How To UnBrick A Hard Bricked Moto X
Hii , First of all I wanna thanks to this awesome scrpit by @s5610 who brought my phone from dead to alive , I think i am the first guy to unbricked the hardbricked phone using this script lol , My phone was hardbricked because i was testing my kernel and entered wrong path in partition due to which i got hard bricked i was worried for my phone , Service Center was asking for 7k in Indian Rupees , i was hopeless then i gave a try to this method , followed all steps written here and then finally i entered to fastboot menu of 30.B7 Kitkat As i was using 30.B7 Bootloader earlier and then i flashed My gpt.bin and S-partition and flashed my stock rom voilla !! and my phone booted the aim was to share this post was this method was on page 42 and only less guys have seen this post , so i created a new thread regarding this
All Credits Goes to - @s5610
s5610 said:
Unbricking Guide for any Moto X Gen 1 (wire trick)
Download, and unpack supplied zip to any disk, C: or D:, in root folder. Install driver by launching Qusb.drv.inst.msi, then open Windows' Device Manager, and see if you got "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
If yes, you see it, go to software part below. If it's not there, a full disassemble of the phone is needed to get close to back side of motherboard (google for "iFixit Teardown Moto X Guide" for step-by-step instruction).
So, when you are inside, disconnect the battery first. No need to pull it out, it's glued. Now get to back side of motherboard, and very very gently gain access to the lower left corner of ARM+DRAM shield (see picture). I've done it with Stanley knife. Also you can use miniature nippers - but very carefuly! Once you get access to inner space of shield, use tiny wire to short special pin to the ground (see picture), then connect USB cable, and in the moment when you see "QHSUSB_DLOAD" device (or "Qualcomm HS-USB QDLoader 9008" if driver is installed) pop out in Windows' Device Manager, quickly remove the wire. The goal is to have "Qualcomm HS-USB QDLoader 9008" in "COM & LPT ports" section of Device Manager. If it is achieved, we are done with hardware, and move on to soft part.
Now software part. Go to unzipped C:\Python27 folder, launch bat-file, and wait until finish:
RUN_blank_bootloader_flash.bat
(if you got error like "No data read from USB..." etc, just skip to next step)
Next launch either
- .Boot_KK_4.4.2_B4.exe,
or .Boot_KK_4.4.4_B7.exe,
or .Boot_LP_5.0.2_BC.exe,
or .Boot_LP_5.1.0_BD.exe,
or .Boot_LP_5.1.0_BE.exe
- depends on Android version your phone has last time. If you don't know what you need, begin with first one.
Wait 10 seconds, then launch next bat-file, and wait until finish:
RUN_moto_x_bootloader_flash.bat
Phone should go into fastboot mode! If it doesn't, repeat previous step trying higher version. But don't try to flash BC, BD, and BE, if you didn't install Lollipop on this phone!
OK. Disconnect the USB cable, connect the battery, connect again USB cable (fastboot don't work, if don't see battery). Launch next bat-file:
RUN_gpt.bin_flash.bat
The phone will get in fastboot, ready to be flashed by appropriate firmware. If it is official RSD (SBF), delete from xml strings consisting gpt.bin and motoboot.img for safe flashing.
...
Download link: http://www.mediafire.com/download/3e38rr3wy28s071/Moto.X.Unbrick.zip
This guide was brought to you by s5610
Links that this guide is based on (where I took files and general idea):
http://forum.xda-developers.com/droid-ultra/general/droid-ultra-maxx-brick-recovery-t2830806
http://forum.xda-developers.com/mot...-moto-x-t2629057[/url[/QUOTE][/QUOTE][/QUOTE]
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Not sure if additional thread is necessary )
UPDATED
The best resurrection method for Moto X is here.
Can Someone re-upload that file? Thanx!
Please upload the mediafire link...
Plz plz.. I have bricked my phone. It seems that this procedure will work for me. Please upload and save my life.
even i have bricked my moto x...need a working download link..please.
https://drive.google.com/file/d/0B3EDzuzDCakzdWxHa2RWVDJhRXc/view?usp=sharing
Cannot install qsub.drv.inst.msi on my windows 10...says failed to attribute and failed to delete qcusbser.sys.
Thanks
Can we write the full firmware through Qload 9008 mode ???
HI I have a question. I bricked my gf's phone while trying to unlock the bootloader and I am not able to turn the phone on. Only positive feedback is that when I plug it in to the computer, I can hear a notification on my computer. I followed your guide. I can see the "Qualcomm HS-USB QDLoader 9008" device (it is "QHSUSB_DLOAD" without driver installed) located in "COM & LPT ports" section.
Then I followed your software instructions. When I run the RUN_blank_bootloader_flash.bat, I get the following
Code:
Starting qflash!
Executing command qflash.exe -com3 -ramload MPRG8960.hex -mbn 33 MSM8960_bootloa
der_singleimage.bin -v -o
Motorola qflash Utility version 1.3
qflash - com3 is an invalid port
Invalid COM port enteredBlank flashing successful
Device will now enumerate in fastboot mode
Then, I followed the rest of the instructions by trying each .Boot .exe and waitng 10 seconds and finally with RUN_moto_x_bootloader_flash
but I am getting the following error.
Code:
C:\Users\cxx\Desktop\Python27>python qdload.py MPRG8960.bin -ptf _boot\partiti
ons.txt -pt
QDLoad utility version 1.2 (c) VBlack 2014
Found TTY port: com3
Traceback (most recent call last):
File "qdload.py", line 815, in <module>
main()
File "qdload.py", line 762, in main
tty = openTTY(args.ttyPort)
File "qdload.py", line 174, in openTTY
tty = serial.Serial(port=tty_path, baudrate=115200)
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 38, in __init
__
SerialBase.__init__(self, *args, **kwargs)
File "C:\Python27\lib\site-packages\serial\serialutil.py", line 282, in __init
__
self.open()
File "C:\Python27\lib\site-packages\serial\serialwin32.py", line 66, in open
raise SerialException("could not open port %r: %r" % (self.portstr, ctypes.W
inError()))
serial.serialutil.SerialException: could not open port 'com3': WindowsError(2, '
The system cannot find the file specified.')
C:\Users\cxx\Desktop\Python27>pause
Press any key to continue . . .
please help.
Thanks.
Device Shows As USB Input
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks
shengslogar said:
Hey all,
I'm having trouble getting my Windows 7 machine to recognize my XT862 as a QHSUSB device. Windows does recognize it, just as a "USB Input Device" -- very generic, I know -- so I don't think I have to do any motherboard hacks (and I sure hope not!). However, as it won't let me update the driver either, so I can't do anything. Also, when I plug it into my Mac, it does pop up as a Qualcomm Composite Device. Since something's obviously still ticking, where did I go wrong?
Thanks
Click to expand...
Click to collapse
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.
liveroy said:
Put it on a charger for 5-6 hrs and see if that will help.I had this same problem but on a Moto G and charging it up helped.
Click to expand...
Click to collapse
Will do! I think I did try charging it awhile ago, but I'll give it another shot.
can my phone be unbricked?? here is the error log:
RAMLOADER VERSION: PBL_DloadVER2.0
------------------------------------------------------
DEVICE INFORMATION:
------------------------------------------------------
Version : 0x8
Min Version : 0x1
Max Write Size: 0x600
Model : 0x90
Device Size : 0
Description : Intel 28F400BX-TL or Intel 28F400BV-TL
------------------------------------------------------
Using passed in packet size, changing from 0x600 -> 0x600
EXTENDED_LINEAR_ADDRESS_REC @ 0x2a000000
Write 65536 bytes @ 0x2a000000
100EXTENDED_LINEAR_ADDRESS_REC @ 0x2a010000
Write 11840 bytes @ 0x2a010000
100START_LINEAR_ADDRESS_REC @ 0x2a000000
EOF_REC
Sleeping for 3s
sdl_hello() - Invalid response: 7e030003331b7e
sdl_hello() - This is a NAK response from ROM code, which means the device has
een reset back to blank flash mode. Usually this is caused by power supply issu
s. Please try again with battery eliminator if it persists
Unexpected target reset, bailing out after 2 retries
I am trying to install the drivers and it will show up as qhsusb_dload for about 5 seconds then reverts back to Relink HS USB QDloader 9008. Should i try the wire trick? It will say that the Qhsusb drivers are installed but always changes.
