Related
=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2- QPST_2.7.422 or here
3- QDLoader HS-USB Driver or here
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
sry for bad english
Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip
thinhx2 said:
Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip
Click to expand...
Click to collapse
you're welcome
this also works with all Snapdragon devices
thinhx2 said:
Very easy http://forum.xda-developers.com/nokia-x2/help/how-to-recover-hard-bricked-nokia-x2-t3072157
But thank bro for tip
Click to expand...
Click to collapse
this does not work forr me. i am getting this error.
Failed using Sahara protocol
Exception:
Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownloadException: Failed using Sahara protocol ---> Nokia.Delta.Gemini.EmergencyDownload.SaharaException: Image transfer ended with failure: InvalidImageTypeReceived
at Nokia.Delta.Gemini.EmergencyDownload.Sahara.Download(String filePath)
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
--- End of inner exception stack trace ---
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__15(Object state)
---------- Post added at 11:17 AM ---------- Previous post was at 11:09 AM ----------
Ramy3r said:
=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2-QPST_2.7.422
3- QDLoader HS-USB Driver
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
**Note**
Works with all snapdragon devices
so if u have another device all u need to change is the firmware files
sry for bad english
Click to expand...
Click to collapse
download links for drivers not working.
jkenic said:
download links for drivers not working.
Click to expand...
Click to collapse
broken links updated
thx for informing me
jkenic said:
this does not work forr me. i am getting this error.
Failed using Sahara protocol
Exception:
Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownloadException: Failed using Sahara protocol ---> Nokia.Delta.Gemini.EmergencyDownload.SaharaException: Image transfer ended with failure: InvalidImageTypeReceived
at Nokia.Delta.Gemini.EmergencyDownload.Sahara.Download(String filePath)
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
--- End of inner exception stack trace ---
at Nokia.Delta.Gemini.EmergencyDownload.EmergencyDownload.SetToFirehoseMode()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.Flash()
at Nokia.CareSuite.PlugIns.DeltaRecovery.RecoveryDialog.RecoveryDialogModel.<HandleDownloadVariantPackageCompleted>b__15(Object state)
---------- Post added at 11:17 AM ---------- Previous post was at 11:09 AM ----------
download links for drivers not working.
Click to expand...
Click to collapse
bro has install nokia care suite?
thinhx2 said:
bro has install nokia care suite?
Click to expand...
Click to collapse
it is the ncs that is giving me the error. i have done everything needed to be done to get my x2 back....
---------- Post added at 02:54 PM ---------- Previous post was at 02:39 PM ----------
Ramy3r said:
broken links updated
thx for informing me
Click to expand...
Click to collapse
u re welcome but number 2 download link still not working.......
jkenic said:
it is the ncs that is giving me the error. i have done everything needed to be done to get my x2 back....
---------- Post added at 02:54 PM ---------- Previous post was at 02:39 PM ----------
u re welcome but number 2 download link still not working.......
Click to expand...
Click to collapse
sry fixed and add links from google drive
Ramy3r said:
=====how to flash dead Nokia x2 readed as [ RELINK HS-USB QD-LOADER 9008 ] instead of [ QHSUSB_BULK ]=====
all u need is:
1- Nokia x2 firmware files from here insert your product code ,click submit then download all the files in the list and put them together in one folder [i named it "RM-1013"]
2- QPST_2.7.422 or here
3- QDLoader HS-USB Driver or here
**remove the phone's battery and put it back after 5 seconds connect the phone with usb cable**
After downloading and installing all files
open start menu and type in search QFIL
open QFIL in "programmer path" map it to the firmware and select:
"rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn"
next press "Load XML" then type in file name *.xml press open and chose:
"rm1013_2.1.0.13_059V782_001_rawprogram_unsparse_ui.xml"
then it will automatically ask u for "Patch File"
type in file name *.xml press open and chose:
P12027803dpi600_label_layout.xml
last thing press Download and take a little rest while the rom is being downloaded to your Nokia x2 :silly:
Facing any problem ? list it below
**Note**
Works with all snapdragon devices
so if u have another device all u need to change is the firmware files
sry for bad english
Click to expand...
Click to collapse
i go an error
Start Download
Program Path:C:\Users\EJINI\Desktop\New folder\RM-1013-1\rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:0
Start Sending Programmer
Download Fail:System.Exception: Unable to download Flash Programmer using Sahara Protocol
at QC.QMSLPhone.Phone.QPHONEMS_SaharaArmPrgDownload(String sFileName)
at QC.SwDownloadDLL.SwDownload.QPHONEMSSaharaDownloadArmPrg(UInt64& version, String armPrgPath)
Download Fail:Sahara FailSahara Fail
Finish Download
almost same with the nokia care suite.
jkenic said:
i go an error
Start Download
Program Path:C:\Users\EJINI\Desktop\New folder\RM-1013-1\rm1013_2.1.0.13_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:0
Start Sending Programmer
Download Fail:System.Exception: Unable to download Flash Programmer using Sahara Protocol
at QC.QMSLPhone.Phone.QPHONEMS_SaharaArmPrgDownload(String sFileName)
at QC.SwDownloadDLL.SwDownload.QPHONEMSSaharaDownloadArmPrg(UInt64& version, String armPrgPath)
Download Fail:Sahara FailSahara Fail
Finish Download
almost same with the nokia care suite.
Click to expand...
Click to collapse
Do u have any problems with ur operating system maybe its not running very well or u have some program that interferes with the download/flashing process
Sent from my Nokia_X2 using XDA Labs
There's nothing wrong with the OS that I know of.... Maybe it's the phone...did not work with windows 10
jkenic said:
There's nothing wrong with the OS that I know of.... Maybe it's the phone...did not work with windows 10
Click to expand...
Click to collapse
Sry for late comment .. Win 10 has a lot of support issues like the error 0x000007 with some games and programs ... I recommend win 7 for best results
Sent from my Nokia_X2 using XDA Labs
Work with lumia devices?
thinhx2 said:
Work with lumia devices?
Click to expand...
Click to collapse
i tested this only on android devices i'm not sure about windows phone tbh
but if it has same files "firehose , rawprogram and label layout" included in firmware files then its possible
error
Hi guys. Please help me with an error. If the firmware gets up in the middle of it.
Hoоdlum said:
Hi guys. Please help me with an error. If the firmware gets up in the middle of it.
Click to expand...
Click to collapse
First of all have you downloaded the full firmware files ? "66 files, 902 MB"
Sent from my Nokia X2 using XDA Labs
Ramy3r said:
First of all have you downloaded the full firmware files ? "66 files, 902 MB"
Sent from my Nokia X2 using XDA Labs
Click to expand...
Click to collapse
66 Yes 902mb file, but it does not end here from another site. Here's why not swing.
Hoоdlum said:
66 Yes 902mb file, but it does not end here from another site. Here's why not swing.
Click to expand...
Click to collapse
Try again using the version I posted of qpst
Sent from my Nokia ara using XDA Labs
Ramy3r said:
Try again using the version I posted of qpst
Sent from my Nokia ara using XDA Labs
Click to expand...
Click to collapse
I downloaded from your site on the links firmware driver program. Error exact same stands in the middle.
That log
Code:
[FONT="Verdana"][B]Validating Application Configuration
Load APP Configuration
COM:-1
SAHARA:True
SAHARA:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
SEARCHPATH:C:\RM-1013
RAWPROGRAM:
rm1013_2.1.0.12_059V786_001_rawprogram_unsparse_ui.xml
PATCH:
P12026702dpi600_label_layout.xml
ACKRAWDATAEVERYNUMPACKETS:True
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:True
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
READBACKMODE:0
RESETAFTERDOWNLOAD:True
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Process Index:0
Validating Download Configuration
Image Search Path: C:\RM-1013
RAWPROGRAM file path: C:\RM-1013\rm1013_2.1.0.12_059V786_001_rawprogram_unsparse_ui.xml
PATCH file path:C:\RM-1013\P12026702dpi600_label_layout.xml
Programmer Path:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
Start Download
Program Path:C:\RM-1013\rm1013_2.1.0.12_user_prog_emmc_firehose_8x10.mbn
COM Port number:9
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Enable Ack Raw Data Every 100Packets
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:9
Sending NOP
FireHose NOP sent successfully
Sending Configuration
Device Type:eMMC
Platform:8x26
Set TxBuffer 0xc000, RxBuffer 0x4000
Firehose configure packet sent successfully!
