and ideas or throw this trash?
I have the same situation like this Would love someone to express their opinions on the situation.
Kerres said:
Can i do anything if my lg g6:
can't access fastboot and download mode
won't load into rom (they may not be one afterall xD)
is only stuck on lg g6 thinq logo
pc doesnt see the device when plugging in
only thing i can do is hold power and volume- buttom to do a factory reset which is the way to access twrp (which is not loading in)
bootloader is unlocked
and ideas or throw this trash?
Click to expand...
Click to collapse
BubisUK said:
I have the same situation like this Would love someone to express their opinions on the situation.
Click to expand...
Click to collapse
You guys can still unbrick by putting the phone in 9008 mode and using the QFil method mentioned here:
https://forum.xda-developers.com/lg-g6/how-to/lg-g6-unbrick-method-t3935924
(Thank the OP in the thread.)
OP above does warn that the method will not work for T-Mobile version of g6, H872.
Do make sure that phone is detected in 9008 mode when you connect to Windows PC. If it is not detected, you might have to put phone in 9008 mode by grounding the connection point on motherboard. You will need to remove the back glass, some screws and and connect the connection point located below flash for camera to the ground plate in phone as shown here:
https://forum.xda-developers.com/lg-g6/how-to/lg-g6-testpoints-edl-mode-9008-t3916962
(Thank the OP in the thread.)
Let's hope your phones are already detected in 9008 mode on PC so you don't have to open the back of phone. This is a bit complicated process and not many will be able to help you if you get stuck with anything, so best would be to read through the posts and making sure you understand all the steps before proceeding and asking OP in those threads if you get stuck. I have only used this method once and it worked for me. There is no visible indication when phone enters EDL mode by short circuiting the board. Have a device manager window open and phone connected to the PC via USB when you attempt short circuit so you know once it enters 9008 mode. Good Luck.
Android# said:
You guys can still unbrick by putting the phone in 9008 mode and using the QFil method mentioned here:
https://forum.xda-developers.com/lg-g6/how-to/lg-g6-unbrick-method-t3935924
(Thank the OP in the thread.)
OP above does warn that the method will not work for T-Mobile version of g6, H872.
Do make sure that phone is detected in 9008 mode when you connect to Windows PC. If it is not detected, you might have to put phone in 9008 mode by grounding the connection point on motherboard. You will need to remove the back glass, some screws and and connect the connection point located below flash for camera to the ground plate in phone as shown here:
https://forum.xda-developers.com/lg-g6/how-to/lg-g6-testpoints-edl-mode-9008-t3916962
(Thank the OP in the thread.)
Let's hope your phones are already detected in 9008 mode on PC so you don't have to open the back of phone. This is a bit complicated process and not many will be able to help you if you get stuck with anything, so best would be to read through the posts and making sure you understand all the steps before proceeding and asking OP in those threads if you get stuck. I have only used this method once and it worked for me. There is no visible indication when phone enters EDL mode by short circuiting the board. Have a device manager window open and phone connected to the PC via USB when you attempt short circuit so you know once it enters 9008 mode. Good Luck.
Click to expand...
Click to collapse
You ar a star I will try using the method you linked here, thank you and have a nice day
Greetings Guys,
How`s doing
Yesterday I have completely bricked my Nokia 6 (Ta-1021), while I was trying to mode the modem image using QPST & QXDM,
now it only shows as HS Qualcomm 9008 in Device manager, with no signs of life, I have read somewhere (not remembering where actually) that we can revive dead ta-1021,
I own EasyJrag plus Emmc Programmer but I couldn`t find any ISP direct connection on the internet ( maybe the data0 line is going underneath the CPU?).
anyway, is there any way to flash the phone back using Qualcomm 9008 EDL mode? the firmware I found on the internet are lacking Firehorse.mbn,rawprogram0.xml and patch.xml files.
thank you in advance for any help.
SyriaN-HuX said:
Greetings Guys,
How`s doing
Yesterday I have completely bricked my Nokia 6 (Ta-1021), while I was trying to mode the modem image using QPST & QXDM,
now it only shows as HS Qualcomm 9008 in Device manager, with no signs of life, I have read somewhere (not remembering where actually) that we can revive dead ta-1021,
I own EasyJrag plus Emmc Programmer but I couldn`t find any ISP direct connection on the internet ( maybe the data0 line is going underneath the CPU?).
anyway, is there any way to flash the phone back using Qualcomm 9008 EDL mode? the firmware I found on the internet are lacking Firehorse.mbn,rawprogram0.xml and patch.xml files.
thank you in advance for any help.
Click to expand...
Click to collapse
Is your issue resolved?
The official way to unlock the bootloader has been unavailable for just over a year, since LG ended their developer program as of 01/01/2022 and you now can't apply for an unlock file anymore.
Searching for a work-around I found this: https://drfone.wondershare.com/unlock/lg-bootloader-unlock-how-to.html
I have tried as best I can to follow these instructions and fail because I can't get my device to enter Qualcomm EDL 9008 mode by any keypress combination, or ADB or fastboot command from OS (Windows and Linux tested). I suspect my edition of the phone doesn't have EDL, or the method of accessing it is not correct in all instructions I've seen. I can get in to fastboot, and LG download mode (which shows in device manager as LGE AndroidNet USB Serial Port), but not Qualcomm ADL 9008 mode which should show in device manager as Qualcomm HS-USB QDLoader 9008.
I'd rather not brick my device, but it is a spare, and I thought I'd try and soup it up with a newer AOSP-Extended before maybe gifting to my partner.
AND!! I'm suspicious of the instructions in the first place! At the bottom, it advertises a piece of software to something related. As a Windows technician in my day job, I see this too often, can't solve bluescreen error 0x123abc45 just download this trialware to fix your PC!!
Try "adb reboot edl" from adb, anyway yes that site is not good
Hey, thanks for coming back to me.
I have tried that, but have just repeated right now to remind myself the outcome, which is, phone reboots as normal. Does not enter EDL mode. Windows and Linux.
Cheers
Anne-d'Royd said:
I suspect my edition of the phone doesn't have EDL, or the method of accessing it is not correct in all instructions I've seen
Click to expand...
Click to collapse
Isn't the method to access EDL on the G6 through shorting two pins on the mobo?
LG G6 TestPoints for EDL Mode (9008)
Simple af. Just short them. For incase that doesn't work;
forum.xda-developers.com
Also, that guide is just a re-worded one for the LG G7 One, not the G6, which use different processors. An engineering bootloader for the LG G6 has not leaked yet, and likely will not leak since it's been 6 years.
LG G7 One Bootloader Unlock [How-to]
Disclaimer: Do this at your own risk, blah blah blah. Brick your phone its on you.. Just a quick tutorial on bootloader unlocking the G7 One. Lots of the info in here can be found in other areas of XDA. *****Read full post before...
forum.xda-developers.com
Hey thanks for the input!
I'm reluctant to go in since the glass is splintered on the back of the unit, that's the main reason I changed my phone nearly 2 years ago.
There are enough varying instructions of there to suggest that EDL on that phone can be accessed by I think five methods.Two methods involve commands from PC, one method is button press combinations whilst connected to PC, another is a special EDL cable and then lastly, the test points.
The guides I've seen explaining the keypress routine says it works for a range of LG phones with qualcomm chips, including the G6 but I have they're wrong. Example:
Dont bother with dr phone. I previously used it to backup my phone. It wanted me to pay to restore but all it did was create a zip of my internal storage.
I think it is highly unlikely that they have a secret way of unlocking one of the hardest to unlock bootloaders on a phone.