Related
Hi All --
Bought my touchpad from the last Ebay firesale (REFURB units). As such, my device is out of warranty with HP.
Device has been running very well with moboot/daily ICS flash/WebOS until a couple weeks ago when I left the tablet sitting for probably the better part of a week without being plugged in to the charger.
Presently, my touchpad does not power on at all with any charger I try and it is 100% unresponsive to every combination of press/hold buttons during attempted power on. I purchased a replacement battery with no change, I charged both of my batteries with an external power supply (at proper voltage/currents) and no response from touchpad.
when I connect touchpad to computer and boot it with PWR+volume down, it is detected as QDLoader. I found the Qualcomm drivers and have them installed. Touchpad is repeatably detected in Loader/download mode with PWR+Volume down.
I found QPST -- a software utility package from Qualcomm used to work with several devices, including the touchpad. QPST's "SOFTWARE DOWNLOAD" module detects the touchpad as a device in download state. The software gives me the option to backup/restore the device and it looks as though it would perhaps be able to bring my touchpad back to life.
I know I'm not the only one with this problem -- i've read hundreds of threads about touchpads "stuck" in Loader/Download mode. If I had a Qualcomm-formatted dump, I'd try restoring it to my device and properly document how to recover from brick to functional (if it works..)
Is there any way someone with a working touchpad would consider booting your TP into QDLoader mode (power + volume down) and doing the dumps with the "Software Download" module from QPST? There is a "backup" tab that creates a QCN file that it looks like I can restore to my touchpad and bring it back to life.
Anyone tried this already? If not -- would someone be onboard to help?
I downloaded the most recent build of QPST i could find from this thread on PPCGeeks and it recognizes my touchpad:
(UGH - newly registered here...not enough posts to submit external links. PM me for the URL to this)
This is a direct link to the QPST version i'm using:
(UGH - PM me for the URL to this)
Here's a link to the QDLoader drivers (64 bit) and I know the 32 bit versions are running around...i can find them if you'd like to help me but can't locate the right drivers.
(newly registered here...not enough posts to submit external links. PM me for the URL to this)
To summarize what I'm asking and be 100% clear, here's the drill
1) backup with rom-manager/clockworkmod or whatever
2) wipe data/cache
3) boot touchpad in Loader mode (pwr+volume down)
4) connect touchpad to computer, run SOFTWARE DOWNLOAD module of QPST -- click backup tab -- do the backup, send the backup file my way or post on forum.
5) back into clockworkmod -- restore the backup from step 1.
This would give me a clean qualcomm-formatted backup that would contain zero of your personal data or account data. You could restore right back to your functional ROM with no mess and no fuss.
Final note -- if someone has already tried this and succeeded (or failed) please let me know!
Thanks guys!
I'd be willing to do this for you, absolutely. Toss me a PM with the links, and I'll get on it today or tonight.
PM Sent! Many thanks!
Give me a couple days to get my computer back up and running and I'll get this for you. Sorry I haven't replied, but I've had some serious technological issues of late.
Not sure if this is going to work.
Got my hands on another touchpad and booted it into loader mode to try this --- when i went to do the download, QPST said the device was in "download" mode rather than "diagnostics" mode and wouldn't pull the image.
My touchpad might be dead and out for the count. Frustrating.
I'm wondering if a USB Jig would work with getting the TP to pop into download mode. If that's what you're trying to achieve here..
Like with Samsung Devices...
http://forum.xda-developers.com/showthread.php?t=1522478
I bought a professionally made jig for $5 to bring my Samsung Captivate back to from the dead.
If not I apologize for the intrusion..
=o)
Hmm -- well it's for sure worth a shot, i had seen some other people referencing a "jig" for unbricking. time to dig in and test one.
Other thing I've seen is that there are threads about jtag points on the touchpad....but i haven't seen anything about jtag software. Might have to dig that up too.
Any and all ideas are welcome
tekrhino said:
I'm wondering if a USB Jig would work with getting the TP to pop into download mode. If that's what you're trying to achieve here..
Like with Samsung Devices...
http://forum.xda-developers.com/showthread.php?t=1522478
I bought a professionally made jig for $5 to bring my Samsung Captivate back to from the dead.
If not I apologize for the intrusion..
=o)
Click to expand...
Click to collapse
Matt, any more development on this?
I have the exact same problem. Had given up on the software front and have just taken the battery out to attempt a manual recharge on an external charger however from your experience of buying a new battery it sounds like that isn't the problem.
Would be awesome if we could restore with the qualcomm software. My touchpad is bricked so probably not much help but if you want me to help test anything I will gladly as the touchpad is in the bin if I can't fix it.
have any of you guys even tried novacom to rebuild?
thats the most critical tool for repairing/diagnosing/repartitioning the TP...QPST is fine and well/necessary, but thats just a driver for the TP to communicate with the PC when in diag/DL mode
post or PM and ill help if possible, similar problems happened to me twice (1-black screen, "no charge, 2-boot loop with no DL mode) and ive recovered each time
Solidus, thanks for the offer of help.
When I connect my touchpad to the PC novacom does not recognise that a device is connected. When I press the volume button the PC now brings up found new device but it is only the QDLoader and again no webos device detected by novacom.
I'm not really sure what steps I need to take to get novacom to interface with the dead TP.
Just to recount the TP is completely dead. Have tried every method of charging including a touchstone and 4 different usb chargers and the PC. Have tried all possible button combinations to no avail.
Had a similar dead TP problem before but managed to bring it back on the the 'Power + 10x Home Button' fix.
Similar problem, need help
So, I seem to have a similar problem with the whole Touchpad issue. I've tried connecting to the wall charger and leaving it for some time, but to no avail. Connecting to my computer and using the Power+Home+Up volume button combination places the device as a "Palm" device in my device manager, but any attempt to use WebOS doctor or anything of the sort says there is nothing connected. I've tried updating the drivers, but my computer doesn't let me update them. When using the Power+Home+Down volume button combination, the Touchpad boots as as a "Qualcomm HS-USB QDLoader 9008" device which loading through QPST yields no results either. I'm not sure what other approach to go to, and any other help would be greatly appreciated.
you're in better shape than me if yours shows up as "palm" -- you should be able to get WebOS Dr. to find it and play nice.
I've made no progress to date.
Hi mattvirus,
I have a similar issue with my touchpad and would like to help. I have Windows XP, so I need the 32-bit version of the qualcomm drivers, but can't locate them. The 64-bit versions are easy to find, but I don't have a 64-bit os on any of my machines yet. If you can direct me where to find them as well as the other software you mentioned in previous posts (and couldn't post the links), I can get started. I have access to a working touchpad as well as my possibly bricked one and I'm convinced its not the battery, but a boot issue. After charging, I've been able to bring up the question mark battery logo, which appears to be full brightness, and it stayed on for 4 and a half hours. I can get into palm mode (which is not palm novacom) with pwr+volup+home and into qhsusb_dload mode with pwr+voldn+home.
Thanks
I'll do some digging to see if I can find the 32bit drivers for you. I've all but given up on my touchpad at this point
Hi,
I've got a Pre3 stuck in QDL (Qualcomm Download Mode) probably due to a BootLoader corruption.
The CPU of the Pre3 is the same in the TouchPad (in fact not really but both use the same CPU TYPE) MSM7x30 so we are in the same boat !
After a lot research i found that it can be one of the BootLoader parts that can be the cause of the loop in QDL.
I found the files needed in the webosdoctor jar for my phone : partition.mbn, dbl.mbn, amss.mbn and osbl.mbn.
In QPST you need a BootLoader for the MSM7x30 (this one to be able to flash the files) the Pre3/TouchPad are an eMMC device so it must be called EMPRG7x30.HEX
(E for Emergency when device is in QDL, M for MMC, PRG is common and our CPU TYPE is 7x30)
I found that file (MPRG7x30.HEX is the same file as EMPRG7x30.HEX) on the web in a firmware package for another phone ... but ... in QPST i probably doing something wrong it give me an error :
QPST 2.7-366 Software Download
1. In Software Download tab if choose my EMPRG7x30.HEX
2. In Multi-image tab i choose the folder with my *.mbn files, i select Sec Boot 2.0 as Boot System, i check Use Emerg. Host D/L
3. I press start ... and QPST answer Could not open flash programming file
Update 11 sept 2012
Log files are friends, it gave what was behind the error : QPST's looking for a bootloader in the same folder as the mbn files and it must be EMMCBLD.HEX or eEMMCBLD.HEX (if Use Emerg. Host D/L is checked).