ReadBackMode:No_Readback
Disable read back
Total Bytes To Program 0x37226800
Download Image
PROGRAM: Replace the partition sectors number 0x20000 to file size in sector 0x125c3
PROGRAM: Partition 0, Sector: 16384, Length: 75203 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_NON-HLOS.bin
FireHose Log: start 16384, num 75203
FireHose Log: Write failed Sector 16480, Errno 2
FireHose Log: Finished sector address 16480
PROGRAM: Written Bytes 0x24b8600 (64)
Program Size: 36.72 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1ec
PROGRAM: Partition 0, Sector: 147456, Length: 492 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sbl1.mbn
FireHose Log: start 147456, num 492
FireHose Log: Write failed Sector 147456, Errno 2
FireHose Log: Finished sector address 147456
PROGRAM: Written Bytes 0x3d800 (64)
Program Size: 0.24 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x1ec
PROGRAM: Partition 0, Sector: 148480, Length: 492 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sbl1.mbn
FireHose Log: start 148480, num 492
FireHose Log: Write failed Sector 148480, Errno 2
FireHose Log: Finished sector address 148480
PROGRAM: Written Bytes 0x3d800 (64)
Program Size: 0.24 MB
PROGRAM: Replace the partition sectors number 0x100 to file size in sector 0x2d
PROGRAM: Partition 0, Sector: 149504, Length: 45 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_sdi.mbn
FireHose Log: start 149504, num 45
FireHose Log: Write failed Sector 149504, Errno 2
FireHose Log: Finished sector address 149504
PROGRAM: Written Bytes 0x5a00 (64)
Program Size: 0.02 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x3aa
PROGRAM: Partition 0, Sector: 180224, Length: 938 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_emmc_appsboot.mbn
FireHose Log: start 180224, num 938
FireHose Log: Write failed Sector 180224, Errno 2
FireHose Log: Finished sector address 180224
PROGRAM: Written Bytes 0x75400 (64)
Program Size: 0.46 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x3aa
PROGRAM: Partition 0, Sector: 181248, Length: 938 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_emmc_appsboot.mbn
FireHose Log: start 181248, num 938
FireHose Log: Write failed Sector 181248, Errno 2
FireHose Log: Finished sector address 181248
PROGRAM: Written Bytes 0x75400 (64)
Program Size: 0.46 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x128
PROGRAM: Partition 0, Sector: 182272, Length: 296 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_rpm.mbn
FireHose Log: start 182272, num 296
FireHose Log: Write failed Sector 182272, Errno 2
FireHose Log: Finished sector address 182272
PROGRAM: Written Bytes 0x25000 (64)
Program Size: 0.14 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x128
PROGRAM: Partition 0, Sector: 183272, Length: 296 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_rpm.mbn
FireHose Log: start 183272, num 296
FireHose Log: Write failed Sector 183272, Errno 2
FireHose Log: Finished sector address 183272
PROGRAM: Written Bytes 0x25000 (64)
Program Size: 0.14 MB
PROGRAM: Replace the partition sectors number 0x5000 to file size in sector 0x38d5
PROGRAM: Partition 0, Sector: 196608, Length: 14549 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_boot.img
FireHose Log: start 196608, num 14549
FireHose Log: Write failed Sector 196608, Errno 2
FireHose Log: Finished sector address 196608
PROGRAM: Written Bytes 0x71aa00 (64)
Program Size: 7.10 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x297
PROGRAM: Partition 0, Sector: 229376, Length: 663 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_tz.mbn
FireHose Log: start 229376, num 663
FireHose Log: Write failed Sector 229376, Errno 2
FireHose Log: Finished sector address 229376
PROGRAM: Written Bytes 0x52e00 (64)
Program Size: 0.32 MB
PROGRAM: Replace the partition sectors number 0x3e8 to file size in sector 0x297
PROGRAM: Partition 0, Sector: 230376, Length: 663 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_tz.mbn
FireHose Log: start 230376, num 663
FireHose Log: Write failed Sector 230376, Errno 2
FireHose Log: Finished sector address 230376
PROGRAM: Written Bytes 0x52e00 (64)
Program Size: 0.32 MB
PROGRAM: Partition 0, Sector: 344064, Length: 262160 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_1.img
FireHose Log: start 344064, num 262160
FireHose Log: Write failed Sector 344064, Errno 2
FireHose Log: Finished sector address 344064
PROGRAM: Written Bytes 0x8002000 (64)
Program Size: 128.01 MB
PROGRAM: Partition 0, Sector: 606600, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_2.img
FireHose Log: start 606600, num 16
FireHose Log: Write failed Sector 606600, Errno 29
FireHose Log: Finished sector address 606600
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 610352, Length: 257992 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_3.img
FireHose Log: start 610352, num 257992
FireHose Log: Write failed Sector 610352, Errno 2
FireHose Log: Finished sector address 610352
PROGRAM: Written Bytes 0x7df9000 (64)
Program Size: 125.97 MB
PROGRAM: Partition 0, Sector: 868352, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_4.img
FireHose Log: start 868352, num 16
FireHose Log: Write failed Sector 868352, Errno 2
FireHose Log: Finished sector address 868352
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 872104, Length: 258384 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_5.img
FireHose Log: start 872104, num 258384
FireHose Log: Write failed Sector 872104, Errno 2
FireHose Log: Finished sector address 872104
PROGRAM: Written Bytes 0x7e2a000 (64)
Program Size: 126.16 MB
PROGRAM: Partition 0, Sector: 1130496, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_6.img
FireHose Log: start 1130496, num 16
FireHose Log: Write failed Sector 1130496, Errno 2
FireHose Log: Finished sector address 1130496
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1130888, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_7.img
FireHose Log: start 1130888, num 16
FireHose Log: Write failed Sector 1130888, Errno 2
FireHose Log: Finished sector address 1130888
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1134640, Length: 95712 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_8.img
FireHose Log: start 1134640, num 95712
FireHose Log: Write failed Sector 1134640, Errno 2
FireHose Log: Finished sector address 1134640
PROGRAM: Written Bytes 0x2ebc000 (64)
Program Size: 46.73 MB
PROGRAM: Partition 0, Sector: 1392640, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_9.img
FireHose Log: start 1392640, num 16
FireHose Log: Write failed Sector 1392640, Errno 2
FireHose Log: Finished sector address 1392640
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1654784, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_10.img
FireHose Log: start 1654784, num 16
FireHose Log: Write failed Sector 1654784, Errno 29
FireHose Log: Finished sector address 1654784
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1655176, Length: 16 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_system_11.img
FireHose Log: start 1655176, num 16
FireHose Log: Write failed Sector 1655176, Errno 29
FireHose Log: Finished sector address 1655176
PROGRAM: Written Bytes 0x2000 (64)
Program Size: 0.01 MB
PROGRAM: Partition 0, Sector: 1777664, Length: 11376 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_cache_1.img
FireHose Log: start 1777664, num 11376
FireHose Log: Write failed Sector 1777664, Errno 2
FireHose Log: Finished sector address 1777664
PROGRAM: Written Bytes 0x58e000 (64)
Program Size: 5.55 MB
PROGRAM: Replace the partition sectors number 0x5000 to file size in sector 0x3ca9
PROGRAM: Partition 0, Sector: 1974272, Length: 15529 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_recovery.img
FireHose Log: start 1974272, num 15529
FireHose Log: Write failed Sector 1974272, Errno 2
FireHose Log: Finished sector address 1974272
PROGRAM: Written Bytes 0x795200 (64)
Program Size: 7.58 MB
PROGRAM: Replace the partition sectors number 0x800 to file size in sector 0x1
PROGRAM: Partition 0, Sector: 1998848, Length: 1 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_user_misc_erase.img
FireHose Log: start 1998848, num 1
ReadFile last error: 0
PROGRAM: Written Bytes 0x200 (64)
Program Size: 0.00 MB
PROGRAM: Partition 0, Sector: 2015232, Length: 262136 Sectors, Sector Size: 512 Bytes
File: C:\RM-1013\rm1013_2.1.0.12_059V786_001.custom_1.img
WriteFile last error: 0
PROGRAM: Send XML command fail code: 9
Failed to write C:\RM-1013\rm1013_2.1.0.12_059V786_001.custom_1.img to the device
Download Fail:FireHose Fail Failed to Upload the emmc images to the phone using Firehose.
