Question How to unlock REVVL V+ 5G bootloader - T-Mobile REVVL V+ 5G

I have been trying and I'm telling you trying to root this phone for that I have to unlock the bootloader it's driving me insane I have a windows 11 laptop I am a noob on all this so I've been watching videos STEP BY STEP AND NOTHING no progress

IvXotiic said:
I have been trying and I'm telling you trying to root this phone for that I have to unlock the bootloader it's driving me insane I have a windows 11 laptop I am a noob on all this so I've been watching videos STEP BY STEP AND NOTHING no progress
Click to expand...
Click to collapse
I used https://github.com/bkerler/mtkclient on Windows 10.
Had to press the 2 volume buttons on device while turning it on.
There are some requirements there, like python to be installed.
Easily done with chocolatey on Windows.

me to need to unlock bootloader REVVL 5G t790w

have you got it rooted yet? its really easy to do. theres a guide on here, or i can walk you through it and i have all the files you'll need in case you cant find them DM me. i also now have the MT6833_Android_scatter.txt and all the firmware needed to revert to stock also. working on how to actually do that as we speak

R41N MuTT said:
have you got it rooted yet? its really easy to do. theres a guide on here, or i can walk you through it and i have all the files you'll need in case you cant find them DM me. i also now have the MT6833_Android_scatter.txt and all the firmware needed to revert to stock also. working on how to actually do that as we speak
Click to expand...
Click to collapse
Would really like to restore my T-Mobile REVVL V+ 5G to stock.
It does not turn on the display but tries to connect to mtkclient.
Issue is it keeps giving me (indefinitely):
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
mtkclient GUI Log:
..Port - Device detected
Preloader - CPU: MT6833(Dimensity 700 5G k6833)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x73
Preloader - Disabling Watchdog...
Preloader - HW code: 0x989
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 96C8388057AFD372754DCBB4B155D5B1
Preloader - SOC_ID: 116C6A57A536601BE60E0E7BA9C4E0B86D979A21F11E8ABA0FB2E6A7DAA9E062
Port - Device detected
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin
xflashext - Patching da1 ...
xflashext
xflashext - [LIB]: Error on patching da1 version check...
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: H9HQ54ACPMMDAR
DAXFlash - UFS MID: 0xad
DAXFlash - UFS CID: ad014839485135344143504d4d444152
DAXFlash - UFS FWVer: 41303032
DAXFlash - UFS Serial: 323031304238453143413030
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DRAM config needed for : ad014839485135344143504d4d444152
DAXFlash - No preloader given. Searching for preloader
DAXFlash - Sending emi data ...
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)

R41N MuTT said:
have you got it rooted yet? its really easy to do. theres a guide on here, or i can walk you through it and i have all the files you'll need in case you cant find them DM me. i also now have the MT6833_Android_scatter.txt and all the firmware needed to revert to stock also. working on how to actually do that as we speak
Click to expand...
Click to collapse
Would love to get a copy of those files if possible.

djismgaming said:
Would really like to restore my T-Mobile REVVL V+ 5G to stock.
It does not turn on the display but tries to connect to mtkclient.
Issue is it keeps giving me (indefinitely):
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
mtkclient GUI Log:
..Port - Device detected
Preloader - CPU: MT6833(Dimensity 700 5G k6833)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0x73
Preloader - Disabling Watchdog...
Preloader - HW code: 0x989
Preloader - Target config: 0xe7
Preloader - SBC enabled: True
Preloader - SLA enabled: True
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: True
Preloader - Mem write auth: True
Preloader - Cmd 0xC8 blocked: True
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Preloader - ME_ID: 96C8388057AFD372754DCBB4B155D5B1
Preloader - SOC_ID: 116C6A57A536601BE60E0E7BA9C4E0B86D979A21F11E8ABA0FB2E6A7DAA9E062
Port - Device detected
DAXFlash - Uploading xflash stage 1 from MTK_AllInOne_DA_5.2152.bin
xflashext - Patching da1 ...
xflashext
xflashext - [LIB]: Error on patching da1 version check...
xflashext - Patching da2 ...
DAXFlash - Successfully uploaded stage 1, jumping ..
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DAXFlash - Successfully received DA sync
DAXFlash - UFS Blocksize:0x1000
DAXFlash - UFS ID: H9HQ54ACPMMDAR
DAXFlash - UFS MID: 0xad
DAXFlash - UFS CID: ad014839485135344143504d4d444152
DAXFlash - UFS FWVer: 41303032
DAXFlash - UFS Serial: 323031304238453143413030
DAXFlash - UFS LU0 Size: 0xee5800000
DAXFlash - UFS LU1 Size: 0x400000
DAXFlash - UFS LU2 Size: 0x400000
DAXFlash - DRAM config needed for : ad014839485135344143504d4d444152
DAXFlash - No preloader given. Searching for preloader
DAXFlash - Sending emi data ...
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
DAXFlash
DAXFlash - [LIB]: Error on sending parameter: DA exceed max num (0xc0070005)
Click to expand...
Click to collapse
Right, I'm working on a fix for that. Standby, I'm so close to cracking this. Any day now. Also, do you have another phone handy? I think I might be able to help you get that phone working again in a rooted state. Possibly.

R41N MuTT said:
Right, I'm working on a fix for that. Standby, I'm so close to cracking this. Any day now. Also, do you have another phone handy? I think I might be able to help you get that phone working again in a rooted state. Possibly.
Click to expand...
Click to collapse
I have another as the REVVL is not my main phone since it got "bricked" as I call it
Thanks for your concern.

Having this same issue, anyone have any recovery files that work?

yahdeeez said:
Having this same issue, anyone have any recovery files that work?
Click to expand...
Click to collapse
Try this https://forum.xda-developers.com/t/root-flash-stock.4541841/ please let me know if you encounter any problems and I'll try to help you through it if I can

R41N MuTT said:
Try this https://forum.xda-developers.com/t/root-flash-stock.4541841/ please let me know if you encounter any problems and I'll try to help you through it if I can
Click to expand...
Click to collapse
Thanks for the quick response.
I just realized that this is for the REVVL V+ 5G and my phone is the REVVL 6 PRO 5G
Im just trying to unbrick it i dont care about root or anything. Are the steps the same since they are both MT6833 devices?

yahdeeez said:
Thanks for the quick response.
I just realized that this is for the REVVL V+ 5G and my phone is the REVVL 6 PRO 5G
Im just trying to unbrick it i dont care about root or anything. Are the steps the same since they are both MT6833 devices?
Click to expand...
Click to collapse
Unlocking the bootloader for any chipset will be the same method across devices with the same chipset. Rooting and firmware modifications are device specific.
If your device is bricked, probably the best thing is to reflash everything back to stock.
To flash this device back to stock, I believe you have to mount partition a and reflash, then mount partition b and reflash. Repeat this for every file. There is an order to it.
There is also a way to do it with SP flash tool, which uses scatter.txt to automate the flashing to both partitions, making the process much simpler.
There may be other hangups, like bypassing Download Authorization, etc.
The key to completing this would be having the firmware and scatter file.
You can get the scatter file by taking a bug report. You start an OTA update and navigate to developer options and capture a bug report.
Next you save the bug report and pull the OTA.
Next you extract payload.bin with payload dumper tool and this is where you will find scatter.txt.
I have been unable to locate an OTA capture or official firmware for the 6 pro. I've got 3 other people waiting for it. It's a matter of when. I no longer own this device and cannot capture the OTA myself. It's still possible, but I don't have the computing resources to do it. You'd have to be filthy rich. And I'm very far from that.
If you can locate stock firmware, official OTA, or if you know somebody with this phone and they are willing to factory reset and capture the OTA for you, perhaps we can proceed. As it stands for right now, I am not able to unbrick your device. Not yet. I know, it sucks, it's not what you want to hear. And maybe somebody else out there already figured it out- I encourage you to keep looking. Although xda is your best bet, they aren't the only development team out there. Sometimes people get lucky and figure it out before the xda crew.
I will continue to look for a solution. Stand by, posts are updated as these things are discovered.
*Edit* to cover all the bases, how did you brick your 6 pro? Was it during the unlocking the bootloader process, or was it during a firmware flash? If it happened while unlocking your bootloader, or rooting, then recovering your device may be extremely possible... Just tell me the steps you took up to where something went wrong