So i rename MPRG7x30.hex to EMMCBLD.HEX and try again ... it doesn't works but go furtherer !
2012/09/11 19:07:41.300 StartSB2Download
2012/09/11 19:07:41.305 Begin SB2.0 Software Download
2012/09/11 19:07:41.305 Skip Reset: 0
2012/09/11 19:07:41.305 Lock phone
2012/09/11 19:07:41.307 Examine phone mode
2012/09/11 19:07:41.307 Get partition file name
2012/09/11 19:07:41.307 Partition file (and path for flash programmer): C:\Users\thierry\Desktop\Partage\Pre3\partition.mbn
2012/09/11 19:07:41.307 Flash Programmer file: C:\Users\thierry\Desktop\Partage\Pre3\EMMCBLD.HEX
2012/09/11 19:07:41.308 Examine phone mode
2012/09/11 19:07:41.308 Prepare to load the flash programmer
2012/09/11 19:07:41.343 Initialize the downloader
2012/09/11 19:07:41.343 Ping the downloader
2012/09/11 19:07:41.343 Sending Ping Request
2012/09/11 19:07:41.344 Response: 0x2 : Ticks: 0
2012/09/11 19:07:41.344 Wait For Download Response Succeeded.
2012/09/11 19:07:41.344 Get downloader parameters
2012/09/11 19:07:41.345 Sending Flash Programmer Parameter Request
2012/09/11 19:07:41.346 Wait For Parameter Response Succeeded.
2012/09/11 19:07:41.346 Load the flash programmer
2012/09/11 19:07:41.346 Search RAM image for erase pattern
2012/09/11 19:07:41.346 Skipped search - base address equals start address
2012/09/11 19:07:41.346 Using 32-bit write
2012/09/11 19:07:41.346 Sent Write: Address: 0x80000000 Size: 0x100
2012/09/11 19:07:41.353 Response: 0x2 : Ticks: 0
2012/09/11 19:07:41.353 Wait For Download Response Succeeded.
2012/09/11 19:07:41.353 Sent Write: Address: 0x80000100 Size: 0x100
2012/09/11 19:07:41.359 Response: 0x2 : Ticks: 0
2012/09/11 19:07:41.359 Wait For Download Response Succeeded.
...
2012/09/11 19:07:45.512 Sent Write: Address: 0x80024600 Size: 0x8C
2012/09/11 19:07:45.518 Response: 0x2 : Ticks: 0
2012/09/11 19:07:45.518 Wait For Download Response Succeeded.
2012/09/11 19:07:45.519 Sending Go Command 0x80000000
2012/09/11 19:07:45.521 Response: 0x2 : Ticks: 0
2012/09/11 19:07:45.521 Wait For Download Response Succeeded.
2012/09/11 19:07:45.521 Finish switching to streaming download mode
2012/09/11 19:07:45.521 SynchronizeConnection starting...
2012/09/11 19:07:45.521 Sending Hello to flash programmer...
2012/09/11 19:07:48.521 Timeout
2012/09/11 19:07:48.521 Sending Hello to flash programmer...
2012/09/11 19:07:51.521 Timeout
2012/09/11 19:07:51.521 Sending Hello to flash programmer...
2012/09/11 19:07:54.521 Timeout
2012/09/11 19:07:54.521 Sending Hello to flash programmer...
2012/09/11 19:07:57.521 Timeout
2012/09/11 19:07:57.521 Sending Hello to flash programmer...
2012/09/11 19:08:00.522 Timeout
2012/09/11 19:08:00.522 Sending Hello to flash programmer...
2012/09/11 19:08:03.522 Timeout
2012/09/11 19:08:03.522 Sending Hello to flash programmer...
2012/09/11 19:08:06.522 Timeout
2012/09/11 19:08:06.522 Sending Hello to flash programmer...
2012/09/11 19:08:07.511 Disabling automatic polling.
2012/09/11 19:08:07.561 Try Hello with polling disabled...
2012/09/11 19:08:07.567 Try Hello with polling disabled...
2012/09/11 19:08:07.573 Try Hello with polling disabled...
2012/09/11 19:08:07.579 SynchronizeConnection succeeded.
2012/09/11 19:08:07.580 Sending Hello Packet
2012/09/11 19:08:07.587 Version info = 3 2
2012/09/11 19:08:07.587 Block size = 400
2012/09/11 19:08:07.587 Flash base = 0
2012/09/11 19:08:07.587 Device Name=eMMC:
2012/09/11 19:08:07.587 Flash ID size= 4
2012/09/11 19:08:07.587 Sectors = 128
2012/09/11 19:08:07.587 Feature mask = 0x09
2012/09/11 19:08:07.587 Sending Close 0
2012/09/11 19:08:07.588 Cannot close when not previously opened
#2012/09/11 19:08:07.589 ARMPRG error: 15, text: Cannot close when not previously opened
2012/09/11 19:08:07.589 CloseDownloader error
2012/09/11 19:08:07.591 Sending Security Mode 0
2012/09/11 19:08:07.593 Decoding partition file
2012/09/11 19:08:07.595 Sending partition file
2012/09/11 19:08:07.595 Sending Partition Table
2012/09/11 19:08:07.799 DBL image: C:\Users\thierry\Desktop\Partage\Pre3\dbl.mbn
2012/09/11 19:08:07.800 Opening DBL file
2012/09/11 19:08:07.801 Sending MI Open mode 15 size 0
2012/09/11 19:08:07.803 No partition table received before open multi
ï2012/09/11 19:08:07.805 ARMPRG error: 15, text: No partition table received before open multi
2012/09/11 19:08:09.060 Download end, status 103, error 783
2012/09/11 19:08:09.060 Exit SB 2.0 download with status 0x00000000
Click to expand...
Click to collapse
In fact the log is right we must send a partition table, partition.mbn contains the MBR only, but how ?
mattvirus said:
I'll do some digging to see if I can find the 32bit drivers for you. I've all but given up on my touchpad at this point
Click to expand...
Click to collapse
If you've not yet given up... I have a working TP and a non-working TP that is in QDL mode. I have the 32-bit drivers installed, and should be able to do what is required. If you're still looking for a solution, please advise. I'm less familiar with the overall problem than you are, but may be in a better position to resolve. I believe I can take the appropriate image, possibly from a totally factory-defaulted TP, if needed.
Still out there?
rippleatwpi said:
If you've not yet given up... I have a working TP and a non-working TP that is in QDL mode. I have the 32-bit drivers installed, and should be able to do what is required. If you're still looking for a solution, please advise. I'm less familiar with the overall problem than you are, but may be in a better position to resolve. I believe I can take the appropriate image, possibly from a totally factory-defaulted TP, if needed.
Still out there?
Click to expand...
Click to collapse
I'm also working on this issue, but w/ Galaxy S3. I have a working stock, and one bricked into QDLoad download mode.
http://forum.xda-developers.com/showthread.php?t=1914359
Check this thread for some good work in progress.
Any luck in fixing your TP?
mexigga said:
Any luck in fixing your TP?
Click to expand...
Click to collapse
Not yet but looks like Darkspr1te is on it with some help with remolten on the forums
http://rootzwiki.com/topic/25858-touchpad-backup-with-qpst-need-this-for-unbricking/page__st__180
http://forum.xda-developers.com/showthread.php?p=34161100&posted=1#post34161100
There is hope for the bricks yet
Hi,
I'm launching this thread to work on an unbrick procedure for fully bricked I9070/P without JTAG or Riffbox (same as Adam Outler, TheBeano, Odia etc... 's project "let's save some bricks")
Reminder : fully bricked = no download/recovery mode, no display, not charging, not going to recovery with a 301k Ohm jig.
I have a fully bricked I9070P and a fully functionnal I8090 (same processor).
Based on the sources and tools for the U8500 that were disclosed in january, I've managed to make my dead phone and my PC talk "a bit" together (under Windows with the VSIW tool, and under linux with recompiling the "flashkit" tools): when plugged in and inserting the battery, the tool sees the terminal, gets its serial number and various data and fails while trying to send and execute a boot file because the terminal closes the USB port.
I've managed to get a certain degree of communication with the "riff" tool (open source) of the Snowball project too (the dev board based on a U9500).