Finish Download[/B][/FONT]
Guys need help....I recently bought a Samsung S8 (t-mobile version) without knowing much of its history thinking it had a deeply discharged battery, but after a good 10 hrs on the charger it still won't turn on, no LEDs, no vibration, nothing, a complete black screen so it will NOT boot into recovery or download mode. However, it does seem to take a charge as the back side does get a bit warm when charged. When plugged into the PC (Win 10) it does not get recognized under My PC but I hear the USB plug-in chime and under the Device Manager, I get "Qualcomm HS-USB QDloader 9008" on COM port 3. From what I've found online, seems like I will need the original S8's complete eMMC image and load it onto the sdcard and recover it that way, even if it's possible.
Can anyone help/guide me in the proper direction? Really hoping to recover this device. This might even help others who may have or will brick their S8's. Thanks a lot in advance
taj786 said:
Guys need help....I recently bought a Samsung S8 (t-mobile version) without knowing much of its history thinking it had a deeply discharged battery, but after a good 10 hrs on the charger it still won't turn on, no LEDs, no vibration, nothing, a complete black screen so it will NOT boot into recovery or download mode. However, it does seem to take a charge as the back side does get a bit warm when charged. When plugged into the PC (Win 10) it does not get recognized under My PC but I hear the USB plug-in chime and under the Device Manager, I get "Qualcomm HS-USB QDloader 9008" on COM port 3. From what I've found online, seems like I will need the original S8's complete eMMC image and load it onto the sdcard and recover it that way, even if it's possible.
Can anyone help/guide me in the proper direction? Really hoping to recover this device. This might even help others who may have or will brick their S8's. Thanks a lot in advance
Click to expand...
Click to collapse
This thread may be old, but for now, the only option you have is getting a replacement. I had that qualcomm HS-USB composite identity on my hard bricked lg g stylo and i couldn't do anything about it but get it replaced.
taj786 said:
Guys need help....I recently bought a Samsung S8 (t-mobile version) without knowing much of its history thinking it had a deeply discharged battery, but after a good 10 hrs on the charger it still won't turn on, no LEDs, no vibration, nothing, a complete black screen so it will NOT boot into recovery or download mode. However, it does seem to take a charge as the back side does get a bit warm when charged. When plugged into the PC (Win 10) it does not get recognized under My PC but I hear the USB plug-in chime and under the Device Manager, I get "Qualcomm HS-USB QDloader 9008" on COM port 3. From what I've found online, seems like I will need the original S8's complete eMMC image and load it onto the sdcard and recover it that way, even if it's possible.
Can anyone help/guide me in the proper direction? Really hoping to recover this device. This might even help others who may have or will brick their S8's. Thanks a lot in advance
Click to expand...
Click to collapse
If this is still an issue you face PM me and i will help you unbrick the device!
TimelessPWN said:
If this is still an issue you face PM me and i will help you unbrick the device!
Click to expand...
Click to collapse
I'm ready to help for unbrick my S8
I have the same exact hard brick on my S8, did you guys ever figure out a solution?
TimelessPWN said:
If this is still an issue you face PM me and i will help you unbrick the device!
Click to expand...
Click to collapse
I have the same error, could you solve it?
did you get it fixed? I think TimelessPWN would have used EDL mode.
mweinbach said:
did you get it fixed? I think TimelessPWN would have used EDL mode.
Click to expand...
Click to collapse
I have not fixed it ye, i need help.
FUBUKY said:
I have not fixed it ye, i need help.
Click to expand...
Click to collapse
ok. from what i am reading, you have a hard brick. that QDloader 9008 is EDL mode. the EDL files that we got from QUALCOMM must be sent to you, and you have to run a QUALCOMM software and apply those files through EDL. I currently have the files but I am not 100% sure how to use them. I recommend contacting https://www.facebook.com/GSMCHEN.up for help. he 100% can.
mweinbach said:
did you get it fixed? I think TimelessPWN would have used EDL mode.
Click to expand...
Click to collapse
FUBUKY said:
I have not fixed it ye, i need help.
Click to expand...
Click to collapse
mweinbach said:
ok. from what i am reading, you have a hard brick. that QDloader 9008 is EDL mode. the EDL files that we got from QUALCOMM must be sent to you, and you have to run a QUALCOMM software and apply those files through EDL. I currently have the files but I am not 100% sure how to use them. I recommend contacting for help. he 100% can.
Click to expand...
Click to collapse
thx man, i am retry repair.
mweinbach said:
ok. from what i am reading, you have a hard brick. that QDloader 9008 is EDL mode. the EDL files that we got from QUALCOMM must be sent to you, and you have to run a QUALCOMM software and apply those files through EDL. I currently have the files but I am not 100% sure how to use them. I recommend contacting https://www.facebook.com/GSMCHEN.up for help. he 100% can.
Click to expand...
Click to collapse
Do you mind sharing the files sir? I have this issue and need the files please
Regards,
.:112:.
Sent from my SM-G928T using Tapatalk
stuntman112 said:
Do you mind sharing the files sir? I have this issue and need the files please
Regards,
.:112:.
Sent from my SM-G928T using Tapatalk
Click to expand...
Click to collapse
I have been told not to. Sorry.
I hope soon a solution comes out, while I continue with my brick.
GSMCHEN apparently can repair them, but you have not answered my messages.
I found the files needed. Will upload a link tonight
Sent from my SM-G928T using Tapatalk
stuntman112 said:
I found the files needed. Will upload a link tonight
Sent from my SM-G928T using Tapatalk
Click to expand...
Click to collapse
thank you very much, I hope the link to try to unbrick my s8 +
Some of the files are in plain sight at AFH. The developer has all the required QCOM tools at the link.
Prog_UFS_Firehose_8998_ddr.elf file:
https://androidfilehost.com/?fid=961840155545585810
Notice it is UFS storage, not EMMC so make sure you have the latest QPST software. Thanks to the developer (hazmat) for the prog file but i believe we will need others also such as .XML's
Messed around with it for a little but didnt figure it out. Hopefully this is a start to dead boot repair for the SM-G955..The Dream2 awakes..
Sent from my SM-G928T using Tapatalk
stuntman112 said:
Some of the files are in plain sight at AFH. The developer has all the required QCOM tools at the link.
Prog_UFS_Firehose_8998_ddr.elf file:
https://androidfilehost.com/?fid=961840155545585810
Notice it is UFS storage, not EMMC so make sure you have the latest QPST software. Thanks to the developer (hazmat) for the prog file but i believe we will need others also such as .XML's
Messed around with it for a little but didnt figure it out. Hopefully this is a start to dead boot repair for the SM-G955..The Dream2 awakes..
Sent from my SM-G928T using Tapatalk
Click to expand...
Click to collapse
without the xml files it does not help us.
I had already tried it, the xml files that it has shared (hazmat) are from xiaomi.
mweinbach said:
I have been told not to. Sorry.
Click to expand...
