Develop Bugs

{guide} How to install/configure kitchen to customize Roms

SORRY MODERATORS AND DEV i an not a dev but still i am posting this in dev section but i have see lot of persons struggling with kitchen including myself.I want to help and thought it might help
Sorry for BAD English [SIZE]
(" ,----.. .--.--. ,' , `. ,---, ");
(" / / \ / / '. ,-+-,.' _ | ,--, ,--.' | ");
("| : : | : /`. / ,-+-. ; , ||,--.'| ,---, | | : ");
(". | ;. / ; | |--` ,--.'|' | ;|| |, ,-+-. / |: : : .--.--. ");
(". ; /--` | : ;_ | | ,', | ':`--'_ ,--.'|' |: | |,--. ,--.--. / / ' ");
("; | ; __ \ \ `. | | / | | ||,' ,'| | | ,"' || : ' | / \ | : /`./ ");
("| : |.' .' `----. \' | : | : |,' | | | | / | || | /' :.--. .-. | | : ;_ ");
(". | '_.' : __ \ \ |; . | ; |--' | | : | | | | |' : | | | \__\/: . . \ \ `. ");
("' ; : \ | / /`--' /| : | | , ' : |__ | | | |/ | | ' | : ," .--.; | `----. \ ");
("' | '/ .''--'. / | : ' |/ | | '.'|| | |--' | : :_:,'/ / ,. | / /`--' / ");
("| : / `--'---' ; | |`-' ; : ;| |/ | | ,' ; : .' \'--'. / ");
(" \ \ .' | ;/ | , / '---' `--'' | , .-./ `--'---' ");
(" `---` '---' ---`-' `--`---' ");
Following are some sites which you can use :-
http://theunlockr.com/2010/03/26/how...p-the-kitchen/
http://theunlockr.com/2010/04/15/how...our-first-rom/
Kitchen Form :-
http://forum.xda-developers.com/showthread.php?p=5626300#post5626300
1)goto this form download kitchen i strongly recommend Linux version
1. Download Ubuntu from ubuntu.com
2. Once it is downloaded, in the VirtualBox program, click the Start button at the top.
3. Close out all the warnings that come up.
4. Then click on Devices > CD/DVD Devices > More CD/DVD Images… then select the .iso image for Ubuntu you downloaded.
2)Then install Ubuntu on ur system(i use vmware for this work)
3)copy kitchen folder to ubuntu the open the folder goto menu run in terminal it should work but if there any error or menu doesnt work then
6. Follow the prompts on the screen to install Ubuntu on your Virtual Machine.
7. Once it is installed and reboots, goto Applications > Accessories > Terminal and type this line with hitting enter at the end:
sudo apt-get install sun-java6-bin sun-java6-jre
It will ask you for a password, type in the password you created when you went through the Ubuntu installation process (it asked you for it before finishing the install).
Then it will ask you y/n. Hit y then enter. Then when it shows you the terms and conditions, hit right arrow on your keyboard and click enter to select ok. Then hit left arrow on your keyboard and enter to select Yes.
*NOTE – Your keyboard and mouse will not function on your regular computer once you use them in the Ubuntu virtual machine. To re-enable them, click the Ctrl button on the right side of your keyboard.
4)Download the java files manually FROM INSIDE THE EMULATOR/LINUX using Firefox here:
**IF YOU GET AN ERROR INSTALLING THE JAVA FILES,
Download the java files manually FROM INSIDE THE EMULATOR/LINUX using Firefox here:
Java6 Bin
Java6 Jre
or
type java in application center in ubuntu jui
Then open the Terminal App in Ubuntu and type this with hitting enter at the end of the line:
sudo dpkg -i sun-java6-jre_6.18-4_all.deb sun-java6-bin_6.18-4_i386.deb
And that should fix it.
5)The open the Kitchen folder in the ubuntu and open MENU file in terminal
6)The rom u want to customize in to be copied into the orignal_update folder
7)Rest u have to enter ur choice in menu and kitchen will create a working folder
8)WORKING folder is the main folder in which u do all ur work(costamization work)
note:- error 6 this is the most frustrating error u will surely face while flashing ur rom and is related to update_scrpit and i stronglly recommend start again from scratch than roaming around finding error
9) download autosign or other signing file if u get any signing error
i want to thank all the dev and persons who help me in solving my problems regarding the kitchen and errors i have faced in developing my roms (which i create form myself as they r not worth posting )
i really appreciate them thanks
I am one big idiot noob

Nice guide! Thanks

Happy to help
One big idiot noob
Sent from my HTC Glacier using xda premium

Awesome, thanks! I was looking for some guides on how to do this. I'll take a look at these when I get some free time.

