Develop Bugs

Help me dump the OS of my PPC

Hi!
I need your help!
I have an Airis T620 PPC, the official patch from the manufacturer's site for WM5 bricked my PPC.
The AirisT620 is a MIO P550 clone, and I've downloaded the WM5 ROM for Mio P550 (MioP550 - Osc260A R05_P09.nb0) and I've intalled it succesfully on my AIRIS.
BUT, I'd like to dump the WM5 of my friend's AIRIS to a *.nb0 file to upload to my PPC. I've downloaded itsutilsbin-20070705.zip and created a RAW image.
Here's the list of the Parts:
C:\itsutils>pdocread -l
127.00M (0x7f00000) SMFLASH
| 1.12M (0x11fc00) Part00
| 1.88M (0x1e0000) Part01
| 26.63M (0x1aa0000) Part02
| 97.38M (0x6160000) Part03
976.50M (0x3d080000) DSK1:
| 976.38M (0x3d061600) Part00
STRG handles:
handle 63d1c926976.38M (0x3d061600)
handle a3f5081e 97.38M (0x6160000)
handle a3f5012a 26.63M (0x1aa0000)
handle 23f50106 1.88M (0x1e0000)
handle c3f74f2a 1.12M (0x11fc00)
disk 63d1c926
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3f5081e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a3f5012a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 23f50106
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk c3f74f2a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
I used this to create the RAW image:
Pdocread -w -d SMFLASH -p Part02 0x0 0x1aa0000 Part02.raw
If I try to make an *.nb0 directly I get the following error message:
C:\itsutils>pdocread 0 0x1aa0000 asd.nb0
CopyTFFSToFile(0x0, 0x1aa0000, asd.nb0)
ERROR: ITReadDisk : read 00000000 bytes - A device attached to the system is not
functioning.
How can I convert the raw to nb0, or how can I dump the ROM directly to nb0?
Thank you for your help!

Hi again!
I tried several methods during the weekend. All failed somewhere.
First I tried to dump the OS to hex.
C:\itsutils>pdocread -h 0xc3f0518e 0x0 0x1aa0000 OS.nb
The error message was:
CopyTFFSToFile(0x0, 0x1aa0000, OS.nb)
ERROR: ITReadDisk : read 00000000 bytes - A device attached to the system is not functioning.
the itsutils.log said:
ERROR: DeviceIoControl(FL_IOCTL_READ_SECTORS) - A device attached to the system is not functioning.
than I tried:
C:\itsutils>pdocread.exe -n 2 0x0 0x1aa0000 OS.nba
error:
ERROR: ITTFFSGetInfo - A device attached to the system is not functioning.
WARNING: using default 512 bytes for sectorsize
CopyTFFSToFile(0x0, 0x1aa0000, OS.nba)
ERROR: ITReadDisk: outbuf==NULL
- A device attached to the system is not functioning.
after that I tried using bkondisk, and bksamsungflash:
C:\itsutils>prun bkondisk -i
in the bkondisk.log:
ERROR: kioctl(FLASH, init1) - The network request is not supported.
error initializing flash
bksamsungflash gives the same error in its log
And my last try was:
C:\itsutils>Pdocwrite -w -d SMFLASH -p Part02 Part02.raw 0x0 0x1aa0000
CopyFileToTFFS(Part02.raw:0, 0, 01aa0000)
and the last error message was:
ERROR: ITWriteDisk - The media is write protected.
How can I acquire the D-O-C password for my PDA?
Anyone has any ideas how to step further?
P.S.
The policies in HKLM\Security\Policies\Policies\00001001 is set to dword '1'
And I think my PPC is missing the IOCTL Api, how can I install it on my PPC?

Is it more simple using SPB backup.. say backup a good version of the system (without PIM) and flash over?

Hi myc!
Yes, I am using SPB backup to backup my personal files, but in this case I need to acquire the operating system of my PDA, witch can't be done with SPB backup.

Hi! (For borisbme Szia!)
Here I summarize my experiences with T620.
NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the below things you will risk that you make your device a brick. Try this at your own risk!
First take a look at the MioP550 - Osc260A R05_P09.nb0 file. The header structure seems to be rather straightforward.
0x00: "Pocket_PC_2005" \x00 \x00 \x00
0x10: 4 bytes : offset of the 1st section
4 bytes : length of the 1st section
4 bytes : checksum
4*'\x00'
0x20: "MS_IPL" som '\x00's
0x30: 4 bytes : offset of the 2nd section
4 bytes : length of the 2nd section
4 bytes : checksum
4*'\x00'
0x40: "OS_IMAGE" some '\x00's
0x50: 4 bytes : offset of the 3nd section
4 bytes : length of the 3nd section
4 bytes : checksum
4*'\x00'
0x60: "UBOOT" some '\x00's
I believe the 1st secion is the update loader , the 2nd is the actual update in MSFLSH50 format (-acer type) and the 3rd is UBOOT update.
Let's not touch the IPL and UBOOT section for a while ;-)
Based on the above information you can split the image into 3 parts and change the OS_IMAGE part.
I noticed that the checksum is for verification purpose but it does not prevent the flashing of an image with wrong checksum. I learned that because I changed the checksum to FFFFFFF to see how flashing reacts, but after a few "Bad checksum, press any key" messages I accidentally flashed my T620 with the above P550 ROM :-(
Let's look at the OS_IMAGE part.
If you want quick dump, you can try prepare_imgfs "saved OS_IMAGE file" -n -acer and view_imgfs , but you can further decompose the file.
I wrote it's "-acer" type, because it has 512 bytes sectors padded with 8 extra bytes. If you remove the padding then you have a clean MSFLSH50 file you can manipute with msflshtool.
Here I can see some difference between the P550 and T620. The 1st sector is the MBR and the partition sizes are different for the 2 device. The 2nd sector is still MSFLSH50 header, I don't know the structure, so would not change that. My assumption was, that it the file sizes are the same, it would not hurt to replace parts ;-)
One can go further with the P550 partition sizes and change T620 dumps to fit into it.
With the following little python script you can split the OS_IMAGE into parts. Do not comment the code , I not a skillful coder;-)
Code:
from binascii import hexlify
from struct import unpack
parts = (("part00",0x8FE),("part01",0xF00),("filler",0x200),("part02",0xD500))
infile = open("OS_IMAGE.dat","rb")
## MBR
mbr=open("mbr.dat","wb")
data = infile.read(520)
mbr.write(data)
mbr.close()
## HDR
hdr=open("hdr.dat","wb")
data = infile.read(520)
hdr.write(data)
hdr.close()
for (part,size) in parts:
print "Extract part ",part
ofile = open(part+".dat","wb")
for i in range(0,size):
data = infile.read(512)
marker = infile.read(8)
ofile.write(data)
ofile.close()
print "Extract rest"
ofile = open("rest.dat","wb")
while True:
data = infile.read(512)
if len(data) == 0:
break
marker = infile.read(8)
ofile.write(data)
ofile.close()
part00 corresponds to the "pdocread" dumped part00 ( I guess it's the bootloder)
part01 corresponds to the "pdocread" dumped part01 ( I guess it's the kernel partition)
part02 corresponds to the "pdocread" dumped part02 ( It is the IMGFS OS image )
With the following little python script you can combine back the parts into a "new" OS_IMAGE you can use to replace the corresponding part in the ".nb0"
Code:
from binascii import hexlify
from binascii import unhexlify
from struct import unpack
from struct import pack
parts = (("part00",0x2,0x8FE,"fdfffbff"),("part01",0x900,0xF00,"fdfffbff"),("filler",0x0,0x200,"fffffbff"),("part02",0x1800,0xD500,"fffffbff"))
outfile = open("NEW.dat","wb")
## MBR
mbr=open("mbr.dat","rb")
data = mbr.read(520)
outfile.write(data)
mbr.close()
## HDR
hdr=open("hdr.dat","rb")
data = hdr.read(520)
outfile.write(data)
hdr.close()
for (part,start,size,mark) in parts:
print "Combine part ",part,start,size
ifile = open(part+".dat","rb")
for i in range(0,size):
data = ifile.read(512)
if data == '':
print "Less data"
data = '\xff'*512
if(data == '\xff'*512):
marker = unhexlify('ffffffffffffffff')
else:
marker = pack("<L",start+i)+unhexlify(mark)
outfile.write(data)
outfile.write(marker)
ifile.close()
print "Combine rest"
ifile = open("rest.dat","rb")
while True:
data = ifile.read(512)
if len(data) == 0:
break
marker = unhexlify("ffffffffffffffff")
outfile.write(data)
outfile.write(marker)
ifile.close()
outfile.close()
The part00 and part01 is smaller in case of T620 with 0x100*512 bytes compared to P550. Add some '\FF\s to have the same size.
The part02 is bigger in case of T620, but the end of it is full of zeroes. Remove some zeroes to have the same size.
If you bring T620 dumped files to same size, you can replace those parts, combine back to OS_IMAGE and replace that part in the .nb0
The part02 can be fully edited with imgfs tools.
The part00 and part01 has SRPX signature, so you can use SRPX2XIP and then xipport or dumprom to check the content.
The .nb0 got this way can be flashed using DNW.
The next step would be the cooking ;-)
With imgfs tools you can easily remove/add packages. The unfortunate thing is that if you change AKU level then you might have to modify the 2 XIP parts as well. I have no experience with that (so far).
Also for porting WM6 it would be really good the have the pdocread dump of the P560 partitions ;-)
Hope this helps a little bit for proceeding with T620/P550 cooking/porting.
NOTE: with flashing you can easily have an expensive paperweight. I'm not an experienced rom cooker, with the above things you risk that you make your device a brick. Try this at your own risk!