Click to collapse
That's the right thing to do,
Anyway, we have to protect these documents, right
Could not get the device un bricked. Thanks GSM CHEN for help. Possible CPU hardware problem. Seems stuck in EDL
LOG
Programmer Path:C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\prog_ufs_firehose_8998_ddr.elf
Image Search Path: C:\Users\User1\Desktop\nhlos\common\tools\emergency_download
RAWPROGRAM file path: C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\rawprogram0.xml
PATCH file path:C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\patch0.xml
Start Download
Program Path:C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\prog_ufs_firehose_8998_ddr.elf
***** Working Folder:C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\prog_ufs_firehose_8998_ddr.elf
11:44:18: Requested ID 13, file: "C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\prog_ufs_firehose_8998_ddr.elf"
11:44:18: 599432 bytes transferred in 0.172000 seconds (3.3236MBps)
11:44:18: File transferred successfully
11:44:18: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:UFS
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
***** Working Folder:C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11
Base Version: 16.10.28.15.28
Binary build date: Oct 31 2016 @ 22:51:02
Incremental Build version: 16.10.31.22.51.02
11:44:22: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM11 --sendxml=rawprogram0.xml --search_path=C:\Users\User1\Desktop\nhlos\common\tools\emergency_download --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=ufs
************************************************
11:44:22: INFO: Current working dir (cwd): C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11\
11:44:22: INFO: Showing network mappings to allow debugging
11:44:22: INFO:
11:44:22: INFO: Trying to store 'rawprogram0.xml' in string table
11:44:22: INFO: Looking for file 'rawprogram0.xml'
11:44:22: INFO: User wants to talk to port '\\.\COM11'
11:44:22: INFO: Took 0.00000000 seconds to open port
11:44:22: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
11:44:22: INFO: If you don't want this, use --dontsorttags
11:44:22: INFO: Looking for file 'gpt_main0.bin'
11:44:22: INFO: Looking for file 'gpt_backup0.bin'
11:44:22: INFO:
Total to be tansferd with <program> or <read> is 44.00 KB
11:44:22: INFO: Sending <configure>
11:44:22: INFO: TARGET SAID: 'Binary build date: Jun 1 2017 @ 14:29:30'
11:44:22: INFO: TARGET SAID: 'Chip serial num: 4294967295 (0xffffffff)'
11:44:22: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '
11:44:22: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
11:44:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
11:44:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
11:44:22: INFO: In handleProgram('gpt_main0.bin')
11:44:22: INFO: Looking for file 'gpt_main0.bin'
11:44:22: INFO: =======================================================
11:44:22: INFO: {<program> FILE: 'C:\Users\User1\Desktop\nhlos\common\tools\emergency_download\gpt_main0.bin'}
11:44:22: INFO: {<program> (24.00 KB) 6 sectors needed at location 0 on LUN 0}
11:44:22: INFO: =======================================================
11:44:22: INFO: TARGET SAID: 'ERROR: Failed to initialize (open whole lun) UFS Device slot 0 partition 0'
11:44:22: INFO: TARGET SAID: 'ERROR: ufs_open_error_code 0 :: 0x27c'
11:44:22: INFO: TARGET SAID: 'ERROR: last ufs_open_error_code 16 :: 0x27c'
11:44:22: INFO: TARGET SAID: 'ERROR: Failed to open the device 3 slot 0 partition 0'
11:44:22: INFO: TARGET SAID: 'INFO: Device type 3, slot 0, partition 0, error 0'
11:44:22: INFO: TARGET SAID: 'WARN: Get Info failed to open 3 slot 0, partition 0, error 0'
11:44:22: INFO: TARGET SAID: 'storage_device_get_num_partition_sectors FAILED!'
11:44:22: INFO: TARGET SAID: 'parseSectorValue could not handle start_sector value'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
11:44:22: {ERROR: program FAILED - Please see log}
Writing log to 'C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11\port_trace.txt', might take a minute
Log is 'C:\Users\User1\AppData\Roaming\Qualcomm\QFIL\COMPORT_11\port_trace.txt'
Download Fail:FireHose Fail:FHLoader Failrocess fail
Finish Download
Sent from my SM-G928T using Tapatalk
a me has not helped me yet.
my phone stuck at erecovery mode . i did flash it with new rom using the dc phoenix but it turn out failed.
here is the progress :
Build number: :COR-L29 9.0.0.193(SP53C636E2R1P12)
Model: COR-L29
Battery state: 4885mv
OEM lock state info:
FB LockState: LOCKED
USER LockState: LOCKED
OEM get bootinfo:
locked
Process identifier:18080917
Getting build number...
Getting base version...
Getting cust version...
Getting preload version...
Erasing ver .. .
File size: 5,037,310,948 bytes
Current version(CURVER): CORC00B000
Writing rescue_recovery_kernel partition
rescue_recovery_kernel partition UPDATE ...OK
Writing rescue_recovery_ramdisk partition
rescue_recovery_ramdisk partition UPDATE ...OK
Writing rescue_recovery_vendor partition
rescue_recovery_vendor partition UPDATE ...OK
USB Device REMOVAL
Type: @OEM83.inf,%tplinkfastboot%;Android Bootloader Interface
VidPid: VID_18D1&PID_D00D
Instance id: 5&118960b2&0&2
Looking for device in upgrade mode...
USB Device INSERTION
Type: @OEM148.inf,%busfilter.devicedesc%;USB Composite Device
VidPid: VID_12D1&PID_107E
Instance id: 5&118960b2&0&2
COM11: DBAdapter Reserved Interface (COM11)
COM12: Android Adapter PCUI (COM12)
8/29/2019 3:56:10 PM Starting to write device in UPGRADE mode...
Device found: XTX7N18830004739
8/29/2019 3:56:38 PM start to write update file
File to update: UPDATE_SD.APP
File size: 5,037,310,948 bytes
Current version(CURVER): CORC00B000
Process identifier:18080974
Validating file...
Looking for attached port...
Preparing to write...
Writing file 1 of 43: SHA256RSA...OK
Writing file 2 of 43: CRC...OK
Writing file 3 of 43: CURVER...OK
Writing file 4 of 43: VERLIST...
Error downloading file 4 of 43
Error writing software
8/29/2019 3:57:16 PM Writing device finished with ERROR
anyone can help me with this ?
Thanks to @Jirmd for letting me use his post as a reference.
Original post: https://forum.xda-developers.com/nexus-7/general/unbrick-nexus-7-tegra-3-device-t4078627
Alternative Method:
1. https://github.com/tofurky/tegra30_debrick
2. https://forum.xda-developers.com/t/...-without-another-n7-or-tegra30-device.4305955
(Both methods do not require another Nexus 7)
Requirements:
1. Linux-based OS (I use Ubuntu 18.04)
2. NvFlash and Wheelie (You can download the Linux version down below)
3. A USB cable (A good and sturdy one)
4. Nerve of steel lol
5. Must have APX driver installed.
6. Another Nexus 7 (Ask someone that have it or ask me)(MUST BE ROOTED AND HAVE TWRP RECOVERY INSTALLED)
7. ADB (platform-tools)
1. DUMP SBK VIA USB
Step 1: Download fusee-launcher for Nexus 7 from this link and extract it to a folder:
http://www.mediafire.com/file/sgwsa79idk24z8u/fusee-launcher-n7.zip/file
Step 2: Open a terminal inside of the folder then type:
Code:
sudo apt-get install python-usb python3-usb
Wait for it to complete. After that, type:
Code:
pip install pyusb
Step 3: Connect your device to a USB 3.0 port (REQUIRED). You can check for connection using "lsusb". There must be a "NVidia Corp" in the list.