Based on this half successes, I'm pretty sure we are close to a clean solution to revive a fully bricked terminal without soldering JTAG.
Here are the main docs I've read so far :
* most posts from the threads "let's save some bricks" and "fun with resistors"
* the reference documents of the I9070 (Samsung_GT-I9070_Galaxy_S_Advance_Galaxy_S_II_Lite_service_manual.rar)
* the reference manual of the U9500 (http://www.calao-systems.com/reposi...X/DATASHEETS/AP9500_reference_manual_rev1.pdf)
* TSU6111 datasheet from TI (the USB/UART switch the 9070 is using, cf the service manual -> Lite Schematics -> u-USB SW IC part)
* lots of docs from the "flashkit" sources
My setup :
* a fully bricked I9070P
* a fully working I8190P
* an 8GB SDCard
* a Windows/Linux workstation (Ubuntu 12.04LTS + Android compiling environment + disclosed sources)
* terminal emulators
* a Prolific cable (PL2303) (any USB to TTL adapter would do it, you can buy one for 3$ as Arduino accessory, or reuse a Nokia DKU 5 -see hackaday website for a link). Take care with Prolifics : they don't work under Windows 8 with the last driver, you have to use the version before, Google is your friend)
* a set of resistors
* a multimeter
* libusb win32 drivers setup, see sourceforge (use the tool included in the drivers package to generate the right .inf file for the U8500 (or use 04CC and 8500)
Here are my conclusions so far :
* based on the Snowball docs and the U9500 spec, we don't seem to have any need to modify anything (resistors) on the mainboard to change boot sequence. The dev board does not have any switch for that and my dead I9070 and working I8190 exibit the same behaviour at bootup : the appear as a "U8500 USB ROM" for a seconds and disconnect when going on farther in the boot sequence.
Moreover, the fact that I managed to have my dead phone talk with the flashtool confort me in the fact that we are almost done.
* I have *not* managed to get any output on my terminal with my Prolific cable plugged in with a 630kOhm resistor on the pins 4 and 5. My resistor setup might be good because it make my working I8190 boot when I plug it in.
But I'm not sure of my RX/TX setup, I have crossed the RX/TX of the phone and the ones of the Prolific but I might have been wrong identifying the pins of my modified USB plug (D+ and D-).
But I'm sure the RX and TX wires of my Prolific are the right ones : when I connect them together (nullmodem configuration), the characters typed on my terminal are displayed.
So the main issue is : how can we have the dead phone keep the USB port open and not close it after 2 seconds?
My assumption is that it is always probing different boot methods (UART, USB, MMC etc) and then attempts to boot normaly from eMMC.
I don't know which part of the bootchain sequence I've garbaged on my I9070: IBL, PBL, SBL, PARAM? Managing to get any debug output on my console would greatly help me.
Has any of you tried to achieve something similar? If yes, could you post your setup and results?
Let's save some bricks another time!
any progress
flentus said:
Hi,
I'm launching this thread to work on an unbrick procedure for fully bricked I9070/P without JTAG or Riffbox (same as Adam Outler, TheBeano, Odia etc... 's project "let's save some bricks")
Reminder : fully bricked = no download/recovery mode, no display, not charging, not going to recovery with a 301k Ohm jig.
I have a fully bricked I9070P and a fully functionnal I8090 (same processor).
Based on the sources and tools for the U8500 that were disclosed in january, I've managed to make my dead phone and my PC talk "a bit" together (under Windows with the VSIW tool, and under linux with recompiling the "flashkit" tools): when plugged in and inserting the battery, the tool sees the terminal, gets its serial number and various data and fails while trying to send and execute a boot file because the terminal closes the USB port.
I've managed to get a certain degree of communication with the "riff" tool (open source) of the Snowball project too (the dev board based on a U9500).
Based on this half successes, I'm pretty sure we are close to a clean solution to revive a fully bricked terminal without soldering JTAG.
Here are the main docs I've read so far :
* most posts from the threads "let's save some bricks" and "fun with resistors"
* the reference documents of the I9070 (Samsung_GT-I9070_Galaxy_S_Advance_Galaxy_S_II_Lite_service_manual.rar)
* the reference manual of the U9500 (http://www.calao-systems.com/reposi...X/DATASHEETS/AP9500_reference_manual_rev1.pdf)
* TSU6111 datasheet from TI (the USB/UART switch the 9070 is using, cf the service manual -> Lite Schematics -> u-USB SW IC part)
* lots of docs from the "flashkit" sources
My setup :
* a fully bricked I9070P
* a fully working I8190P
* an 8GB SDCard
* a Windows/Linux workstation (Ubuntu 12.04LTS + Android compiling environment + disclosed sources)
* terminal emulators
* a Prolific cable (PL2303) (any USB to TTL adapter would do it, you can buy one for 3$ as Arduino accessory, or reuse a Nokia DKU 5 -see hackaday website for a link). Take care with Prolifics : they don't work under Windows 8 with the last driver, you have to use the version before, Google is your friend)
* a set of resistors
* a multimeter
* libusb win32 drivers setup, see sourceforge (use the tool included in the drivers package to generate the right .inf file for the U8500 (or use 04CC and 8500)
Here are my conclusions so far :
* based on the Snowball docs and the U9500 spec, we don't seem to have any need to modify anything (resistors) on the mainboard to change boot sequence. The dev board does not have any switch for that and my dead I9070 and working I8190 exibit the same behaviour at bootup : the appear as a "U8500 USB ROM" for a seconds and disconnect when going on farther in the boot sequence.
Moreover, the fact that I managed to have my dead phone talk with the flashtool confort me in the fact that we are almost done.
* I have *not* managed to get any output on my terminal with my Prolific cable plugged in with a 630kOhm resistor on the pins 4 and 5. My resistor setup might be good because it make my working I8190 boot when I plug it in.
But I'm not sure of my RX/TX setup, I have crossed the RX/TX of the phone and the ones of the Prolific but I might have been wrong identifying the pins of my modified USB plug (D+ and D-).
But I'm sure the RX and TX wires of my Prolific are the right ones : when I connect them together (nullmodem configuration), the characters typed on my terminal are displayed.
So the main issue is : how can we have the dead phone keep the USB port open and not close it after 2 seconds?
My assumption is that it is always probing different boot methods (UART, USB, MMC etc) and then attempts to boot normaly from eMMC.
I don't know which part of the bootchain sequence I've garbaged on my I9070: IBL, PBL, SBL, PARAM? Managing to get any debug output on my console would greatly help me.
Has any of you tried to achieve something similar? If yes, could you post your setup and results?
Let's save some bricks another time!
Click to expand...
Click to collapse
dude did you find any solution??same problem here
up up this thread.... i'm also experiencing with my s3 mini i8190 continuously disconnecting libusb-win32 driver... my phone is at deadboot and unable to resurrect with RIFFBOX...
neilPD_07 said:
up up this thread.... i'm also experiencing with my s3 mini i8190 continuously disconnecting libusb-win32 driver... my phone is at deadboot and unable to resurrect with RIFFBOX...
Click to expand...
Click to collapse
Mebay u have dead mini USB port in SIII mini ?
Sent from my GT-I9070 using Tapatalk
Hi guys,
I had a little time playing with this, but I have good news :
I modified the default profile used for the flashtool backend to "ADL boot" : my "dead" phone now stays connected to the USB and is reported as "started" by the flashtool CLI ("flash-tool get_connected_equipments") however, when I try some "active" flash-tool CLI commands, the backend crashes.
As I was running it either in windows 8.1 64 bits or Linux in a VM, their might have some bad interactions with the OS on the one hand and the USB port forwarding on the other hand (there was issues with the LCD and LCM drivers in Windows, I grabbed the 64 bits ones from VSIW...).
-> I have to test on a 32 bit Windows.
Good to read to understand further (extracted from flash-tool-backend.html file) :
Note : ME stands for mobile equipment, "boot indication" can take the following values : ADL, ALT, Normal, Production, Programming : set into the config files pointed by the .mesp file)
Boot process description
When the peripheral boot sequence starts, the ME sends an asic id to the connected PC tool. The PC tool then answers with a boot indication. If normal, "ADL" or "production" is sent as boot indication; this means that the x-loader will start the binary software stored at the corresponding location in the boot image (based on the location stated by the TOC). If programming is used as boot indication, the PC will send a completely new set of boot code to the ME. This is used when a loader is downloaded during service mode startup via the Flash Tool Backend. When the normal boot indication is sent, Flash Tool backend sends no more data and the ME is booted with the binary software stored in the place where the normal software is stored according to the TOC.