Full analysis of Xiaomi Mi4 Windows Mobile 10 ROM

I have done an extended analysis of the FFU file of Windows Mobile 10 for Xiaomi Mi4.
The partition layout is not the same from Android and Windows Phone. But, some partitions have the same starting LBA, ending LBA and size so they are at the same location and have the same size in both partition layouts. Because the FFU doesn't contain data blocks to write in these partitions, we can assume they stay intact during the update from Android to Windows Mobile.
This way I found out that 5 partitions are kept from Android, 13 are written with data and 6 are nulled (content is all zeroes):
Code:
+-----+-----------+-----------+--------+-----------------+---------+-------------------+
+ # | Start LBA | End LBA | Size | Name | In FFU | Status |
+-----+-----------+-----------+--------+-----------------+---------+-------------------+
| 0| 1024| 2047| 1024|SBL1 | Yes | Written |
| 1| 2048| 2559| 512|UEFI_BS_NV | Yes | Nulled |
| 2| 3072| 3583| 512|UEFI_RT_NV | Yes | Nulled |
| 3| 4096| 8191| 4096|UEFI | Yes | Written |
| 4| 8192| 10239| 2048|DDR | | Kept from Android |
| 5| 10240| 12287| 2048|SSD | | Kept from Android |
| 6| 12288| 14335| 2048|PADDING0 | Yes | Nulled |
| 7| 14336| 30719| 16384|DPP | Yes | Written |
| 8| 30720| 30783| 64|DBI | Yes | Written |
| 9| 31744| 32743| 1000|RPM | Yes | Written |
| 10| 32768| 33767| 1000|TZ | Yes | Written |
| 11| 33792| 34815| 1024|WINSECAPP | Yes | Written |
| 12| 34816| 67583| 32768|TZAPPS | Yes | Written |
| 13| 67584| 68607| 1024|BACKUP_SBL1 | | |
| 14| 68608| 68671| 64|BACKUP_DBI | | |
| 15| 69632| 73727| 4096|BACKUP_UEFI | | |
| 16| 73728| 74727| 1000|BACKUP_RPM | | |
| 17| 74752| 75751| 1000|BACKUP_TZ | | |
| 18| 75776| 76799| 1024|BACKUP_WINSECAPP | | |
| 19| 76800| 109567| 32768|BACKUP_TZAPPS | Yes | Nulled |
| 20| 109568| 117759| 8192|MMOS | Yes | Written |
| 21| 117760| 131071| 13312|PADDING1 | | |
| 22| 131072| 134143| 3072|MODEM_FS1 | | Kept from Android |
| 23| 134144| 137215| 3072|MODEM_FS2 | Yes | Nulled |
| 24| 137216| 137247| 32|MODEM_FSC | Yes | Nulled |
| 25| 138240| 154623| 16384|PLAT | Yes | Written |
| 26| 154624| 220159| 65536|EFIESP | Yes | Written |
| 27| 220160| 262143| 41984|PADDING2 | | |
| 28| 262144| 265215| 3072|MODEM_FSG | | Kept from Android |
| 29| 265216| 491519| 226304|PADDING3 | | |
| 30| 491520| 524287| 32768|PERSIST | | Kept from Android |
| 31| 524288| 5537791| 5013504|MainOS | Yes | Written |
| 32| 5537792| 20967423|15429632|Data | Yes | Written |
+-----+-----------+-----------+--------------------------+---------+-------------------+
Regarding the partitions which are in the FFU file, here are all the information I gathered about them:
"SBL1" is a SBL (Secondary Boot Loader) file with a 80 bytes header
The file is not signed (no signature and no certificate chain).
Codeword[4]: d1dc4b84
Magic[4]: 3410d773
Image ID[4]: 15000000 (SBL1_IMG)
Reserved 1[4]: ffffffff
Reserved 2[4]: ffffffff
Image source[4]: 50000000
Image destination pointer[4]: 00c000f8 (4160798720)
Image size[4]: f8480400
Code size[4]: f8480400
Signature pointer[4]: f80805f8 (4161079544)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: f80805f8 (4161079544)
Certificate chain size[4]: 00000000 (0)
OEM root certificate selelected[4]: 01000000
OEM number of root certificates[4]: 01000000
Booting image config[4]: ffffffff
Reserved 6[4]: ffffffff
Reserved 7[4]: ffffffff
Reserved 8[4]: ffffffff
Reserved 9[4]: ffffffff
"UEFI_BS_NV" is an empty partition
"UEFI_RT_NV" is an empty partition
"UEFI" is probably an ARM binary file with a 40 bytes header
The file is not signed (no signature and no certificate chain).
Image ID[4]: 05000000 (APPSBL_IMG)
Flash partition version[4]: 03000000
Image source[4]: 00000000
Image destination pointer[4]: 00002000 (2097152)
Image size[4]: 00800d00
Code size[4]: 00800d00
Signature pointer[4]: 00802d00 (2981888)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: 00802d00 (2981888)
Certificate chain size[4]: 00000000 (0)
"PADDING0" is an empty partition
"DPP" is a FAT partition
"DBI" is probably an ARM binary file with a 40 bytes header
The file is not signed (no signature and no certificate chain).
Image ID[4]: 1e000000
Flash partition version[4]: 03000000
Image source[4]: 00000000
Image destination pointer[4]: 000080fe (4269801472)
Image size[4]: 982d0000
Code size[4]: 982d0000
Signature pointer[4]: 982d80fe (4269813144)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: 982d80fe (4269813144)
Certificate chain size[4]: 00000000 (0)
"RPM" is an ARM ELF (Executable and Linkable Format) file
Class: ELF32
Magic[16]: 7f454c46010101000000000000000000
Type[2]: 0200 (ET_EXEC [Executable file])
Machine[2]: 2800 (EM_ARM [Advanced RISC Machines ARM])
Version[4]: 01000000
Entry point address[4]: 91001000
Start of program headers[4]: 34000000
Start of section headers[4]: 00000000
Flags[4]: 02000005
Size of this header[2]: 3400
Size of program headers[2]: 2000
Number of program headers[2]: 0400
Size of section headers[2]: 2800
Number of section headers[2]: 0000
Section header string table index[2]: 0000
"TZ" is an ARM ELF (Executable and Linkable Format) file
Class: ELF32
Magic[16]: 7f454c46010101000000000000000000
Type[2]: 0200 (ET_EXEC [Executable file])
Machine[2]: 2800 (EM_ARM [Advanced RISC Machines ARM])
Version[4]: 01000000
Entry point address[4]: 000081fe
Start of program headers[4]: 34000000
Start of section headers[4]: 00000000
Flags[4]: 02000005
Size of this header[2]: 3400
Size of program headers[2]: 2000
Number of program headers[2]: 1000
Size of section headers[2]: 2800
Number of section headers[2]: 0000
Section header string table index[2]: 0000
"WINSECAPP" is an ARM ELF (Executable and Linkable Format) file
Class: ELF32
Magic[16]: 7f454c46010101000000000000000000
Type[2]: 0200 (ET_EXEC [Executable file])
Machine[2]: 2800 (EM_ARM [Advanced RISC Machines ARM])
Version[4]: 01000000
Entry point address[4]: 0090fe07
Start of program headers[4]: 34000000
Start of section headers[4]: 00000000
Flags[4]: 02000005
Size of this header[2]: 3400
Size of program headers[2]: 2000
Number of program headers[2]: 0400
Size of section headers[2]: 2800
Number of section headers[2]: 0000
Section header string table index[2]: 0000
"TZAPPS" is a FAT partition
"BACKUP_TZAPPS" is an empty partition
"MODEM_FS2" is an empty partition
"MODEM_FSC" is an empty partition
"PLAT" is a FAT partition
"EFIESP" is a FAT partition
"MMOS" is a FAT partition
"MainOS" is a NTFS partition
-> Boot sector backup at offset 2566913536 match the boot sector from sector 0
"Data" is a NTFS partition
-> Boot sector backup at offset 7899971072 match the boot sector from sector 0