I was trying to root it. (well firstly trying to do the MTK unlock bootloader thing I found from these threads, whole time it was for the REVVL V+ 5G
The last thing I remember seeing was dm-verity is corrupt and it wouldn't boot eventually giving me a option to factory reset or reboot I rebooted and it hasn't worked since. I can get it detected to bypass with the auth tool but I cant get anything in SP flash tool to flash. Im uploading the firmware I found for it now its the only one I found and had to subscribe some site to get it.
I can't do nothing adb or fastboot its just the mediatek drivers being detected and Ive tried everything on win 10 as well as Garuda Linux
Its my main phone Ive been going at it for 3 days Im debating on whether I should take it to metro and try and get a replacement with the insurance

yahdeeez said:
I was trying to root it.
The last thing I remember seeing was dm-verity is corrupt and it wouldn't boot eventually giving me a option to factory reset or reboot I rebooted and it hasn't worked since. I can get it detected to bypass with the auth tool but I cant get anything in SP flash tool to flash. Im uploading the firmware I found for it now its the only one I found and had to subscribe some site to get it.
I can't do nothing adb or fastboot its just the mediatek drivers being detected and Ive tried everything on win 10 as well as Garuda Linux
Its my main phone Ive been going at it for 3 days Im debating on whether I should take it to metro and try and get a replacement with the insurance
Click to expand...
Click to collapse
Unfortunately, once you root, unlock the bootloader, or otherwise tamper with the software, your device warranty and insurance are voided. Now, if the device fails naturally then it's their fault. Just like gasoline goes in your car. If your poured maple syrup in it the warranty is voided. But this doesn't mean all hope is lost. If you DM me or email me I have other solutions. I don't want my account deleted and I don't think xda would appreciate me putting it out there.
Okay, DM verity corrupted? There are ways to fix that. I don't think you need the firmware to fix it. I'm fact, I believe flashing firmware is a wasted effort. Your error, I believe is in the unlocking the bootloader. Did you ever try to root?

Check this out.
How to unlock Revvl 6 Pro 5g?
I need help unlocking bootloader on my new Revvl 6 Pro 5g, this is my first mtk device, and I'm a Windows guy and I'm lost on the whole mtk client tool and python. Any and all help would be a phenomenal help! I think this phone would have a lot...
forum.xda-developers.com
Also _hollywood_ seems to know a lot about this device. Perhaps asking their advice would prove helpful

Related

need E9+ flashtools firmware full for unbreack totualy is dead

hi pls share htc e9+ flashtools firmware
phone is soft breack
Operation : Check / Read Info [ v1.58 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 7 ]
Sync...
Inital Boot Ok!
BB_CPU_PID : 6795
BB_CPU_NME : [MediaTek] Helio[X10]|MT6795_S00
BB_CPU_EXT : 0xCA00 , 0x8A00 , 0x0000
Processing BROM stage
Settings for BROM configured!
SecCfgVal : 0x00000000
BromVer : 0x00FF
BLVersion : 0x0001
PreLoader : Active [ Boot with PL ]
BootLdrSS : NORMAL with PRELOADER
Processing DA stage
DA Select done, will use MTK_AllInOne_DA_v5.1624.16.07
Sending and initialize DA ...
[DA_ERROR] : SECURITYBOOT_BOOT_NOT_ACCEPTED
Boot Error!
Operation Failed
Elapsed: 00:00:28
Reconnect Power/Cable!

