Develop Bugs

S8500 stuck at Bada screen

I hope someone can help me. I tried almost everything. My wave just won't boot normally. It all started when I tried to downgrade from Bada 2.0 (S8500XPKH3) to 1.2 (S8500XXJL2) and got a security port error while flashing (used Multiloader 5.65). My wave wouldn't boot up so I got someone to repair it with JTAG. Good thing it was revived. It can now go to download mode, however, i tried flashing almost all firmware versions (Bada 1.0, 1.2, 2.0) in different regions from samfirmware but to no avail.
I browsed through the forums hoping I can get an answer but I didn't see any similar case. I'm sure I'm doing the flashing right 'coz I get "All files complete." when flashing is done. Only that, every firmware that I try, it just stays in the logo screen when it starts up.
I'm looking forward for any response.
Best regards.

I guessed you have done all well. But still try this process:
1. Download a fresh, full and original firmware for your region from samMobile.com
(The firmware version does not matter, but it has to be full and for your region).
2. Make sure your battery is fully charged
3. Remove SIM and memory card from phone.
4. Ensure that all kies drivers are successfully installed.
5. Use multiLoader v5.65
6. Cross-check that your USB plug is not damaged (if possible use another one)
7. When flashing, make sure you tick the FULL DOWNLOAD option in multiLoader.
Try the above and report back. Best of luck.

yeah you should tick boot change and full download for a complete fresh installation

Good thing it was revived
Click to expand...
Click to collapse
Depend on how it was repaired via JTAG...
Maybe NV items are overwritten... this could be bad.
It is not the best idea to use Fullflash from others...
I have RIFF Box experiences...
Best Regards
P.S.:
Try to flash some Rsrc2_S8500(Mid).rc2
Maybe Bluescreen tell you what is missing...

adfree said:
Depend on how it was repaired via JTAG...
Maybe NV items are overwritten... this could be bad.
It is not the best idea to use Fullflash from others...
I have RIFF Box experiences...
Best Regards
P.S.:
Try to flash some Rsrc2_S8500(Mid).rc2
Maybe Bluescreen tell you what is missing...
Click to expand...
Click to collapse
Thanks for the tips guys. I tried the routine checking. I've also tried different a different pc. Same thing.
I'm more inclined to this adfree. NV items might be corrupted. I just know the basics of flashing.I tried several Rsrc2_s8500 (Mid) and yes I got a blue screen with details. I don't know how to interpret it myself but I remember there was IMEI not active. Will post the details later. Hope you or someone can share your thoughts.
Best regards.

I tried S8500XPKH3 again with Rsrc2_S8500(Mid).rc2 and I got this from Multiloader 5.65:
Download Start Ch[0]
BootLoader 1703.9KB OK[0.7s]
Dbl 281.5KB OK[0.8s]
Wait reset !!
Amss 12740.3KB OK[5.0s]
Apps 26214.4KB OK[12.3s]
Rsrc1 37748.7KB OK[14.4s]
Rsrc2 2884.3KB OK[1.3s]
FFS 49217.5KB OK[111.8s]
CSC 36085.8KB OK[106.0s]
SHPAPP 203259.9KB OK[368.3s]
All files complete[638.0s]
Phone reboots and comes up with blue screen:
S/W version: S8500+XP+KH3
Modem: Q6270B-KPRBL-1.5.45t
SHP: VPP R5 2.1.1
Build Host: S1-AGENT08
Build At: 2011/08/16 20:56:16
Aoo Debug Level: 0
ASSERTION_ASSERT: 0 failed. (file SysSecureBoot.c, line 4193) BoAn4193
<Call stack information>
PC = 4000C8D3 OemDumpRegister
LR = 4000C8D7 OemDumpRegister
<Mocha Task Call stack>
_SysAssertReport
__SysSecBootReadNetLockInfoFromFile
ALL HW Information:
HW VERSION: S8500_rev07
IMEI VERSION: Not Active
RF CAL DATE: Not Active
Bad Block Information:
nNumBMPs: 0
nAge: 0
Run Time Bad Block Occurred:
Init BMPs - 2, Current BMPs = 0
Nucleus Task Information:
Running Task name - Mocha Slices = 0000001E Wait = 00000000
Signal = 00000000 Priority = 0
I've been working on this for a week now but no matter what firmware I flash, i can't get my wave to boot normally

Try qualcomm tools to activate imei
ask Adfree or use google to find the qualcomm tools program and then make your imei active using your pc.
what region was your 8500 originally?
remember that different region firmware use different boot files.
Try to use the boot files that was on your wave originally.