Regarding the FFU file itself (10586.1102.3063.Retail.FFU): the image embedded catalog is not signed. I attached it to this post. I also attached the extracted hash table. Indeed, the cat file only contains a SHA1 of the hashtable: it's enough to ensure the data is fine.
All the informations:
"_SECURITY_HEADER" position: 0
_SECURITY_HEADER
----------------
cbSize[4]: 20000000 (32)
Signature[12]: 5369676e6564496d61676520 (SignedImage )
dwChunkSizeInKb[4]: 80000000 (128)
dwAlgId[4]: 0c800000 (32780)
dwCatalogSize[4]: 48010000 (328)
dwHashTableSize[4]: 00a50600 (435456)
"Signed Catalog" position: 32
"Hash table data" position: 360 (+328)
"Padding" position: 435816 (+435456)
"_IMAGE_HEADER" position: 524288 (+88472)
Image Integrity Validation
--------------------------
Verify SHA-1 hash (91b4b4d9944bd90e36891b26c6ecded90190fcd5) of the hash table against the one from the embedded catalog
-> SHA-1 hash of the hash table match the hash from the catalog
Verify 1783627776 bytes of data per chunk of 128 kilobytes using 13608 SHA256 hashes (32 bytes)
-> Done successfully!
_IMAGE_HEADER
-------------
cbSize[4]: 18000000 (24)
Signature[12]: 496d616765466c6173682020 (ImageFlash )
ManifestLength[4]: f41a0000 (6900)
dwChunkSize[4]: 80000000 (128)
"Manifest" position: 524312
"Padding" position: 531212 (+6900)
"_STORE_HEADER" position: 655360 (+124148)
_STORE_HEADER
-------------
dwUpdateType[4]: 00000000 (0)
MajorVersion[2]: 0100 (1)
MinorVersion[2]: 0000 (0)
FullFlashMajorVersion[2]: 0200 (2)
FullFlashMinorVersion[2]: 0000 (0)
szPlatformId[192]: 5849414f4d49544553542e5869616f6d69383937342e4d49340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (XIAOMITEST.Xiaomi8974.MI4)
dwBlockSizeInBytes[4]: 00000200 (131072)
dwWriteDescriptorCount[4]: 25350000 (13605)
dwWriteDescriptorLength[4]: 58520300 (217688)
dwValidateDescriptorCount[4]: 00000000 (0)
dwValidateDescriptorLength[4]: 00000000 (0)
dwInitialTableIndex[4]: 00000000 (0)
dwInitialTableCount[4]: 01000000 (1)
dwFlashOnlyTableIndex[4]: d1000000 (209)
dwFlashOnlyTableCount[4]: 01000000 (1)
dwFinalTableIndex[4]: 23350000 (13603)
dwFinalTableCount[4]: 02000000 (2)
NumOfStores[2]: Skipped because field is only for version 2 FFU image
StoreIndex[2]: Skipped because field is only for version 2 FFU image
StorePayloadSize[8]: Skipped because field is only for version 2 FFU image
DevicePathLength[2]: Skipped because field is only for version 2 FFU image
DevicePath[2]: Skipped because field is only for version 2 FFU image
"_VALIDATION_ENTRY" position: 655608
"_VALIDATION_ENTRY" size: 0
"_BLOCK_DATA_ENTRY" position: 655608
"_BLOCK_DATA_ENTRY" size: 217688
"_IMAGE_PAYLOAD" position: 917504
_VALIDATION_ENTRY
-----------------
Skipped because there is no validation entries
_BLOCK_DATA_ENTRY
-----------------
(Removed because it's really long !)
"Padding" position: 873296
"_IMAGE_PAYLOAD" position: 917504
GUID Partition Table Layouts
----------------------------
GUID Partition Table from data block #0
Code:
+-----+-----------+-----------+--------+------------------------------------+
+ # | Start LBA | End LBA | Size | Name |
+-----+-----------+-----------+--------+------------------------------------+
+-----+-----------+-----------+--------+------------------------------------+
GUID Partition Table from data block #209
Code:
+-----+-----------+-----------+--------+------------------------------------+
+ # | Start LBA | End LBA | Size | Name |
+-----+-----------+-----------+--------+------------------------------------+
| 0| 1024| 2047| 1024|SBL1 |
| 1| 2048| 2559| 512|UEFI_BS_NV |
| 2| 3072| 3583| 512|UEFI_RT_NV |
| 3| 4096| 8191| 4096|UEFI |
| 4| 8192| 10239| 2048|DDR |
| 5| 10240| 12287| 2048|SSD |
| 6| 12288| 14335| 2048|PADDING0 |
| 7| 14336| 30719| 16384|DPP |
| 8| 30720| 30783| 64|DBI |
| 9| 31744| 32743| 1000|RPM |
| 10| 32768| 33767| 1000|TZ |
| 11| 33792| 34815| 1024|WINSECAPP |
| 12| 34816| 67583| 32768|TZAPPS |
| 13| 67584| 68607| 1024|BACKUP_SBL1 |
| 14| 68608| 68671| 64|BACKUP_DBI |
| 15| 69632| 73727| 4096|BACKUP_UEFI |
| 16| 73728| 74727| 1000|BACKUP_RPM |
| 17| 74752| 75751| 1000|BACKUP_TZ |
| 18| 75776| 76799| 1024|BACKUP_WINSECAPP |
| 19| 76800| 109567| 32768|BACKUP_TZAPPS |
| 21| 117760| 131071| 13312|PADDING1 |
| 22| 131072| 134143| 3072|MODEM_FS1 |
| 23| 134144| 137215| 3072|MODEM_FS2 |
| 24| 137216| 137247| 32|MODEM_FSC |
| 25| 138240| 154623| 16384|PLAT |
| 26| 154624| 220159| 65536|EFIESP |
| 27| 220160| 262143| 41984|PADDING2 |
| 28| 262144| 265215| 3072|MODEM_FSG |
| 29| 265216| 491519| 226304|PADDING3 |
| 30| 491520| 524287| 32768|PERSIST |
+-----+-----------+-----------+--------+------------------------------------+
GUID Partition Table from data block #13603
Code:
+-----+-----------+-----------+--------+------------------------------------+
+ # | Start LBA | End LBA | Size | Name |
+-----+-----------+-----------+--------+------------------------------------+
| 0| 1024| 2047| 1024|SBL1 |
| 1| 2048| 2559| 512|UEFI_BS_NV |
| 2| 3072| 3583| 512|UEFI_RT_NV |
| 3| 4096| 8191| 4096|UEFI |
| 4| 8192| 10239| 2048|DDR |
| 5| 10240| 12287| 2048|SSD |
| 6| 12288| 14335| 2048|PADDING0 |
| 7| 14336| 30719| 16384|DPP |
| 8| 30720| 30783| 64|DBI |
| 9| 31744| 32743| 1000|RPM |
| 10| 32768| 33767| 1000|TZ |
| 11| 33792| 34815| 1024|WINSECAPP |
| 12| 34816| 67583| 32768|TZAPPS |
| 13| 67584| 68607| 1024|BACKUP_SBL1 |
| 14| 68608| 68671| 64|BACKUP_DBI |
| 15| 69632| 73727| 4096|BACKUP_UEFI |
| 16| 73728| 74727| 1000|BACKUP_RPM |
| 17| 74752| 75751| 1000|BACKUP_TZ |
| 18| 75776| 76799| 1024|BACKUP_WINSECAPP |
| 19| 76800| 109567| 32768|BACKUP_TZAPPS |
| 20| 109568| 117759| 8192|MMOS |
| 21| 117760| 131071| 13312|PADDING1 |
| 22| 131072| 134143| 3072|MODEM_FS1 |
| 23| 134144| 137215| 3072|MODEM_FS2 |
| 24| 137216| 137247| 32|MODEM_FSC |
| 25| 138240| 154623| 16384|PLAT |
| 26| 154624| 220159| 65536|EFIESP |
| 27| 220160| 262143| 41984|PADDING2 |
| 28| 262144| 265215| 3072|MODEM_FSG |
| 29| 265216| 491519| 226304|PADDING3 |
| 30| 491520| 524287| 32768|PERSIST |
| 31| 524288| 5537791| 5013504|MainOS |
| 32| 5537792| 20967423|15429632|Data |
+-----+-----------+-----------+--------+------------------------------------+
Data Blocks to Partitions
-------------------------
Data Block #0-0: -> GPT
Data Block #0-1: -> GPT
Data Block #1-0: -> SBL1
to
Data Block #4-0: -> SBL1
Data Block #5-0: -> UEFI_BS_NV
to
Data Block #8-0: -> UEFI_RT_NV
Data Block #9-0: -> UEFI
to
Data Block #24-0: -> UEFI
Data Block #25-0: -> PADDING0
to
Data Block #32-0: -> PADDING0
Data Block #33-0: -> DPP
Data Block #34-0: -> DBI
Data Block #35-0: -> RPM
to
Data Block #38-0: -> RPM
Data Block #39-0: -> TZ
to
Data Block #42-0: -> TZ
Data Block #43-0: -> WINSECAPP
to
Data Block #46-0: -> WINSECAPP
Data Block #47-0: -> TZAPPS
to
Data Block #48-0: -> TZAPPS
Data Block #49-0: -> BACKUP_TZAPPS
to
Data Block #60-0: -> BACKUP_TZAPPS
Data Block #61-0: -> MODEM_FS2
to
Data Block #68-0: -> MODEM_FS2
Data Block #69-0: -> MODEM_FSC
Data Block #70-0: -> PLAT
to
Data Block #127-0: -> PLAT
Data Block #128-0: -> EFIESP
to
Data Block #208-0: -> EFIESP
Data Block #209-0: -> GPT
Data Block #210-0: -> MMOS
to
Data Block #211-0: -> MMOS
Data Block #212-0: -> MainOS
to
Data Block #12925-0: -> MainOS
Data Block #12926-0: -> Data
to
Data Block #13602-0: -> Data
Data Block #13603-0: -> GPT
Data Block #13604-0: -> GPT