Hard Brick Moto Z Play patch April

Guys i looked everywhere, i have almost 19 files of blank flash with me, i tried every file.
most of them i get this error
Code:
**** Log buffer [000001] 2018-04-26_17:50:55 ****
[ 0.000] Opening device: \\.\COM4
[ 0.001] Detecting device
[ 4.007] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 4.007] Check qboot_log.txt for more details
[ 4.008] Total time: 4.009s
[ 4.008]
[ 4.008] qboot version 3.40
[ 4.008]
[ 4.008] DEVICE {
[ 4.008] name = "\\.\COM4",
[ 4.008] flags = "0x64",
[ 4.008] addr = "0x61FE5C",
[ 4.008] api.bnr = "0x2932F80",
[ 4.008] }
[ 4.008]
[ 4.008]
[ 4.008] Backup & Restore {
[ 4.008] num_entries = 0,
[ 4.008] restoring = "false",
[ 4.008] backup_error = "not started",
[ 4.008] restore_error = "not started",
[ 4.008] }
[ 4.008]
Sometimes i get this error:
Code:
**** Log buffer [000001] 2018-04-26_18:50:06 ****
[ 0.000] Opening device: \\.\COM3
[ 0.001] Detecting device
[ 0.004] ...cpu.id = 70 (0x46)
[ 0.004] ...cpu.sn = 2664816212 (0x9ed5de54)
[ 0.004] Opening singleimage
[ 0.005] Loading package
[ 0.006] ...filename = singleimage.pkg.xml
[ 0.007] Loading programmer
[ 0.008] ...filename = programmer.mbn
[ 0.008] Sending programmer
[ 0.227] Handling things over to programmer
[ 0.227] Identifying CPU version
[ 0.233] Waiting for firehose to get ready
[ 60.789] Waiting for firehose to get ready
[120.875] ...MSM8953 unknown
[120.875] Determining target secure state
[120.882] Waiting for firehose to get ready
[180.966] ...secure = no
[181.005] Waiting for firehose to get ready
[241.083] Configuring device...
[241.086] Waiting for firehose to get ready
[301.165] Waiting for firehose to get ready
[361.257] Waiting for firehose to get ready
[421.340] Waiting for firehose to get ready
[481.421] ERROR: do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
[481.421] Check qboot_log.txt for more details
[481.422] Total time: 481.423s
[481.422]
[481.422] qboot version 3.40
[481.422]
[481.422] DEVICE {
[481.422] name = "\\.\COM3",
[481.422] flags = "0x64",
[481.422] addr = "0x61FE5C",
[481.422] sahara.current_mode = "0",
[481.422] api.buffer = "0x2D9D020",
[481.422] cpu.serial = "2664816212",
[481.422] cpu.id = "70",
[481.422] cpu.sv_sbl = "0",
[481.422] cpu.name = "MSM8953",
[481.422] storage.type = "eMMC",
[481.422] sahara.programmer = "programmer.mbn",
[481.422] module.firehose = "0xEEBC8",
[481.422] cpu.ver = "0",
[481.422] cpu.vername = "unknown",
[481.422] api.bnr = "0x2CD8388",
[481.422] }
[481.422]
[481.422]
[481.422] Backup & Restore {
[481.422] num_entries = 0,
[481.422] restoring = "false",
[481.422] backup_error = "not started",
[481.422] restore_error = "not started",
[481.422] }
[481.422]
i was at 7.0 and got a update *april* i just clicked and forgot that my phone was rooted, when i look back my cellphone was off . cant access bootloader...
and no blank flash help me.
OBS: used windows 10, 3.0 USB and Vmware with windows 7.
Qualcomm driver installed.
what should i do?
I get these errors too, in my case I did downgrade the oreo 8.0.0 patch from March to Nougat 7.1.1 after I was applying a patch by OTA. I had forgotten that this was how hardbrick got, lol. now I'm hoping to get the blankflash for Oreo 8.0.0 and hope to revive my Z Play.
translated from google translate
Guys, you all know that expecially on this Motorola phone you need to avoid flashing an older bootloader to apply after an OTA update. It ends with hardbrick, that is not the first time we've seen this on this forum.
Systemlessly said:
Guys, you all know that expecially on this Motorola phone you need to avoid flashing an older bootloader to apply after an OTA update. It ends with hardbrick, that is not the first time we've seen this on this forum.
Click to expand...
Click to collapse
but , my rom was 7 , so none of this bootloaders are old. i just cant find one to fix and cant understand this error what means.
carolnap said:
Guys i looked everywhere, i have almost 19 files of blank flash with me, i tried every file.
most of them i get this error
i was at 7.0 and got a update *april* i just clicked and forgot that my phone was rooted, when i look back my cellphone was off . cant access bootloader...
and no blank flash help me.
OBS: used windows 10, 3.0 USB and Vmware with windows 7.
Qualcomm driver installed.
what should i do?
Click to expand...
Click to collapse
Have you you tried the blankflash here? https://forum.xda-developers.com/showpost.php?p=73402033&postcount=181
If so and it doesn't work, or your device was previously updated to the stock 7.1.1 or 8.0 stock firmware, then you may well have to either wait for a newer blankflash or send your device for a service repair.
Generally, if you downgrade your device stock firmware, please do not use OTA updates.
Systemlessly said:
Guys, you all know that expecially on this Motorola phone you need to avoid flashing an older bootloader to apply after an OTA update. It ends with hardbrick, that is not the first time we've seen this on this forum.
Click to expand...
Click to collapse
echo92 said:
Have you you tried the blankflash here? https://forum.xda-developers.com/showpost.php?p=73402033&postcount=181
If so and it doesn't work, or your device was previously updated to the stock 7.1.1 or 8.0 stock firmware, then you may well have to either wait for a newer blankflash or send your device for a service repair.
Generally, if you downgrade your device stock firmware, please do not use OTA updates.
Click to expand...
Click to collapse
hello, i used, it always stucked on "waiting for the firehose to come"
and then error
so if i use the oreo blankflash... ill only be able to use oreo from now on.
it that what u means?
obs: i think is stock 7.1.1
carolnap said:
hello, i used, it always stucked on "waiting for the firehose to come"
and then error
so if i use the oreo blankflash... ill only be able to use oreo from now on.
it that what u means?
Click to expand...
Click to collapse
Try the blankflash a few times, sometimes it fails to receive a response from your device (hence waiting for the firehose). Alternatively it could mean the blankflash is too old for your bootloader to rescue it (blankflashes appear to only be able to repair bootloaders that are older or as new as the blankflash supplied bootloader).
If you use the Oreo blankflash, then your bootloader would be likely updated to the Oreo bootloader. In theory, you could flash older stock firmware, but again, using OTA updates on a device with downgraded stock firmware is a really bad idea.
However, that is dependent on even if we get an Oreo blankflash, as these are leaked from internal Motorola development. As such, we're very lucky to have them...
echo92 said:
Try the blankflash a few times, sometimes it fails to receive a response from your device (hence waiting for the firehose). Alternatively it could mean the blankflash is too old for your bootloader to rescue it (blankflashes appear to only be able to repair bootloaders that are older or as new as the blankflash supplied bootloader).
If you use the Oreo blankflash, then your bootloader would be likely updated to the Oreo bootloader. In theory, you could flash older stock firmware, but again, using OTA updates on a device with downgraded stock firmware is a really bad idea.
However, that is dependent on even if we get an Oreo blankflash, as these are leaked from internal Motorola development. As such, we're very lucky to have them...
Click to expand...
Click to collapse
can you tell me if metters that i use windows 10 or windows 7, because both give me the same error.
and when is at waiting the firehose i listen to a driver sound that is unpluggin and then pluggin ...
carolnap said:
can you tell me if metters that i use windows 10 or windows 7, because both give me the same error.
and when is at waiting the firehose i listen to a driver sound that is unpluggin and then pluggin ...
Click to expand...
Click to collapse
Hmm, are you seeing your device present in Device Manager? It should either show up as Motorola ADB interface or perhaps fastboot addison_s, or is it showing up as Qualcomm HS_USB 9008 or similar?
Do you have the Motorola ADB drivers installed? Also, do you have driver signature enforcement disabled if you are running a 64 bit build of Windows? (one guide to disable enforcement is here: https://www.howtogeek.com/167723/ho...8.1-so-that-you-can-install-unsigned-drivers/ )
Also, try with the original USB Motorola cable or a high quality USB data cable. You could try the following too (credit to: https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016 )
Follow the below steps.
1. Keep your mobile connected using USB, obviously.
2. using one hand keep power button and volume down button pressed at same time and using other hand click blank-flash.bat file.
3. It might be possible that blank-flash.bat scritps get finished earlier, in that case, keep clicking .bat file continuously, you don't need to close previous cmd window. For me it took 5-6 run to get script detect/communicate with device. Here idea is that your mobile should get detected when you press power button+volume button while blank-flash.bat file is still executing.
4. keep trying step 3 unless you dont see below logs.
However, if you were originally on 7.1.1 then downgraded to 7.0, then took the April OTA update, depending on what 7.1.1 firmware you had, you may have to wait for the Oreo blankflash or pay for a service repair, as the blankflashes we have may be too old, and won't rescue a corrupted 7.1.1 bootloader (since downgrading stock firmware does not downgrade your bootloader in many cases. Hence, taking an old OTA - which does not check your bootloader version - corrupts your newer bootloader when the OTA flashes an old bootloader onto your device).
That being said, given you were rooted in the first place, the OTA should have failed as it detected root. What happens when you power off your device and then hold down the power and volume down keys, anything?
echo92 said:
Hmm, are you seeing your device present in Device Manager? It should either show up as Motorola ADB interface or perhaps fastboot addison_s, or is it showing up as Qualcomm HS_USB 9008 or similar?
Do you have the Motorola ADB drivers installed? Also, do you have driver signature enforcement disabled if you are running a 64 bit build of Windows? (one guide to disable enforcement is here: https://www.howtogeek.com/167723/ho...8.1-so-that-you-can-install-unsigned-drivers/ )
Also, try with the original USB Motorola cable or a high quality USB data cable. You could try the following too (credit to: https://forum.xda-developers.com/moto-g4-plus/help/solved-unbrick-hard-bricked-dead-t3585016 )
Follow the below steps.
1. Keep your mobile connected using USB, obviously.
2. using one hand keep power button and volume down button pressed at same time and using other hand click blank-flash.bat file.
3. It might be possible that blank-flash.bat scritps get finished earlier, in that case, keep clicking .bat file continuously, you don't need to close previous cmd window. For me it took 5-6 run to get script detect/communicate with device. Here idea is that your mobile should get detected when you press power button+volume button while blank-flash.bat file is still executing.
4. keep trying step 3 unless you dont see below logs.
However, if you were originally on 7.1.1 then downgraded to 7.0, then took the April OTA update, depending on what 7.1.1 firmware you had, you may have to wait for the Oreo blankflash or pay for a service repair, as the blankflashes we have may be too old, and won't rescue a corrupted 7.1.1 bootloader (since downgrading stock firmware does not downgrade your bootloader in many cases. Hence, taking an old OTA - which does not check your bootloader version - corrupts your newer bootloader when the OTA flashes an old bootloader onto your device).
That being said, given you were rooted in the first place, the OTA should have failed as it detected root. What happens when you power off your device and then hold down the power and volume down keys, anything?