Wowww!!
This post is really Interresant !
I have a mio p550, and i have an mio p560 dump !
Anyone can help me how to port the mio p560 rom to my p550 rom ??
great thanks !!!

Airis T620 Raw files
Hi,
I've dumped my ROM, and now I have the raw files. Can anyone tell me how to convert them back into a usable ROM? Thanks in advance.

Vodafone UK

HI,
Does anyone have the Vodafone UK rom ?
I have searched but only found the Dutch version.

I guess you could search better?
It's on the 1st or 2nd page...

Misread
Hi,
I think you have misread my post.
There is a Dutch version but I need the English version.
There are posts about the Vodafone UK rom, but no one has uploaded the shipped rom.
However I have tried to backup it up from my phone but got an error saying "Application Locked".
Not being clued up in the world of flashing I got a little nervous and gave up before I really screwed things up.
I know everyone is going to say there is plenty of information on the forum on how to do this, but nothing is clear cut on exactly what to do and half the instructions are written in cooks language which I don't understand.
Plus the issue I have with the HARD_SPL, I notice that you have use a different version for the version ROm you have on the phone!!! That is also confusing me.
Why can't it be as simple as the touch, had no problems flashing that with the swiftblade ROM, which was awsome.
I am willing to give it ago and learn a few things on the way to get the ROM so other people can have it to, but I will need someone to help me through step by step and also I can write a guide so other noobs can follow it. I think this will also help stop with the posting of the same questions on the forum.
So if there is anyone out there who is willing to spend a little time with me to get this sorted we noobs would greatly appreciate.
Cheeers
G

help
Someone must be able to help out ?

Not seen or heard of any available UK Vodafone ROMS on here yet. (correct me if i'm wrong)
However to get started on flashing - check out the mod my diamond pages for info about flashing this device. a lot easier than searching here.

Appreciate the info.
I am trying to dump the rom first so it can be added to the forum for Vodafone UK users.
But can not find a clear cut set of instructions anywhere. When I run the pdocread.exe command I get following message:
"Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\thomas>cd desktop/dump
C:\Documents and Settings\thomas\Desktop\Dump>pdocread.exe
Copying C:\Documents and Settings\thomas\Desktop\Dump\itsutils.dll to WCE:\windo
ws\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked."
I don't know what this means!!

Garetht said:
Appreciate the info.
I am trying to dump the rom first so it can be added to the forum for Vodafone UK users.
But can not find a clear cut set of instructions anywhere. When I run the pdocread.exe command I get following message:
"Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\thomas>cd desktop/dump
C:\Documents and Settings\thomas\Desktop\Dump>pdocread.exe
Copying C:\Documents and Settings\thomas\Desktop\Dump\itsutils.dll to WCE:\windo
ws\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked."
I don't know what this means!!
Click to expand...
Click to collapse
you need to locate EnableRAPI.cab file and run it on your device

Garetht said:
Appreciate the info.
I am trying to dump the rom first so it can be added to the forum for Vodafone UK users.
But can not find a clear cut set of instructions anywhere. When I run the pdocread.exe command I get following message:
"Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\thomas>cd desktop/dump
C:\Documents and Settings\thomas\Desktop\Dump>pdocread.exe
Copying C:\Documents and Settings\thomas\Desktop\Dump\itsutils.dll to WCE:\windo
ws\itsutils.dll
Could not update itsutils.dll to the current version, maybe it is inuse?
try restarting your device, or restart activesync
or maybe your device is application-locked."
I don't know what this means!!
Click to expand...
Click to collapse
Why do you get mad but appreciate the info this does not make sense.
EnableRapi

Cursor moved

half way there
Right then, I have managed to get this so far:
C:\Documents and Settings\thomas\Desktop\Dump>pdocread.exe -l
210.38M (0xd260000) DSK1:
| 3.12M (0x31f000) Part00
| 4.38M (0x460000) Part01
| 108.88M (0x6ce0000) Part02
| 94.00M (0x5e00000) Part03
3.75G (0xf0000000) DSK7:
| 3.75G (0xf0000000) PART00
STRG handles:
handle 87a2a642 3.75G (0xf0000000)
handle 67ca48da 94.00M (0x5e00000)
handle 47db27be108.88M (0x6ce0000)
handle 87db279a 4.38M (0x460000)
handle a7db2752 3.12M (0x31f000)
disk 87a2a642
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 67ca48da
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 47db27be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk 87db279a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
disk a7db2752
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
I tried to do the second bit but didn't know what to, and this is the result of it:
C:\Documents and Settings\thomas\Desktop\Dump>pdocread -w -d FLASHDR -b 0x800 -p
Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
ERROR: ITReadDisk: outbuf==NULL
- The device is not ready for use.
But am stuck on what to do next ?

have you examined other DUMP procedures like this hermes
do you have all the itsutils tools collection

Tools
I have all those tools.
But I don't know what to write in the command line to start the 2nd part. I have read the link you gave me but it doens't make sense
Any pointers ?

anyone
Anyone got any pointers ?

Problem after problem!!!!!
Got this far now:
C:\Documents and Settings\thomas\Desktop\Dump>pdocread -w -d FLASHDR -p Part00 0
0x31f000 Part00.raw CopyTFFSToFile (0x0, 0x31f000, Part00.raw)
ERROR: ITTFFSGetInfo - The device is not ready for use.
WARNING: using default 512 bytes for sectorsize
(C) 2003-2008 Willem jan Hengeveld [email protected]
Usage: pdocread [options] start [ length [ filename ] ]
when no length is specified, 512 bytes are assumed
when no filename is specified, a hexdump is printed
-t : find exact disk size
-l : list all diskdevices
-v : be verbose
-s OFS : seek into source file ( for writing only )
-b SIZE: specify sectorsize used to calculate sector offsets
-B SIZE: specify blocksize to use when reading the disk
-G SIZE: specify blocksize to use when transfering over activesync
-u PASSWD : unlock DOC device
-S BK1x : specify alternate disksignature ( e.g. BIPO, BK1A .. BK1G )
-W OFS : specify optional 'writeenable' flag ptr
Source:
-d NAME : devicename or storename
-p NAME : partitionname
-h HANDLE : directly specify handle
either specify -d and optionally -p, or specify -h
Method:
-n NUM : binarypartition number ( normal p if omitted )
-w : read via windows disk api
-o : read OTP area
if the filename is omitted, the data is hexdumped to stdout
if no length is specified, 512 bytes are printed
numbers can be specified as hex (ex: 0x8000) or decimal (ex: 32768)
C:\Documents and Settings\thomas\Desktop\Dump>
As you can see I get an Error saying " ITTFFSGetInfo - The device is not ready for use".
Now I am really stuck !!!
Help please..........................

instead of FLASHDR use DSK1:

no sure
Well that did something, but not sure what:
C:\Documents and Settings\thomas\Desktop\Dump>pdocread -w -d DSK1: -p Part00 0 0
x31f000 Part00.raw CopyTFFSToFile (0x0, 0x31f000, Part00.raw)
(C) 2003-2008 Willem jan Hengeveld [email protected]
Usage: pdocread [options] start [ length [ filename ] ]
when no length is specified, 512 bytes are assumed
when no filename is specified, a hexdump is printed
-t : find exact disk size
-l : list all diskdevices
-v : be verbose
-s OFS : seek into source file ( for writing only )
-b SIZE: specify sectorsize used to calculate sector offsets
-B SIZE: specify blocksize to use when reading the disk
-G SIZE: specify blocksize to use when transfering over activesync
-u PASSWD : unlock DOC device
-S BK1x : specify alternate disksignature ( e.g. BIPO, BK1A .. BK1G )
-W OFS : specify optional 'writeenable' flag ptr
Source:
-d NAME : devicename or storename
-p NAME : partitionname
-h HANDLE : directly specify handle
either specify -d and optionally -p, or specify -h
Method:
-n NUM : binarypartition number ( normal p if omitted )
-w : read via windows disk api
-o : read OTP area
if the filename is omitted, the data is hexdumped to stdout
if no length is specified, 512 bytes are printed
numbers can be specified as hex (ex: 0x8000) or decimal (ex: 32768)
C:\Documents and Settings\thomas\Desktop\Dump>
I have a file called Part00.raw in my dump folder now but it is 0KB.
Is that correct ?

pointers
Can someone see what I did wrong in the last post ?

anyone help ?

Trying to do the same get to same part but get
C:\itsutils>pdocread -w -d DSK1: -p Part00 0 0x31f000 Part00.raw
CopyTFFSToFile(0x0, 0x31f000, Part00.raw)
ERROR: ITReadDisk : read 00000000 bytes - The parameter is incorrect.
any suggestions anyone.

Chech this post out seems to be working for me
http://forum.xda-developers.com/showthread.php?t=412447
Just need to change the coulered values to match yours. Also make sure the numbers on the right of the coulered ones are the same, were slightly dif for part 2 and 3.

[TOOL] Sahara & Firehose Test (Alcatel Flasher oncoming ...)