Regarding the Firehose flasher:
".\prog_emmc_firehose_8974.mbn" is a SBL (Secondary Boot Loader) file with a 80 bytes header
The file is not signed (no signature and no certificate chain).
Codeword[4]: d1dc4b84
Magic[4]: 3410d773
Image ID[4]: 0d000000
Reserved 1[4]: ffffffff
Reserved 2[4]: ffffffff
Image source[4]: 50000000
Image destination pointer[4]: 50c000f8 (4160798800)
Image size[4]: 90480100
Code size[4]: 90480100
Signature pointer[4]: e00802f8 (4160882912)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: e00802f8 (4160882912)
Certificate chain size[4]: 00000000 (0)
OEM root certificate selelected[4]: 01000000
OEM number of root certificates[4]: 01000000
Booting image config[4]: ffffffff
Reserved 6[4]: ffffffff
Reserved 7[4]: ffffffff
Reserved 8[4]: ffffffff
Reserved 9[4]: ffffffff
Finally, the packages installed in this ROM:
Part of the Windows Mobile Adaptation Kit (AK):
C:\Program Files (x86)\Windows Kits\10\MSPackages\Merged\arm\fre
Probably untouched.
Microsoft.MS_RETAILDEMOCONTENT_NEUTRAL.Data.cab
Microsoft.MS_RETAILDEMOCONTENT_ZH-CN.Data.cab
Microsoft.EFIESP.Production.cab
Microsoft.MS_BOOTSEQUENCE_RETAIL.EFIESP.cab
Microsoft.RELEASE_PRODUCTION.EFIESP.cab
Microsoft.MainOS.Production.cab
Microsoft.MainOS.Production_Lang_en-US.cab
Microsoft.MainOS.Production_Lang_zh-CN.cab
Microsoft.MainOS.Production_Res_1080x1920.cab
Microsoft.MS_BOOTSEQUENCE_RETAIL.MainOS.cab
Microsoft.MS_COMMSENHANCEMENTCHINA.MainOS.cab
Microsoft.MS_COMMSMESSAGINGGLOBAL.MainOS.cab
Microsoft.MS_FACEBOOK.MainOS.cab
Microsoft.MS_OPTIMIZED_BOOT.MainOS.cab
Microsoft.MS_RETAILDEMOCONTENT_NEUTRAL.MainOS.cab
Microsoft.MS_RETAILDEMOCONTENT_ZH-CN.MainOS.cab
Microsoft.MS_SKYPE.MainOS.cab
Microsoft.MS_STANDARD_FEATURE_1.MainOS.cab
Microsoft.PhoneFM.cab
Microsoft.PRERELEASE_PROTECTED.MainOS.cab
Microsoft.PRERELEASE_PROTECTED.MainOS_Lang_en-US.cab
Microsoft.PRERELEASE_PROTECTED.MainOS_Lang_zh-CN.cab
Microsoft.PRERELEASE_PROTECTED.MainOS_Res_1080x1920.cab
Microsoft.RELEASE_PRODUCTION.MainOS.cab
Microsoft.RELEASE_PRODUCTION.UpdateOS.cab
Microsoft.UpdateOS.Production.cab
C:\Program Files (x86)\Windows Kits\10\MSPackages\mobilecore\ARM\fre
Probably untouched.
microsoft.mobilecore.prod.efiesp.cab
microsoft.mobilecore.prod.mainos.cab
microsoft.mobilecore.updateos.cab
C:\Program Files (x86)\Windows Kits\10\MSPackages\retail\ARM\fre
Probably untouched.
Microsoft.Input.mtf_Lang_en-US.cab
Microsoft.Input.mtf_Lang_zh-CN.cab
Microsoft.Speech.Data_Lang_en-US.cab
Microsoft.Speech.Data_Lang_zh-CN.cab
Part of the Qualcomm Board Support Package:
E:\MI4\BSP\prebuilt.3063.RTF\spkg
ODM-made packages:
Qualcomm.MI4.Customizations.MainOS.spkg
Qualcomm.MI4.Customizations.StartLayout.spkg
Qualcomm.MI4.Customizations.StaticApps.MainOS.spkg
Qualcomm.MI4.Customizations.EFIESP.spkg
Qualcomm.QC8974.OEMAutobrightness.spkg
Qualcomm.QC8974.OEMDevicePlatform.spkg
Qualcomm.Xiaomi.DeviceLayout.spkg
Qualcomm MSM8974 drivers:
Can ODM recompile these packages? Or are they untouched?
OEM.HalExtensions.UpdateOS.spkg
OEM.Service.ProvisionService.spkg
Qualcomm.QC8974.BattProv.spkg
Qualcomm.QC8974.FlightToken.spkg
Qualcomm.QC8974.startupnsh.spkg
Qualcomm.QC8974.ABD.spkg
Qualcomm.QC8974.AccLSM330.spkg
Qualcomm.QC8974.ADCM.spkg
Qualcomm.QC8974.adsprpc.spkg
Qualcomm.QC8974.AlsPrxTMD27723.spkg
Qualcomm.QC8974.AMSSPeriImage_8974DI4.spkg
Qualcomm.QC8974.AtmelTouch.spkg
Qualcomm.QC8974.AudioDeviceDriver.spkg
Qualcomm.QC8974.bam_dmux.spkg
Qualcomm.QC8974.BCryptCipher_KM.spkg
Qualcomm.QC8974.BT_MainOS.spkg
Qualcomm.QC8974.DataDaemon.spkg
Qualcomm.QC8974.DiagBridge.spkg
Qualcomm.QC8974.DiagCSI.spkg
Qualcomm.QC8974.DiagRouter.spkg
Qualcomm.QC8974.direct3dum11.spkg
Qualcomm.QC8974.DisableSaverF800Bugcheck.spkg
Qualcomm.QC8974.DSPPeriImage.spkg
Qualcomm.QC8974.FveEnable.HardwareCrypto.spkg
Qualcomm.QC8974.GyroLsm330.spkg
Qualcomm.QC8974.HalExtQCTimer.spkg
Qualcomm.QC8974.HalExtQCWdogTimer.spkg
Qualcomm.QC8974.hwnhaptics.spkg
Qualcomm.QC8974.hwnled.spkg
Qualcomm.QC8974.ipc_router.spkg
Qualcomm.QC8974.libadsprpc.spkg
Qualcomm.QC8974.linklocal.spkg
Qualcomm.QC8974.MagAKM8963.spkg
Qualcomm.QC8974.mbb.spkg
Qualcomm.QC8974.mbbuio.spkg
Qualcomm.QC8974.mbrg.spkg
Qualcomm.QC8974.ocmem.spkg
Qualcomm.QC8974.PageFile.UserData.256.spkg
Qualcomm.QC8974.Pep_ROT.spkg
Qualcomm.QC8974.PEPLED.spkg
Qualcomm.QC8974.PEPProxy.spkg
Qualcomm.QC8974.PhoneRadioRevision_8974DI4.spkg
Qualcomm.QC8974.pil.spkg
Qualcomm.QC8974.powerkeygpiodriver.spkg
Qualcomm.QC8974.PPMSettings.spkg
Qualcomm.QC8974.QC_PEP.spkg
Qualcomm.QC8974.qcadc.spkg
Qualcomm.QC8974.qcaud.spkg
Qualcomm.QC8974.QcBattMiniclass.spkg
Qualcomm.QC8974.QcBattMngr.spkg
Qualcomm.QC8974.qcbluetooth.spkg
Qualcomm.QC8974.QcBms.spkg
Qualcomm.QC8974.qccamavs.spkg
Qualcomm.QC8974.qccamflash.spkg
Qualcomm.QC8974.qccamfrontsensor_imx219_8m_bayer.spkg
Qualcomm.QC8974.qccamisp.spkg
Qualcomm.QC8974.QCCamJpegE.spkg
Qualcomm.QC8974.qccamplatform.spkg
Qualcomm.QC8974.qccamrearsensor_imx214_13m_bayer.spkg
Qualcomm.QC8974.qccamsettings.spkg
Qualcomm.QC8974.qccamtuningdata.spkg
Qualcomm.QC8974.qccdi.spkg
Qualcomm.QC8974.QCCI.spkg
Qualcomm.QC8974.qccomposite.spkg
Qualcomm.QC8974.QCDiagLogging.spkg
Qualcomm.QC8974.qcdx11compiler.spkg
Qualcomm.QC8974.qcdxdriver.spkg
Qualcomm.QC8974.qcepmadc.spkg
Qualcomm.QC8974.qcfmminiport.spkg
Qualcomm.QC8974.qcfmtransport.spkg
Qualcomm.QC8974.qcgnss.spkg
Qualcomm.QC8974.QcGnssSvc.spkg
Qualcomm.QC8974.qcgpio.spkg
Qualcomm.QC8974.QcGsiffSvc.spkg
Qualcomm.QC8974.qci2c.spkg
Qualcomm.QC8974.qcimssink.spkg
Qualcomm.QC8974.qcimssrc.spkg
Qualcomm.QC8974.QCJpegEncoderMFT.spkg
Qualcomm.QC8974.QcKmdBam.spkg
Qualcomm.QC8974.qclistensoundmodellib.spkg
Qualcomm.QC8974.QcLTECoexMgr.spkg
Qualcomm.QC8974.qcmchdcpuml.spkg
Qualcomm.QC8974.qcmcumd.spkg
Qualcomm.QC8974.QcMipiBif.spkg
Qualcomm.QC8974.QcPmic.spkg
Qualcomm.QC8974.QcPmicApps.spkg
Qualcomm.QC8974.QcPmicGpio.spkg
Qualcomm.QC8974.QCPowerLog.spkg
Qualcomm.QC8974.qcqdss.spkg
Qualcomm.QC8974.QcRCSPresSvc.spkg
Qualcomm.QC8974.qcSensor1UM.spkg
Qualcomm.QC8974.qcSensors.spkg
Qualcomm.QC8974.qcSensorsConfig.spkg
Qualcomm.QC8974.QcShutdownSvc.spkg
Qualcomm.QC8974.QCSI.spkg
Qualcomm.QC8974.qcslimbus.spkg
Qualcomm.QC8974.qcspi.spkg
Qualcomm.QC8974.qcspmi.spkg
Qualcomm.QC8974.QcUsbFnSsFilter.spkg
Qualcomm.QC8974.qcviddecmft.spkg
Qualcomm.QC8974.QcVidEncmftH263.spkg
Qualcomm.QC8974.QcVidEncmftH264.spkg
Qualcomm.QC8974.QcVidEncMftMPEG4.spkg
Qualcomm.QC8974.qcvidencum.spkg
Qualcomm.QC8974.qcvss.spkg
Qualcomm.QC8974.QcWicEncoder8974.spkg
Qualcomm.QC8974.QmiDaemon.spkg
Qualcomm.QC8974.qmux.spkg
Qualcomm.QC8974.QNFC.spkg
Qualcomm.QC8974.qualcomm_uart.spkg
Qualcomm.QC8974.RegCustomization.spkg
Qualcomm.QC8974.remoteat.spkg
Qualcomm.QC8974.RemoteAtSrvc.spkg
Qualcomm.QC8974.remotefs.spkg
Qualcomm.QC8974.revrmnet.spkg
Qualcomm.QC8974.rmnetbridge.spkg
Qualcomm.QC8974.RPEN.spkg
Qualcomm.QC8974.scm.spkg
Qualcomm.QC8974.ShowVideoCallingSwitch_8974DI4.spkg
Qualcomm.QC8974.smd.spkg
Qualcomm.QC8974.smmu.spkg
Qualcomm.QC8974.SOCProdTest.spkg
Qualcomm.QC8974.ssd.spkg
Qualcomm.QC8974.ssm.spkg
Qualcomm.QC8974.subsys.spkg
Qualcomm.QC8974.TouchDetectionDriver.spkg
Qualcomm.QC8974.UsbFnFilter.spkg
Qualcomm.QC8974.WCNSSPeriImage.spkg
Qualcomm.QC8974.WDFHelper.spkg
Qualcomm.QC8974.WifiNotifierSrvc.spkg
Qualcomm.QC8974.wlan.spkg
Qualcomm.QC8974.wlan_ihv.spkg
Qualcomm.QC8974.WMIms.spkg
Qualcomm.QC8974.WMRil.spkg
Qualcomm.QC8974_MTP.ACSP.spkg
Qualcomm.M8X74SOC_MTP.acpi.spkg
Qualcomm.QC8974.smbios_cfg.spkg
Partitions:
Qualcomm.QC8974.dbi.spkg
Qualcomm.QC8974.rpm.spkg
Qualcomm.QC8974.sbl1.spkg
Qualcomm.QC8974.tz.spkg
Qualcomm.QC8974.tzapps.spkg
Qualcomm.QC8974.uefi.spkg
Qualcomm.QC8974.winsecapp.spkg