Click to expand...
Click to collapse
hi,
-- on device manager is showing Qualcomm HS_USB 9008
-- driver signature enforcement disabled ( ive done that)
-- original USB Motorola cable (im using this one)
-- That being said, given you were rooted in the first place, the OTA should have failed as it detected root. What happens when you power off your device and then hold down the power and volume down keys, anything?
well my cellphone shut down in the middle of update and nothing happens when i press those keys.
thanks for helping me, but i really dont know why when i finnaly get those message of waiting the firehose it get the error. it should be working right, i dont think its driver anymore...
on the 0.233 (in the picture) is where i hear the sound of driver unpluggin and the pluggin so i stop pressing vol down and power...
but nothing happens after that. even if i keep pressing the sound continue and the error is the same
carolnap said:
hi,
-- on device manager is showing Qualcomm HS_USB 9008
-- driver signature enforcement disabled ( ive done that)
-- original USB Motorola cable (im using this one)
-- That being said, given you were rooted in the first place, the OTA should have failed as it detected root. What happens when you power off your device and then hold down the power and volume down keys, anything?
well my cellphone shut down in the middle of update and nothing happens when i press those keys.
thanks for helping me, but i really dont know why when i finnaly get those message of waiting the firehose it get the error. it should be working right, i dont think its driver anymore...
on the 0.233 (in the picture) is where i hear the sound of driver unpluggin and the pluggin so i stop pressing vol down and power...
but nothing happens after that. even if i keep pressing the sound continue and the error is the same
Click to expand...
Click to collapse
Ah, if your device shut down in the middle of the update, then that suggests a definite hard brick (presumably when the OTA attempted to flash the old April 2017 bootloader onto a 7.1.1 bootloader and corrupted the newer bootloader).
The info you've provided suggests that your device is communicating in the Qualcomm fallback mode (HS_USB 9008) to your computer, hence why you're hearing the driver sounds. However, the multitude of 'waiting for firehose' suggests that the blankflash is still not communicating properly with your device. As I understand it, when the blankflash communicates with your device, it sends over a (signed) programmer to establish a connection and to verify your device CPU and bootloader are suitable for sending over the new bootloader. If it is not suitable, the blankflash is left waiting for a reply (waiting for firehose) before timing out. That suggests the blankflashes you're using are too old for your device bootloader, especially if you're getting MSM8953 unknown, which likely points to the blankflash being unable to identify your CPU/chipset and/or bootloader and so cannot authorise the transfer.
For more info: https://github.com/openpst/sahara/blob/master/README.md
Also, here's an interesting article on firehose programmers (the part of the blankflash that authorises the transfer of the new bootloader) and why some OEMs don't want to give them out, as you could in theory compromise the bootloader security: https://alephsecurity.com/2018/01/22/qualcomm-edl-1/
echo92 said:
Ah, if your device shut down in the middle of the update, then that suggests a definite hard brick (presumably when the OTA attempted to flash the old April 2017 bootloader onto a 7.1.1 bootloader and corrupted the newer bootloader).
The info you've provided suggests that your device is communicating in the Qualcomm fallback mode (HS_USB 9008) to your computer, hence why you're hearing the driver sounds. However, the multitude of 'waiting for firehose' suggests that the blankflash is still not communicating properly with your device. As I understand it, when the blankflash communicates with your device, it sends over a (signed) programmer to establish a connection and to verify your device CPU and bootloader are suitable for sending over the new bootloader. If it is not suitable, the blankflash is left waiting for a reply (waiting for firehose) before timing out. That suggests the blankflashes you're using are too old for your device bootloader.
For more info: https://github.com/openpst/sahara/blob/master/README.md
Also, here's an interesting article on firehose programmers (the part of the blankflash that authorises the transfer of the new bootloader) and why some OEMs don't want to give them out, as you could in theory compromise the bootloader security: https://alephsecurity.com/2018/01/22/qualcomm-edl-1/
Click to expand...
Click to collapse
what you means by definite hard brick, ill not able to recover even with the blankflash oreo?
carolnap said:
what you means by definite hard brick, ill not able to recover even with the blankflash oreo?
Click to expand...
Click to collapse
By definite hard brick, I mean you may likely need to wait for a much newer blankflash than any we have available. Hard bricks are very difficult to resolve without the correct/newest blankflashes. As I mentioned earlier, any blankflash you use can only work if it's flashing a 7.1.1 or newer bootloader onto a device that was formally updated to 7.1.1 - any blankflashes designed for 7.0 or blankflashes for older 7.1.1 builds may not work. Again, you may wish to repeat using the blankflash as sometimes it takes a few tries to get the connection working.
The Oreo blankflash should work, as that likely carries the newest bootloader available. However, I have no idea when that will be leaked, or if it will even be leaked. You may be able to find a member who knows a sympathetic Motorola engineer to get an updated blankflash from, or a factory Oreo stock fastboot ROM, but those are leaks and as such it is very difficult to know if or when they will be released.
If you need a device in a hurry, you would likely be best served by possibly paying for a motherboard replacement or buying a new device, and putting your Z Play aside in the hope there's a rescue blankflash in the future.
usuario do Z play said:
I get these errors too, in my case I did downgrade the oreo 8.0.0 patch from March to Nougat 7.1.1 after I was applying a patch by OTA. I had forgotten that this was how hardbrick got, lol. now I'm hoping to get the blankflash for Oreo 8.0.0 and hope to revive my Z Play.
translated from google translate
Click to expand...
Click to collapse
What date was the security patch of Nougat that you flashed? @echos97 told me that if it was the Feb 2018 one, (which was the one directly before the March and April Oreo builds), you might have been safe to update via OTA. Perhaps you flashed an older build?
djdelarosa25 said:
What date was the security patch of Nougat that you flashed? @echos97 told me that if it was the Feb 2018 one, (which was the one directly before the March and April Oreo builds), you might have been safe to update via OTA. Perhaps you flashed an older build?
Click to expand...
Click to collapse
i have this file next to the rom
BUILD REQUEST INFO:
SW Version: addison-user 7.0 NPNS25.137-24-1-4 5 release-keysM8953_10222.33.04.62R
MBM Version: C1.06
Modem Version: M8953_10222.33.04.62R
FSG Version: FSG-8953-04.81
Build Fingerprint: motorola/addison/addison:7.0/NPNS25.137-24-1-4/5:user/release-keys
VERSION INFO FOUND UNDER 'ABOUT PHONE' SCREEN:
System Version: 25.201.5.addison.retail.en.US
Model number: XT1635-02
Android Version: 7.0
Baseband Version: M8953_10222.33.04.62R
Build Number: addison-user 7.0 NPNS25.137-24-1-4 5 release-keys
Build Date: Thu Mar 16 08:38:42 CDT 2017
OTHER MISC VERSION INFO:
Subsidy Lock Config: slcf_rev_d_default_v1.0.nvm
Regulatory Info (eLabel): regulatory_info_default.png
Blur Version: Blur_Version.25.201.5.addison.retail.en.US
Version when read from CPV: addison-user 7.0 NPNS25.137-24-1-4 5 release-keys
was the first update i got when i started the rom
right now i dont even knw if was april
carolnap said:
i have this file next to the rom
BUILD REQUEST INFO:
SW Version: addison-user 7.0 NPNS25.137-24-1-4 5 release-keysM8953_10222.33.04.62R
MBM Version: C1.06
Modem Version: M8953_10222.33.04.62R
FSG Version: FSG-8953-04.81
Build Fingerprint: motorola/addison/addison:7.0/NPNS25.137-24-1-4/5:user/release-keys
VERSION INFO FOUND UNDER 'ABOUT PHONE' SCREEN:
System Version: 25.201.5.addison.retail.en.US
Model number: XT1635-02
Android Version: 7.0
Baseband Version: M8953_10222.33.04.62R
Build Number: addison-user 7.0 NPNS25.137-24-1-4 5 release-keys
Build Date: Thu Mar 16 08:38:42 CDT 2017
OTHER MISC VERSION INFO:
Subsidy Lock Config: slcf_rev_d_default_v1.0.nvm
Regulatory Info (eLabel): regulatory_info_default.png
Blur Version: Blur_Version.25.201.5.addison.retail.en.US
Version when read from CPV: addison-user 7.0 NPNS25.137-24-1-4 5 release-keys
was the first update i got when i started the rom
right now i dont even knw if was april
Click to expand...
Click to collapse
You didn't answer my question. You posted that you flashed back to Nougat after flashing Oreo. May I ask again, what date was the security patch of the Nougat firmware that you flashed?
EDIT: Apologies, seems like you flashed way back to 7.0. Well, if that's the case, I think there's nothing you can do but wait for the Oreo firmware to become available. If you flashed back to Feb 2018 7.1.1, this may not have been an issue.
djdelarosa25 said:
You didn't answer my question. You posted that you flashed back to Nougat after flashing Oreo. May I ask again, what date was the security patch of the Nougat firmware that you flashed?
Click to expand...
Click to collapse
If that's the stock ROM they flashed, Googling the build number suggests it was March 2017. If they had formally updated to 7.1.1, their bootloader would have been at least the August 2017 build. The large disparity in firmware build versions is the likely reason they hard bricked when taking the Nougat April 2017 OTA patch. Credit to: https://forum.xda-developers.com/moto-z-play/how-to/moto-z-play-reteu-firmware-otas-t3557917
djdelarosa25 said:
You didn't answer my question. You posted that you flashed back to Nougat after flashing Oreo. May I ask again, what date was the security patch of the Nougat firmware that you flashed?
Click to expand...
Click to collapse
i didnt flashed oreo anytime
guys, i was with a custom rom, and flashed this rom (last topic)
so i got the update after reboot the cellphone (right after flashed this rom) ok?
and then the cellphone died.
djdelarosa25 said:
You didn't answer my question. You posted that you flashed back to Nougat after flashing Oreo. May I ask again, what date was the security patch of the Nougat firmware that you flashed?
EDIT: Apologies, seems like you flashed way back to 7.0. Well, if that's the case, I think there's nothing you can do but wait for the Oreo firmware to become available. If you flashed back to Feb 2018 7.1.1, this may not have been an issue.
Click to expand...
Click to collapse
why 7 is a problem and not 7.1
7 is older...
carolnap said:
why 7 is a problem and not 7.1
7 is older...
Click to expand...
Click to collapse
Not all 7.1.1 builds are SAFE to flash, ONLY the latest build prior to the Android version jump - in this case, the Feb 2018 patch
7.0 is way older. If you came from Oreo and flashed Feb 2018 7.1.1 Nougat, you would still have the Oreo bootloader. In this case, updating back to Oreo would work, as it is the same bootloader version. But if you flashed 7.0 and accepted an OTA, this would brick your device due to bootloader incompatibility. AFAIK, you can't skip OTA releases. You'd have to update to the next patch before the next one if your device is a few builds outdated.
I have to credit my friend @echo92 here for all the knowledge. Though to be fair, I haven't completely gotten the whole idea and I ask for your help again in helping this poor fellow.

