QPST/QFIL could be the answer to all of our issues - Nexus 6P General

TL;DR - This program is essentially like sbf/odin/and other such tools. Almost..
QPST/QFIL is a flashing tool for qualcomm devices. It can be used to flash the eMMC of our device.
This means that it can fix any software brick.
The only thing is, I can't seem to find the necessary files to flash.
HERE @tenfar started to do a bit of research on the topic.
Let's get this ball rolling and use the tool that Huawei uses! No more RMA's! (Hopefully)
QPST
engineer radioDon't flash unless you know what you're doing. It will disable radio
How this could potentially be used
EDIT: According to the pdf, the angler is supported in this release of BoardDiag! http://www.mylgphones.com/download-boarddiag-v2-99a.html
http://www.modaco.com/forums/topic/348787-guide-how-to-modify-your-partitions/
Solder emmc

---

I'm attempting to do a full eMMC backup now with
Code:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/emulated/0/backup.img bs=512 count=30535646

---

tr4nqui1i7y said:
I'm attempting to do a full eMMC backup now with
Code:
adb shell
su
dd if=/dev/block/mmcblk0 of=/storage/emulated/0/backup.img bs=512 count=30535646
Click to expand...
Click to collapse
I have the backup.img. Going to try to decompile and see if it's actually any help.

---

Anyone know where to find the version of this for our device? 'prog_emmc_firehose_8936.mbn'
Our flash programmer file won't be firehose, afaik. still figuring this all out.

---

I've got a long night ahead of me Going to try to get the necessary files another way. Running the adb command yeilded corrupt imgs twice. Since it took about an hour each time, I'll have to find another way.

---

@Jammol want to get in on this?

---

Maybe we can find something like this for our device?
EDIT: Maybe there is a way to run fsck.repair against a usb device?
EDIT: Maybe I'll just try to change the physical eMMC at this point Like This
EDIT: But then we'd need to repartition memory Similar to this

---

In the process of making this over
Code:
partition_entries=14
partition_name=PrimaryGPT
start_block=0x0
file_name=PrimaryGPT.mbn
file_size=524288
partition_name=sbl1
start_block=0x20400
file_name=sbl1.mbn
file_size=524288
partition_name=rpm
start_block=0x20C00
file_name=rpm.mbn
file_size=524288
partition_name=tz
start_block=0x21000
file_name=tz.mbn
file_size=524288
partition_name=sdi
start_block=0x21400
file_name=sdi.mbn
file_size=524288
partition_name=aboot
start_block=0x21800
file_name=aboot.mbn
file_size=524288
partition_name=sbl1b
start_block=0x22C00
file_name=sbl1b.mbn
file_size=524288
partition_name=tzb
start_block=0x23400
file_name=tzb.mbn
file_size=524288
partition_name=rpmb
start_block=0x23800
file_name=rpmb.mbn
file_size=524288
partition_name=abootb
start_block=0x23C00
file_name=abootb.mbn
file_size=524288
partition_name=imgdata
start_block=0x37400
file_name=imgdata.mbn
file_size=1572864
partition_name=laf
start_block=0x38C00
file_name=laf.mbn
file_size=13631488
partition_name=boot
start_block=0x43C00
file_name=boot.mbn
file_size=8912896
partition_name=BackupGPT
start_block=0x3A3DC00
file_name=BackupGPT.mbn
file_size=524288
Using this INFO