For some reason, it's showing "IMEI not active" when I get the blue screen after flashing with Rsrc2_S8500(Mid).rc2.
I read adfree's qualcomm tools guide and it was more on editing the product code. And, i can't access the configuration mode/hidden menu since I can't boot the phone normally.

IMEI is NV item 550 and ...
But it is secured by...
I have never tried on S8500...
Lost IMEI is enough evidence, that NV items are corrupt/missing/damaged...
I'll try to analyze your Error message...
.. will report later.
Best Regards
Edit 1...
SysSecureBoot
SysSecBootReadNetLockInfoFromFile
Click to expand...
Click to collapse
Maybe also Netlock? So maybe without IMEI Security check failes...

I think the guy who tried to resurrect my phone was using JTAG Medusa. Is there any possibility something went wrong during the process? I was just happy that the phone can go on download mode but didn't expect that whichever firmware I try, phone is just stuck on logo.
With regard to the IMEI, should i recover it, will it have a good chance to fix the problem? Can i use qualcomm tools even if the phone can only run on download mode?

if use medusa make this erase full flash after that write full from support stop writ flash in 6% in flash procedure after this flash full flash all files with boot after this pach wit z3x pachv2.Repair imei and al by ok
tested with s8500 whoo come in donload mode with 3 butons vol - lock and power
in first when try flash bada 1.0 soft after ffs write in screen see missing fota 2.0 please instal instal bada 1.2 after this

@OP:
Your SysSec data, which is closely related to NvData, has been damaged, probably by JTAG ovewrite. These data are encrypted by device-unique key.
It is possible to repair it without JTAG, through modified FOTA. But I don't think I'm the one to try this. Last time I played with that data I damaged my BL3. :\

Thanks for those who provided their insights. I kind of gave up last week and had to bring my phone to the service center. Fortunately or not, the tech had to replace the motherboard which cost around 170 USD including the "repair fee". My phone's back with a new motherboard and ready for some risky flashing again. Hehe.
Anyway, thanks again guys. Good day to y'all!

full erase flash only 6% from full after thath full flash with orginal flasher now read wit rj45 cable with z3x nvm from phone in 550 string see if imei is 359321654 need write 8a31391256 and write in phone now imei ok or select in z3x i 5500 put orginal imei and sn repair all come good and working
after all ok read full again from phone search s8500 and see you detail if need edit as your orginal string
ЄЇ~GT-S8500............їµ±№....................................TMU.....2010-06-01....АМАз±Х..................S8500BOJE7_TMOJE7...564C......9750......86210000114318......KAC007021M(S8500)...-

During my plays with RIFF JTAG and few stupid experiments with full erase I'm now facing same problem...
Strange, but this happens with my own JTAG dump...
Will see how long I need to repair this...
Best Regards

It seems no good idea to be. To erase whole NAND via JTAG...
Anyway... long time and luck... I was able to bypass Boot Cycle and then to Restore NV items via QPST...
Maybe 1 part of solution is, to use Firmware BOJE7 with Bootloader XXJEE...
Then maybe your handset start...
Now you can access menu to change to Qualcomm Diag Port for restoring NV items...
Best Regards