Hard brick after LOS installation

Hello everybody,
once again I'm in trouble.
With help of Marcowe I updated my phone with no OS to Oreo
HTML:
https://forum.xda-developers.com/z2-force/help/z2-os-help-to-t3837577
I wanted to give it another try and here I my attempts to install LOS.
1. oem unlock
2. I booted into current twrp (fastboot boot twrp-3.2.3-2-nash.img
3. adb push of lineange onto internal sd card
4. In TWRP under advanced wipe I pressed format data (If I now think about it, in the progress windows there was some red text probably not a good sign)
5. I installed LOS with now error
6. There was an option to delete dalvik cache which I pressed
7 . System reboot
8. Black screen Device Manager shows me Qualcomm HS-USB QDLoader 9008 (COM6)
I tried a blankflash file from here
HTML:
https://unbricks.com/unbrick-motorola-moto-z2-force-update-fix-issues/
but it shows me an error. Log file will be at end of post.
QFIL does not find a corresponding MBN nor an XML file in stock rom
HTML:
https://forum.xda-developers.com/z2-force/development/factory-image-moto-z2-force-nash-retail-t3699306
If you have got any idea to get my phone back, I would be happy and would like to contribute.
Regards,
Bew
Log file:
[ 0.001] Opening device: \\.\COM6
[ 0.003] Detecting device
[ 34.009] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 34.009] Check qboot_log.txt for more details
[ 34.009] Total time: 34.011s
[ 34.009]
[ 34.009] qboot version 3.85
[ 34.009]
[ 34.009] DEVICE {
[ 34.009] name = "\\.\COM6",
[ 34.009] flags = "0x64",
[ 34.009] addr = "0x28FD74",
[ 34.009] api.bnr = "0x372FD8",
[ 34.009] }
[ 34.009]
[ 34.009]
[ 34.009] Backup & Restore {
[ 34.009] num_entries = 0,
[ 34.009] restoring = "false",
[ 34.009] backup_error = "not started",
[ 34.009] restore_error = "not started",
[ 34.009] }
[ 34.009]
Try this, power the phone back on. If you get that screen again cover the power button (don't press yet) with one finger, then cover the volume down button (don't press yet) with another.. Then press the power button, until the screen goes blank, then right after it does, (while still holding down the power button) Press the volume down button, until it comes on again.. Hopefully it will give you the bootloader instead.. If it does, Then find a flashll file for your carrier.
doubledragon5 said:
Try this, power the phone back on. If you get that screen again cover the power button (don't press yet) with one finger, then cover the volume down button (don't press yet) with another.. Then press the power button, until the screen goes blank, then right after it does, (while still holding down the power button) Press the volume down button, until it comes on again.. Hopefully it will give you the bootloader instead.. If it does, Then find a flashll file for your carrier.
Click to expand...
Click to collapse
Hello doubledragon5,
the screen is blank all the time. It stays black if I try to turn it on or off. The phone gives no sign if its on or off.
Regards,
Bew
b.bew said:
Hello doubledragon5,
the screen is blank all the time. It stays black if I try to turn it on or off. The phone gives no sign if its on or off.
Regards,
Bew
Click to expand...
Click to collapse
Sorry miss read your post.
Unbrick yo Brick quick ish
Here are the signed diag drivers for win
Qualcomm Diag Drivers Signed
attached is the blankflash zip
Unplug your phone, install diag drivers, replug and wait for the everything to recognize and settle.
Unzip the blankflash to a folder and run the bat file, after it's done you should be back in bootloader where you can re-flash the latest firmware for your phone.
Use 2.0 usb ports from your motherboard, not a hub like the front of your pc; and use the oem cable.
If you have trouble getting this to work then unplug your phone from your pc, uninstall your moto drivers and the qualcomm drivers. Restart. Reininstall the drivers, reboot; then plug your phone and wait for the drivers to recognize, install, and settle. You may need to try to run the blankflash a couple of times to get it to take. You may need to try alternate usb ports, even 3.0+
This phone can be super picky about ports, cables, and even adb/fastboot versions. For most they won't have to worry about most of this, but for others this is the basic setup that works for the majority of users.
*Note - To get into blankflash/edl mode manually...
from bootloader prompt 'fastboot oem blankflash' w/o quotes
via adb command 'adb reboot edl' w/o quotes
41rw4lk said:
Here are the signed diag drivers for win
Qualcomm Diag Drivers Signed
attached is the blankflash zip
Unplug your phone, install diag drivers, replug and wait for the everything to recognize and settle.
Unzip the blankflash to a folder and run the bat file, after it's done you should be back in bootloader where you can re-flash the latest firmware for your phone.
Click to expand...
Click to collapse
Thank you very much.
I was able to start in bootloader again. I was not able to flash the firmware via the procedure described by Marcowe (see link in first post, it mentioned that they are no sectors _a _b or something like that, I will recheck.). Still I was able too boot in Oreo.
I guess because its an A/B device? Does this mean that one is corrupted now?
Regards,
Bew
b.bew said:
Thank you very much.
I was able to start in bootloader again. I was not able to flash the firmware via the procedure described by Marcowe (see link in first post, it mentioned that they are no sectors _a _b or something like that, I will recheck.). Still I was able too boot in Oreo.
I guess because its an A/B device? Does this mean that one is corrupted now?
Regards,
Bew
Click to expand...
Click to collapse
So you're able to boot and use your phone, correct? If so, don't worry about the other slot, it'll get sorted when a new update comes out, or you flash a custom rom (if you choose to). If you followed Marcowe's flashing instructions from that other post you linked, then the same firmware is flashed on both slots. As for slot _a _b messages, could have been an out of date bootloader session depending on what you were doing and what, if anything, you flashed prior to trying to flash the firmware. A few different things could be going on there, so unless you can't boot I wouldn't trip on it at the moment.
Either way, if you can boot and use your phone I wouldn't worry about it, unless there is something specific you're trying to do. Alternatively, you can boot into bootloader mode and run the command 'fastboot getvar all' w/o quotes and get a little info about the state of your phone.
41rw4lk said:
So you're able to boot and use your phone, correct? If so, don't worry about the other slot, it'll get sorted when a new update comes out, or you flash a custom rom (if you choose to). If you followed Marcowe's flashing instructions from that other post you linked, then the same firmware is flashed on both slots. As for slot _a _b messages, could have been an out of date bootloader session depending on what you were doing and what, if anything, you flashed prior to trying to flash the firmware. A few different things could be going on there, so unless you can't boot I wouldn't trip on it at the moment.
Either way, if you can boot and use your phone I wouldn't worry about it, unless there is something specific you're trying to do. Alternatively, you can boot into bootloader mode and run the command 'fastboot getvar all' w/o quotes and get a little info about the state of your phone.
Click to expand...
Click to collapse
I'm able to boot and use my phone. I would like to use lineageos but my last two attempts where disasters.
I copied the last part of the info state which gives information about the slots since I'm not sure wat to delete besides of serial number.
(bootloader) current-slot: _a
(bootloader) running-bl-slot: _a
(bootloader) running-boot-lun: 2
(bootloader) slot-suffixes: _a,_b
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: no
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 0
b.bew said:
I'm able to boot and use my phone. I would like to use lineageos but my last two attempts where disasters.
I copied the last part of the info state which gives information about the slots since I'm not sure wat to delete besides of serial number.
(bootloader) current-slot: _a
(bootloader) running-bl-slot: _a
(bootloader) running-boot-lun: 2
(bootloader) slot-suffixes: _a,_b
(bootloader) slot-count: 2
(bootloader) slot-successful:_a: yes
(bootloader) slot-successful:_b: no
(bootloader) slot-unbootable:_a: no
(bootloader) slot-unbootable:_b: no
(bootloader) slot-retry-count:_a: 6
(bootloader) slot-retry-count:_b: 0
Click to expand...
Click to collapse
You weren't on the correct build when you flashed Lineage OS. It explicitly says which one to be on in the OP.
http://download.invisiblek.org/nash/unbrick.zip -- this has instructions in it. We've done it hundreds of time, and I know it works.
Best of luck.
fastboot oem fb_mode_set
fastboot getvar max-sparse-size
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash bootloader_a bootloader.img
fastboot flash bootloader_b bootloader.img
fastboot flash modem_a NON-HLOS.bin
fastboot flash fsg_a fsg.mbn
fastboot flash modem_b NON-HLOS.bin
fastboot flash fsg_b fsg.mbn
fastboot erase modemst1
fastboot erase modemst2
fastboot flash bluetooth_a BTFM.bin
fastboot flash dsp_a adspso.bin
fastboot flash logo_a logo.bin
fastboot flash boot_a boot.img
fastboot flash system_a system.img_sparsechunk.0
fastboot flash system_a system.img_sparsechunk.1
fastboot flash system_a system.img_sparsechunk.2
fastboot flash system_a system.img_sparsechunk.3
fastboot flash system_a system.img_sparsechunk.4
fastboot flash system_a system.img_sparsechunk.5
fastboot flash oem_a oem.img
fastboot flash bluetooth_b BTFM.bin
fastboot flash dsp_b adspso.bin
fastboot flash logo_b logo.bin
fastboot flash boot_b boot.img
fastboot flash system_b system.img_sparsechunk.0
fastboot flash system_b system.img_sparsechunk.1
fastboot flash system_b system.img_sparsechunk.2
fastboot flash system_b system.img_sparsechunk.3
fastboot flash system_b system.img_sparsechunk.4
fastboot flash system_b system.img_sparsechunk.5
fastboot flash oem_b oem.img
fastboot erase carrier
fastboot erase ddr
fastboot oem fb_mode_clear
Put this as your flashall.bat with your correct firmware