The ADL boot scenario works like this:
1. Flash Tool Backend receives asic id
2. Boot indication ADL is sent
3. Flash tool backend starts LCD and LCM and waits for a loader startup message.
The loader is stored at the ADL location of the boot image (this is supported by the assemble tool).
I think I'd have to assemble the correct bootloader to enable "profile-STE_DBX500_flashloader.prfl" profile to work (we are missing corresponding loader.ldr loader). It would enable the use of the "LoaderCommunication"
I think I have all the pieces and the docs (we even have the certificates to sign it !): just need time and a better GFAF (Girlfriend acceptance factor).
The guys who managed to unbrick some Qualcomm based devices might be of a huge help, they would be much more efficient than I can be... I any of you have time to drive them around here, do not hesitate!
Enjoy!
flentus said:
Hi guys,
I had a little time playing with this, but I have good news :
I modified the default profile used for the flashtool backend to "ADL boot" : my "dead" phone now stays connected to the USB and is reported as "started" by the flashtool CLI ("flash-tool get_connected_equipments") however, when I try some "active" flash-tool CLI commands, the backend crashes.
As I was running it either in windows 8.1 64 bits or Linux in a VM, their might have some bad interactions with the OS on the one hand and the USB port forwarding on the other hand (there was issues with the LCD and LCM drivers in Windows, I grabbed the 64 bits ones from VSIW...).
-> I have to test on a 32 bit Windows.
Good to read to understand further (extracted from flash-tool-backend.html file) :
Note : ME stands for mobile equipment, "boot indication" can take the following values : ADL, ALT, Normal, Production, Programming : set into the config files pointed by the .mesp file)
Boot process description
When the peripheral boot sequence starts, the ME sends an asic id to the connected PC tool. The PC tool then answers with a boot indication. If normal, "ADL" or "production" is sent as boot indication; this means that the x-loader will start the binary software stored at the corresponding location in the boot image (based on the location stated by the TOC). If programming is used as boot indication, the PC will send a completely new set of boot code to the ME. This is used when a loader is downloaded during service mode startup via the Flash Tool Backend. When the normal boot indication is sent, Flash Tool backend sends no more data and the ME is booted with the binary software stored in the place where the normal software is stored according to the TOC.
The ADL boot scenario works like this:
1. Flash Tool Backend receives asic id
2. Boot indication ADL is sent
3. Flash tool backend starts LCD and LCM and waits for a loader startup message.
The loader is stored at the ADL location of the boot image (this is supported by the assemble tool).
I think I'd have to assemble the correct bootloader to enable "profile-STE_DBX500_flashloader.prfl" profile to work (we are missing corresponding loader.ldr loader). It would enable the use of the "LoaderCommunication"
I think I have all the pieces and the docs (we even have the certificates to sign it !): just need time and a better GFAF (Girlfriend acceptance factor).
The guys who managed to unbrick some Qualcomm based devices might be of a huge help, they would be much more efficient than I can be... I any of you have time to drive them around here, do not hesitate!
Enjoy!
Click to expand...
Click to collapse
Any good updates & tested solution sir? I'm still waiting for a big solution for this kind of problem... TIA
Hi !
well, I'm almost done with the bootloaders: I have a loader.ldr compiled + 2 bin.
I've reset my dev. env. to an Ubuntu 10.04 according to a .doc I found in the sources (search for "*.doc", you will find "getting_Started_with_Android_and_Linux.doc"): I now have far less compilation errors, but I'm still struggling to get the full compilation process just right. For eg. I had to remove the "alsactrl" component due to dependency issues I've not been able to solve.
As already stated, I'm far from being a dev. expert so it takes me a lot of time to acheive the right compilation.
I would highly need the help of s/b who is fluent with Android compilation/dev env.: first it would be necessary to establish how to merge correctly the disclosed sources with Google's sources + the open sources from Samsung (kernel + system) (we have duplicates here as the kernel is also available in the disclosed sources, but both are different releases).
As already stated, given the few spare tile I have and without the help of the right people this will take me ~4 months+ to have this unbrick done (if I face no deadlock).
So, if you want this faster: get the right guys on the forum (from the "dev" branches) and drag them here so we can go forward much faste!
Hi!
So, I think I'm getting close: I now have the boot files build procedure working (+kernel and sytem, but I don't need those).
When I try to boot my phone with those boot files using the "flasher -tXXXX -X0,normal.bin" command, it seems that they are rejected as the phone connects and disconnects (boot loop on the iRom startup, I believe).
So, now I really need to have some kind of debug console setup to understand what's going on (cause of rejection, like signature problem etc...):
I've been working blindly up to now hopping that the software would work "off the shelves"... it never does
I'll have to try to understand how the "trigger UART" parameter of flashkit backend works and what is it intended to (I'll have to read the code for that as I've never seen any explanation about it anywhere in the docs). I don't figure out how this could work as on the backend GUI it lists the host PC's serial ports...
Another option would be to have my FTDI debug setup working. Maybe it's not "another option" but is required if the "trigger UART" is just enabling UART debug on the phone and requires a debug cable to read these debug data. My problem in that case would be how to have USB *and* UART on the same port... unless all this is designed for dev targets that have 2 USB ports as the Calao's u8500 targets. In that case, i'd have to find something smarter
As usual, if someone with knownledge on all this is willing to help: wave your hand, I'd happy to share my researches and go forward much faster. But I really feel I'm alone on this (even if I know that there will be tons of leechers when/if I manage to have this work
That's life on XDA!
Nice nice
flentus said:
Hi!
So, I think I'm getting close: I now have the boot files build procedure working (+kernel and sytem, but I don't need those).
When I try to boot my phone with those boot files using the "flasher -tXXXX -X0,normal.bin" command, it seems that they are rejected as the phone connects and disconnects (boot loop on the iRom startup, I believe).
So, now I really need to have some kind of debug console setup to understand what's going on (cause of rejection, like signature problem etc...):
I've been working blindly up to now hopping that the software would work "off the shelves"... it never does
I'll have to try to understand how the "trigger UART" parameter of flashkit backend works and what is it intended to (I'll have to read the code for that as I've never seen any explanation about it anywhere in the docs). I don't figure out how this could work as on the backend GUI it lists the host PC's serial ports...
Another option would be to have my FTDI debug setup working. Maybe it's not "another option" but is required if the "trigger UART" is just enabling UART debug on the phone and requires a debug cable to read these debug data. My problem in that case would be how to have USB *and* UART on the same port... unless all this is designed for dev targets that have 2 USB ports as the Calao's u8500 targets. In that case, i'd have to find something smarter
As usual, if someone with knownledge on all this is willing to help: wave your hand, I'd happy to share my researches and go forward much faster. But I really feel I'm alone on this (even if I know that there will be tons of leechers when/if I manage to have this work
That's life on XDA!
Click to expand...
Click to collapse
U R great man..UP UP UP :good::good::good:
use UART debug on USB
This will help me, I'll test it on my working S3 mini (same proc and very similar HW)... when I have time...
-> this will validate my UART debug setup : http://forum.xda-developers.com/showthread.php?t=2100809
ok, UART debug up and partially running on my SIII mini: debug messages displayed on terminal but keystrokes do not reach the phone, this is secondary for me at the moment, I may have a bad contact somewhere.
Tested on my dead I9070: no display, so the Xloader on my eMMC is garbaged (or Xloader UART debug is disabled, but this is less likely).
As expected, I now have to figure out how to have flashloader boot files upload *and* debug working together to understand what's wrong with my compiled boot files. I think the "trigger UART" thing is a good track, but I'm really puzzled by how to have the USB *and* the UART setup at the same time.
I fear to fry something by having phone D+/D- connected to USB port of the PC and connected at the same time to my Prolific TxD/RxD + 5V VCC connected to PC USB... sounds like a bad thing.
Another track would be USB debug I see in some parts of the code, but I don't know how to read the debug from there, more code to inspect...
got it~
---------- Post added at 02:03 PM ---------- Previous post was at 01:22 PM ----------
I also have a fully bricked I9070( not I9070P).I`m waiting for your good news.Thanks first.