[Q] Help with unbricking XPeria Play r800i

Good day all,
I've recently done something rather stupid, and any assistance in reviving my r800i (bootloader locked, but network unlocked, was locked to Network Three UK before I unlocked it using Omnius Suite) What has happened is this, I had bought credits for Omnius to debrand my phone from Three UK so that I could use the phone with T-Mobile or Vodafone. This worked great, but I also wanted to unlock the bootloader so that I could use Flashtool for replacing Gingerbread 2.3.4 (Sony Stock version) with something like ICS or even CyanogenMod. Why I pressed the button in Omnius to repair s1 boot is beyond me, but it happened and now I have a completely bricked Xperia Play.
The phone will not enter recovery mode via the Back button + USB cable, and I cannot power up the phone at all. No initial vibrate or any LED / Display activity at all. It is essentially a plastic brick. The good news is, that I can still place the phone into Testpoint mode using the standard method for XPeria Play models. Doing this allows Omnius to identify my model log which is listed below:
Code:
Action journal
14:26:56 Identify
14:26:56 Shows detailed information about the connected phone.
14:26:56 Operating system: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601), 64-bit
14:26:56 Application version: 1.38.4753
14:26:56 . The action name is 'Identification'
14:26:56 Selected phone type: R800
14:26:56 Selected connection method: USB ROM
14:26:56 i Instructions
14:26:56 i 1. Make sure the phone battery is charged to at least 50%.
14:26:56 i 2. Switch off the phone!
14:26:56 i 3. Remove the phone battery and wait at least 5 seconds, then insert the battery back to the phone!
14:26:56 i 4. Connect the testpoint to phone's ground (battery negative pole, metallic circuit shielding, GND) and leave it connected!
14:26:56 i 5. Shortly press the power button!
14:26:56 i 6. Disconnect the testpoint!
14:26:56 i 7. Connect the cable to the phone!
14:26:56 [picture]
14:26:56 . The action started waiting for the user
14:27:22 . The action finished waiting for the user
14:27:22 Connecting via Zeus USB Flash Device (USB1)...
14:27:22 Device driver version: 2.2.0.5
14:27:22 Qualcomm ROM ID: 06010100900000
14:27:22 Sending loader...
14:27:23 Waiting for loader response...
14:27:23 . The action started waiting for the user
14:27:24 . The action finished waiting for the user
14:27:24 Connecting via SEMC USB Flash Device (USB1)...
14:27:24 Device driver version: 3.0.0.0
14:27:24 Detected chipset: MSM7X30
14:27:24 Boot mode: ROM
14:27:24 Device ID: F9C9A248EBDBBE1B509F0D36326DE55E352776BF
14:27:24 Minimum loader AID: 0001
14:27:24 Phone rooting status is unknown.
14:27:24 Sending loader...
14:27:24 Waiting for loader response...
14:27:25 Phone model (from TA): R800i
14:27:25 Current CXC (from TA): 1245-8821_4.0.2.A.0.42
14:27:25 Current CDA (from TA): 1247-6199_R7D
14:27:25 Current FS (from TA): WORLD-1-8_4.0.2.A.0.42
14:27:25 i The phone is not locked to a network.
14:27:25 i Simlock origin: Unknown simlock origin, EC4B6B4A38BDDC0476229B3FB58222216CB21193
14:27:25 s Successfully done.
14:27:25 . The action entered shutdown phase
14:27:25 . The action reported success
Additional details
---
2F B4 6E 69 5C EB 9C F5 36 FD 40 C1 3A DB D8 84
D9 94
---
Obviously I think that my stupid action of hitting the 'Repair S1 Boot' action has overwritten the boot partition of my phone, but with it being Simlocked with origin unknown, prevents the phone from firing up. As mentioned earlier, I can't even enter recovery mode to reflash the stock software from Sony using PC Companion or SUS (downloaded also). The phone is recognized as ZEUS USB Flash device when I enter TP, but using any other method of powering up the phone via recovery buttons etc. do nothing.
So I would really appreciate any kind of assistance that I can have in getting my phone back up again. I've installed all of the following tools onto my PC. I'm running Windows 7 64bit incase there's issues with driver compatability.
a) SETool2 (no Smartcard or box though)
b) Remote USB Client.
c) Teamviewer 7
d) Omnius Suite
e) S1Tool
f) Octopus (without box)
Many thanks people, your help is greatly appreciated.
Paul.

Maybe this is the final decision, flash ur XPlay using Flashtool.
After that doing from step by step very carefully.

Take a look at this may need to pm dev http://forum.xda-developers.com/showthread.php?t=1252038

tallman43 said:
Take a look at this may need to pm dev http://forum.xda-developers.com/showthread.php?t=1252038
Click to expand...
Click to collapse
Many thanks for the link, I've PM'd Alejandrissimo with details etc.

APEXnow said:
Many thanks for the link, I've PM'd Alejandrissimo with details etc.
Click to expand...
Click to collapse
No prob's let us know how you get on:fingers-crossed:

Hi folks,
Unfortunately, I am still in the same situation. I've attempted to PM and email contact alejandrissimo but I've had no response so I assume that they're unavailable or not online. Is there anybody available that has the SETools with the box available that would help me out in repairing the s1 boot area of my phone?
Any help would be greatly appreciated as I'm struggling without my phone presently.
Thanks,
Paul.