Let me introduce some new tool for you. This is my first practice in learning and understanding "How to work with Sahara & Firehose?" and as an owner of Alcatel Idol 3 4.7" firsts test of this app were made on my Idol 3 6039Y. What is this?
Working name of this app - Sahara & Firehose test. In the future it should become a full-featured Alcatel Flasher with full-flash or individual partition flashing feature and some other usefull features. Now it can:
Determine and enumerates all COM ports in a system.
Interact with your device and load a Firehose programmer via Sahara protocol.
Reading and parsing GPT partition table of device.
Reading device information such as IMEI, Provider ID, and S/N.
Reading selected partition from device (in this version only two partition is supported: boot & recovery). In other words you can make backup of any (for now only these two) partition of your device.
Support Alcatel Idol 3 4.7 "6039 and Alcatel Idol 3 5.5" 6045, and Alcatel Idol 4 5.2" 6055.
Partition writing support (since 07.09.2016 builds). For example, you can write TWRP recovery on the phone. Small how to is available here.
Small Instruction (or how to test app)
1. Install Alcatel (Qualcomm) Drivers on your PC. Better way to do it is to install official Mobile Uprgrade application from Alcatel's Support. It should install all needed drivers automatically.
2. Turn your phone in Download Mode. To do this simply connect your phone to PC via USB-cable and hold both Volume buttons and Power button until Download Mode screen (see in attachment) appears. When it appears - press Volume up button to enter download mode.
3. Check your device manager, if you succefully completed two previous steps COM port with name "Qualcomm HS-USB QDLoader 9008" should appears. Start Sahara & Firehose test app and press 1. Detect button. In drop-down list you should see this COM-port. If app haven't find any 9008 ports check that the all needed drivers installed or simply repeat steps 1-2.
4. Press 2. NPRG button to upload Firehose Programmer to your phone. Make sure that you select correct device model before do this. If NPRG succefully loaded you should see something like this in log window:
Code:
02.09.2016 21:45:03: Start Download NPRG ....
02.09.2016 21:45:03: offset[0],len[52]
02.09.2016 21:45:03: offset[52],len[96]
02.09.2016 21:45:03: offset[4096],len[4096]
02.09.2016 21:45:03: offset[8192],len[2440]
02.09.2016 21:45:03: offset[12288],len[4096]
02.09.2016 21:45:03: offset[16384],len[4096]
02.09.2016 21:45:03: offset[20480],len[4096]
02.09.2016 21:45:03: offset[24576],len[4096]
02.09.2016 21:45:03: offset[28672],len[4096]
02.09.2016 21:45:03: offset[32768],len[4096]
02.09.2016 21:45:03: offset[36864],len[4096]
02.09.2016 21:45:03: offset[40960],len[4096]
02.09.2016 21:45:03: offset[45056],len[4096]
02.09.2016 21:45:03: offset[49152],len[4096]
02.09.2016 21:45:03: offset[53248],len[4096]
02.09.2016 21:45:03: offset[57344],len[4096]
02.09.2016 21:45:03: offset[61440],len[4096]
02.09.2016 21:45:03: offset[65536],len[4096]
02.09.2016 21:45:03: offset[69632],len[4096]
02.09.2016 21:45:03: offset[73728],len[4096]
02.09.2016 21:45:03: offset[77824],len[4096]
02.09.2016 21:45:03: offset[81920],len[4096]
02.09.2016 21:45:03: offset[86016],len[4096]
02.09.2016 21:45:03: offset[90112],len[4096]
02.09.2016 21:45:03: offset[94208],len[4096]
02.09.2016 21:45:03: offset[98304],len[4096]
02.09.2016 21:45:03: offset[102400],len[4096]
02.09.2016 21:45:03: offset[106496],len[3044]
02.09.2016 21:45:03: SAHARA_END_IMAGE_TX_ID received
0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
02.09.2016 21:45:04: Send done command
0000: 06 00 00 00 0C 00 00 00 00 00 00 00 *............ *
5. Press 3. Get GPT button to read GPT information from phone. If GPT table is filled as on screen in attachment - all is Ok and now your ready to test other functions. Get Info or partition read. To read partition simply check the checkbox on needed partition and choose a filename to save. Remind that in first version of this app you can read only boot & recovery partition.
Official Project URL: http://www.decker.su/2016/08/sahara-firehose-test-qualcomm.html (it's in russian, but you can use Google Translate to translate it to english)
Link to download: Alcatel_Flasher.rar
Archive password: decker.su
p.s. If you interesting in this project deveplopment - you can post any comments, ideas, opinions, results of test in this thread, or as a comments on Project URL page. Unfortunatelly i haven't more free time to work on this project and work on it just on my interest when i have free time from main work and my family. Because of these reasons i don't know when i finished work on next build. Now i'm working on partition write functionality ... In future this app possibly can be more universal, i mean that flasher can work not only Alcatel devices, but can be universal tool for some Qualcomm based phones, like a SP Flash Tool for Mediatek.
Latest version
You can download the latest version of Sahara & Firehose Test App on the link above.
NB! Before you do any writings to a phone - strongly recommended to make a backup of existing partitions. If in backup (reading) process you get some errors or application hangs, or other unexpected things - you shouldn't write anything to phone. If backup is succeded - you can try write feature. If something goes wrong and in such reasons you was damaged any partition on phone - use the Mobile Upgrade Q to restore phone to a factory state.
Will be grateful for any feedback ...
Project is temporarily (?) closed. Why? Answer is here.
Updated 08.06.2017 17:25 (GMT+3)
Was launched a small crowdfunding campaign to support the developement. Main targets: add Idol 4S 6070 support, build TWRP Recovery for 6070. Detailed description of campaign available in this post.
WBR, DeckerSU.

DeckerSU said:
Let me introduce some new tool for you. This is my first practice in learning and understanding "How to work with Sahara & Firehose?" and as an owner of Alcatel Idol 3 4.7" firsts test of this app were made on my Idol 3 6039Y. What is this?
Working name of this app - Sahara & Firehose test. In the future it should become a full-featured Alcatel Flasher with full-flash or individual partition flashing feature and some other usefull features. Now it can:
Determine and enumerates all COM ports in a system.
Interact with your device and load a Firehose programmer via Sahara protocol.
Reading and parsing GPT partition table of device.
Reading device information such as IMEI, Provider ID, and S/N.
Reading selected partition from device (in this version only two partition is supported: boot & recovery). In other words you can make backup of any (for now only this two) partition of your device.
Support Alcatel Idol 3 4.7 "6039 and Alcatel Idol 3 5.5" 6045.
Small Instruction (or how to test app)
1. Install Alcatel (Qualcomm) Drivers on your PC. Better way to do it is to install official Mobile Uprgrade application from Alcatel's Support. It should install all needed drivers automatically.
2. Turn your phone in Download Mode. To do this simply connect your phone to PC via USB-cable and hold both Volume buttons and Power button until Download Mode screen (see in attachment) appears. When it appears - press Volume up button to enter download mode.
3. Check your device manager, if you succefully completed two previous steps COM port with name "Qualcomm HS-USB QDLoader 9008" should appears. Start Sahara & Firehose test app and press 1. Detect button. In drop-down list you should see this COM-port. If app haven't find any 9008 ports check that the all needed drivers installed or simply repeat steps 1-2.
4. Press 2. NPRG button to upload Firehose Programmer to your phone. Make sure that you select correct device model before do this. If NPRG succefully loaded you should see something like this in log window:
Code:
02.09.2016 21:45:03: Start Download NPRG ....
02.09.2016 21:45:03: offset[0],len[52]
02.09.2016 21:45:03: offset[52],len[96]
02.09.2016 21:45:03: offset[4096],len[4096]
02.09.2016 21:45:03: offset[8192],len[2440]
02.09.2016 21:45:03: offset[12288],len[4096]
02.09.2016 21:45:03: offset[16384],len[4096]
02.09.2016 21:45:03: offset[20480],len[4096]
02.09.2016 21:45:03: offset[24576],len[4096]
02.09.2016 21:45:03: offset[28672],len[4096]
02.09.2016 21:45:03: offset[32768],len[4096]
02.09.2016 21:45:03: offset[36864],len[4096]
02.09.2016 21:45:03: offset[40960],len[4096]
02.09.2016 21:45:03: offset[45056],len[4096]
02.09.2016 21:45:03: offset[49152],len[4096]
02.09.2016 21:45:03: offset[53248],len[4096]
02.09.2016 21:45:03: offset[57344],len[4096]
02.09.2016 21:45:03: offset[61440],len[4096]
02.09.2016 21:45:03: offset[65536],len[4096]
02.09.2016 21:45:03: offset[69632],len[4096]
02.09.2016 21:45:03: offset[73728],len[4096]
02.09.2016 21:45:03: offset[77824],len[4096]
02.09.2016 21:45:03: offset[81920],len[4096]
02.09.2016 21:45:03: offset[86016],len[4096]
02.09.2016 21:45:03: offset[90112],len[4096]
02.09.2016 21:45:03: offset[94208],len[4096]
02.09.2016 21:45:03: offset[98304],len[4096]
02.09.2016 21:45:03: offset[102400],len[4096]
02.09.2016 21:45:03: offset[106496],len[3044]
02.09.2016 21:45:03: SAHARA_END_IMAGE_TX_ID received
0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
02.09.2016 21:45:04: Send done command
0000: 06 00 00 00 0C 00 00 00 00 00 00 00 *............ *
5. Press 3. Get GPT button to read GPT information from phone. If GPT table is filled as on screen in attachment - all is Ok and now your ready to test other functions. Get Info or partition read. To read partition simply check the checkbox on needed partition and choose a filename to save. Remind that in first version of this app you can read only boot & recovery partition.
Official Project URL: http://www.decker.su/2016/08/sahara-firehose-test-qualcomm.html (it's in russian, but you can use Google Translate to translate it to english)
Link to download: Alcatel_Flasher.rar
Archive password: decker.su
p.s. If you interesting in this project deveplopment - you can post any comments, ideas, opinions, results of test in this thread, or as a comments on Project URL page. Unfortunatelly i haven't more free time to work on this project and work on it just on my interest when i have free time from main work and my family. Because of these reasons i don't know when i finished work on next build. Now i'm working on partition write functionality ... In future this app possibly can be more universal, i mean that flasher can work not only Alcatel devices, but can be universal tool for some Qualcomm based phones, like a SP Flash Tool for Mediatek.
Will be grateful for any feedback ...
Click to expand...
Click to collapse
Good Job ?
Sent from my 6045Y using Tapatalk

Wow ! It will be nice for flashing twrp.img on stock 6.0.1

murigny64 said:
Wow ! It will be nice for flashing twrp.img on stock 6.0.1
Click to expand...
Click to collapse
Yep, when all work is completed it can be used to flash not only custom recovery, but any partition. For example, a lot ot users of 6039Y was displeased Android 6.0.1 Marshmallow update. With this tool they can flash Android 5.0.2 image or any custom ROM. But now need some testers to check exising functions: reading GPT, handset info and making backup of boot & recovery partitions. If somebody wanna help project development - test existing function on your phone and make a small report here (work or not, any bugs and difficulties, etc). It's absolutelly safely to your device, because no any writings to device in this version, only reading existing info. So, will be great to see some tester's reports here ...