Step 4: Type:
Code:
sudo ./fusee-launcher.py –tty dump-sbk-via-usb.bin
Something like this should appear:
Code:
05f4a5d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x00004de0
overwrite_payload_off: 0x00004de0
payload_second_length: 0x0000c7b0
b'00a0004000300040e04d0000b0c70000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'
Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x00000000
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 73728 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
txing 4096 bytes (20480 already sent) to buf[1] 0x40005000
txing 4096 bytes (24576 already sent) to buf[0] 0x40003000
txing 4096 bytes (28672 already sent) to buf[1] 0x40005000
txing 4096 bytes (32768 already sent) to buf[0] 0x40003000
txing 4096 bytes (36864 already sent) to buf[1] 0x40005000
txing 4096 bytes (40960 already sent) to buf[0] 0x40003000
txing 4096 bytes (45056 already sent) to buf[1] 0x40005000
txing 4096 bytes (49152 already sent) to buf[0] 0x40003000
txing 4096 bytes (53248 already sent) to buf[1] 0x40005000
txing 4096 bytes (57344 already sent) to buf[0] 0x40003000
txing 4096 bytes (61440 already sent) to buf[1] 0x40005000
txing 4096 bytes (65536 already sent) to buf[0] 0x40003000
txing 4096 bytes (69632 already sent) to buf[1] 0x40005000
txing 4096 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
b'4445414442454546'
DEADBEEF
b'3030303030303030'
00000000
b'3030303030303030'
00000000
b'3034303030303930'
04000090
b'4634314330433241'
F41C0C2A
b'3133333731333337'
13371337
b'3535353535353535'
55555555
b'3430303033303030'
40003000
b'3430303035303030'
40005000
b'4141414141414141'
AAAAAAAA
b'3131313131313131'
11111111
b'3030303030303236'
00000026
b'3232323232323232'
22222222
b'68656c6c6f2c20776f726c640a00'
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'
Traceback (most recent call last):
File "./fusee-launcher.py", line 823, in <module>
buf = switch.read(USB_XFER_MAX)
File "./fusee-launcher.py", line 530, in read
return self.backend.read(length)
File "./fusee-launcher.py", line 134, in read
return bytes(self.dev.read(0x81, length, 3000))
File "/usr/local/lib/python3.6/dist-packages/usb/core.py", line 988, in read
self.__get_timeout(timeout))
File "/usr/local/lib/python3.6/dist-packages/usb/_debug.py", line 60, in do_trace
return f(*args, **named_args)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 833, in bulk_read
timeout)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 936, in __read
_check(retval)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 595, in _check
raise USBError(_strerror(ret), ret, _libusb_errno[ret])
usb.core.USBError: [Errno 110] Operation timed out
Search for the line "hello, world" inside of your log. It looks like this in this example:
Code:
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'
The last 8 characters are not your SBK. This is the first 8 numbers of your Device ID. Delete this and delete the b' at the start and also the ' at the end.
The result should look like this:
Code:
e57de3bab6cb499d874d5772cb219f01
Congratulation, you have successfully dump your device SBK via USB.
2. GETTING YOUR CPU UID
Step 1: Download Wheelie and NvFlash then extract it to a folder.
Step 2: Download this broken blob.bin file (REQUIRE)
http://www.mediafire.com/file/32cxvjv2wajokqf/blob.bin/file
Then place it inside of the Wheelie and NvFlash folder.
Step 3: Open a terminal inside of the folder then type:
Code:
./wheelie --blob blob.bin
After that, something like this should appear:
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
[=] Chip UID: 0x98254853062001158
[-] Incorrect SBK or SBK type selected. nverror: 0x4.
Search for "Chip UID", remove the "0x" at the beginning. The result should look like this:
Code:
98254853062001158
Congratulation, you got your chip UID
3. GENERATE BLOB FILES USING ANOTHER NEXUS 7
Step 1: Download MkNvfBlob from this link:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/precompiled/precompiledN7.tar.xz
Note: Extract this to your Nexus 7.
Step 1.1: Reboot into TWRP recovery.
Step 2: Open a terminal inside of you ADB folder then type:
Code:
adb shell
After that:
Code:
su
Type this command after that:
Code:
mkdir /AndroidRoot
Last one:
Code:
cat /proc/cpuinfo > /AndroidRoot/cpuinfo
Pull the cpuinfo file using this command:
Code:
adb pull /AndroidRoot
Note: You could copy your cpuinfo file to your PC using MTP (IDK how to do this so search Google lol)
Open your ADB folder and there should be a AndroidRoot folder with a cpuinfo file inside of it.
Open cpuinfo using a Text Editor. Something like this should be inside:
Code:
Processor : ARMv7 Processor rev 9 (v7l)
processor : 0
BogoMIPS : 1993.93
processor : 1
BogoMIPS : 1993.93
processor : 2
BogoMIPS : 1993.93
processor : 3
BogoMIPS : 1993.93
Features : swp half thumb fastmult vfp edsp neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 9
Hardware : grouper
Revision : 0000
Serial : 015d4a5f202c0401
Replace the Serial line with your Chip UID.
After that, place the cpuinfo file back to the /AndroidRoot folder on your device using this command:
Code:
adb push AndroidRoot /
After you are done, don't close the ADB windows.
Step 3: Download bootloader.xbt:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bootloaders/bootloader.grouper.XBT
And BCT for your device:
https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bct/n7.bct
And copy these two files to the /AndroidRoot folder on your device.
Step 4: Type this command on the ADB windows:
Code:
cd /AndroidRoot
After that, type:
Code:
chmod 777 ./mknvfblob
After that, type:
Code:
./mknvfblob -W -K <your SBK> --blob /AndroidRoot/test.blob --bctin /AndroidRoot/n7.bct --bctr /AndroidRoot/testr.bct --bctc /AndroidRoot/testc.bct --blin /AndroidRoot/bootloader.grouper.XBT --blout /AndroidRoot/test.ebt
Wait for it to do its job.
After that, go to your /AndroidRoot folder and copy all the file that just got generated (testr.bct, testc.bct. test.ebt, test.blob) to your PC using the adb pull command on Step 2
Congratulation, you have successfully generate blob for your bricked device.
4. UNBRICK YOUR DEVICE (The fun part )
Step 1: Boot your bricked device into APX mode either using Power button or Power + Vol UP.
Step 2: Open a terminal inside of the folder where you place your NvFlash folder (move the blob file inside of that folder, all of them)
Step 3: Open a terminal inside of your Wheelie and NvFlash folder. Type:
Code:
sudo ./nvflash --bl test.ebt --bct testr.bct --blob test.blob
If you got this command:
Code:
command error: no command found
Then try this one instead:
Code:
./nvflash --setbct --create --configfile <your flash.cfg> --bl test.ebt --bct testr.bct --blob test.blob
If you got the NvError, its fine.
Something like this should appear (the first command):
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000
chip uid from BR is: 0x0000000000000000015d2bc285340e0f
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2bc285340e0f
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: recovery.bct
- 6128/6128 bytes sent
recovery.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.ebt
- 2146912/2146912 bytes sent
bootloader.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
A Google Logo should appear on your device screen with the text "Battery is too low" on the upper left corner. Unplug the battery and replug it. After that, plug it into a wall charger for atleast 4 hour.
Step 4: Unplug the battery and boot into APX mode again using the button combination.
Step 5: Type this command while holding down the Vol DOWN button:
Code:
sudo ./nvflash --resume --download 8 boot.img
Replace "boot.img" with your ROM boot.img file. If you download another boot.img that isn't for your ROM, your device will bootloop.
Step 6:
Type:
Code:
sudo ./nvflash --resume --download 4 bootloader.img
Replace "bootloader.img" with your bootloader.img file name (You could get it inside of the Factory Image)
And after its done, your device should technically unbrick now. But I still recommend you re-flash stock ROM.
Step 7: The final step
Boot into your OS using the command below:
Code:
sudo ./nvflash --resume --go
If your device boot back into APX mode, maybe you have done something wrong. Try again.
If you got a Google logo on your device then congratulation! Your device is now unbricked.
Note: If step 7 didn't work, try booting this recovery image using this command:
Code:
fastboot boot flatline_grouper.img
Link for the recovery image is in the "Links" section.
Note: To get into Fastboot, add the "--go" line at the end of the command in Step 5
Code:
sudo ./nvflash --resume --download 8 boot.img --go
HOLD DOWN VOL DOWN while doing this command, you should get into fastboot at
After you are in the Flatline recovery, navigate to the "Advanced" section using the VOL buttons. Select it using the POWER button.
Select the "wheelie" at the end of the list.
Select "I agree".
After that, select "Step 1: Flash AndroidRoot.mobi custom bootloader." IGNORE Step 2 because it won't gonna work anyways.
Your device should reboot and the Google logo should appear, that means that your device is unbricked.
Note: If you wanted to flash stock ROM, open the "image-*******.zip" inside of the factory image and open the android-info.txt file. Edit the "require-bootloader" line to "4.13". After that, it should work.