APEXnow said:
Hi folks,
Unfortunately, I am still in the same situation. I've attempted to PM and email contact alejandrissimo but I've had no response so I assume that they're unavailable or not online. Is there anybody available that has the SETools with the box available that would help me out in repairing the s1 boot area of my phone?
Any help would be greatly appreciated as I'm struggling without my phone presently.
Thanks,
Paul.
Click to expand...
Click to collapse
Really alejandrissimo is really busy. Make sure your online when he gets on (Mexico timeframe). Hes the only one who use SETools and he has second knowledge about xperias. Sorry contact him again and make sure you add him in gtalk.

chery2k said:
Really alejandrissimo is really busy. Make sure your online when he gets on (Mexico timeframe). Hes the only one who use SETools and he has second knowledge about xperias. Sorry contact him again and make sure you add him in gtalk.
Click to expand...
Click to collapse
Brilliant, many thanks for that. He's emailed me to add gtalk contact so I'll sort that out today. Much appreciated
Paul

Have you tried to flash .ftf via flashtool?
Sent from my R800i using xda app-developers app

olokos said:
Have you tried to flash .ftf via flashtool?
Sent from my R800i using xda app-developers app
Click to expand...
Click to collapse
It can't be flashed that way because the phone will not respond to plugging the USB cable in while holding the Back button. It will only fire up into Testpoint mode and that's it.
Paul.

I am so happy!!! Alejandro, you are one in a million my friend, one in a million. Fixed my phone, refreshed the OS, and unlocked the bootloader all in the spate of an hour, including my dodgy tweeser handywork for Testpoint. Seriously, thank you so much my friend, you've made me a happy man!. Top marks!
100% Recommended
Paul.

APEXnow said:
I am so happy!!! Alejandro, you are one in a million my friend, one in a million. Fixed my phone, refreshed the OS, and unlocked the bootloader all in the spate of an hour, including my dodgy tweeser handywork for Testpoint. Seriously, thank you so much my friend, you've made me a happy man!. Top marks!
100% Recommended
Paul.
Click to expand...
Click to collapse
Glad to see it workedYep like you said one in a million.

help me i bricked my xperia r800i ..same problem with you

Archos 50 Cesium/Bush Eluma B2 - any hope?

This is my first modern Windows Mobile (I used Windows Mobile 11 years a go) and it seems Microsoft was crippled the operating system.
Model: Bush Eluma, Windows 10 native (rebranded Archos 50 Cesium)
Specification:
Snapdragon 210
Adreno 304
1 GB RAM
16GB ROM
MicroSD support up to 128GB
5" 720x1280 IPS screen
4G LTE
WIFI/Bluetooth/GPS
8MP rear/2MP front with flash
2100mAh battery
Spec. Sheet: archos [dot] com/corporate/press/press_releases/EN_ARCHOS_50Cesium_50eHelium.pdf
What I'm trying to do: Interop-unlock
What I've managed to do: Deploy apps, such as Root Tool and vcREG
Where I'm stuck: Setting the value for my model of phone - I have no idea where to look
I hope I've provided information in a clear format. I'd very much appreciate some help or feedback in order to interop-unlock this model
System\Platform\DeviceTargetingInfo
PhoneManufacturer
Value = "True" (I think this used to just say "ARCHOS")
Thank you for reading.

Was there any progress made with this? Looking to interop unlock phone too so any help would be great

you tried this?
https://forum.xda-developers.com/windows-10-mobile/acer-liquid-jade-primo-upgrade-to-au-cu-t3589156

Worked a treat! Thanks a lot.

user154 said:
Sorry to kinda hijack this thread, but I have this device and struggling to find any other owners. My understanding is that the archos 50 cesium is the windows version of the 50e helium. I have an emmc dump of the 50e helium, if you cant already tell where im going with this, I want to flash this dump to my eluma b2 but cant get qfil or thor2 to do this. Can anyone help? or even know if this is possible?
Click to expand...
Click to collapse
I say just enjoy the W10 phone while you can, or if you really want Android, go buy that model online some where.
It is not as simple as it sounds. You would need at least a flash programmer for the SoC in that phone which usually the manufacturers never release. Depending on the format of the dump you might need other flashers or files to understand how the Archos 50 eMMC is structured or to utilize them in the flashing process. You would also want to be able to put the phone into EDL mode. If you can manage to even boot the flash programmer and initialize a flash of the phone there is also high risk of bricking it. Because you would be flashing partitions that were not signed for that phone/SoC. So I am not sure if you would also need to unlock the boot loader on it or not...sounds like you would. IMO it would be best to unlock the bootloader so you can backup the current layout of the phone. This as far as I know is not possible, so I would just stop there.
I know there are some threads in other forums where they are trying to do this with the IDOL 4s, and maybe a couple devices in the past have worked out to be able to do this. However it pretty much hinges on unlocking the boot loader. Also from what I know once you flash it like that and even if device survives (it boots, the IMEI is in tact, etc.) you cannot revert it back or it is pretty much impossible to go back without bricking it.