DeckerSU said:
Yep, when all work is completed it can be used to flash not only custom recovery, but any partition. For example, a lot ot users of 6039Y was displeased Android 6.0.1 Marshmallow update. With this tool they can flash Android 5.0.2 image or any custom ROM. But now need some testers to check exising functions: reading GPT, handset info and making backup of boot & recovery partitions. If somebody wanna help project development - test existing function on your phone and make a small report here (work or not, any bugs and difficulties, etc). It's absolutelly safely to your device, because no any writings to device in this version, only reading existing info. So, will be great to see some tester's reports here ...
Click to expand...
Click to collapse
i'll try it soon
Backup of partition is active?

murigny64 said:
i'll try it soon
Backup of partition is active?
Click to expand...
Click to collapse
Yes, you can now backup boot and recovery partition.

hello, nice job !
Could you make a tutorial about going back to TWRP and LL ROM, on the 6039 ? I updated to stock MM and I'm stuck now...
Thanks a lot

DeckerSU said:
Yes, you can now backup boot and recovery partition.
Click to expand...
Click to collapse
Fail to download NPRG:
Code:
05/09/2016 17:44:50: Trying to open port COM30 ...
05/09/2016 17:44:50: Port COM30 succefully opened.
05/09/2016 17:44:51: Bytes read: 0
0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
05/09/2016 17:44:51: Failed to Download NPRG, Please reset the handset and try again.
I've tried 3 times (reset and reconnect) and same result.
6045Y with 6.0.1 (full rom with twrp)

murigny64 said:
Fail to download NPRG:
Click to expand...
Click to collapse
How Sahara & Firehose test determine COM30 on your PC? Qualcomm HS-USB QDLoader 9008 or some other? Make sure that other programs that possibly can interact with COM-ports are not running at this moment (i mean - Mobile Upgrade, any 3G/4G modem dashboards and others).

bouldou said:
hello, nice job !
Could you make a tutorial about going back to TWRP and LL ROM, on the 6039 ? I updated to stock MM and I'm stuck now...
Thanks a lot
Click to expand...
Click to collapse
Do you test current version of software on your handset? If does, plz, make a small report here.

DeckerSU said:
How Sahara & Firehose test determine COM30 on your PC? Qualcomm HS-USB QDLoader 9008 or some other? Make sure that other programs that possibly can interact with COM-ports are not running at this moment (i mean - Mobile Upgrade, any 3G/4G modem dashboards and others).
Click to expand...
Click to collapse
I apply "detect", my HS-USB Qloader is on COM30 (verified) and no other app running.

murigny64 said:
I apply "detect", my HS-USB Qloader is on COM30 (verified) and no other app running.
Click to expand...
Click to collapse
Strange. Can you try to do the same test on other PC? Also, can you delete current drivers and ugrade / reinstall it from here? To reinstall drivers just unpack the archive Qualcomm USB Drivers For Windows.7z , find COM30 in your device manager and choose "Update ...", than select the unpacked folder as drivers source (don't forget to check [x] Look in subfolders).

Same result: driver updated, reboot and retry
and no other PC with windows

murigny64 said:
Same result: driver updated, reboot and retry
and no other PC with windows
Click to expand...
Click to collapse
Let's wait for results from other testers with 6045Y ... I have around 5 success stories about 6039Y (except mine), and 1 success and 2 fail reports (included yours) about 6045Y. If you find possibility to try it on other PC with same phone - it would be helpfull.

DeckerSU said:
Let's wait for results from other testers with 6045Y ... I have around 5 success stories about 6039Y (except mine), and 1 success and 2 fail reports (included yours) about 6045Y. If you find possibility to try it on other PC with same phone - it would be helpfull.
Click to expand...
Click to collapse
Ok, work with my daughter PC on w10
can read GPT, Info.
but can't read recovery and boot (i've selected this lines), message: Error process "boot", empty filename"
EDIT: oups, i missing enter a filename for backup ! so, now, it work for backup
nice for now
EDIT: On my PC, i disable USB3 controler and now, it work
thanks

murigny64 said:
Ok, work with my daughter PC on w10
nice for now
Click to expand...
Click to collapse
Nice to hear. But, before release next build of app with flashing partitioning functional we should fix all possible (and impossible too errors in interacting with a COM-port. Which OS is installed on your previous PC? Win XP / 7 / 8 / 8.1 ? x86 or x64? Are you sure that on this PC you haven't installed any software (or serivces) that possibly can interact with a COM-port too? Situation you described above strongly resembles that after you connect phone in download mode some other app tries to read some packets from COM port and this is the reason why Sahara and Firehose app fails to load programmer.
Today i was taken 6045Y from my mates on a hour and test all by myself (Win 8.1 Pro x64), here is a small video that demonstates all the process:
Sahara & Firehose Test. Demonstration on Alcatel OT-6045Y.
2All: You can use this video as a small "video guide" to test the app.

murigny64 said:
EDIT: On my PC, i disable USB3 controler and now, it work
Click to expand...
Click to collapse
You are right, some problems with COM-port operating can be caused by some specific USB 3.0 Controllers. Better to do all with USB 2.0 port. Thx for reply.

DeckerSU said:
Nice to here. But, before release next build of app with flashing partitioning functional we should fix all possible (and impossible too errors in interacting with a COM-port. Which OS is installed on your previous PC? Win XP / 7 / 8 / 8.1 ? x86 or x64? Are you sure that on this PC you haven't installed any software (or serivces) that possibly can interact with a COM-port too? Situation you described above strongly resembles that after you connect phone in download mode some other app tries to read some packets from COM port and this is the reason why Sahara and Firehose app fails to load programmer.
Today i was taken 6045Y from my mates on a hour and test all by myself (Win 8.1 Pro x64), here is a small video that demonstates all the process:
Sahara & Firehose Test. Demonstration on Alcatel OT-6045Y.
2All: You can use this video as a small "video guide" to test the app.
Click to expand...
Click to collapse
My PC is I3 4320 w8.1 pro x64 , but now it work if i disable (in bios) USB3 controller (ETRON USB3.0 controller). So all ports are USB2 now.
My daughter HandBook core I5 4440 is W10 with USB3 enable and it work.
For usefull interface, can you enlarge windows (to see full partition lines) ? and add import GPT ?