I received this PM, I believe it can be useful for others experimenting with it
flentus said:
Ola Paul,
I contact you on an advise from Cocafe.
I launched a while ago the thread "[Workshop] Unbrick fully bricked I9070" (http://forum.xda-developers.com/showthread.php?t=2701363)
I'm looking for help to acheive the task as I don't have very much time to spend on it due to huge work I have this year.
Would you be ok to participate if you have a little spare time and interest in it?
I think I'm very close to the solution, and this would help a lot of 9070 owners (and maybe SIII mini and Sony too).
As explained in my thread, I have difficulties getting the disclosed sources to build correctly up to the end when integrated with Google SDK. As a result the "finalizing" scripts (that gather the binaries and tidy the "out" directory) don't execute: I end up with a large mess and STE tools don't work out of the box. I have to gather the pieces one by one to have them run which is very time consuming and error prone.
I can say that the recovery process won't need any kind of soldering, wiring or whatever: just a regular USB cable and the right sofware.
The disclosed sources contain everything we need: PBL/SBL sources, signing tool+certificates, the software to talk to the iROM + various documentation.
The problem is just a question of assembling the pieces...
My idea is to assemble an Xloader (PBL) + Uboot (SBL) + recovery and boot from that to execute recovery.
The "flashkit" tool enables this process, I quote the docs: "If 'programming' boot indication is used as boot indication, the PC will send a completely new set of boot code to the ME. This is used when a loader is downloaded during service mode startup via the Flash Tool Backend.".
Tell me if you wish to help me, or if you know someone who has competencies and would wish to!
I speek average spanish if you prefer to exchange in this language.
Regards
Click to expand...
Click to collapse
I am sorry for pointing this out, STE tools wont work ever on i9070, the reason being that we do not have a STE bootloader, heck, most of the low level stuff do not resemble the ST-Ericsson Montblanc development board. You can't even change the bootloader arguments, you can only add to them (the way I first enabled SELinux), the Samsung Bootloader version that we have may be not as restrictive as others, but Sonys bootloader resembles more to STE's than ours.
The only way you may found how to restore it is accessing the JTAG mode (something that is determined only if JTAG is connected and recognized) and depends solely on the emergency bootloader (if that exists, because I am not sure how the device powers on without PBL), the "seconds" of power you get on the USB is the device looking for JTAG.
The "disclosed" sources are for ST-Ericsson devices
Something you should do, is analyze the structures of /dev/block/mmcblk0p10, which contains our partition table (GUID Partition Table - GPT).
Simple way of doing it, you have to do dd if=/dev/block/mmcblk0p10 of=/sdcard/janice.pit on terminal emulator, this is ROM agnostic, because the structures are the same on both stock and any custom ROM. Of course, that is from a working device, I'll do that and drop it here later since I am working on something else right now, and thanks diegoch for discovering this.
Anyway, as diego pointed to me, our partition table is like this.
PIT, CSPSA, EFS, MODEM fs, SBL, SBL2, PARAM, IPL modem, MODEM, Kernel, Kernel2, system, data, cache, preload, fota, sdcard
This is the correct order I believe, since basically, when you use ODIN and use a PIT file, the partition table gets rewritten according to whatever is on that .pit file. So PIT is basically the GPT partition table; obviously SBL is the Samsung bootloader, and SBL2 I believe it's either stage 2.5 or a backup of the first.
So, no clue by going the STE way, something familiar here.
So, I may say something good at the end, see if the i9100 guys ever did it, and go from there, since our device is largely based around i9100 (Galaxy S II)
Hi Paul,
thanks for your contribution.
A few replies/questions :
* you state that Montblanc dev board and I9070 are completly different: isn't the aim of dev dev board to be close to ME while adding extra connectors to ease debug and interfacing for prototyping? Calao dev board looks very close to I9070: I have compared the schematics and component list: they look very very much alike. For me, NovaThor U8500 plateform consists of a DB8500 SoC, a Mali 400, a built-in modem + chips for USB, audio and SIM operations.
So, to me, I may be wrong, at least the processor (u8500), PLL, eMMC, SDRAM, UART + several low level controlers should be the same. As we are trying to work at such level (just trying to get the basic system to boot to just enable eMMC write), don't we have a chance to manage to have those work (maybe with adressing adaptation, those might be tough)?
* I can't agree with you that "the "seconds" of power you get on the USB is the device looking for JTAG.": on boot time, even without trashed PBL, the ME connects to USB properly with vendor/ID=04cc/8500, and sends its ASIC ID (displayed on PC screen). As stated earlier in the thread, I manage to send some commands and receive response from the ME in this state using STE tools (flashkit_cli, sending commands threw flashkit_backend).
It's definetly not any JTAG stuffs. JTAG on the I9070 is accessible on the mainboard via dedicated pads, you can locate using the light schematics provided in the "Service manual" package.
This early boot behaviour is documented in the "flash-tool-backend.html" document (available in s-4.1_vendor_st-ericsson.tar in ./s-4.1_vendor_st-ericsson/vendor/st-ericsson/tools/platform/flash_kit/flash_tool_backend/com.stericsson.sdk.backend.build/doc):
Boot process description
When the peripheral boot sequence starts, the ME sends an asic id to the connected PC tool.
The PC tool then answers with a boot indication.
- If normal, ADL or production is sent as boot indication; this means that the x-loader will start the binary software stored at the corresponding location in the boot image (based on the location stated by the TOC).
- If programming is used as boot indication, the PC will send a completely new set of boot code to the ME. This is used when a loader is downloaded during service mode startup via the Flash Tool Backend.
- When the normal boot indication is sent, Flash Tool backend sends no more data and the ME is booted with the binary software stored in the place where the normal software is stored according to the TOC.
The ADL boot scenario works like this:
1. Flash Tool Backend receives asic id
2. Boot indication ADL is sent
3. Flash tool backend starts LCD and LCM and waits for a loader startup message.
The loader is stored at the ADL location of the boot image (this is supported by the assemble tool).
* If I understand well, as we don't have the sources for the bootloader, your proposal is to grab one from a working device.
That sounds a really good idea!
Here is the complete partition table/PIT of the I9070 (recovered by someone with a Riff box from a GB archive, if I remember well):
(copy/paste it in a traditional editor and add padding to recover the table).
Partition number Filename in archive Name in PIT starting offset HEX Size in bytes HEX
MBR, GPT 0 20000
STE_boot.bin TOC ISSW XLOADER 20000 60000
mmcblk0p10 GT-I9070P_EUR_XX_8G.pit PIT 80000 100000
mmcblk0p6 cspsa.img CSPSA FS 180000 180000
EMPTY 300000 100000
mmcblk0p7 EFS.img EFS 400000 A00000
mmcblk0p2 modemfs.img MODEM FS E00000 100000
mem_init.bin STE MEM INIT 1E00000 80000
power_management.bin PWR MGT 1E80000 80000
mmcblk0p14 normal.bin SBL 1F00000 200000
mmcblk0p16 normal2.bin SBL_2 2100000 200000
mmcblk0p1 param.lfs PARAM 2300000 1000000
mmcblk0p12 ipl.bin IPL MODEM 3300000 200000
mmcblk0p13 modem.bin MODEM 3500000 1000000
mmcblk0p15 kernel.bin KERNEL 4500000 1000000
mmcblk0p17 kernel2.bin KERNEL2 5500000 1000000
mmcblk0p3 system.img SYSTEM 6500000 26400000
mmcblk0p5 userdata.img DATAFS 2C900000 80000000
mmcblk0p4 cache.img CACHEFS AC900000 13200000
mmcblk0p9 hidden.img HIDDEN BFB00000 14000000
mmcblk0p11 ssgtest.img FOTA D3B00000 3200000
mmcblk0p8 ums.rfs UMS D6D00000 FAA00000
--> PBL corresponds to "TOC ISSW XLOADER" (STE_boot.bin in the flash archive) and SLB to normal.bin. So basically we have our boot files. We can extract them from the GB flash archive or from a ROM dump (I have dd'ed every partitions from 2 different I9070P + a full recovery dump from a 9070 provided by Riff box support files I found once I don't remember where).
So, if I have time one of theses days, I'll try to build a flash archive based on these files and try to boot from STE tools on it using "programming" as boot indication.