Links:
flash.cfg: http://www.mediafire.com/file/j90hc1dfz58aytq/flashcfg.zip/file
flatline_grouper.img: https://www.mediafire.com/file/z1jvgy6km33f7bf/flatline_grouper.img/file
Wheelie, NvFlash and platform-tools (For ADB) (Works for both Linux and Windows): https://www.mediafire.com/file/0nuy4indgvagq3v/nvflash-and-platformtool.zip/file
Download the Factory Image for your Nexus 7 incase you want to re-flash stock ROM (nakasi or nakasig): https://developers.google.com/android/images#nakasi
That is. If you need any help, message me.
Update: After a few days of troubleshooting, fixing and updating my post, it seems like the step to unbrick your Nexus 7 2012 may depends on how did you brick it, what OS version you are running or the condition of your device. So you may have to "think outside the box" sometimes in this guide.
Update #2: Some helpful advice from @Jirmd with some minor change:
When you get this error :
Code:
Nvflash v1.10.76762 started
Using blob v1.13.00000
chip uid from BR is: 0x0000000000000000015d4a5f202c0401
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d4a5f202c0401
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 2
device config fuse: 17
sdram config strap: 1
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0
after this command :
Code:
./nvflash --configfile flash.cfg --create --bct testr.bct --setbct --bl test.ebt --blob test.blob --sync
Probably you have broken your internal storage!
You can probably flash:
Bootloader image (bootloader.img)
Kernel image (boot.img)
Recovery image (recovery.img aka TWRP)
But you CAN'T flash a new system via TWRP or fastboot, because the bootloader or the recovery was unable to connect to the partitions table.
You can try this command to erase bad blocks:
Code:
./nvflash --resume --configfile flash.cfg --obliterate
Reboot to APX mode and try the above command again.
But, broken internal storage is pretty much unrepairable.
There is some possibility of disassembly your device and overheat your memory IC, but this method is not easy and need more technical skill.
And in my case this did not help.
Click to expand...
Click to collapse
In my case, this command also gives me the nverror 0x4 but it also did something to my Nexus 7 as it was required for the next step.
Update #3: Updated the guide and removed some unessacery steps.
Update #4: Updated.
Hi, enderzip...
I've been keeping track of the recent developments regarding bricked Nexus 7's, APX mode and nvFlash, here on XDA. There's currently quite a few threads on this topic.
As I understand it, you've been motivated by a desire to recover data from your bootloader bricked Nexus 7. So my question is simple...
'Have you been successful?'
Have you actually resurrected a bricked Nexus 7 with no functioning bootloader AND with no originally created flatline wheelie blobs?
If so, you have done what I thought could not be done! I tip my hat to you, with your tenacity and your technical understanding of the complex issues involved.
If I had a Linux system myself, I'd be half-minded to dig out my old Nexus 7, deliberately bugger up the bootloader, and follow your instructions for the sheer technical challenge!
--------------------------------------
Some general thoughts...
The Nexus 7 is old (c.2012), and likely not many people use it anymore, but that's not what's important here. What is important is the persistence, the huge technical ability, and the sheer bloody minded refusal ~ by some ~ to let their Nexus 7 die... to go into what the poet Dylan Thomas called that 'good night'...
"Do not go gentle into that good night,
Old age should burn and rave at close of day;
Rage, rage against the dying of the light."
https://poets.org/poem/do-not-go-gentle-good-night
And in so doing, mayhap enderzip and others, have provided potential clues for other devices, other hardware, other phones or tablets, when faced with similar hard brick problems. One can but hope.
The above post by enderzip is technically way beyond me, and I have no immediate use for it, but it's a fundamental distillation of everything XDA stands for - namely, experimentation and creativity.
It's basically, amazing!
Thanks enderzip
Rgrds,
Ged.
Hello Enderzip,
Thank you so much for this very good an detailed tuto.
I followed cautiously your instructions but I am blocked @ step 3.
The command "mkdir /AndroidRoot" returns "mkdir : '/AndroidRoot' : Read-only file system".
I suspect Android system partition as read only but does know way to change.
I would appreciate your clever support.
Thank you in advance.
Envoyé de mon Nexus 4 en utilisant Tapatalk
zak4 said:
Hello Enderzip,
Thank you so much for this very good an detailed tuto.
I followed cautiously your instructions but I am blocked @ step 3.
The command "mkdir /AndroidRoot" returns "mkdir : '/AndroidRoot' : Read-only file system".
I suspect Android system partition as read only but does know way to change.
I would appreciate your clever support.
Thank you in advance.
Envoyé de mon Nexus 4 en utilisant Tapatalk
Click to expand...
Click to collapse
You could manually create the folder if you have root. By using those Root File explorer on Google Play Store.
I recommend you using this one: https://play.google.com/store/apps/details?id=com.clearvisions.explorer
Open the app then go to the root section, create a new folder name: AndroidRoot
And you are good to go.
If the above method didnt work, type these command one by one:
Code:
adb shell
su
mount -o rw,remount /system
You can mount your /system back to Read-Only using this command:
Code:
mount -o ro,remount /system
GedBlake said:
Hi, enderzip...
I've been keeping track of the recent developments regarding bricked Nexus 7's, APX mode and nvFlash, here on XDA. There's currently quite a few threads on this topic.
As I understand it, you've been motivated by a desire to recover data from your bootloader bricked Nexus 7. So my question is simple...
'Have you been successful?'
Have you actually resurrected a bricked Nexus 7 with no functioning bootloader AND with no originally created flatline wheelie blobs?
If so, you have done what I thought could not be done! I tip my hat to you, with your tenacity and your technical understanding of the complex issues involved.
If I had a Linux system myself, I'd be half-minded to dig out my old Nexus 7, deliberately bugger up the bootloader, and follow your instructions for the sheer technical challenge!
--------------------------------------
Some general thoughts...
The Nexus 7 is old (c.2012), and likely not many people use it anymore, but that's not what's important here. What is important is the persistence, the huge technical ability, and the sheer bloody minded refusal ~ by some ~ to let their Nexus 7 die... to go into what the poet Dylan Thomas called that 'good night'...
"Do not go gentle into that good night,
Old age should burn and rave at close of day;
Rage, rage against the dying of the light."
https://poets.org/poem/do-not-go-gentle-good-night
And in so doing, mayhap enderzip and others, have provided potential clues for other devices, other hardware, other phones or tablets, when faced with similar hard brick problems. One can but hope.
The above post by enderzip is technically way beyond me, and I have no immediate use for it, but it's a fundamental distillation of everything XDA stands for - namely, experimentation and creativity.
It's basically, amazing!
Thanks enderzip
Rgrds,
Ged.
Click to expand...
Click to collapse
Yes, I have successfully unbrick my Nexus 7 WITHOUT any type of blob file i have generated before.
And no, you should thank @Jirmd instead of me. If he didn't post his thread, my Nexus is still probably a paperweight.
Deleted.
@enderzip
Thank you Enderzip. I succeeded the creation of AndroidRoot with the command for write permission on system.
I have another issue about extraction of SBK of my bricked Nexus 7. I prepared everything (download of fusee-launcher, pyusb installation ...), checked connection of my device through APX (see below) but when I type sudo ./fusee-launcher.py –tty dump-sbk-via-usb.bin I got :
[email protected]:~/Downloads/fusee-launcher-n7$ lsusb
Bus 002 Device 096: ID 058f:6362 Alcor Micro Corp. Flash Card Reader/Writer
Bus 002 Device 061: ID 0955:7330 NVIDIA Corp.
Bus 002 Device 004: ID 046d:0805 Logitech, Inc. Webcam C300
Bus 002 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
...
[email protected]:~/Downloads/fusee-launcher-n7$ sudo ./fusee-launcher.py --tty dump-sbk-via-usb.bin
sudo: ./fusee-launcher.py : command not found
Sorry to be blocked again.
@enderzip
I found a solution to my issue by allowing the "execution of the file as program" in the permissions of fusee-launcher.py file.
Fusee-launcher started but quickly stopped before application stack dumping : message delivered by fusee-launcher is to use USB 3.0 and I realized that I have only USB 2.0 on my old desk computer.