user154 said:
It doesnt really matter if the device is rendered unusable, it is quite a long way down the list of backup devices I have, it was more for the fun of trying to do it. The device is the exact same as its android counterpart (hardware wise) this is what made me think it should theoretically be possible. The dump I have was made with infinitybox, I have managed to create the required rawprogram.xml and patch.xml from the gpt binary contained within the dump. I have also found a couple of flash programmers for the soc (prog_emmc_firehose_8909.mbn, and a couple of manufacturer specific ones, pretty sure iv got the filename slightly wrong there). I have been able to boot the device to EDL mode using a cable, however sahara fails to load the flash programmer to the device. I didnt think the bootloader would need to be unlocked to flash the device seeing as the device is in EDL mode and what Im trying to flash is signed as is just the dump from the android counterpart. Maybe this is where im going wrong. Also Im working on the assumption the IMEI will be wiped as I plan to flash persist.img from dump too, I thought trying to keep the partition where it is stored in windows 10 and repartition the rest of the emmc to the same as the android counterpart might make things more complicated than they already are. Also IMEI can sometimes be quite simple to repair on certain devices (A lot more simple than what Im trying to acheieve here anyway). Can you point me in the right direction as to where I can find instructions to unlock the bootloader of this device? for some reason it doesnt get recognised by wpinternals (In any mode, EDL, standard flash mode, no idea what thats called on windows haha, or booted normally)
Click to expand...
Click to collapse
Sounds like you're on the right path. I'm not 100% sure you need to unlock the boot loader, however it would definitely make things easier as you could dump partitions from the phone as it is and even possibly enable mass storage mode. I am unsure where you would look to unlock that phones boot loader other than here. The flash programmers you have may not be built for the Windows Phone eMMC and why they are not booting.

Hi, this is quite interesting for me as I am struggling with 2 Cesium 40 devices stuck in Qualcomm download mode. I thought I managed to extract msimage.mbn and hex binary file from ffu, converted the hex file to hex.hex and added first and last-but-one lines. Although there was no way to escape from Qualcomm mode. Thor recognizes the Qualcomm deveices, but tells me to stop QFIL operations, even if there is no QFIL. Any ideas?

JoachimP said:
Hi, this is quite interesting for me as I am struggling with 2 Cesium 40 devices stuck in Qualcomm download mode. I thought I managed to extract msimage.mbn and hex binary file from ffu, converted the hex file to hex.hex and added first and last-but-one lines. Although there was no way to escape from Qualcomm mode. Thor recognizes the Qualcomm deveices, but tells me to stop QFIL operations, even if there is no QFIL. Any ideas?
Click to expand...
Click to collapse
If you have qpst/qfil installed on your PC, and have used them recently. The services might still be running. Just hunt for them in task manager and kill them and run thor2 again. See if that helps.

Worked a treat! Much obliged.

@nate0
Hi, thanks for your reply. I am nearly sure, I uninstalled QFIL and shutdown my pc after use, but I will check on it.

So I uninstalled QFIL and rebooted. This is the result:
C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode list_connections
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode list_connections
Process started Wed Nov 14 08:48:16 2018
Logging to file C:\Users\me\AppData\Local\Temp\thor2_win_20181114084816_ThreadId-4796.log
Debugging enabled for listconnections
WinUSB in use.
Connection list START
0.1A07:0004:0004 {71de994d-8b7c-43db-a27e-2ae7cd579a0c} Emergency mode connected
Connection list END
Exited with success
C:\Program Files\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode emergency -hexfile cesium\hex.hex -mbnfile cesium\prog_emmc_firehose_8x10.mbn -ffufile cesium\flash_retail.ffu
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile cesium\hex.hex -mbnfile cesium\prog_emmc_firehose_8x10.mbn -ffufile cesium\flash_retail.ffu
Process started Wed Nov 14 08:48:52 2018
Logging to file C:\Users\me\AppData\Local\Temp\thor2_win_20181114084852_ThreadId-7500.log
Debugging enabled for emergency
Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Message send failed with error code -1
Waiting connection to DLOAD: 2 of 2
Check if device in Dload
Message send failed with error code -1
Failed to connect to DLOAD mode
Make sure that the COM port is free. Close QPST.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 8.00 seconds.
THOR2_EMERGENCYFLASHV1_ERROR_PROGRAMMER_SEND_FAILED
THOR2 1.8.2.18 exited with error code 85030 (0x14C26)
Any suggestions?