Do not forget, you can still install android on it without digging

djtonka said:
Do not forget, you can still install android on it without digging
Click to expand...
Click to collapse
Yes, I know you can flip from Android and Windows Mobile as you wish
I shared these information to understand how they ported Windows Mobile to an Android phone: it seems you need to keep some partition.

TristanLeBoss said:
Yes, I know you can flip from Android and Windows Mobile as you wish
I shared these information to understand how they ported Windows Mobile to an Android phone: it seems you need to keep some partition.
Click to expand...
Click to collapse
Kept partitions must be related to flash mode .
I think if you remove them you will not be able to go back to android

Can it be ported to other phones.

@TristanLeBoss i just wanna know what's the magic that differentiates an ARM windows to an ARM Android? Basic instruction set is the same. So it can be ported to other ARM devices right?

@katsuga & @iamsubhranil
Windows Mobile 10 can theoretically work on all ARM phones. But that's the theory...
For example, Secure Boot will be a problem because if the bootloader of your phone is not signed by your manufacturer, your phone won't boot. Some phones like the Google Nexus offer a way to disable Secure Boot...
The next problem I see is with the drivers. I am unsure if they can be customized by manufacturers or if they are generic.

TristanLeBoss said:
For example, Secure Boot will be a problem because if the bootloader of your phone is not signed by your manufacturer, your phone won't boot. Some phones like the Google Nexus offer a way to disable Secure Boot...
The next problem I see is with the drivers. I am unsure if they can be customized by manufacturers or if they are generic.
Click to expand...
Click to collapse
SecureBoot can be disabled by OEM unlocking AFAIK. And regarding the .spkg drivers, I already made some searches and found that they are UWD(Universal Windows Drivers). VS15 itself provides some generic drivers for UWP. Any low level customisations have to be made by the devolper. This is an one time effort as only UWD will reside in any future version of Windows. Being Linux based OpenSource OS, we already have our device sources, bases and all low level components in the source code state. I don't think porting them in UWD won't be any problem. Will it?

With these discoveries, what could be considered the most optimal candidate phone to test a port on? Be it not all ducks will line up in a row, but if only 1 or 2 are standing out of line, then it seems there are workarounds that can be implemented...hence the disabling of secure boot. The other difficulty is how to flash, or what method can be used both ways...from Android to WM10 and vice versa. Something similar to the miflash tool looks ideal or possibly other qualcomm tools. Maybe I am thinking too far ahead here...

nate0 said:
With these discoveries, what could be considered the most optimal candidate phone to test a port on? Be it not all ducks will line up in a row, but if only 1 or 2 are standing out of line, then it seems there are workarounds that can be implemented...hence the disabling of secure boot. The other difficulty is how to flash, or what method can be used both ways...from Android to WM10 and vice versa. Something similar to the miflash tool looks ideal or possibly other qualcomm tools. Maybe I am thinking too far ahead here...
Click to expand...
Click to collapse
Well at first I think a 100% similar spec-ed Android device with a Windows one could be the target because there'll be much less chance of missing and/or conflicting drivers and other components.

nate0 said:
With these discoveries, what could be considered the most optimal candidate phone to test a port on? Be it not all ducks will line up in a row, but if only 1 or 2 are standing out of line, then it seems there are workarounds that can be implemented...hence the disabling of secure boot. The other difficulty is how to flash, or what method can be used both ways...from Android to WM10 and vice versa. Something similar to the miflash tool looks ideal or possibly other qualcomm tools. Maybe I am thinking too far ahead here...
Click to expand...
Click to collapse
You figured them
1) Ability to disable Secure Boot or to boot an untrusted boot loader
2) Ability to flash in 9008 mode
2a) A file to flash to restore the original OS
2b) Sahara programmer to restore GPT & need boot partitions (MPRGXXXX.hex & XXXX_msimage.mbn) in case we soft brick it
2b) Firehose programmer (prog_XXXX_firehose.mbn) to flash new partitions once fastboot is gone
3) A SoC supported by one of the Windows Mobile 10 FFU we have (Xiaomi Mi4, Lumia 950, Lumia 950XL...)