Does someone know how to patch EHCI driver ? Is it a possible solution ?
Thanks for your advice.
enderzip said:
Yes, i have successfully unbrick my Nexus 7 WITHOUT any type of blob file i have generated before.
And no, you should thank @Jirmd instead of me. If he didn't post his thread, my Nexus is still probably a paperweight.
Click to expand...
Click to collapse
enderzip, wow, you soo good and cool. I am totaly glad for this, how you make your tutorial. And we must give thanks for AndroidRoot team and Jenkinsen. Without this people, we all have only paperweight.
Now, i will try make my moded mknvfblob worked standalone. Without Tegra 3, only on linux X86 PC.
And, i will try make tutorial for nexus 7 , how boot linux from usb, without multiboot. ( For case, when is your internal storage totaly unreparable damaged.)
Deleted.
Thank you Enderzip. I will follow your advice and buy a USB 3.0 PCI Express card and try later.
Again many thanks to you and Jmrd for your tutorial that will enable us to revive our bricked Nexus 7.
Envoyé de mon Nexus 4 en utilisant Tapatalk
I know this might be a stupid question, but what is the boot.img at step 6? The grouper factory image contains a "bootloader-grouper-4.23.img" and a zip containing a "boot.img", I guess that's the file we should flash?
gormatrax said:
I know this might be a stupid question, but what is the boot.img at step 6? The grouper factory image contains a "bootloader-grouper-4.23.img" and a zip containing a "boot.img", I guess that's the file we should flash?
Click to expand...
Click to collapse
The boot.img is inside the .zip inside of the factory image. I think the name is "image-nz---.zip"
Step 5 works and returns the same as in the guide, the tablet shows the google logo, without the battery too low in the corner.
However, at step 6, i get this:
Code:
Nvflash v1.13.87205 started
[resume mode]
command failure: Error querying partition type (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0
what should i do?
edit: for good measure this is the result from step 5:
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000iles ┼§˛■q
chip uid from BR is: 0x0000000000000000015d25689b3c1019
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d25689b3c1019
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0
@enderzip thank you so much for this detailed guide. Now I was able to generate the image (blobs) myself. When flashin the images (blobs), both the ones generated by you and the ones generated by me, following error is received... Could you help on this?
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
Waiting for device in APX mode...
[=] Chip UID: 0x15d16897a500403
[=] RCM Version: 0x30001
[=] CPU Model: Tegra 3
[+] Sending bootloader...
[-] Error 3 sending command
Thanks Steffen
gormatrax said:
Step 5 works and returns the same as in the guide, the tablet shows the google logo, without the battery too low in the corner.
However, at step 6, i get this:
Code:
Nvflash v1.13.87205 started
[resume mode]
command failure: Error querying partition type (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0
what should i do?
edit: for good measure this is the result from step 5:
Code:
Nvflash v1.13.87205 started
Using blob v1.13.00000iles ┼§˛■q
chip uid from BR is: 0x0000000000000000015d25689b3c1019
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d25689b3c1019
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: test.ebt
- 2146896/2146896 bytes sent
test.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 0 3
failed executing command 11 NvError 0x120002
command failure: create failed (bad data)
bootloader status: specified device is invalid (code: 6) message: nverror:0x4 (0x4) flags: 0
Click to expand...
Click to collapse
In this case, uss this command instead:
Code:
sudo ./nvflash --setbct --create --configfile <flash.cfg file name> --resume --download 8 boot.img --go
It may or may not work.
enderzip said:
In this case, uss this command instead:
Code:
sudo ./nvflash --setbct --create --configfile <flash.cfg file name> --resume --download 8 boot.img --go
It may or may not work.
Click to expand...
Click to collapse
It doesn't work, it says that --resume must be first in the command. I moved it to the front, but then it said that it needed the bct file:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
bct file required for this command
command failure: create failed
I tried passing the testr.bct to it, but it looks even worse:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --bct testr.bct --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
failed executing command 12 NvError 0x120002
command failure: create failed (bad data)
bootloader status: module is in invalid state to perform the requested operation
(code: 4) message: nverror:0x8 (0x8) flags: 0
When executing each command, the tablet was showing the Google logo, after performing part 4 step 4.
Note that I also get the error that @steffenm82 is getting when running
Code:
wheelie --blob test.blob
, however that didn't stop the next step from working...
gormatrax said:
It doesn't work, it says that --resume must be first in the command. I moved it to the front, but then it said that it needed the bct file:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
bct file required for this command
command failure: create failed
I tried passing the testr.bct to it, but it looks even worse:
command:
Code:
nvflash --resume --setbct --create --configfile flash16.cfg --bct testr.bct --download 8 boot.img --go
result:
Code:
Nvflash v1.13.87205 started
[resume mode]
sending file: testr.bct
- 6128/6128 bytes sent
testr.bct sent successfully
failed executing command 12 NvError 0x120002
command failure: create failed (bad data)
bootloader status: module is in invalid state to perform the requested operation
(code: 4) message: nverror:0x8 (0x8) flags: 0
When executing each command, the tablet was showing the Google logo, after performing part 4 step 4.
Note that I also get the error that @steffenm82 is getting when running
Code:
wheelie --blob test.blob
, however that didn't stop the next step from working...
Click to expand...
Click to collapse
Hmm, have you tried switching the USB port? Maybe the USB cable too.
steffenm82 said:
@enderzip thank you so much for this detailed guide. Now I was able to generate the image (blobs) myself. When flashin the images (blobs), both the ones generated by you and the ones generated by me, following error is received... Could you help on this?
Code:
Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
Waiting for device in APX mode...
[=] Chip UID: 0x15d16897a500403
[=] RCM Version: 0x30001
[=] CPU Model: Tegra 3
[+] Sending bootloader...
[-] Error 3 sending command
Thanks Steffen
Click to expand...
Click to collapse
Sorry for my late reply, in this case, try skipping to the next step.
I must say that @enderzip guide make my nexus 7 back on it´s feet despite not having previously generated blobs. After some days of research and some nights via PM and FB messenger he managed to bring my Nexus back on. So Yes @GedBlake he managed to unbrick a nexus 7 with no previous generated blobs. But the mentor of this tutorial was @Jirmd. In adittion, thanks to this 2 wonderful persons that make my Nexus 7 back to it´s gold years!!!
Hello everyone, im flashing my bricked 11T pro.
Im using latest QPST with QFIL, I have installed correct drivers for pc and my phone enters edl mode.
However when I try to flash Im getting this error
12:35:07: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=rawprogram0.xml --search_path=C:\Program Files (x86)\Qualcomm\QPST\bin --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
************************************************
12:35:07: DEBUG: Binary build date: Jun 25 2019 @ 03:16:10
12:35:07: DEBUG: Build Version: 19.06.25.03.16.10
12:35:07: INFO: Current working dir (cwd): C:\Users\Ara\AppData\Roaming\Qualcomm\QFIL\COMPORT_3\
12:35:07: INFO: Showing network mappings to allow debugging
12:35:07: DEBUG: New connections will be remembered.
12:35:07: DEBUG:
12:35:07: DEBUG: There are no entries in the list.
12:35:07: DEBUG:
12:35:07: INFO:
12:35:07: INFO: Trying to store 'rawprogram0.xml' in string table
12:35:07: DEBUG: ==================================================================================
12:35:07: DEBUG: ==================================================================================
12:35:07: INFO: Looking for file 'rawprogram0.xml'
12:35:07: DEBUG: 1. Calling stat('C:\Program Files (x86)\Qualcomm\QPST\bin\rawprogram0.xml')
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\rawprogram0.xml') with AccessMode='rb'
12:35:07: DEBUG: Trying get filesize, calling fseek()
12:35:07: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\rawprogram0.xml' (10686 bytes)
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\rawprogram0.xml') with AccessMode='r'
12:35:07: DEBUG: Trying get filesize, calling fseek()
12:35:07: DEBUG: ==================================================================================
12:35:07: DEBUG: ==================================================================================
12:35:07: INFO: Looking for file 'metadata.img'
12:35:07: DEBUG: 1. Calling stat('C:\Program Files (x86)\Qualcomm\QPST\bin\metadata.img')
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\metadata.img') with AccessMode='rb'
12:35:07: DEBUG: Trying get filesize, calling fseek()
12:35:07: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\metadata.img' (45132 bytes)
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\metadata.img') with AccessMode='rb'
12:35:07: INFO: Reading through sparse file 'metadata.img' and pulling out relevant header information...