hello i have the same problem all time, first install qualcom drivers, then i uninstall motorola drivers and reboot, is very difficult to detect my phone in my pc, dont know why, but when detects it says unknown device, then i manually update the driver to Qualcomm HS-USB QDLoader 9008 (COM6), and its ok, run bat file blankflash, but it says waiting for device all time i did on my windows 7 pc and my windows 1 pc is the same, can anyone help me?
XxeAgLeAnGeLxX said:
hello i have the same problem all time, first install qualcom drivers, then i uninstall motorola drivers and reboot, is very difficult to detect my phone in my pc, dont know why, but when detects it says unknown device, then i manually update the driver to Qualcomm HS-USB QDLoader 9008 (COM6), and its ok, run bat file blankflash, but it says waiting for device all time i did on my windows 7 pc and my windows 1 pc is the same, can anyone help me?
Click to expand...
Click to collapse
You have to stop thread jumping and posting bits and pieces of your problem here and there, it makes it difficult to help you and it clutters the thread making it hard to reference for other users. Are we to back track through 3-4 different threads to see what the original problem is and what you've tried? Plus this thread is almost a year old and I'm sure isn't relevant to what your problem is.
41rw4lk said:
You have to stop thread jumping and posting bits and pieces of your problem here and there, it makes it difficult to help you and it clutters the thread making it hard to reference for other users. Are we to back track through 3-4 different threads to see what the original problem is and what you've tried? Plus this thread is almost a year old and I'm sure isn't relevant to what your problem is.
Click to expand...
Click to collapse
sorry
41rw4lk said:
Here are the signed diag drivers for win
Qualcomm Diag Drivers Signed
attached is the blankflash zip
Unplug your phone, install diag drivers, replug and wait for the everything to recognize and settle.
Unzip the blankflash to a folder and run the bat file, after it's done you should be back in bootloader where you can re-flash the latest firmware for your phone.
Use 2.0 usb ports from your motherboard, not a hub like the front of your pc; and use the oem cable.
If you have trouble getting this to work then unplug your phone from your pc, uninstall your moto drivers and the qualcomm drivers. Restart. Reininstall the drivers, reboot; then plug your phone and wait for the drivers to recognize, install, and settle. You may need to try to run the blankflash a couple of times to get it to take. You may need to try alternate usb ports, even 3.0+
This phone can be super picky about ports, cables, and even adb/fastboot versions. For most they won't have to worry about most of this, but for others this is the basic setup that works for the majority of users.
*Note - To get into blankflash/edl mode manually...
from bootloader prompt 'fastboot oem blankflash' w/o quotes
via adb command 'adb reboot edl' w/o quotes
Click to expand...
Click to collapse
I tried multiple methods to get into edl mode to do a blankflash , but I am not succesful. I tried the manual commands you mentioned but "fastboot oem blankflash" throws an error "command restricted".
adb reboot edl simply reboots multiple times and then boots normally to os, doesn't get detected as Qualcomm 9092 device.
I tried qcom method from bootloader which just normally boots the device to android but my laptop does detect it as qualcomm 9092 device. but then your blank-flash file doesn't work on it and stays on "waiting for device" .
Reason I want to blankflash is I accidentally flashed stock pie retail rom on my TMO 1789-04 device and now I dont have network/no sim error. Although baseband and imei are visible I dont have network or shows no sim error. I did manage to install TMO stock oreo but still no luck. As a last try I want to do blankflash and see if it helps.
can you please help me to get into edl mode or help blankflash my moto XT 1789-04?
latadswapnil said:
I tried multiple methods to get into edl mode to do a blankflash , but I am not succesful. I tried the manual commands you mentioned but "fastboot oem blankflash" throws an error "command restricted".
adb reboot edl simply reboots multiple times and then boots normally to os, doesn't get detected as Qualcomm 9092 device.
I tried qcom method from bootloader which just normally boots the device to android but my laptop does detect it as qualcomm 9092 device. but then your blank-flash file doesn't work on it and stays on "waiting for device" .
Reason I want to blankflash is I accidentally flashed stock pie retail rom on my TMO 1789-04 device and now I dont have network/no sim error. Although baseband and imei are visible I dont have network or shows no sim error. I did manage to install TMO stock oreo but still no luck. As a last try I want to do blankflash and see if it helps.
can you please help me to get into edl mode or help blankflash my moto XT 1789-04?
Click to expand...
Click to collapse
Blankflash won't solve that problem. Once you flash a pie modem you're stuck with it. The only solution is a pie modem which doesn't exist for TMO. No one has found a work around for this and with this phone being as old as it is now, it's unlikely that anything useful will be provided. Sorry. If you look around the forum you see dozens of warnings and examples of flashing the wrong firmware to your phone, most notably pie firmware. I think the only solution would be a pie modem that works for TMO too or a way to overwrite the modem nv value, both are pretty far out there.
41rw4lk said:
Blankflash won't solve that problem. Once you flash a pie modem you're stuck with it. The only solution is a pie modem which doesn't exist for TMO. No one has found a work around for this and with this phone being as old as it is now, it's unlikely that anything useful will be provided. Sorry. If you look around the forum you see dozens of warnings and examples of flashing the wrong firmware to your phone, most notably pie firmware. I think the only solution would be a pie modem that works for TMO too or a way to overwrite the modem nv value, both are pretty far out there.
Click to expand...
Click to collapse
is there a way we can erase flash memory and reinstall bootloader and everything from scratch?
Also, can you please help blankflashing the phone? any steps that I can take to be in edl mode?
41rw4lk said:
Blankflash won't solve that problem. Once you flash a pie modem you're stuck with it. The only solution is a pie modem which doesn't exist for TMO. No one has found a work around for this and with this phone being as old as it is now, it's unlikely that anything useful will be provided. Sorry. If you look around the forum you see dozens of warnings and examples of flashing the wrong firmware to your phone, most notably pie firmware. I think the only solution would be a pie modem that works for TMO too or a way to overwrite the modem nv value, both are pretty far out there.
Click to expand...
Click to collapse
So it seems that the problem is flashing a newer modem that is not compatible with Tmobile. Can you expand on where the info is written and why it cannot be reverted?
Sackgi said:
So it seems that the problem is flashing a newer modem that is not compatible with Tmobile. Can you expand on where the info is written and why it cannot be reverted?
Click to expand...
Click to collapse
The problem is TMO stopped with oreo, never made pie. So if you flashed a pie modem on TMO you're out of luck. When you flash a new modem most times it bumps your revision number up, so you can't roll back. You can typically only flash within the same revision or higher. Meaning you can't rollback to a lower revision modem.That info and warnings are all over this forum, and a lot of it is just anti-rollback.
Even on oreo whenever someone would flash the wrong oreo firmware, if it had a higher revision than what the proper firmware had, they would have to wait for an update that had an equal or higher revision modem to recover. Since TMO never and won't ever make pie firmware, going back is just not possible.
41rw4lk said:
The problem is TMO stopped with oreo, never made pie. So if you flashed a pie modem on TMO you're out of luck. When you flash a new modem most times it bumps your revision number up, so you can't roll back. You can typically only flash within the same revision or higher. Meaning you can't rollback to a lower revision modem.That info and warnings are all over this forum, and a lot of it is just anti-rollback.
Even on oreo whenever someone would flash the wrong oreo firmware, if it had a higher revision than what the proper firmware had, they would have to wait for an update that had an equal or higher revision modem to recover. Since TMO never and won't ever make pie firmware, going back is just not possible.
Click to expand...
Click to collapse
So what you are telling me is that there is no way to rollback once the revision number is higher. I question how is that no one has figured it out how to overcome this. Is it not possible to write a script to trick the system to install the old modem using the new modem file? In other words, if what needs to be verified is that the revision number matches, would it be possible to modify the new modem file with the old modem one?
Nothing is ever impossible, this site is a testament to that. Those revision numbers are most likely stored as nv values. How easy it is to edit those, idk. Can it be done without bricking your phone, idk. I do know that plenty of members have thrown everything they can think of at this problem to no avail, several of them just completely bricking their phone entirely.
What you're saying makes sense on paper, but you're talking about hijacking the boot process and injecting data long before android even enters the picture. That's qualcomm stuff, like blankflashing.
The reality is, it's an android 9 problem on a phone that's stuck on 8 while the rest have moved on to 10 and 11. Not a big market of players to delve into this problem, sorry. As for just editing a modem, not so easy. I've seen others trying in other forums. Not to mention what gets flagged and tripped trying to flash something like that. Once you edit an officially signed package, it's no longer officially signed. Sorry to be the bad news bear.