Help ! Urgent! Bricked no resolution

Hello, I performed a custom rom process on the moto g5 xt1671 and the rom used was from another smartphone and from another totally incompatible brand (a mistake) and therefore my phone was bricked and so I flashed blank and the fastboot was very buggy with words of start in green and the information below, I did fastboot by cmd tried to install stock rom always gives error in the first command and so I went to see the information through fastboot and it was fb: b8.25 (*) kernel: 000000000000 (multiple 0) and sku: 00000000 (several 0) without any information, how do I fix it - lot?:crying:

There is no blank flash for this device that I know of
You may need a motherboard replacement if you have flashed firmware etc from other devices
The only known solution to a hard brick for this device is below however as you have flashed unknown bootloaders & other firmware which is not meant for your device you may still end up needing a motherboard replacement
See my hard brick guide below
https://forum.xda-developers.com/g5/how-to/rooted-moto-g5-run-morning-post-image-t3776012

[Q] HTC Desire 816 single SIM EU version stuck in emergency download mode - how to fix?

I got a hard bricked HTC Desire 816 single SIM, EU version, Qualcomm MSM8928 Snapdragon 400 chipset
I know for sure it's a HTC single SIM phone, the rest I googled with the help of part numbers printed on various parts of the phone.
I can post the numbers if it helps to identify the phone
I guess it's an European model and not an import.
When I connect it to a PC I get a Qualcomm HS-USB QDLoader 9008 (Com4) port detected
I fully charged the battery on an external charger.
I have tried this guide: https://forum.xda-developers.com/t/guide-unbrick-htc-816w-a5_dug-from-hard-bricked-9008.3391110/ but the phone does nothing, when I press Vol- & Power button.
I see the phone in various SW like QFIL but I have no idea what firmware is the correct one.
I would like to read the whole phone content to identify which firmware I need - but how?
Or is there a other how identify the phone? Perhaps restore only the preloader, bootloader ... ?
Any advice how to proceed?
Thank you

Some progress ...
I need QPST or something similar, what is able to flash in emergency download mode - done
I need to download and extract probably suitable firmwares - done
I need a suitable programmer for the MSM8928 - probably done
But the firmwares are not in an usable format for the QPST Software Download.
How do I convert them to mbn or hex?

The firmwares are incomplete, it seems I need a complete mmcblk0 dump ...

It seems I'm out of luck.
I've tried different tools under Windows and Linux (to rule out Windows driver issues) but the result is the same.
I can download the prog_emmc_firehose_8928.mbn but that's it, the port stops responding after that.
I've also tried to boot two images (A5_DUG and A5_DWGL) from a SD Card and nothing, no sign of life.
I know need a A5_UL image but I thought the phone should show at least some sign of life but nothing :-(
The only sign of life is the port in EDL mode, when connected to a PC.
Is the phone dead or is there something else I could try?
I'm out of ideas ...

Some news.
I got some responses to SAHARA commands from the phone:
Attempting to switch device to mode: Command Mode
Device is awaiting client commands
Serial Number: AAA - BBB
Unknown ID 1: 0
Unknown ID 2: 0
MSM HW ID: 32993 - 000080E1
OEM Public Key Hash Hex:
========
Dumping Data For Command: 0x06 - Read Debug Data - 3904 Bytes
========
SBL SW Version: 0
========
Dumping Data For Command: 0x00 - NOP - 16 Bytes
========
Requesting mode switch from Command Mode (0x03) to Memory Debug (0x02)
Devices responded with an error: Invalid Command
Port Closed
Firehose programmer download:
/dev/ttyUSB1 USB VIDID=05c6:9008 Qualcomm CDMA Technologies MSM QHSUSB__BULK
Connected to /dev/ttyUSB1
Reading hello handshake
Device In Mode: Image Transfer Pending
Version: 2
Minimum Version: 1
Max Command Packet Size: 1024
Device requesting 80 bytes of image 0x0D - EHOSTDL
Sending image /prog_emmc_firehose_8928.mbn
Image /prog_emmc_firehose_8928.mbn successfully sent.
If there are no more images requested, you should send the done command.
Sending Done Command
Done Command Successfully Sent
No response from device
It seems that the prog_emmc_firehose_8928.mbn is not the correct one ...