12:35:07: INFO: File metadata.img is a sparse file, being split up into 2 separate XML tags
12:35:07: DEBUG: ==================================================================================
12:35:07: DEBUG: ==================================================================================
12:35:07: INFO: Looking for file 'cust.img'
12:35:07: DEBUG: 1. Calling stat('C:\Program Files (x86)\Qualcomm\QPST\bin\cust.img')
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\cust.img') with AccessMode='rb'
12:35:07: DEBUG: Trying get filesize, calling fseek()
12:35:07: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\cust.img' (1420882428 bytes)
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\cust.img') with AccessMode='rb'
12:35:07: INFO: Reading through sparse file 'cust.img' and pulling out relevant header information...
12:35:07: INFO: File cust.img is a sparse file, being split up into 15 separate XML tags
12:35:07: DEBUG: ==================================================================================
12:35:07: DEBUG: ==================================================================================
12:35:07: INFO: Looking for file 'super.img'
12:35:07: DEBUG: 1. Calling stat('C:\Program Files (x86)\Qualcomm\QPST\bin\super.img')
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\super.img') with AccessMode='rb'
12:35:07: DEBUG: Trying get filesize, calling fseek()
12:35:07: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\super.img' (8224175424 bytes)
12:35:07: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\super.img') with AccessMode='rb'
12:35:07: INFO: Reading through sparse file 'super.img' and pulling out relevant header information...
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
12:35:07: {ERROR: sparse_open:2625 Unknown chunk type cac2
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
File super.img is in bin folder of qfil ,
I also tried launching program with administrator rights.
I get another error -_-
Click to expand...
Click to collapse
Right now I will be trying to do the same on different PC.
Sahara is a brittle protocol. If anything goes wrong or you disconnect the cable you have to start all over with a reset and go to EDL mode.
Edit: Oh, and it looks like your super.img is a corrupt sparse file (or too advanced for this tool?)
Try to flash partition one at a time with cmd fhloader, you can see the commands or fhloader --help in cmd
Renate said:
Sahara is a brittle protocol. If anything goes wrong or you disconnect the cable you have to start all over with a reset and go to EDL mode.
Edit: Oh, and it looks like your super.img is a corrupt sparse file (or too advanced for this tool?)
Click to expand...
Click to collapse
I download rom from official xiaomi site , it was in zip archive. I downloaded it again on different laptop with different system and getting the same problem.
Thing is phone is hardly bricked, my friend wanted to flash it to EliteRom but he flashed different model over my xiaomi so boot logo changed to redmi etc, I cant enter fastboot or recovery only EDL mode. I use stock cable
JonasHS said:
Try to flash partition one at a time with cmd fhloader, you can see the commands or fhloader --help in cmd
Click to expand...
Click to collapse
I dont know how to use commands in EDL mode, as I know its only possible to flash roms in EDL
You can see other folks on xda who ran into cac2 as sparse chunk.
I've not had a lot to do with sparse files.
I'd try to inflate the sparse file to non-sparse on your desktop and then you can do a normal write using whatever EDL tool you like.
Renate said:
You can see other folks on xda who ran into cac2 as sparse chunk.
I've not had a lot to do with sparse files.
I'd try to inflate the sparse file to non-sparse on your desktop and then you can do a normal write using whatever EDL tool you like.
Click to expand...
Click to collapse
Ok, where can I find instruction about inflating sparse file to non-sparse ones?
Aramantir said:
Ok, where can I find instruction about inflating sparse file to non-sparse ones?
Click to expand...
Click to collapse
This should work in Linux land:
Code:
cp file.img copy.img --sparse=never
Renate said:
This should work in Linux land:
Code:
cp file.img copy.img --sparse=never
Click to expand...
Click to collapse
so i need to install linux on virtual machine and do this command on super.img?
Aramantir said:
so i need to install linux on virtual machine and do this command on super.img?
Click to expand...
Click to collapse
Dunno. Maybe try:
Code:
C:\>fsutil sparse setFlag super.img 0
Renate said:
Dunno. Maybe try:
Code:
C:\>fsutil sparse setFlag super.img 0
Click to expand...
Click to collapse
I dont know what Im doing wrong, I tried cmd and powershell
Aramantir said:
View attachment 5794769I dont know what Im doing wrong, I tried cmd and powershell
Click to expand...
Click to collapse
QFIL also makes a cmd but it gets stuck on this
Code:
Microsoft Windows [Version 10.0.19045.2364]
(c) Microsoft Corporation. All rights reserved.
C:\>fsutil sparse
---- SPARSE Commands Supported ----
queryFlag Query sparse
queryRange Query range
setFlag Set sparse
setRange Set sparse range
Renate said:
Code:
Microsoft Windows [Version 10.0.19045.2364]
(c) Microsoft Corporation. All rights reserved.
C:\>fsutil sparse
---- SPARSE Commands Supported ----
queryFlag Query sparse
queryRange Query range
setFlag Set sparse
setRange Set sparse range
Click to expand...
Click to collapse
Ok I put all files to C and run command
I guess its best to run it in different folder
Are you as Admin?
The file could be in use too.
Aramantir said:
Ok I put all files to C and run command View attachment 5794781
I guess its best to run it in different folder
Click to expand...
Click to collapse
Ok so its done, now I can flash?
Aramantir said:
View attachment 5794791
Ok so its done, now I can flash?
Click to expand...
Click to collapse
Same error...That sparse thing didn`t worked at all :C
Right now trying different software. I also had 2 programmers in folder of fastboot rom. I choose different one. In some time it failed to connect
I have no experience on the sparse file, so I can't say.
Does dir look any different after the fsutil commands?
Does the File Explorer show you anything different?
Those QFIL utilities are designed to fresh flash something coming off the factory floor.
Most people have not trashed every byte of their device and need to flash everything.
This "rawprogram0.xml" is also a bit overblown. Most of it could just be done with a batch/script file.
And the serial port drivers are straight from hell.
In any case, that's my opinion.
You can try EDL clients that don't need COM port drivers.
https://github.com/bkerler/edl
http://www.temblast.com/edl.htm
The last is mine. I like it. You don't have to. It doesn't do sparse files (yet).
What exactly do you have to flash and how did it get wrecked?
Even without super you should be able to get back to fastboot and have that deal with sparse files.
Renate said:
I have no experience on the sparse file, so I can't say.
Does dir look any different after the fsutil commands?
Does the File Explorer show you anything different?
Those QFIL utilities are designed to fresh flash something coming off the factory floor.
Most people have not trashed every byte of their device and need to flash everything.
This "rawprogram0.xml" is also a bit overblown. Most of it could just be done with a batch/script file.
And the serial port drivers are straight from hell.
In any case, that's my opinion.
You can try EDL clients that don't need COM port drivers.
https://github.com/bkerler/edl
http://www.temblast.com/edl.htm
The last is mine. I like it. You don't have to. It doesn't do sparse files (yet).
What exactly do you have to flash and how did it get wrecked?
Even without super you should be able to get back to fastboot and have that deal with sparse files.
Click to expand...
Click to collapse
So as I said before it got flashed different model of phone.
Like my phone model is Mi11T pro, but someone flashed REDMI K40 ROM ... (because they had super similar name)
So all boot/recovery partitions got overwritten and its impossible for me to enter fastboot and flash stock rom.
Thing I got from Xiaomi site is flashboot rom which contains all that data I need to flash , but having 2 programmer file and a lot of xml files kinda scares me, tomorrow I will be learning how to use your program
From using command you gave before - I didnt saw any changes. There was 86 files in folder and there is 86 files in folder after using it, maybe I did something wrong? About script, xiaomi gives ready scripts for flashing but I guess they are for fastboot flashing
There is also premade python script but I have no idea how to use it