MT6785t DataBase Files for writting IMEI (Redmi Note 8 Pro)

I have problem with SIM Cards that My Phone cant read any Mobile Network.
I found it's a IMEI problem and NVRAM is corrupted. So i need to repair IMEI by Database Files of MT6785t, then i can write IMEI again.
Another Solution is, if Anyone can backup NVRAM.img by SP Flash Tool by Read Back Method Like this
How To backup NVRAM on Mediatek MT67XX Devices - ROM-Provider
Step by Step guide to backup NVRAM aka IMEI bluetooth and mac address on Mediatek Devices including Latest MT67XX Devices MT6735, MT6737, MT6752
romprovider.com
a Video for this method
NVRAM details from Scatter
partition_index: SYS19
partition_name: nvram
file_name: NONE
is_download: false
type: NORMAL_ROM
linear_start_addr: 0x17580000
physical_start_addr: 0x17580000
partition_size: 0x4000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BINREGION
is_upgradable: false
empty_boot_needed: false
reserve: 0x00
Another way is if anyone has rooted his Redmi Note 8 Pro then copy this files and give me a link to download them. Path of DB File /etc/mddb
Thanks in Advance.
<erased>
All methods i tried can fix only IMEI for SIM2.
Haven't tried backup from a healthy phone.
Did it work for both SIM slots?
V3rt!g(o) said:
All methods i tried can fix only IMEI for SIM2.
Haven't tried backup from a healthy phone.
Did it work for both SIM slots?
Click to expand...
Click to collapse
Can you give me your nvram so l can rename it to my original one
V3rt!g(o) said:
All methods i tried can fix only IMEI for SIM2.
Haven't tried backup from a healthy phone.
Did it work for both SIM slots?
Click to expand...
Click to collapse
Can you give me your nvram so l can rename it to mine
I found this on a turkish website
https://gsmturkey.net/attachments/yedek-zip.10447/
this will erase your imei and mac addresses if you flash them. you can repair them using engineer rom/maiu meta
Canny1913 said:
I found this on a turkish website
https://gsmturkey.net/attachments/yedek-zip.10447/
this will erase your imei and mac addresses if you flash them. you can repair them using engineer rom/maiu meta
Click to expand...
Click to collapse
I am kinda in the same boat did anyone tried this and did it work ?