TristanLeBoss said:
You figured them
1) Ability to disable Secure Boot or to boot an untrusted boot loader
2) Ability to flash in 9008 mode
2a) A file to flash to restore the original OS
2b) Sahara programmer to restore GPT & need boot partitions (MPRGXXXX.hex & XXXX_msimage.mbn) in case we soft brick it
2b) Firehose programmer (prog_XXXX_firehose.mbn) to flash new partitions once fastboot is gone
3) A SoC supported by one of the Windows Mobile 10 FFU we have (Xiaomi Mi4, Lumia 950, Lumia 950XL...)
Click to expand...
Click to collapse
EDIT: Has anyone documented successfully disabling secure-boot on a Nexus or accomplished this? Is this the same as unlocking the boot loader? I have been thinking along the lines of UEFI/EFI secure boot. Similar to disabling secure boot on a surface so you can install Android... Wondering if there are any repercussions or if it can be reversed...

TristanLeBoss said:
Regarding the Firehose flasher:
".\prog_emmc_firehose_8974.mbn" is a SBL (Secondary Boot Loader) file with a 80 bytes header
The file is not signed (no signature and no certificate chain).
Codeword[4]: d1dc4b84
Magic[4]: 3410d773
Image ID[4]: 0d000000
Reserved 1[4]: ffffffff
Reserved 2[4]: ffffffff
Image source[4]: 50000000
Image destination pointer[4]: 50c000f8 (4160798800)
Image size[4]: 90480100
Code size[4]: 90480100
Signature pointer[4]: e00802f8 (4160882912)
Signature size[4]: 00000000 (0)
Certificate chain pointer[4]: e00802f8 (4160882912)
Certificate chain size[4]: 00000000 (0)
OEM root certificate selelected[4]: 01000000
OEM number of root certificates[4]: 01000000
Booting image config[4]: ffffffff
Reserved 6[4]: ffffffff
Reserved 7[4]: ffffffff
Reserved 8[4]: ffffffff
Reserved 9[4]: ffffffff
Click to expand...
Click to collapse
@TristanLeBoss
What else do you know about this programmer or others you may be able to analyze, was it supplied through the OEM to use with their tool? Can it be used on other ARM QC 8974 chip phones? Maybe it can be used on another phone with same partition layout/size? If not I am curious if there is a way to extract or build the mbn/programmer files needed from another phone via jtag setup or something.
I ask this since the OnePlus 2 (A2001 Chinese model) there are mbn/flash partitions/programmer files available for unbricking. Maybe those would come in handy...

This sounds like your theory would also work with an OTG cable and a thumb drive. But what do you mean get a uefi image file to pack in the boot image though. This would be a signed file?

feherneoh said:
If you tell me the exact device you are using (and optionally give me a boot.img for it) I can try to build one image for you (first LK, to make sure drivers are okay, if they work, then EFIDroid)
Click to expand...
Click to collapse
Only for same specs device's for now or for all android devices?

feherneoh said:
I should be able to build UEFI for almost any SnapDragon device, but in some cases LCD does not work with it
And you still have to mess around with W10M to make it work
Click to expand...
Click to collapse
Your method uses an SD card to build/boot the separate OS correct? Can this be done with a OTG connection as well? Would this work for the OnePlus3? I currently own one. If not I would be willing to purchase a cheap used OnePlus 2 device seeing how folks are trying to get rid of them now, but not sure how easily available that boot.img is.....

Actually it seems a OP2 device has no SD card slot either, if I am able to get a cheap used test device that will work then seems OnePlus X does have a slot. Have you successfully accomplished a boot of W10M off an SD card from an Android phone? What's your test device, and do you have separate thread on this as some this is off topic from the thread Subj... @TristanLeBoss apologies.

feherneoh said:
BTW, I know people who started porting it, but it is extremely hard
Click to expand...
Click to collapse
Yes from my small experience digging into it, it is not easy to get all things to line up the way they are needed.

LG G4 Bricked Qualcomm HS-USB QDLoader 9008

Hello,
I know,I know, you will say yet another topic about LG G4 and Qualcomm 9008 problem.
you have right but this problem intrigues me.
Some people proposed a solution for reviving the phone without a box by short-cutting 2 testpoint on the motherbord before connecting to the computer.
so here is what I did, unfortunately without success, but together we can find where is the problem and find a final solution for this big problem.
1- ONLY connect Smartphone USB Side like this :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2- Shortcut with tweezers the two testpoints as described here :
3-On windows 10 x64 Launch QFIL V 2.0.0.5 with Admin Rights :
4- Connect USB Computer side :
5-Choose COM PORT and all settings like this :
6-Clik Download Button
7- unsuccessful operation, this is the log file
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
port_trace.txt
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: DEBUG: Binary build date: Sep 28 2015 @ 17:28:46
09:28:30: DEBUG: Build Version: 15.09.28.17.28.46
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: DEBUG: Les nouvelles connexions seront m‚moris‚es.
09:28:30: DEBUG:
09:28:30: DEBUG: La liste est vide.
09:28:30: DEBUG:
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: DEBUG: ==================================================================================
09:28:30: DEBUG: ==================================================================================
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: DEBUG: 1. Calling stat(C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml')
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='rb'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: Found 'C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml' (5089 bytes)
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='r'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: User set ZLPAWAREHOST to 1
09:28:30: INFO: User wants to talk to port '\\.\COM4'
09:28:40: DEBUG: port_fd=0xC8
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: OpenPort:5566 It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable
So where is the problem ? Shortcutting the two points is supposed to open the FireHose port but i tested with twezzers, cooper cable...ect nothing seem to work
any Idea ?
thank you

PS: I have the Link to the files if you want them

Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.

I got the same problem with my H815T. It only allows me to flash the LS991 files, but I lose the imei
serestma said:
Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.
Click to expand...
Click to collapse
H810: https://mega.nz/#!55tACDZC!Ci1pjEr8_wr9Ng2SrPgj42MwxnGybo60de26w2gtimg

I bought a subscription from easy-firmware hoping that they have right emmc_firehose. They are scammers. I have a bricked LG G4 too and since now I have not found a way to unbrick it. Do not waste your time. For H815 the files are wrong and we also need nonfused emmc_firehose_programmer. Also the SD Card method is not working for me tried it with 10 different images and 4 different cards. I am investigating this issue and if I find a solution I will make a tutorial for all fellas that are in trouble.