---

@bitdomo gave thorough instructions here
OP updated.
I want to make a little comment about this boarddiag tool, and how it works.
Emmc test:
Erase: erase the whole emmc. Even if you select a partition from the dropdown menu,
Read only: Only reads random blocks from the emmc. If you check DUMP it will read back the amount of blocks of a the chosen partition given in the partition.txt
Write only: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition).
Read/Write: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition) and then verify them by reading it back
SDRAM test:
I think this test the memory. There is a Level option for it. I dont know what is the differance between the two.
PIMC ON:
No idea, but in some LG documentations it is for only APQ8064 chipset.
Restore boot img:
Restores the images.
How it know which partitions have to be restored?
There is a rawprogram0.xml in model\Nexus5 (MSM8974_HammerHead)\boot_partition_info folder.
The partitions declared here will be flashed to the device if you select nothing in the partititon dropdown menu or in the restore boot img dropdown menu
Boarddiag only cares about the "label" value (have to be tha same as in partition.txt) from rawprogram0.xml. The rest info like startblock, files size and file name will be acquired from the partition.txt.
Partition.txt is a binary file:
0x00-0x03: start block
0x04-0x07: file size in block numbers ( 1 block = 512 byte)
0x08-0x0F: always zero
0x10-0x2F: partition name (must be the same as the label value in rawprogram0.xml)
0x30-0x4F: file name
and the pattern goes on.
I wrote a little program which converts this binary partition.txt to an actual txt. You can get it from here
Copy the partition.txt to the same folder where the bin2txt and txt2bin exes are. Run bin2txt then it will create a readable_partition.txt file. Edit it with notepad++. The start block is in HEX and the file size is in bytes (must be multiple of 512). Partition entries is the number of partition declared in the partition.txt. If you done with the editing then run txt2bin and it will create a new_partition.txt file.
Click to expand...
Click to collapse

---

tr4nqui1i7y said:
@Jammol want to get in on this?
Click to expand...
Click to collapse
What's the current setup of your device? Meaning locked stock or unlocked?
I haven't messed with partitions that deep since the Lg Pro I think that's the same as the Nexus 4 but blocky.
I'll get my desktop setup today after work. Been using my work work laptop for adb (probably shouldn't).
Sent from my LG G4 using Tapatalk

---

@jimbridgman you enjoy working this deep don't you?
Sent from my Nexus 6P using XDA-Developers mobile app

---

Jammol said:
What's the current setup of your device? Meaning locked stock or unlocked?
I haven't messed with partitions that deep since the Lg Pro I think that's the same as the Nexus 4 but blocky.
I'll get my desktop setup today after work. Been using my work work laptop for adb (probably shouldn't).
Sent from my LG G4 using Tapatalk
Click to expand...
Click to collapse
I have two:
unlocked/rooted/rom'd
unlocked/corrupt eMMC
I see you posted with a G4, is your 6P bootlooped again/still?

---

My device is currently stuck in RELINK HS-USB QDLoader 9008 according to device manager.
I've tried miflash, qfil, and boarddiag.
Unfortunately they all require a programmer file, which I have no clue as to where we can get that package of files (programmer file, build.xml, and patch.xml)

---

I won't be rolling up my sleeves on this, as I've already been down the rabbit hole on this one. But, I will lend a hand. You might have better luck using this version. Also, here's the latest qd loader driver. Good luck.

---

kibmikey1 said:
I won't be rolling up my sleeves on this, as I've already been down the rabbit hole on this one. But, I will lend a hand. You might have better luck using this version. Also, here's the latest qd loader driver. Good luck.
Click to expand...
Click to collapse
Would happen to have any clues on how to find the files necessary for qfil on our device?

---

tr4nqui1i7y said:
Would happen to have any clues on how to find the files necessary for qfil on our device?
Click to expand...
Click to collapse
Normally those are taken from a backup from the system you're modifying. But if you don't have one, you need to either extract the defaults from a master (like a factory image or unpackaged full ota) or someone can extract the necessary files you need from their own backup and send them to you.

---

kibmikey1 said:
Normally those are taken from a backup from the system you're modifying. But if you don't have one, you need to either extract the defaults from a master (like a factory image or unpackaged full ota) or someone can extract the necessary files you need from their own backup and send them to you.
Click to expand...
Click to collapse
When I checked out the factory images I didn't see any mbn or xml files. Any chance you'd lend a hand? Checked the ota and didn't seem to find the right files either.
Maybe I just overlooked them.
Both can be found on g.co/ABH