Hi, before asking if it should work on any other variant than "Y" I've tried it by myself on a 6039A and had the following results:
Detect device: OK
Read NPRG: OK
Get GPT: OK
Get device info: OK
Read/Backup boot or recovery partition: NOK
Code:
05/09/2016 20:00:55: Trying to open port COM6 ...
05/09/2016 20:00:55: Port COM6 succefully opened.
05/09/2016 20:00:55: Bytes read: 48
0000: 01 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00 *....0...........*
0010: 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
0000: 02 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00 *....0...........*
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
05/09/2016 20:00:55: Bytes written: 48
05/09/2016 20:00:55: Bytes read: 20
0000: 03 00 00 00 14 00 00 00 0D 00 00 00 00 00 00 00 *................*
0010: 34 00 00 00 *4... *
05/09/2016 20:00:55: Start Download NPRG ....
05/09/2016 20:00:55: offset[0],len[52]
05/09/2016 20:00:55: offset[52],len[96]
05/09/2016 20:00:55: offset[4096],len[4096]
05/09/2016 20:00:55: offset[8192],len[2440]
05/09/2016 20:00:55: offset[12288],len[4096]
05/09/2016 20:00:55: offset[16384],len[4096]
05/09/2016 20:00:55: offset[20480],len[4096]
05/09/2016 20:00:55: offset[24576],len[4096]
05/09/2016 20:00:55: offset[28672],len[4096]
05/09/2016 20:00:55: offset[32768],len[4096]
05/09/2016 20:00:55: offset[36864],len[4096]
05/09/2016 20:00:55: offset[40960],len[4096]
05/09/2016 20:00:55: offset[45056],len[4096]
05/09/2016 20:00:55: offset[49152],len[4096]
05/09/2016 20:00:55: offset[53248],len[4096]
05/09/2016 20:00:55: offset[57344],len[4096]
05/09/2016 20:00:55: offset[61440],len[4096]
05/09/2016 20:00:55: offset[65536],len[4096]
05/09/2016 20:00:55: offset[69632],len[4096]
05/09/2016 20:00:55: offset[73728],len[4096]
05/09/2016 20:00:55: offset[77824],len[4096]
05/09/2016 20:00:55: offset[81920],len[4096]
05/09/2016 20:00:55: offset[86016],len[4096]
05/09/2016 20:00:55: offset[90112],len[4096]
05/09/2016 20:00:55: offset[94208],len[4096]
05/09/2016 20:00:55: offset[98304],len[4096]
05/09/2016 20:00:55: offset[102400],len[4096]
05/09/2016 20:00:55: offset[106496],len[3044]
05/09/2016 20:00:55: SAHARA_END_IMAGE_TX_ID received
0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *................*
05/09/2016 20:00:56: Send done command
0000: 06 00 00 00 0C 00 00 00 00 00 00 00 *............ *
05/09/2016 20:01:00: Trying to open port COM6 ...
05/09/2016 20:01:00: Port COM6 succefully opened.
05/09/2016 20:01:00: Bytes read: 494
XML[0] = <?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
05/09/2016 20:01:00: [email protected] [email protected]
XML[1] = <?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="8192" MaxPayloadSizeToTargetInBytesSupported="16384" MaxXMLSizeInBytes="4096" Version="1" TargetName="8916" /></data>
XML[2] = <?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
05/09/2016 20:01:01: [email protected] [email protected]
05/09/2016 20:01:02: Bytes read: 0
05/09/2016 20:01:02: Bytes read: 396
XML[0] = <?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
05/09/2016 20:01:02: [email protected] [email protected]
XML[1] = <?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="16384" MaxPayloadSizeToTargetInBytesSupported="16384" MaxXMLSizeInBytes="4096" Version="1" TargetName="8916" /></data>
05/09/2016 20:01:02: Reading GPT ...
05/09/2016 20:01:02: Bytes read: 16384
05/09/2016 20:01:02: Bytes read: 1024
05/09/2016 20:01:02: Bytes read: 185
XML[0] = <?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 0" /></data>
05/09/2016 20:01:02: Finished sector address 0
XML[1] = <?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>
05/09/2016 20:01:02: [+] Primary GPT header
05/09/2016 20:01:02: [-] Signature: EFI PART
05/09/2016 20:01:02: [-] Revision: 65536
05/09/2016 20:01:02: [-] Header Size: 92
05/09/2016 20:01:02: [-] CRC32 of header: 0x53EF1BAE
05/09/2016 20:01:02: [-] Current LBA: 1
05/09/2016 20:01:02: [-] Backup LBA: 30535679
05/09/2016 20:01:02: [-] First usable LBA for partitions: 34
05/09/2016 20:01:02: [-] Last usable LBA for partitions: 30535646
05/09/2016 20:01:02: [-] Disk GUID: {98101B32-BBE2-4BF2-A06E-2BB33D000C20}
05/09/2016 20:01:02: [-] Partition entries starting LBA: 2
05/09/2016 20:01:02: [-] Number of partition entries: 40
05/09/2016 20:01:02: [-] Size of partition entry: 128
05/09/2016 20:01:02: [-] CRC32 of partition array: 0xC36E06BE
05/09/2016 20:01:08: Reading handset information ...
05/09/2016 20:01:08: Trying to open port COM6 ...
05/09/2016 20:01:08: Port COM6 succefully opened.
05/09/2016 20:01:08: Bytes read: 185
XML[0] = <?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 0" /></data>
05/09/2016 20:01:08: Finished sector address 0
XML[1] = <?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>
IMEI : 014368002608563
Model : 6039A-AAAVAR7
SN : NWKK01CCTIY00PB
The thing is that after I select any partition (boot or recovery) the tool hangs and, after some minutes, I have to force close it.
If I go to the selected backup folder I can find a 16 Kbytes img file (16.384 bytes).
So, the first question is, is the intention to make it work on any other 6039 variant?
Thanks.
PS.
Windows 7 x86.
Drivers installed from MU 5.0

pablog_86 said:
So, the first question is, is the intention to make it work on any other 6039 variant?
Click to expand...
Click to collapse
Yes, this app designed to be universal, so, in future it should work with all 6039 variants. Now i'm trying determine cause and fix this errors. Similar situation have another one user with 6045Y.
p.s. Could you test app in two variants: same PC with other phone and same phone with other PC and post report here?
p.p.s. New build from 06.09.2016 available. Download the latest version before make any tests.

LG G4 Bricked Qualcomm HS-USB QDLoader 9008

Hello,
I know,I know, you will say yet another topic about LG G4 and Qualcomm 9008 problem.
you have right but this problem intrigues me.
Some people proposed a solution for reviving the phone without a box by short-cutting 2 testpoint on the motherbord before connecting to the computer.
so here is what I did, unfortunately without success, but together we can find where is the problem and find a final solution for this big problem.
1- ONLY connect Smartphone USB Side like this :
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
2- Shortcut with tweezers the two testpoints as described here :
3-On windows 10 x64 Launch QFIL V 2.0.0.5 with Admin Rights :
4- Connect USB Computer side :
5-Choose COM PORT and all settings like this :
6-Clik Download Button
7- unsuccessful operation, this is the log file
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
port_trace.txt
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: DEBUG: Binary build date: Sep 28 2015 @ 17:28:46
09:28:30: DEBUG: Build Version: 15.09.28.17.28.46
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: DEBUG: Les nouvelles connexions seront m‚moris‚es.
09:28:30: DEBUG:
09:28:30: DEBUG: La liste est vide.
09:28:30: DEBUG:
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: DEBUG: ==================================================================================
09:28:30: DEBUG: ==================================================================================
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: DEBUG: 1. Calling stat(C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml')
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='rb'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: Found 'C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml' (5089 bytes)
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='r'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: User set ZLPAWAREHOST to 1
09:28:30: INFO: User wants to talk to port '\\.\COM4'
09:28:40: DEBUG: port_fd=0xC8
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: OpenPort:5566 It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable
So where is the problem ? Shortcutting the two points is supposed to open the FireHose port but i tested with twezzers, cooper cable...ect nothing seem to work
any Idea ?
thank you

PS: I have the Link to the files if you want them

Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.

I got the same problem with my H815T. It only allows me to flash the LS991 files, but I lose the imei
serestma said:
Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.
Click to expand...
Click to collapse
H810: https://mega.nz/#!55tACDZC!Ci1pjEr8_wr9Ng2SrPgj42MwxnGybo60de26w2gtimg

I bought a subscription from easy-firmware hoping that they have right emmc_firehose. They are scammers. I have a bricked LG G4 too and since now I have not found a way to unbrick it. Do not waste your time. For H815 the files are wrong and we also need nonfused emmc_firehose_programmer. Also the SD Card method is not working for me tried it with 10 different images and 4 different cards. I am investigating this issue and if I find a solution I will make a tutorial for all fellas that are in trouble.

AZstyle said:
Hello,
I know,I know, you will say yet another topic about LG G4 and Qualcomm 9008 problem.
you have right but this problem intrigues me.
Some people proposed a solution for reviving the phone without a box by short-cutting 2 testpoint on the motherbord before connecting to the computer.
so here is what I did, unfortunately without success, but together we can find where is the problem and find a final solution for this big problem.
1- ONLY connect Smartphone USB Side like this :
2- Shortcut with tweezers the two testpoints as described here :
3-On windows 10 x64 Launch QFIL V 2.0.0.5 with Admin Rights :
4- Connect USB Computer side :
5-Choose COM PORT and all settings like this :
6-Clik Download Button
7- unsuccessful operation, this is the log file
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
port_trace.txt
Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
SEARCHPATH:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818
RAWPROGRAM file path: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml
PATCH file path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\patch0.xml
Programmer Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Process Index:0
Start Download
Program Path:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM4 -s 13:C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn 'Current working dir: C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn
09:28:26: Requested ID 13, file: "C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\prog_emmc_firehose_8992_lite.mbn"
09:28:26: 273568 bytes transferred in 0.360000 seconds (0.7247MBps)
09:28:26: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
09:28:26: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Sep 28 2015 @ 17:28:46
Build version: 15.09.28.17.28.46
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: INFO: User wants to talk to port '\\.\COM4'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable}
Writing log to 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Fail:FireHose Fail FHLoader Failrocess fail
Finish Download
09:28:30: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml --search_path=C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC
************************************************
09:28:30: DEBUG: Binary build date: Sep 28 2015 @ 17:28:46
09:28:30: DEBUG: Build Version: 15.09.28.17.28.46
09:28:30: INFO: Current working dir (cwd): C:\Users\Amine\AppData\Roaming\Qualcomm\QFIL\
09:28:30: INFO: Showing network mappings to allow debugging
09:28:30: DEBUG: Les nouvelles connexions seront m‚moris‚es.
09:28:30: DEBUG:
09:28:30: DEBUG: La liste est vide.
09:28:30: DEBUG:
09:28:30: INFO:
09:28:30: INFO: Trying to store 'rawprogram0.xml' in string table
09:28:30: DEBUG: ==================================================================================
09:28:30: DEBUG: ==================================================================================
09:28:30: INFO: Looking for file 'rawprogram0.xml'
09:28:30: DEBUG: 1. Calling stat(C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml')
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='rb'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: Found 'C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml' (5089 bytes)
09:28:30: DEBUG: 2. Calling fopen('C:\G4\8992_QFIL_signing_H818\8992_QFIL_signing_H818\8992_QFIL_signing_H818\rawprogram0.xml') with AccessMode='r'
09:28:30: DEBUG: Trying get filesize, calling fseek()
09:28:30: DEBUG: User set ZLPAWAREHOST to 1
09:28:30: INFO: User wants to talk to port '\\.\COM4'
09:28:40: DEBUG: port_fd=0xC8
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
09:28:40: {ERROR: OpenPort:5566 It took 10.00000000 seconds to open port. Which is longer than 3.000. This indicates your target is not stable
So where is the problem ? Shortcutting the two points is supposed to open the FireHose port but i tested with twezzers, cooper cable...ect nothing seem to work
any Idea ?
thank you
Click to expand...
Click to collapse
qfil needs the firehose.bin i know we dont have one for the sprint varient also have u tried any debrick imgs and sd card method?