AZstyle said:
Hello,
I know,I know, you will say yet another topic about LG G4 and Qualcomm 9008 problem.
you have right but this problem intrigues me.
Some people proposed a solution for reviving the phone without a box by short-cutting 2 testpoint on the motherbord before connecting to the computer.
so here is what I did, unfortunately without success, but together we can find where is the problem and find a final solution for this big problem.
1- ONLY connect Smartphone USB Side like this :
2- Shortcut with tweezers the two testpoints as described here :
3-On windows 10 x64 Launch QFIL V 2.0.0.5 with Admin Rights :
4- Connect USB Computer side :
5-Choose COM PORT and all settings like this :
6-Clik Download Button
7- unsuccessful operation, this is the log file
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
port_trace.txt
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: DEBUG: Binary build date: Sep 28 2015 @ 17:28:46
09:28:30: DEBUG: Build Version: 15.09.28.17.28.46
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: DEBUG: Les nouvelles connexions seront m‚moris‚es.
09:28:30: DEBUG:
09:28:30: DEBUG: La liste est vide.
09:28:30: DEBUG:
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: DEBUG: ==================================================================================
09:28:30: DEBUG: ==================================================================================
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: DEBUG: 1. Calling stat(C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml')
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='rb'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: Found 'C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml' (5089 bytes)
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='r'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: User set ZLPAWAREHOST to 1
09:28:30: INFO: User wants to talk to port '\\.\COM4'
09:28:40: DEBUG: port_fd=0xC8
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: OpenPort:5566 It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable
So where is the problem ? Shortcutting the two points is supposed to open the FireHose port but i tested with twezzers, cooper cable...ect nothing seem to work
any Idea ?
thank you
Click to expand...
Click to collapse
qfil needs the firehose.bin i know we dont have one for the sprint varient also have u tried any debrick imgs and sd card method?

Guys just flash the ls991 files and the problem with imei is fixable by flashing some files through fastboot
Do what this says and if you bricked your phone just flash ls991 files again
Only problem which remains is sd card read and write
But you will have a full functional phone

shamescool said:
Guys just flash the ls991 files and the problem with imei is fixable by flashing some files through fastboot
Do what this says and if you bricked your phone just flash ls991 files again
Only problem which remains is sd card read and write
But you will have a full functional phone
Click to expand...
Click to collapse
Please do not mislead other people and try not to answer questions if you didn't try the fixes yourself.
Depending on the bootstack of the CPU SD method might or might nor work.
In theory you can EMMC repair with LS991 but then you will have SecureBoot problems (Error 1006). I didn't try it yet but there is a method where you force off emmc verification by shorting EMMC CMD terminal to GND. But this requires very small soldering, opening the phone and removing the motherboard. The method is tried and working on 4PDA.
EDIT: @AZstyle The firehose are scams, the only working one is the ls991 which I think is a developer one because you will get fastboot access but I can't personally flash anything in LGUP.
When I flash all partitions but bootstack I get 1006 error. I didn't try the soldering method because I have a Medusa Box on the way. I will try USB Repair and if it does not work I will just RMA.

neutrondev said:
Please do not mislead other people and try not to answer questions if you didn't try the fixes yourself.
Depending on the bootstack of the CPU SD method might or might nor work.
In theory you can EMMC repair with LS991 but then you will have SecureBoot problems (Error 1006). I didn't try it yet but there is a method where you force off emmc verification by shorting EMMC CMD terminal to GND. But this requires very small soldering, opening the phone and removing the motherboard. The method is tried and working on 4PDA.
EDIT: @AZstyle The firehose are scams, the only working one is the ls991 which I think is a developer one because you will get fastboot access but I can't personally flash anything in LGUP.
When I flash all partitions but bootstack I get 1006 error. I didn't try the soldering method because I have a Medusa Box on the way. I will try USB Repair and if it does not work I will just RMA.
Click to expand...
Click to collapse
im not misleading anyone here im just sharing my experience
yes you will get 1006 problem by flashing partitions but at least you get a fully functioning phone
the way i mentioned is actually worked for another person here in this forum please test if you still have doubt
my phone is also a refurbished h811 which has a f500l mobo on it and flashing those ls991 files made the phone alive in h811 10n but i did nt have any imei or base band no camera too(even speaker and sensors didnt work)
so i tried flashing some partitions in fastboot and then i had my imei back and also the camera
then i edited f500 tot file with winhex and my phone bricked again(obviously)so i tried flashing ls991 again and now i have a fully functioning phone which cannot be said for sd card...my phone cant write or read any sdcard and its really pissing me of
any suggest for sd card?

H810_ARecovery
¿How to use or flash this files?, tell me please.

neutrondev said:
I bought a subscription from easy-firmware hoping that they have right emmc_firehose. They are scammers. I have a bricked LG G4 too and since now I have not found a way to unbrick it. Do not waste your time. For H815 the files are wrong and we also need nonfused emmc_firehose_programmer. Also the SD Card method is not working for me tried it with 10 different images and 4 different cards. I am investigating this issue and if I find a solution I will make a tutorial for all fellas that are in trouble.
Click to expand...
Click to collapse
u are right, i already tested all this ****, its appear that the only solution is to repair the emmc boot with octopus box or medusa box
next week i'll bring my G4 to a repair store to do this operation.
and I will keep u informed with the results

AZstyle said:
u are right, i already tested all this ****, its appear that the only solution is to repair the emmc boot with octopus box or medusa box
next week i'll bring my G4 to a repair store to do this operation.
and I will keep u informed with the results
Click to expand...
Click to collapse
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Good Remark, I can't remember if I tested with LS911 files, I tested with H815 H818p without sucess.
Do you have the files for LS911? can u share them with me please so i'll give a try.
Thanks

What about that ?
and this

serestma said:
Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.
Click to expand...
Click to collapse
https://mega.nz/#F!1DhXTLAa!kH8MfkbeOKcUWt3T2R6cTQ

@AZstyle Do not flash with those files because I think you will need CPU swap. I think that programmer blows fuses for US version. I did that and now I can't repair it even with MEDUSA I can flash ls991 firmware it boots but with H815 NO.

the_naxhoo said:
I got the same problem with my H815T. It only allows me to flash the LS991 files, but I lose the imei
H810: https://mega.nz/#!55tACDZC!Ci1pjEr8_wr9Ng2SrPgj42MwxnGybo60de26w2gtimg
Click to expand...
Click to collapse
No Problem If You Loosed IMEI I Can Flash IMEI For You Just Poke Me On WhatsApp Only WhatsApp !!!
7000926368
Hope I Can Help You
Sent from my LS-4004 using Tapatalk

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Yes I have flashed ls991 firehose . What do you need to know?
.
Sent from my LG-H815 using XDA Labs

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Medusa Pro Box Works Like Charm !!!
I Fixed 7 LG G4 With It EMMC One
And 3 LG G4 With USB One
If Someone Have Medusa Pro Box And Unable To Fix With It Thats Sure That You Might Have Not Soldered Wire Correct Or Motherboard Has Hardware Problem
Sent from my LS-4004 using Tapatalk

steadfasterX said:
Yes I have flashed ls991 firehose . What do you need to know?
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Dont know where i find a ls992 firehose do you?
I bricked my g5 in a freak bad usb cord accident.

Unbricking Zenfone 5Z with QFIL - Firehose error

Wondering if anybody has suggestions for me...
I've got a bricked Zenfone 5Z, in the QDLoader 9008 mode. I've been trying to reflash it using QFIL and the file in this thread. When I try to flash, I get the following error:
Code:
17:39:49: INFO: User wants to talk to port '\\.\COM10'
17:39:59: DEBUG: port_fd=0xC4
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
17:39:59: {ERROR: OpenPort:5214 It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable
Does anybody have suggestions on how to get past this error? I have tried various versions of QFIL (most recently tried 2.0.1.1) and have tried Qualcomm drivers from 2013 / 2014.
Any help would be appreciated

same problem any solution ?