* Using the knowledge of the I9100 (Galaxy S II): I'm afraid this is a very different hardware, I9100 uses an Exynos 4210, so I hardly see what we could use from there... Could you give us some more advise on that idea?
Regards
Hi!
I had no time working on this for a while: extremely busy at work.
Maybe this weekend...
@cocafe: I've read you know how to extract the initramfs from the kernel, modify, repack, and reflash it. I'll need to do that to modify the "on boot" section of the init.rc to launch the recovery from standard boot. Could you drop me here the command lines to do that? Thanks in advance!
This looks by far the most advanced research into bringing back a hard bricked i9070.
@flentus Did you manage to upload a new bootloader?
Hi,
had to time at all to play with this for a loooong time.
I have grabed a few new phones so me 9070 is now burried deep into a drawer but I really wish to finish this one day because I feel I'm very close to something.
If anybody would like to take over this, feel free, I can provide support for the stuff I have understood (and remember of...)
Regards
Hi everyone, as you can see in topic I bricked my phone. or at least I think I did it.
To make a long story short - my brother gave me Xpera T, I installed cm12 but had problems with gapps (google apps has stopped), then I tried to remove it to have clean install and got the situation in recovery "can't mount cache/system..."
Then I tried parted /dev/block/mmcblk0 mkfs ext2
But, after I did it I restarted phone and now I can't turn it on. There is no any sign it's alive. Like a brick :-/
When I connect phone to computer and try power+up it won't enter recovery mode so I can't use ADB or Fastboot.
Only trace that phone exists shows dmesg command:
[ 135.031450] usb 3-5: new high-speed USB device number 9 using xhci_hcd
[ 135.196087] usb 3-5: New USB device found, idVendor=05c6, idProduct=9008
[ 135.196095] usb 3-5: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 135.196100] usb 3-5: Product: QHSUSB_DLOAD
[ 135.196103] usb 3-5: Manufacturer: Qualcomm CDMA Technologies MSM
[ 135.196734] qcserial 3-5:1.0: Qualcomm USB modem converter detected
[ 135.197345] usb 3-5: Qualcomm USB modem converter now attached to ttyUSB0
So, is there any hope that I coul'd repair it, or the garbage is the right place for it?
Thank you!
Here's how to unbrick.
First turn off the phone and connect the phone to the computer while holding the volume down button. Wait for few minutes until the drivers are installed correctly. now you can disconnect the phone.
1. Download and install flashtool.
2. Download the stock rom for your device. Click here for a list of stock ROMs.
3. Right click and copy the downloaded file, and go to C:\flashtool\firmware\ and paste.
4. Open flashtool. Click the "lightning" symbol and select "flashmode" and click OK.
5. Select the file name you just downloaded, Put a tick on "No final verification" and click "flash".
6. Wait for a minute or two until you get a popup window. (It will say "press the back button and connect the phone to pc". But DO NOT do that)
7. Now turn off the phone. Connect the USB cable to the computer, but don't connect it to the phone yet.
8. Press and hold the volume down button. Keep pressing and connect the USB cable to the phone.
9. Release the volume down button as soon as the popup window go away.
10. DO NOT disconnect the USB cable until the flashtool say "Flashing completed".
11. Now unplug the cable and turn on the phone. It will take a few extra minutes to boot for the first time.
Hit the thanks button if this helped. :good:
The file I need to download is no longer available, can you upload it again?
marko-marko said:
The file I need to download is no longer available, can you upload it again?
Click to expand...
Click to collapse
Done. Checkout the post #2
All the links are updated.
Be careful what ROM you download. Double check the Model no. of your phone and the ROM. They must match.
I did everything you said until number 9 (Release the volume button as soon as the popup window go away) because that window never got away.
In flashtool windows says:
Device connected with USB debugging off
For 2011 devices line, be sure you are in MTP mode
Device disconnected
On mobile turns on red light when it's connected to USB, but turns off very soon, after flashtool says it's disconnected.
marko-marko said:
I did everything you said until number 9 (Release the volume button as soon as the popup window go away) because that window never got away.
In flashtool windows says:
Device connected with USB debugging off
For 2011 devices line, be sure you are in MTP mode
Device disconnected
On mobile turns on red light when it's connected to USB, but turns off very soon, after flashtool says it's disconnected.
Click to expand...
Click to collapse
Did you do the step 7 right? did you turn off the phone before connecting the cable?
Yes, the phone is turned off. It can't be turned on after I bricked it
marko-marko said:
Yes, the phone is turned off. It can't be turned on after I bricked it
Click to expand...
Click to collapse
I edited the instructions. Give it a try. Hope this will work :angel:
InfinitelyCrazy said:
I edited the instructions. Give it a try. Hope this will work :angel:
Click to expand...
Click to collapse
Nothing, same as the last time.
Firstly I have removed the battery for 15 minutes and than installed driver.
I followed procedure, but again number 9 never happened.
I tried to update driver for qualcomm (that is mobile) but it says that it's already updated.
Hello Everyone !!
=>A hard bricked OP5 has nothing but a black screen (nothing ever comes on the screen, not even a boot logo), it might vibrate when a power button is pressed and held for 20 seconds, has no Recovery partition, no adb mode, and no fastboot partition (It might be a flickering OnePlus logo). The device might be detected in Linux and you might be able to even send commands to it. In Windows, the bricked OP5 should be detected as QHUSB_BULK,Unknown Device,Qualcomm something. You might have a bricked OP5 as a result of flashing a kernel meant for a different device (or a ROM meant for another device that included a kernel), tinkering with the boot logo or bootloader, or your attempt of unlocking the bootloader resulted in corrupting the boot partition. Most of the times, it is needed because OEM Unlocking is disabled, and phone can't boot and no recovery.
=>The solution for OP5 hardbrick is similar to OP3,OP3T- you just need a Qualcomm driver and a recovery package.it'll help to get out from one of the most weird state of the phone.(file is exact file from OnePlus)
METHOD
This method is easy to use and flashes OxygenOS 4.5.10 on your phone. It wipes all your data and restores all partitions to stock. It will work in any condition unless it is a hardware damage.
Step 1 :- DOWNLOADS :- https://drive.google.com/drive/folders/0B7PMif5jp70BRmpSX1Nzb2JhRGs?usp=sharing
Step 2 :- Extract Drivers and Recovery Tool files on Desktop.
Step 3 :- If you are using Windows other than Windows XP,turn off Driver Signature Enforcement.To do so,follow this guide :- http://www.howtogeek.com/167723/how-...igned-drivers/
Step 4 :- Press the power button for 40 seconds to turn off the phone.
Step 5 :- Press only volume up button for 10 seconds and while keeping it pressed,connect your phone to PC.Keep volume up pressed till your device shows in device manager as [Unknown Device,QHUSB_BULK (under Unknown Devices) or Qualcomm HS USB ...... (under COMs and Ports)].
Step 6 :- Right Click on your device in the device manager and select Update Device Software. Choose the .inf file manually from x86 or x64 folder as the case implies and select Qualcomm 9008 from the listed devices.If you are unable to see 9008,see the end of post for various other methods to show Qualcomm 9008.
Step 7 :- When the device shows as Qualcomm 9008 ,go to the extracted Recovery Package and run the MSM Download Tool as administrator.
Step 8 :- Click start at top left corner and wait for it to finish (green text will come).
Step 9 :- Disconnect phone from PC and boot into system.
How to Make the device show as Qualcomm 9008
1.) Make sure driver signature enforcement is disabled.
2.) Try these drivers,one of them might work too :-
https://www.androidfilehost.com/?fid=24052804347799753
https://www.androidfilehost.com/?fid=24269982086990168
https://www.androidfilehost.com/?fid=24349802275800175
https://www.androidfilehost.com/?fid=24349802275800173
https://www.androidfilehost.com/?fid=24349802275800171
3.)Download this :- http://www.mediafire.com/download/4a...6wc67/Qualcomm 1.00.11.rar
Keep phone disconnected from PC.
Open the folder "qc" and install the Test Certificate in the following Stores: Trusted Root, Trusted Publisher, Third-Party Root and Personal
Run the Qualcomm setup wizard (also located in the qc folder)
When completed, restart your PC again with Driver Signature Disabled. (Optional but preferred)
The driver should now automatically install. If not, go to device manager and right click "Unknown Device" and click "Update Driver" Search up the QC folder and press ok. The driver should now install.