Guys just flash the ls991 files and the problem with imei is fixable by flashing some files through fastboot
Do what this says and if you bricked your phone just flash ls991 files again
Only problem which remains is sd card read and write
But you will have a full functional phone

shamescool said:
Guys just flash the ls991 files and the problem with imei is fixable by flashing some files through fastboot
Do what this says and if you bricked your phone just flash ls991 files again
Only problem which remains is sd card read and write
But you will have a full functional phone
Click to expand...
Click to collapse
Please do not mislead other people and try not to answer questions if you didn't try the fixes yourself.
Depending on the bootstack of the CPU SD method might or might nor work.
In theory you can EMMC repair with LS991 but then you will have SecureBoot problems (Error 1006). I didn't try it yet but there is a method where you force off emmc verification by shorting EMMC CMD terminal to GND. But this requires very small soldering, opening the phone and removing the motherboard. The method is tried and working on 4PDA.
EDIT: @AZstyle The firehose are scams, the only working one is the ls991 which I think is a developer one because you will get fastboot access but I can't personally flash anything in LGUP.
When I flash all partitions but bootstack I get 1006 error. I didn't try the soldering method because I have a Medusa Box on the way. I will try USB Repair and if it does not work I will just RMA.

neutrondev said:
Please do not mislead other people and try not to answer questions if you didn't try the fixes yourself.
Depending on the bootstack of the CPU SD method might or might nor work.
In theory you can EMMC repair with LS991 but then you will have SecureBoot problems (Error 1006). I didn't try it yet but there is a method where you force off emmc verification by shorting EMMC CMD terminal to GND. But this requires very small soldering, opening the phone and removing the motherboard. The method is tried and working on 4PDA.
EDIT: @AZstyle The firehose are scams, the only working one is the ls991 which I think is a developer one because you will get fastboot access but I can't personally flash anything in LGUP.
When I flash all partitions but bootstack I get 1006 error. I didn't try the soldering method because I have a Medusa Box on the way. I will try USB Repair and if it does not work I will just RMA.
Click to expand...
Click to collapse
im not misleading anyone here im just sharing my experience
yes you will get 1006 problem by flashing partitions but at least you get a fully functioning phone
the way i mentioned is actually worked for another person here in this forum please test if you still have doubt
my phone is also a refurbished h811 which has a f500l mobo on it and flashing those ls991 files made the phone alive in h811 10n but i did nt have any imei or base band no camera too(even speaker and sensors didnt work)
so i tried flashing some partitions in fastboot and then i had my imei back and also the camera
then i edited f500 tot file with winhex and my phone bricked again(obviously)so i tried flashing ls991 again and now i have a fully functioning phone which cannot be said for sd card...my phone cant write or read any sdcard and its really pissing me of
any suggest for sd card?

H810_ARecovery
¿How to use or flash this files?, tell me please.

neutrondev said:
I bought a subscription from easy-firmware hoping that they have right emmc_firehose. They are scammers. I have a bricked LG G4 too and since now I have not found a way to unbrick it. Do not waste your time. For H815 the files are wrong and we also need nonfused emmc_firehose_programmer. Also the SD Card method is not working for me tried it with 10 different images and 4 different cards. I am investigating this issue and if I find a solution I will make a tutorial for all fellas that are in trouble.
Click to expand...
Click to collapse
u are right, i already tested all this ****, its appear that the only solution is to repair the emmc boot with octopus box or medusa box
next week i'll bring my G4 to a repair store to do this operation.
and I will keep u informed with the results

AZstyle said:
u are right, i already tested all this ****, its appear that the only solution is to repair the emmc boot with octopus box or medusa box
next week i'll bring my G4 to a repair store to do this operation.
and I will keep u informed with the results
Click to expand...
Click to collapse
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Good Remark, I can't remember if I tested with LS911 files, I tested with H815 H818p without sucess.
Do you have the files for LS911? can u share them with me please so i'll give a try.
Thanks

What about that ?
and this

serestma said:
Hello, ¿you can share the links?, I need the files for LG H810.
Thank you in advance.
Click to expand...
Click to collapse
https://mega.nz/#F!1DhXTLAa!kH8MfkbeOKcUWt3T2R6cTQ

@AZstyle Do not flash with those files because I think you will need CPU swap. I think that programmer blows fuses for US version. I did that and now I can't repair it even with MEDUSA I can flash ls991 firmware it boots but with H815 NO.

the_naxhoo said:
I got the same problem with my H815T. It only allows me to flash the LS991 files, but I lose the imei
H810: https://mega.nz/#!55tACDZC!Ci1pjEr8_wr9Ng2SrPgj42MwxnGybo60de26w2gtimg
Click to expand...
Click to collapse
No Problem If You Loosed IMEI I Can Flash IMEI For You Just Poke Me On WhatsApp Only WhatsApp !!!
7000926368
Hope I Can Help You
Sent from my LS-4004 using Tapatalk

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Yes I have flashed ls991 firehose . What do you need to know?
.
Sent from my LG-H815 using XDA Labs

neutrondev said:
I bought a medusa box and did the soldering myself. It will not work -_-. I will investigate further but it might need Emmc replacement. Did you try to flash with Qfil using LS991 programmer emmc_firehose? It is very important to know
Click to expand...
Click to collapse
Medusa Pro Box Works Like Charm !!!
I Fixed 7 LG G4 With It EMMC One
And 3 LG G4 With USB One
If Someone Have Medusa Pro Box And Unable To Fix With It Thats Sure That You Might Have Not Soldered Wire Correct Or Motherboard Has Hardware Problem
Sent from my LS-4004 using Tapatalk

steadfasterX said:
Yes I have flashed ls991 firehose . What do you need to know?
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Dont know where i find a ls992 firehose do you?
I bricked my g5 in a freak bad usb cord accident.

Zs570kl non pro loader.img

Possible way to unbrick the zenfone 3 deluxe or any Qualcomm device all is needed is the a working device of the same model if someone with root can run this command in the terminal emulator ((dd if=/dev/block/mmcblk0 of=/sdcard/Loader.img bs=1024 count=168960)) to get the files nneeded to boot into bootloader i will then burn that img to a sdcard boot into bootloader and flash with asus tool please if any one can help it will only take a second thanks i appreciate

This is the link i am relying on http://www.aryk.tech/2017/02/how-to-unbrick-debrick-qualcomm-android.html?m=1

dcraffam said:
Possible way to unbrick the zenfone 3 deluxe or any Qualcomm device all is needed is the a working device of the same model if someone with root can run this command in the terminal emulator ((dd if=/dev/block/mmcblk0 of=/sdcard/Loader.img bs=1024 count=168960)) to get the files nneeded to boot into bootloader i will then burn that img to a sdcard boot into bootloader and flash with asus tool please if any one can help it will only take a second thanks i appreciate
Click to expand...
Click to collapse
Hey, I checked it out and have followed the instructions. Didn't know this was a thing and thought it would be good to have just in case a flash goes wrong.
Before you download, I'd like for you to confirm that my model was what you asked for: the ZS570KL with a 2.15GHz Snapdragon 820 CPU. If it's correct with you, then this Loader.img should be compatible with your device.
I've removed the old file and am working on a new one.
Good luck and godspeed. Please post an update, and if it works out for you, please document the steps you took to solve the issue!

Zenfone 3
Well i cant say thank you enough for at least trying the 2.15 cpu is the correct device and i still cant thank you enough i appreciate the time and effort

dcraffam said:
Well i cant say thank you enough for at least trying the 2.15 cpu is the correct device the only problem is when i burn the image to the sdcars there is a couple files that dont belong maby if you can move a couple files from your device then try agin the sdcard with files burned to it consit of [Please remove this part] so i believe it will work maby just gotta get some of the files out of there thabks in advance i really do appreciate the effortt
Click to expand...
Click to collapse
Hey! I'm currently in the process of trying to get this sorted out. I don't want to get to into the explanation of it, but would you kindly edit your post to remove that file list. There's nothing personal in it, but I'd rather the contents of my SD card be kept private.
In short, the command you gave me copied the first 165mb of my SD card and created an img file from it. The reason being, mmcblk0 is the SD card. On phones with EMMC, this would normally be the internal memory and mmcblk1 would be the SD card. However, because the Zenfone uses UFS 2.0, it's in a different place and thus acts differently. I'm trying to figure out what the right command is to create what needs to be created. Please give me a moment, and please edit your post and delete the file you downloaded!