Help unbricking Xiaomi Mi Note 3 (not redmi)

hi guys i have been trying to unbrick the phone via miflash and qfil with no sucess for the past week... now im boiling... and hoping i can get some help from you guys.
The phone is on black screen so i use the 2 jumpers to enter into edl mode...
i get this error while trying to flash the rom.
If you guys can help i will totally apreciate it.
[18:40:30 COM3]:MiFlash 2017.12.12.0
[18:40:30 COM3]:flash in thread name:COM3,id:10
[18:40:30 COM3]:QSaharaServer.exe -u 3 -s 13:C:\ROM MI NOTE 3\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global_8c73072230\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global\images\prog_emmc_firehose_Sdm660_ddr.elf & fh_loader.exe --port=\\.\COM3 --sendxml=rawprogram0.xml --search_path=C:\ROM MI NOTE 3\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global_8c73072230\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global\images --noprompt --showpercentagecomplete --maxpayloadsizeinbytes=0 --zlpawarehost=1 --memoryname=ufs --verbose & fh_loader.exe --port=\\.\COM3 --sendxml=patch0.xml --search_path=C:\ROM MI NOTE 3\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global_8c73072230\jason_global_images_V10.4.2.0.PCHMIXM_20190906.0000.00_9.0_global\images --noprompt --showpercentagecomplete --maxpayloadsizeinbytes=0 --zlpawarehost=1 --memoryname=ufs --verbose & fh_loader.exe --port=\\.\COM3 --setactivepartition=1 --noprompt --showpercentagecomplete --maxpayloadsizeinbytes=0 --zlpawarehost=1 --memoryname= ufs --verbose & fh_loader.exe --port=\\.\COM3 --reset --noprompt --showpercentagecomplete --maxpayloadsizeinbytes=0 --zlpawarehost=1 --memoryname=ufs --verbose
[18:40:30 COM3]hysical Memory Usage:110592 Byte
[18:40:30 COM3]:start process id 12604 name cmd
[18:42:01 COM3]:Binary build date: May 9 2017 @ 03:56:22
[18:42:01 COM3]:QSAHARASERVER CALLED LIKE THIS: 'QSaharaServer.ex'Current working dir: C:\20171\MiFlash20171212
[18:42:01 COM3]:Sahara mappings:
[18:42:01 COM3]:2: amss.mbn
[18:42:01 COM3]:6: apps.mbn
[18:42:01 COM3]:8: dsp1.mbn
[18:42:01 COM3]:10: dbl.mbn
[18:42:01 COM3]:11: osbl.mbn
[18:42:01 COM3]:12: dsp2.mbn
[18:42:01 COM3]:16: efs1.mbn
[18:42:01 COM3]:17: efs2.mbn
[18:42:01 COM3]:20: efs3.mbn
[18:42:01 COM3]:21: sbl1.mbn
[18:42:01 COM3]:22: sbl2.mbn
[18:42:01 COM3]:23: rpm.mbn
[18:42:01 COM3]:25: tz.mbn
[18:42:01 COM3]:28: dsp3.mbn
[18:42:01 COM3]:29: acdb.mbn
[18:42:01 COM3]:30: wdt.mbn
[18:42:01 COM3]:31: mba.mbn
[18:42:01 COM3]:13: C:\ROM
[18:42:01 COM3]:18:42:00: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
[18:42:01 COM3]:18:42:00: ERROR: function: sahara_main:924 Sahara protocol error
[18:42:01 COM3]:18:42:00: ERROR: function: main:303 Uploading Image using Sahara protocol failed
[18:42:01 COM3]:Base Version: 17.04.27.14.27
[18:42:01 COM3]:Binary build date: May 9 2017 @ 03:56:18
[18:42:01 COM3]:Incremental Build version: 17.05. 9.03.56.18
[18:42:01 COM3]: _____
[18:42:01 COM3]: | ___|
[18:42:01 COM3]: | |__ _ __ _ __ ___ _ __
[18:42:01 COM3]: | __| '__| '__/ _ \| '__|
[18:42:01 COM3]: | |__| | | | | (_) | |
[18:42:01 COM3]: \____/_| |_| \___/|_|
[18:42:01 COM3]:18:42:01: {ERROR: Option 'MI' does not begin with --
[18:42:01 COM3]:}
[18:42:01 COM3]:ERROR: Could not append to 'port_trace.txt'
[18:42:01 COM3]:Log is 'C:\20171\MiFlash20171212\port_trace.txt'
[18:42:01 COM3]:Base Version: 17.04.27.14.27
[18:42:01 COM3]:Binary build date: May 9 2017 @ 03:56:18
[18:42:01 COM3]:Incremental Build version: 17.05. 9.03.56.18
[18:42:01 COM3]: _____
[18:42:01 COM3]: | ___|
[18:42:01 COM3]: | |__ _ __ _ __ ___ _ __
[18:42:01 COM3]: | __| '__| '__/ _ \| '__|
[18:42:01 COM3]: | |__| | | | | (_) | |
[18:42:01 COM3]: \____/_| |_| \___/|_|
[18:42:01 COM3]:18:42:01: {ERROR: Option 'MI' does not begin with --
[18:42:01 COM3]:}
[18:42:01 COM3]:ERROR: Could not append to 'port_trace.txt'
[18:42:01 COM3]:Log is 'C:\20171\MiFlash20171212\port_trace.txt'
[18:42:01 COM3]:Base Version: 17.04.27.14.27
[18:42:01 COM3]:Binary build date: May 9 2017 @ 03:56:18
[18:42:01 COM3]:Incremental Build version: 17.05. 9.03.56.18
[18:42:01 COM3]: _____
[18:42:01 COM3]: | ___|
[18:42:01 COM3]: | |__ _ __ _ __ ___ _ __
[18:42:01 COM3]: | __| '__| '__/ _ \| '__|
[18:42:01 COM3]: | |__| | | | | (_) | |
[18:42:01 COM3]: \____/_| |_| \___/|_|
[18:42:01 COM3]:18:42:01: {ERROR: Option 'ufs' does not begin with --
[18:42:01 COM3]:}
[18:42:01 COM3]:ERROR: Could not append to 'port_trace.txt'
[18:42:01 COM3]:Log is 'C:\20171\MiFlash20171212\port_trace.txt'
[18:42:01 COM3]:Base Version: 17.04.27.14.27
[18:42:01 COM3]:Binary build date: May 9 2017 @ 03:56:18
[18:42:01 COM3]:Incremental Build version: 17.05. 9.03.56.18
[18:42:01 COM3]:18:42:01: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
[18:42:01 COM3]:************************************************
[18:42:01 COM3]:fh_loader.exe --port=\\.\COM3 --reset --noprompt --showpercentagecomplete --maxpayloadsizeinbytes=0 --zlpawarehost=1 --memoryname=ufs --verbose
[18:42:01 COM3]:************************************************
[18:42:01 COM3]:18:42:01: INFO: Current working dir (cwd): C:\20171\MiFlash20171212\
[18:42:01 COM3]:18:42:01: INFO: Showing network mappings to allow debugging
[18:42:01 COM3]:18:42:01: INFO: User wants to talk to port '\\.\COM3'
[18:42:01 COM3]:18:42:01: INFO: Took 0.00000000 seconds to open port
[18:42:01 COM3]:18:42:01: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
[18:42:01 COM3]:18:42:01: INFO: If you don't want this, use --dontsorttags
[18:42:01 COM3]:18:42:01: INFO: Sending <configure>
[18:42:01 COM3]: _____
[18:42:01 COM3]: | ___|
[18:42:01 COM3]: | |__ _ __ _ __ ___ _ __
[18:42:01 COM3]: | __| '__| '__/ _ \| '__|
[18:42:01 COM3]rocess exit id 12604 name cmd
[18:42:01 COM3]: | |__| | | | | (_) | |
[18:42:01 COM3]:error:18:42:00: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
[18:42:01 COM3]:error:18:42:00: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.
[18:42:01 COM3]rocess exit.
[18:42:01 COM3]:flashSuccess False
[18:42:01 COM3]:isFactory False CheckCPUID False
[18:42:01 COM3]:before:flashSuccess is False set IsUpdate:True set IsDone True
[18:42:01 COM3]:after:flashSuccess is False set IsUpdate:false set IsDone true