Question Can't load ROM - OnePlus 9 Pro bricked

Hi,
I want ask for help with recovery of my One Plus 9 Pro. The smartphone was oryginally in LE2120 (China) version but with India ROM (LE2121). I Wanted change it for EU ROM (LE2123) but that crashesh my phone...
After hours of failed attempts I don;t know what else I can do...
First ROM install attemt ended with errors on first pics. Next I've installed TWRP and now after each start of OnePlus it launches TWRP ant nothing else. I can ewentually go to the fastboot menu.
From TWRP I can't do repair, upload files from my PC, repair filesystem - amost nothing... Errors in another attached pics..
I've try to use MSM Tools and push files using EDL but it also finished with error (another attached pics).
In current state I can't go to the fastbootD menu (only TWRP available and launching automatically). When trying go to fastbootD - getting error (attachement).
I have downloaded many versions of OnePlus ROM's and recovery files with MSM Tolls but with any results - all of them eded with the same eerors like in attachements.
Please help what I should do now to get my Oneplus working again.
Let me think....
Try using the Eu MSM. I've read on oneplus community someone had a similar problem. Google "msmtool for le2120" and it should be one of the first results.
Marffi said:
Hi,
I want ask for help with recovery of my One Plus 9 Pro. The smartphone was oryginally in LE2120 (China) version but with India ROM (LE2121). I Wanted change it for EU ROM (LE2123) but that crashesh my phone...
After hours of failed attempts I don;t know what else I can do...
First ROM install attemt ended with errors on first pics. Next I've installed TWRP and now after each start of OnePlus it launches TWRP ant nothing else. I can ewentually go to the fastboot menu.
From TWRP I can't do repair, upload files from my PC, repair filesystem - amost nothing... Errors in another attached pics..
I've try to use MSM Tools and push files using EDL but it also finished with error (another attached pics).
In current state I can't go to the fastbootD menu (only TWRP available and launching automatically). When trying go to fastbootD - getting error (attachement).
I have downloaded many versions of OnePlus ROM's and recovery files with MSM Tolls but with any results - all of them eded with the same eerors like in attachements.
Please help what I should do now to get my Oneplus working again.
Click to expand...
Click to collapse
In twrp you can goto advanced->adb sideload, to flash roms.
You can also go into twrp fastbootd, if you follow these steps:
normally boot into twrp with "fastboot boot"
in twrp goto reboot->fastboot
while shutting down hold power+vol down (brings you to bootloader)
run fastboot boot twrp.img
For flashing partitions in fastboot you can always use _slot instead of --slot. For example "fastboot flash boot --slot=a boot.img" ->"fastboot flash boot_a boot.img". Same has to be done with slot b.
It could also be a good idea to use LE2120 MSM to go back to a usable state.
Since your original firmware was from India, I can mod you an MSM tool to flash the EU firmware. Give me a couple hours. Have to run an errand in town first...
In the meantime use the IN MSM Tool to revive your phone then wait for my mod MSM Tool to flash EU to phone.
der_akinator said:
In twrp you can goto advanced->adb sideload, to flash roms.
You can also go into twrp fastbootd, if you follow these steps:
normally boot into twrp with "fastboot boot"
in twrp goto reboot->fastboot
while shutting down hold power+vol down (brings you to bootloader)
run fastboot boot twrp.img
For flashing partitions in fastboot you can always use _slot instead of --slot. For example "fastboot flash boot --slot=a boot.img" ->"fastboot flash boot_a boot.img". Same has to be done with slot b.
It could also be a good idea to use LE2120 MSM to go back to a usable state.
Click to expand...
Click to collapse
Unfortunatley not I can't go to fastbootd. When trying do that I'm getting another error:
Marffi said:
Unfortunatley not I can't go to fastbootd. When trying do that I'm getting another error:
Click to expand...
Click to collapse
Use the IN MSM Tool to revive phone... In edl mode.
OP9Pro - Repository of MSM Unbrick Tools (TMO, EU, GLO, IN)
By using these tools, you accept full responsibility for your actions. Your warranty is void should you run any of these utilities without OnePlus support present. I am not responsible for bricks, fires, nuclear war, etc. If you modified any...
forum.xda-developers.com
here you go.......
File on MEGA
mega.nz
In EDL mode using new downlod the same error as previous
TheGhost1951 said:
here you go.......
File on MEGA
mega.nz
Click to expand...
Click to collapse
Using moded MSM Tools I've get messages:
1. Try Firehose Communication Handshake
2. Setting Firehose Communication Data trasmi...
3. Get TID Failed
and nothing more.
Log File:
[2472][05-17 16:38:43.843]<4> Set Proc Mode 0
[2472][05-17 16:38:43.996]<2> =========================================================
[2472][05-17 16:38:43.996]<2> | OnePlus DL PID:14264
[2472][05-17 16:38:43.996]<2> | Execute: 2023/05/17 14:38 GMT
[2472][05-17 16:38:43.996]<2> =========================================================
[2472][05-17 16:38:50.359]<4>
========================================================
[2472][05-17 16:39:06.535]<4> MetadataVersion=2,CryptVersion=1,[2472][05-17 16:39:06.535]<4> m_bIsPackImage=1
[2472][05-17 16:39:06.566]<4> Set Proc Mode 1
[2472][05-17 16:39:06.766]<4> ATO element doesn't exist. Skip.
[2472][05-17 16:39:06.782]<4> Project Name: 20857
[2472][05-17 16:39:06.782]<4> Factory ID: 20857IN
[2472][05-17 16:39:06.782]<4> Image Version: lemonadep_22_I.07_210412
[2472][05-17 16:39:06.782]<4> Skip SHA256 Check: No
[2472][05-17 16:39:06.782]<4> HW CHK: No
[2472][05-17 16:39:06.782]<4> RF CHK: No
[2472][05-17 16:39:06.782]<4> PRJ CHK: No
[2472][05-17 16:39:06.798]<4> MDL CHK: Yes
[2472][05-17 16:39:06.798]<4> ATO build: No
[2472][05-17 16:39:06.798]<4> Load upd cfg failed. continue.
[2472][05-17 16:39:06.798]<4> frp: 1
[2472][05-17 16:39:06.798]<4> Tool version verified! (V5.1.77)
[2472][05-17 16:39:06.798]<4> project 20857 not support boot mode feature
[2472][05-17 16:39:06.798]<4> project 20857 enable fuse
[2472][05-17 16:39:06.835]<4> [1] dwMajorVersion=6,dwMinorVersion=2,is_win7_system=0
[2472][05-17 16:39:06.873]<4> Skip multi-image identify: 0
[13140][05-17 16:39:15.492]<4> Device Arrival: \\?\USB#VID_05C6&PID_9008#5&318e2ee3&0&1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
[6740][05-17 16:39:19.069]<4> [0] SetComStep: 1
[6740][05-17 16:39:19.069]<4> [0] GetComStep: 1
[6740][05-17 16:39:19.071]<4> CID = -1
[6740][05-17 16:39:19.071]<4> Non TMO group
[6740][05-17 16:39:19.085]<4> [1] Set device as UFS
[6740][05-17 16:39:19.311]<4> [1] [CSerialCommHelper] Buf: 0 (16/10)
[6740][05-17 16:39:19.327]<4> [1] [CSerialCommHelper] No data in buffer to be sent 0
[6740][05-17 16:39:21.514]<4> [1] [SP][195] Check cmd done status failed. 1
[6740][05-17 16:39:21.637]<4> [1] [SP][208] Reset Sahara
[6740][05-17 16:39:21.852]<4> [1] [COM1] AddCpuIDtoIndex cupid(8aeb0289)
[6740][05-17 16:39:25.061]<4> [1] UFS Inquiry Command Output: SAMSUNG KLUEG8UHDB-C2D1 1903
[6740][05-17 16:39:25.061]<4> [1] UFS info Vendor = samsung, TotalLogicalBlocks = 499892224
[6740][05-17 16:39:25.061]<4> [1] [FFU]FWversion 903
[6740][05-17 16:39:25.061]<4> [1] [FFU] UFS Total Active LU 6
[6740][05-17 16:39:25.061]<4> [1] EmmcSizeInGB = 238.367188, TotalLogicalBlocks = 499892224
[6740][05-17 16:39:25.061]<4> [1] Memory size:
[6740][05-17 16:39:25.061]<4> [1] Not in intranet, pass.[6740][05-17 16:39:25.077]<4> [1] [Firehose] HwVersion = 22
[6740][05-17 16:39:25.093]<4> [1] [Firehose] RfVersion = 11
[6740][05-17 16:39:25.124]<4> [1] [Firehose] PrjVersion = 11
[6740][05-17 16:39:25.146]<4> [1] Get SW ID failed.
[13140][05-17 16:40:15.427]<4> Device Remove: \\?\USB#VID_05C6&PID_9008#5&318e2ee3&0&1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
[13140][05-17 16:42:34.518]<4> Device Arrival: \\?\USB#VID_05C6&PID_9008#5&318e2ee3&0&1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
[18596][05-17 16:42:36.464]<4> [0] SetComStep: 1
[18596][05-17 16:42:36.464]<4> [0] GetComStep: 1
[18596][05-17 16:42:36.466]<4> CID = -1
[18596][05-17 16:42:36.466]<4> Non TMO group
[18596][05-17 16:42:36.470]<4> [1] Set device as UFS
[18596][05-17 16:42:36.704]<4> [1] [CSerialCommHelper] Buf: 0 (16/10)
[18596][05-17 16:42:36.720]<4> [1] [CSerialCommHelper] No data in buffer to be sent 0
[18596][05-17 16:42:38.924]<4> [1] [SP][195] Check cmd done status failed. 1
[18596][05-17 16:42:39.025]<4> [1] [SP][208] Reset Sahara
[18596][05-17 16:42:39.256]<4> [1] [COM1] AddCpuIDtoIndex cupid(8aeb0289)
[18596][05-17 16:42:42.432]<4> [1] UFS Inquiry Command Output: SAMSUNG KLUEG8UHDB-C2D1 1903
[18596][05-17 16:42:42.432]<4> [1] UFS info Vendor = samsung, TotalLogicalBlocks = 499892224
[18596][05-17 16:42:42.432]<4> [1] [FFU]FWversion 903
[18596][05-17 16:42:42.432]<4> [1] [FFU] UFS Total Active LU 6
[18596][05-17 16:42:42.432]<4> [1] EmmcSizeInGB = 238.367188, TotalLogicalBlocks = 499892224
[18596][05-17 16:42:42.432]<4> [1] Memory size:
[18596][05-17 16:42:42.432]<4> [1] Not in intranet, pass.[18596][05-17 16:42:42.447]<4> [1] [Firehose] HwVersion = 22
[18596][05-17 16:42:42.463]<4> [1] [Firehose] RfVersion = 11
[18596][05-17 16:42:42.501]<4> [1] [Firehose] PrjVersion = 11
[18596][05-17 16:42:42.516]<4> [1] Get SW ID failed.
[13140][05-17 16:42:48.489]<4> Device Remove: \\?\USB#VID_05C6&PID_9008#5&318e2ee3&0&1#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
and second one:
IA V1.0
FCL V1.2
PL V1.9
MVL V1.3
SID 300 is non enc
Encrytped block of item 20 is incorrect
SID 300 is non enc
Encrytped block of item 20 is incorrect
Marffi said:
Unfortunatley not I can't go to fastbootd. When trying do that I'm getting another error:
Click to expand...
Click to collapse
This error shouldn't be a problem, but you probably have to wait 5-10 seconds to use fastboot. You can also flash boot, vendor_boot and dtbo of any rom and use their fastbootd.
der_akinator said:
This error shouldn't be a problem, but you probably have to wait 5-10 seconds to use fastboot. You can also flash boot, vendor_boot and dtbo of any rom and use their fastbootd.
Click to expand...
Click to collapse
Do you think he could get to recovery from fastboot and factory reset?
Or from fastboot flash update payload.bin?
TheGhost1951 said:
Do you think he could get to recovery from fastboot and factory reset?
Click to expand...
Click to collapse
Yes, should work with all recoveries with "fastboot reboot recovery"
Payload has to be extracted, but after that you can flash all partitions from fastbootd.
One caveat is that MSM payload contains some partitions that are not included in OTA payload.bin
Edit:
MSM payload can be extracted with this: https://github.com/bkerler/oppo_decrypt
But I don't know if the extra MSM partitions are flashable with fastboot.
der_akinator said:
Yes, should work with all recoveries with "fastboot reboot recovery"
Payload has to be extracted, but after that you can flash all partitions from fastbootd.
One caveat is that MSM payload contains some partitions that are not included in OTA payload.bin
Click to expand...
Click to collapse
"
C:\ADB>fastboot reboot recovery
Rebooting into recovery OKAY [ 0.016s]
Finished. Total time: 0.016s
"
Phone just restart and automatically load TWRP. Nothing more.
Marffi said:
"
C:\ADB>fastboot reboot recovery
Rebooting into recovery OKAY [ 0.016s]
Finished. Total time: 0.016s
"
Phone just restart and automatically load TWRP. Nothing more.
Click to expand...
Click to collapse
Yes that's was the answer to @TheGhost1951 question.
TheGhost1951 said:
Or from fastboot flash update payload.bin?
Click to expand...
Click to collapse
"
C:\ADB>fastboot devices
8aeb0289 fastboot
C:\ADB>fastboot flash update payload.bin
error: write_sparse_skip_chunk: don't care size 4211328355 is not a multiple of the block size 4096
Sending sparse 'update' 1/7 (786428 KB) error: write_sparse_skip_chunk: don't care size 4211328355 is not a multiple of the block size 4096
error: write_sparse_skip_chunk: don't care size 4211328355 is not a multiple of the block size 4096
OKAY [ 19.952s]
Writing 'update' FAILED (remote: 'Partition not found')
fastboot: error: Command failed
"
So failed as well
What was the last MSM tool tried? Did you try the Indian MSM tool?
TMO 9PRO LAST OPTION HARDBRICKED FIX & BACK TO TMO STOCK FIX
Frist off I'm not Responsible for anything that happens to your phone!!! DO NOT FLASH UNLESS YOU TRIED EVERYTHING ELSE FIRST INDIA MSM TOOL TO FIX YOUR HARD BRICKED T-MOBILE 9PR0!!!! DO THIS AT YOUR OWEN RISK!!! DISCLAIMER: THIS WILL...
forum.xda-developers.com

Categories

Resources