dcraffam said:
Possible way to unbrick the zenfone 3 deluxe or any Qualcomm device all is needed is the a working device of the same model if someone with root can run this command in the terminal emulator ((dd if=/dev/block/mmcblk0 of=/sdcard/Loader.img bs=1024 count=168960)) to get the files nneeded to boot into bootloader i will then burn that img to a sdcard boot into bootloader and flash with asus tool please if any one can help it will only take a second thanks i appreciate
Click to expand...
Click to collapse
So, I've got bad news, and hopefully good news.
First the bad news. From the research I have done, I believe the method that you've presented here will not work. This is because around the time when the Snapdragon 820 came out, many companies opted to use UFS over EMMC, as it's essentially the next step in flash storage evolution. EMMC and MicroSD cards were treated essentially the same way, and thus some phones were able to "boot" off the SD card using the first 165mb of the bootloader. Since UFS isn't treated the same way and has to be read differently, the ability to boot off the SD card became lost with the change of storage.
Now for the hopefully good news. I looked into your xda post history to see the other methods you tried and noticed you posted in a thread about QFIL looking for the proper files. After some investigation into the process, I've stumbled upon what I think may be what you need. I'm not entirely clear about the process, but I think I have a rough estimate of what needs to be done. I'm not home right now, so I can't confirm some of the steps, but hopefully I can guide you through it. If any confusion occurs, I'll hopefully be able to clarify it while I'm home. Please see my next comment for the process.

qfil
asianflipboy said:
So, I've got bad news, and hopefully good news.
First the bad news. From the research I have done, I believe the method that you've presented here will not work. This is because around the time when the Snapdragon 820 came out, many companies opted to use UFS over EMMC, as it's essentially the next step in flash storage evolution. EMMC and MicroSD cards were treated essentially the same way, and thus some phones were able to "boot" off the SD card using the first 165mb of the bootloader. Since UFS isn't treated the same way and has to be read differently, the ability to boot off the SD card became lost with the change of storage.
Now for the hopefully good news. I looked into your xda post history to see the other methods you tried and noticed you posted in a thread about QFIL looking for the proper files. After some investigation into the process, I've stumbled upon what I think may be what you need. I'm not entirely clear about the process, but I think I have a rough estimate of what needs to be done. I'm not home right now, so I can't confirm some of the steps, but hopefully I can guide you through it. If any confusion occurs, I'll hopefully be able to clarify it while I'm home. Please see my next comment for the process.
Click to expand...
Click to collapse
thanks for the research any thing you can do to help is greatly appreciated

A (Rough!!!) Guide to (Hopefully) Unbricking the ZS570KL from 9008 issue
So let's get started, @dcraffam.
As a *DISCLAIMER* I am not responsible for any damage this may cause your phone (Although how much more damage can really be done when it's bricked?)
This is all based on theory, as my device isn't bricked and I don't intend on attempting to fix a working device. That being said, this is good knowledge to have for the future, so I'm making this to hopefully help those who might need it in the future.
The prerequisites for this, to the best of my knowledge, are as follows:
A ZS570KL that, when plugged into a computer, produces a device in your device manager that has the number 9008 in it
A computer running Windows
9008, to my knowledge, is like Snow White waiting for Prince Charming's lips. It's essentially a brick, but with the right tools, you can kickstart it to a state where it can make a full recovery. I stumbled upon some tools that I think can get the job done, but it will be up to you to test them out. I wish you the best of luck.
The first one you should grab is:
The Qualcomm USB Drivers
https://androiddatahost.com/nbyn6
Pretty straightforward. You'll need these so your computer can properly interact with your device.
The second thing to grab is:
The Qualcomm Flash Image Loader (QFIL) Tool
https://androiddatahost.com/flkn2
This is the program that should be able to bring your phone back, your Prince Charming, if you will. It's not an installer, so just extract the files to a known folder and keep it open. You'll need to access it soon.
I obtained both of these files from this website's guide:
https://androidmtk.com/use-qualcomm-flash-image-loader-qfil
In fact, you'll be pretty much following that guide, but with a couple of changes. But before that, you'll need a couple more things.
Stock ZS570KL FRP
https://drive.google.com/open?id=1s4nas0iP_rLcnLLwh348krvLUNP57YF2
And you may or may not need this one but
ZS570KL 8996 elf file
https://drive.google.com/file/d/1GgIDDYofsyn_F__6YveofDgYsXaYFvZr/view?usp=drivesdk
These I also stumbled upon. They're the files necessary to get the QFIL tool to work, and are specifically for your phone. The first one is especially important, as that's the stock firmware that will be loaded onto your phone. Extract that into a separate folder that's easy to locate. The second one is specific to your phone, but there's already one in the FRP zip. Only use it if the one in the FRP zip doesn't work. They seem to be correct for the most part, but I found them in a weird website, so be warned. That website was:
https://addrom.com/rom-stock-asus-zenfone-3-deluxe-z016d-zs570kl/
So to recap:
Download the files
Install the drivers
Extract the files into easy to find places.
https://www.youtube.com/watch?v=JxlMntGp6vs
Now, what follows will be the edited edition of the video above. I believe it needs to be adjusted because it's, by default, in EMMC mode and not UFS mode. I'm home now, so I'm making the proper updates. Hopefully they work for you.
The instructions are as follows:
1. Open up QFIL.exe
2. On the top left, there's a button called configuration. Hit that and then Firehose Configuration.
3. A popup should appear. The important thing to change is a drop down menu that says "EMMC". Change it to "UFS" instead. Hit OK to go back to QFIL.
4. Plug your phone in, and click SelectPort on the top right of QFIL. Your phone should be there. Select it and hit OK.
5. In QFIL, hit Browse, navigate to the extracted FRP zip and select "prog_ufs_firehose_8996_ddr.elf" It should automatically select the folder as the build folder.
6. Next, hit "Load XML...", and "rawprogram0.xml" should pop up. Select that one, and then "patch0.xml"
7. If all goes well, you'll be able to hit "Download" below "Load XML." If you can't, try going through the steps with the 8996 ZS570KL elf file.
Hopefully nothing fails and your phone reboots into stock firmware. From there, I recommend updating to the latest firmware.
If this method fails you, there are some other Qualcomm image flashers that are available to try. Hopefully we can find one that works for you.
Good luck! Please let me know if you encounter any issues or if you're successful!

qfil
so i thank you agin for your research sadly the files did not work for me i have tried maby 5 or 6 qfil roms and my phone wont accept the digital signature its saying binary build date jun 17 2016 but there is no firmware that goes back that far i guess theres no hope for me unless you can try to make a back up with qpst software download and i flash or something i really dont see a save anymore but if you do find somehing else please let mee know thanks i really appreiate it

dcraffam said:
so i thank you agin for your research sadly the files did not work for me i have tried maby 5 or 6 qfil roms and my phone wont accept the digital signature its saying binary build date jun 17 2016 but there is no firmware that goes back that far i guess theres no hope for me unless you can try to make a back up with qpst software download and i flash or something i really dont see a save anymore but if you do find somehing else please let mee know thanks i really appreiate it
Click to expand...
Click to collapse
Darn, was really hoping it would work. Would you mind running it again, and then copying and saving the output text, and then post it here? I'd like to use it to research it further.
Also, what do you mean by make a backup? Do you have more information regarding this process?