---

tr4nqui1i7y said:
When I checked out the factory images I didn't see any mbn or xml files. Any chance you'd lend a hand? Checked the ota and didn't seem to find the right files either.
Maybe I just overlooked them.
Both can be found on g.co/ABH
Click to expand...
Click to collapse
You could try using cygwin to decompile the images, but I'm not sure if they're encrypted or not. If they are (and they probably are...) that would be no help. Another option would be to compile Android through llvm using this. It would give you the advantage of having it decompiled to the levels you need before encryption (mbn and xml files). You'll have to make the programmer file yourself. I'll give an example, using an 8660 from a Nexus 5. 8660_msimage.mbn is released in SW by default, actually, it includes the all the boot images and partition table there. MPRG8660.hex would download this image and reset to mass-storage mode.
1. Have the QPST 2.7.366 or higher version installed.
2. Make a local folder, copy sbl1/sbl2/sbl3/rpm/tz images to this folder.
3. copy the emmcswdownload.exe from C:\Program Files\Qualcomm\QPST\bin to this folder.
4. Prepare the partition_boot.xml as below and copy the partition_boot.xml to the same folder as above.
<?xml version="1.0"?>
<image>
<physical_partition number="0">
<primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">
<file name="sbl1.mbn" offset="0"/>
</primary>
<primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">
<file name="sbl2.mbn" offset="0"/>
</primary>
<primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">
<file name="sbl3.mbn" offset="0"/>
</primary>
<primary order="4" type="5" bootable="false" label="EXT" size="1000000">
<extended order="1" type="47" label="RPM" size="1000" readonly="false">
<file name="rpm.mbn" offset="0"/>
</extended>
<extended order="2" type="46" label="TZ" size="1000" readonly="false">
<file name="tz.mbn" offset="0"/>
</extended>
</primary>
</physical_partition>
</image>
5. Run the emmcswdownload.exe tool to create OEM boot image with a command below.
emmcswdownload.exe -f 8660_msimage.mbn -x partition_boot.xml -s 1G -g 4M
6. The 8660_msimage.mbn will be generated in the folder.
Again, it's just an example of building one, and it's using an older model, but I think you get it. Aside from that, the only other thing I can think for you would be to use the files Qualcomm's board support package (Dragonboard 810), which would come with purchasing it with an entire new motherboard, which is the equivalent of rma'ing it anyway. This would be me rolling my sleeves back down for tonight. Let me know how it goes!

---

kibmikey1 said:
You could try using cygwin to decompile the images, but I'm not sure if they're encrypted or not. If they are (and they probably are...) that would be no help. Another option would be to compile Android through llvm using this. It would give you the advantage of having it decompiled to the levels you need before encryption (mbn and xml files). You'll have to make the programmer file yourself. I'll give an example, using an 8660 from a Nexus 5. 8660_msimage.mbn is released in SW by default, actually, it includes the all the boot images and partition table there. MPRG8660.hex would download this image and reset to mass-storage mode.
1. Have the QPST 2.7.366 or higher version installed.
2. Make a local folder, copy sbl1/sbl2/sbl3/rpm/tz images to this folder.
3. copy the emmcswdownload.exe from C:\Program Files\Qualcomm\QPST\bin to this folder.
4. Prepare the partition_boot.xml as below and copy the partition_boot.xml to the same folder as above.
<?xml version="1.0"?>
<image>
<physical_partition number="0">
<primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">
<file name="sbl1.mbn" offset="0"/>
</primary>
<primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">
<file name="sbl2.mbn" offset="0"/>
</primary>
<primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">
<file name="sbl3.mbn" offset="0"/>
</primary>
<primary order="4" type="5" bootable="false" label="EXT" size="1000000">
<extended order="1" type="47" label="RPM" size="1000" readonly="false">
<file name="rpm.mbn" offset="0"/>
</extended>
<extended order="2" type="46" label="TZ" size="1000" readonly="false">
<file name="tz.mbn" offset="0"/>
</extended>
</primary>
</physical_partition>
</image>
5. Run the emmcswdownload.exe tool to create OEM boot image with a command below.
emmcswdownload.exe -f 8660_msimage.mbn -x partition_boot.xml -s 1G -g 4M
6. The 8660_msimage.mbn will be generated in the folder.
Again, it's just an example of building one, and it's using an older model, but I think you get it. Aside from that, the only other thing I can think for you would be to use the files Qualcomm's board support package (Dragonboard 810), which would come with purchasing it with an entire new motherboard, which is the equivalent of rma'ing it anyway. This would be me rolling my sleeves back down for tonight. Let me know how it goes!
Click to expand...
Click to collapse
What about making the xml files?

---

tr4nqui1i7y said:
What about making the xml files?
Click to expand...
Click to collapse
You can build xml files in eclipse. The Android NDK/SDK provided should have the template there to use.