Click thanks IF i helped you
reserved
@vasu97
We already have a dedicated thread on the same topic.
what can i edit so it won't relock the bootloader? or does it relock it?
vasu97 said:
Hello Everyone !!
=>A hard bricked OP5 has nothing but a black screen (nothing ever comes on the screen, not even a boot logo), it might vibrate when a power button is pressed and held for 20 seconds, has no Recovery partition, no adb mode, and no fastboot partition (It might be a flickering OnePlus logo). The device might be detected in Linux and you might be able to even send commands to it. In Windows, the bricked OP5 should be detected as QHUSB_BULK,Unknown Device,Qualcomm something. You might have a bricked OP5 as a result of flashing a kernel meant for a different device (or a ROM meant for another device that included a kernel), tinkering with the boot logo or bootloader, or your attempt of unlocking the bootloader resulted in corrupting the boot partition. Most of the times, it is needed because OEM Unlocking is disabled, and phone can't boot and no recovery.
=>The solution for OP5 hardbrick is similar to OP3,OP3T- you just need a Qualcomm driver and a recovery package.it'll help to get out from one of the most weird state of the phone.(file is exact file from OnePlus)
METHOD
This method is easy to use and flashes OxygenOS 4.5.10 on your phone. It wipes all your data and restores all partitions to stock. It will work in any condition unless it is a hardware damage.
Step 1 :- DOWNLOADS :- https://drive.google.com/drive/folders/0B7PMif5jp70BRmpSX1Nzb2JhRGs?usp=sharing
Step 2 :- Extract Drivers and Recovery Tool files on Desktop.
Step 3 :- If you are using Windows other than Windows XP,turn off Driver Signature Enforcement.To do so,follow this guide :- http://www.howtogeek.com/167723/how-...igned-drivers/
Step 4 :- Press the power button for 40 seconds to turn off the phone.
Step 5 :- Press only volume up button for 10 seconds and while keeping it pressed,connect your phone to PC.Keep volume up pressed till your device shows in device manager as [Unknown Device,QHUSB_BULK (under Unknown Devices) or Qualcomm HS USB ...... (under COMs and Ports)].
Step 6 :- Right Click on your device in the device manager and select Update Device Software. Choose the .inf file manually from x86 or x64 folder as the case implies and select Qualcomm 9008 from the listed devices.If you are unable to see 9008,see the end of post for various other methods to show Qualcomm 9008.
Step 7 :- When the device shows as Qualcomm 9008 ,go to the extracted Recovery Package and run the MSM Download Tool as administrator.
Step 8 :- Click start at top left corner and wait for it to finish (green text will come).
Step 9 :- Disconnect phone from PC and boot into system.
How to Make the device show as Qualcomm 9008
1.) Make sure driver signature enforcement is disabled.
2.) Try these drivers,one of them might work too :-
https://www.androidfilehost.com/?fid=24052804347799753
https://www.androidfilehost.com/?fid=24269982086990168
https://www.androidfilehost.com/?fid=24349802275800175
https://www.androidfilehost.com/?fid=24349802275800173
https://www.androidfilehost.com/?fid=24349802275800171
3.)Download this :- http://www.mediafire.com/download/4a...6wc67/Qualcomm 1.00.11.rar
Keep phone disconnected from PC.
Open the folder "qc" and install the Test Certificate in the following Stores: Trusted Root, Trusted Publisher, Third-Party Root and Personal
Run the Qualcomm setup wizard (also located in the qc folder)
When completed, restart your PC again with Driver Signature Disabled. (Optional but preferred)
The driver should now automatically install. If not, go to device manager and right click "Unknown Device" and click "Update Driver" Search up the QC folder and press ok. The driver should now install.
Click thanks IF i helped you
Click to expand...
Click to collapse
Holy crap! I literally spent the last 12 hours trying to get my phone fixed. This was the only solution. Thank you so much!!!
If anyone had problems with the MSM tool "Sahara communication failed," unplug your phone. Turn it off by holding the power button for a while. Hold the power up for 10 seconds, then keep holding the volume up and plug your phone in to the PC. The MSM tool should automatically detect and restore your phone.
vasu97 said:
reserved
Click to expand...
Click to collapse
thank you so much
I've tried all the steps on multiple ports and different computers but I got always the errno 258 while loading the cache.img. Don't know what else to do...
People, please help!
I decided to unlock my lumia 720, I did everything according to the instructions. At first everything went fine, but then wpinternels got stuck on flashing done. rebooting. Then the computer just stopped seeing the phone. Now the phone does not turn on and does not charge, generally like a dead one. Even wdrt doesn't see it. Is it a brick or not? Help!
People, please help!
I decided to unlock my lumia 720, I did everything according to the instructions. At first everything went fine, but then wpinternels got stuck on flashing done. rebooting. Then the computer just stopped seeing the phone. Now the phone does not turn on and does not charge, generally like a dead one. Even wdrt doesn't see it. Is it a brick or not? Help!
People, please help!
I decided to unlock my lumia 720, I did everything according to the instructions. At first everything went fine, but then wpinternels got stuck on flashing done. rebooting. Then the computer just stopped seeing the phone. Now the phone does not turn on and does not charge, generally like a dead one. Even wdrt doesn't see it. Is it a brick or not? Help!
Hi,
please have a look into your device manager. If you find something like Qualcomm Boot loader device, proceed with one of those many instructions "unbrick without JTAG". I think your Lumia is in emergency mode.
You may also look for thor2.exe on your computer, it is in the Windows Device Recovery Tool subdirectory. Open a command line window, type thor2>help.txt and open help.txt with a text editor. Look up emergency mode. You will find something like [thor2 -mode emergency -hexfile D:\Packages\Products\RM-994\FAST8930_BATMANROW.hex -mbnfile D:\Packages\Products\RM-994\RM994_msimage_v1.0.mbn]. Notice, that is for my phone, not a 720. File name and directory entries must be changed to your needs, but hopfully you will understand the pattern.
Good luck!
Joachim
I'm found hex and mbn files for my lumia 720, changed your command for my files, but thor2 wrote this log:
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -
mode emergency -hexfile "E:\720\hex.hex" -mbnfile "E:\720\mbn.mbn"
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile E:\720\hex.hex -mbnfile E:\720\mbn.mbn
Process started Sat Jun 03 13:32:23 2023
Logging to file C:\Users\pikachu\AppData\Local\Temp\thor2_win_20230603133223_Th
readId-4876.log
Debugging enabled for emergency
Initiating emergency download
Operation took about 20.00 seconds.
THOR2_ERROR_CONNECTION_NOT_FOUND
THOR2 1.8.2.18 exited with error code 84000 (0x14820)
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>
JoachimP said:
Hi,
please have a look into your device manager. If you find something like Qualcomm Boot loader device, proceed with one of those many instructions "unbrick without JTAG". I think your Lumia is in emergency mode.
You may also look for thor2.exe on your computer, it is in the Windows Device Recovery Tool subdirectory. Open a command line window, type thor2>help.txt and open help.txt with a text editor. Look up emergency mode. You will find something like [thor2 -mode emergency -hexfile D:\Packages\Products\RM-994\FAST8930_BATMANROW.hex -mbnfile D:\Packages\Products\RM-994\RM994_msimage_v1.0.mbn]. Notice, that is for my phone, not a 720. File name and directory entries must be changed to your needs, but hopfully you will understand the pattern.
Good luck!
Joachim
Click to expand...
Click to collapse
I'm not have this in device manager. Computer doesn't see my phone.
Did you try a different USB cable, different USB port on your computer (rear side if you have a desktop or tower pc)? Did you pull the battery or press volume down ans power switch at the same time for about 20 seconds to make a power reset?
You might pn me a screenshot of your device manager.
I tried 4 different cables and different usb connectors on my laptop, still doesn't help. I also tried to hold the keys, the phone vibrates and nothing else happens. I can't remove the battery because on the lumia 720 it's not removable and I don't have a screwdriver to remove the back cover.
I am using windows 8.1 64 bit on my laptop. When you connect the phone in the device manager, nothing changes.
I tried 4 different cables and different usb connectors on my laptop, still doesn't help. I also tried to hold the keys, the phone vibrates and nothing else happens. I can't remove the battery because on the lumia 720 it's not removable and I don't have a screwdriver to remove the back cover.
I am using windows 8.1 64 bit on my laptop. When you connect the phone in the device manager, nothing changes.