qfil port_trace.txt
16:01:22: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Users\anthony\Downloads\Qualcomm_Flash_Image_Loader_v2.0.0.5\fh_loader.exe --port=\\.\COM4 --sendxml=rawprogram0.xml,rawprogram1.xml,rawprogram2.xml,rawprogram3.xml,rawprogram4.xml,rawprogram5.xml --search_path=C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=UFS
************************************************
16:01:22: DEBUG: Binary build date: Oct 31 2016 @ 22:51:02
16:01:22: DEBUG: Build Version: 16.10.31.22.51.02
16:01:22: INFO: Current working dir (cwd): C:\Users\anthony\AppData\Roaming\Qualcomm\QFIL\
16:01:22: INFO: Showing network mappings to allow debugging
16:01:22: DEBUG: New connections will be remembered.
16:01:22: DEBUG:
16:01:22: DEBUG: There are no entries in the list.
16:01:22: DEBUG:
16:01:22: INFO:
16:01:22: INFO: Trying to store 'rawprogram0.xml' in string table
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'rawprogram0.xml'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\rawprogram0.xml')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\rawprogram0.xml') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\rawprogram0.xml' (5303 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\rawprogram0.xml') with AccessMode='r'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'persist.img'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\persist.img')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\persist.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\persist.img' (4804840 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\persist.img') with AccessMode='rb'
16:01:22: INFO: Reading through sparse file 'persist.img' and pulling out relevant header information...
16:01:22: INFO: File persist.img is a sparse file, being split up into 1 separate XML tags
16:01:22: DEBUG:
16:01:22: INFO: Looking for file 'factory.img'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\factory.img')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\factory.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\factory.img' (33554432 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\factory.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: INFO: cache.img is a sparse image
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'cache.img'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img' (6398160 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: INFO: cache.img is a sparse image
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'cache.img'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img' (6398160 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: INFO: cache.img is a sparse image
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'cache.img'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img' (6398160 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\cache.img') with AccessMode='rb'
16:01:22: DEBUG: ==================================================================================
16:01:22: DEBUG: ==================================================================================
16:01:22: INFO: Looking for file 'devcfg.mbn'
16:01:22: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\devcfg.mbn')
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\devcfg.mbn') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
16:01:22: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\devcfg.mbn' (40024 bytes)
16:01:22: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\devcfg.mbn') with AccessMode='rb'
16:01:22: DEBUG: Trying get filesize, calling fseek()
[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:23: DEBUG: ==================================================================================
16:01:23: DEBUG: ==================================================================================
16:01:23: INFO: Looking for file 'userdata.img'
16:01:23: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img')
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: DEBUG: Trying get filesize, calling fseek()
16:01:23: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:23: DEBUG: ==================================================================================
16:01:23: DEBUG: ==================================================================================
16:01:23: INFO: Looking for file 'userdata.img'
16:01:23: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img')
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: DEBUG: Trying get filesize, calling fseek()
16:01:23: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:23: DEBUG: ==================================================================================
16:01:23: DEBUG: ==================================================================================
16:01:23: INFO: Looking for file 'userdata.img'
16:01:23: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img')
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: DEBUG: Trying get filesize, calling fseek()
16:01:23: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:23: DEBUG: ==================================================================================
16:01:23: DEBUG: ==================================================================================
16:01:23: INFO: Looking for file 'userdata.img'
16:01:23: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img')
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: DEBUG: Trying get filesize, calling fseek()
16:01:23: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:23: DEBUG: ==================================================================================
16:01:23: DEBUG: ==================================================================================
16:01:23: INFO: Looking for file 'userdata.img'
16:01:23: DEBUG: 1. Calling stat(C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img')
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: DEBUG: Trying get filesize, calling fseek()
16:01:23: DEBUG: Found 'C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img' (139675944 bytes)
16:01:23: DEBUG: 2. Calling fopen('C:\Program Files (x86)\Qualcomm\QPST\bin\[up_vnROM.net]_MR1.2_WW_ZS570KL-4.12.40.1781-rel-user-20170117-secured-ufs-releaseFRP\userdata.img') with AccessMode='rb'
16:01:23: INFO: userdata.img is a sparse image
16:01:24: DEBUG: XML FILE (111 bytes): CharsInBuffer=2861-111=2750
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Binary build date: Jun 17 2016 @ 10:09:02"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'Binary build date: Jun 17 2016 @ 10:09:02'
16:01:24: DEBUG: XML FILE (110 bytes): CharsInBuffer=2750-110=2640
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Chip serial num: 4294967295 (0xffffffff)"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'Chip serial num: 4294967295 (0xffffffff)'
16:01:24: DEBUG: XML FILE (234 bytes): CharsInBuffer=2640-234=2406
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke "/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '
16:01:24: DEBUG: XML FILE (139 bytes): CharsInBuffer=2406-139=2267
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="VIP - Validated Image Programming is enabled - Validation is enabled."/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'VIP - Validated Image Programming is enabled - Validation is enabled.'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=2267-108=2159
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Image Total Size = 0xE3 (227)"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'Image Total Size = 0xE3 (227)'
16:01:24: DEBUG: XML FILE (101 bytes): CharsInBuffer=2159-101=2058
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="HeaderIs80Bytes = 0x0"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'HeaderIs80Bytes = 0x0'
16:01:24: DEBUG: XML FILE (138 bytes): CharsInBuffer=2058-138=1920
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.sw_type = 0x3 (DeviceProgrammer *insists* on this)"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.sw_type = 0x3 (DeviceProgrammer *insists* on this)'
16:01:24: DEBUG: XML FILE (101 bytes): CharsInBuffer=1920-101=1819
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.sw_version = 0x0"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.sw_version = 0x0'
16:01:24: DEBUG: XML FILE (102 bytes): CharsInBuffer=1819-102=1717
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.header_len_1 = 0x28"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.header_len_1 = 0x28'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1717-108=1609
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.code_ptr_1 = 0xF54AC112"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.code_ptr_1 = 0xF54AC112'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1609-108=1501
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.code_len_1 = 0x6F636E65"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.code_len_1 = 0x6F636E65'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1501-108=1393
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.x509_chain_ptr = 0x1782EE58"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.x509_chain_ptr = 0x1782EE58'
16:01:24: DEBUG: XML FILE (107 bytes): CharsInBuffer=1393-107=1286
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.x509_chain_len = 0xA3E3F20"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.x509_chain_len = 0xA3E3F20'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1286-108=1178
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.signature_ptr = 0x5CB92A76"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.signature_ptr = 0x5CB92A76'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1178-108=1070
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.signature_len = 0x5455223D"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.signature_len = 0x5455223D'
16:01:24: DEBUG: XML FILE (108 bytes): CharsInBuffer=1070-108=962
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="image_info.header_ptr_1 = 0x85E14DA0"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'image_info.header_ptr_1 = 0x85E14DA0'
16:01:24: DEBUG: XML FILE (170 bytes): CharsInBuffer=962-170=792
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="AuthenticateImage() Returning FALSE, secboot_authenticate() returned 0x2 (not E_SECBOOT_SUCCESS=0x0)"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'AuthenticateImage() Returning FALSE, secboot_authenticate() returned 0x2 (not E_SECBOOT_SUCCESS=0x0)'
16:01:24: DEBUG: XML FILE (116 bytes): CharsInBuffer=792-116=676
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR 1: Line 1140: AUTHENTICATE_IMAGE_FAILURE"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'ERROR 1: Line 1140: AUTHENTICATE_IMAGE_FAILURE'
16:01:24: DEBUG: XML FILE (138 bytes): CharsInBuffer=676-138=538
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Failed to authenticate Digital Signature, resetting validation state"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'Failed to authenticate Digital Signature, resetting validation state'
16:01:24: DEBUG: XML FILE (120 bytes): CharsInBuffer=538-120=418
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR 11: Line 790: DIGITAL_SIGNATURE_DID_NOT_PASS"/>
</data>
-------------------------------------------------------------------------------------------
16:01:24: INFO: TARGET SAID: 'ERROR 11: Line 790: DIGITAL_SIGNATURE_DID_NOT_PASS'
16:01:24: DEBUG: XML FILE (79 bytes): CharsInBuffer=418-79=339
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" />
</data>
-------------------------------------------------------------------------------------------
16:01:24: DEBUG: Response was 'NAK'
16:01:24: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
16:01:24: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
16:01:24: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information

@dcraffam, what's the version of QFIL that you're using? I don't see any mentions of some of the keywords I was expecting (i.e. Sahara, firehose, rawprogram0.xml)
The QFIL I linked is 2.0.1.1. I think the older one isn't compatible with UFS.

i uploaded the wrong file
asianflipboy said:
@dcraffam, what's the version of QFIL that you're using? I don't see any mentions of some of the keywords I was expecting (i.e. Sahara, firehose, rawprogram0.xml)
The QFIL I linked is 2.0.1.1. I think the older one isn't compatible with UFS.
Click to expand...
Click to collapse
i am using the version you provided 2.0.1.1 that was just a old port trace.. thanks for the help and the interest in the topic

dcraffam said:
i am using the version you provided 2.0.1.1 that was just a old port trace.. thanks for the help and the interest in the topic
Click to expand...
Click to collapse
I took a look at the updated trace. Looks good up to where the computer tries to interact with the device. It seems there's a signature validation it's failing, possibly because the source FRP file isn't official.
In Configure > Firehose configuration, is the option for validation on? If it's on, try running with it off.
When your phone is plugged in and all the files are set, does an "Advanced Options" button show up? If it does, would you mind screenshotting it and posting it on here?
Also, can you search for the log it mentions at the end of the file? No idea where it gets generated, but it's probably in a folder or a file in the same directory called log.

qfil
asianflipboy said:
@dcraffam, what's the version of QFIL that you're using? I don't see any mentions of some of the keywords I was expecting (i.e. Sahara, firehose, rawprogram0.xml)
The QFIL I linked is 2.0.1.1. I think the older one isn't compatible with UFS.
Click to expand...
Click to collapse
asianflipboy said:
I took a look at the updated trace. Looks good up to where the computer tries to interact with the device. It seems there's a signature validation it's failing, possibly because the source FRP file isn't official.
In Configure > Firehose configuration, is the option for validation on? If it's on, try running with it off.
When your phone is plugged in and all the files are set, does an "Advanced Options" button show up? If it does, would you mind screenshotting it and posting it on here?
Also, can you search for the log it mentions at the end of the file? No idea where it gets generated, but it's probably in a folder or a file in the same directory called log.
Click to expand...
Click to collapse
i have to agree with you after trying almost everything i can think of even other programs to just try to send a specific file it all fails to verify so maby the source isnt official as far as the port_trace .txt ill upload it

using the zte axon 7 edl tool it is able to communicate with my phone in edl mode once i replace the firehose prgram in the tools folder if you can get your phone in download mode there is a script to backup some partions includeing the edl boot mode efs reecovery and full maby if you backed up your edl i can restore mine from it if your willing to try it...... that is the zte axon 7 tool kit i couldnt upload the firehose programmer but the on you provided should work its simple just unzip run as admin and its really detailed with info once you open it up thanks aot if you do decide to try i feel like we are running out of ideas lol happy days:good::good:

dcraffam said:
using the zte axon 7 edl tool it is able to communicate with my phone in edl mode once i replace the firehose prgram in the tools folder if you can get your phone in download mode there is a script to backup some partions includeing the edl boot mode efs reecovery and full maby if you backed up your edl i can restore mine from it if your willing to try it...... that is the zte axon 7 tool kit i couldnt upload the firehose programmer but the on you provided should work its simple just unzip run as admin and its really detailed with info once you open it up thanks aot if you do decide to try i feel like we are running out of ideas lol happy days:good::good:
Click to expand...
Click to collapse
I tried the tool, but it was having trouble putting my phone into EDL mode. I tried various methods, like vol+ and vol- while rebooting and changing the fastboot command to send and edl reboot command but it didn't stick. I'll keep trying to get it to work though.
In any case, did you try the Xiaomi Mi Flash tool? Apparently it can work better than QFIL in certain cases.