Related
I am exploring two approaches for phone recovery
#1 compile rom using kernel source from the MFG (The MFG gave me the FTP download info but my device wasn't in the FTP folder. Long story short, the MFG software team is
"working on getting the files for me" That was a few days ago.... We'll see what happens.)
#2 Use MPRG and msimage files along with flashing program and raw image files from the phone for recovery.
All my research says that two files are needed to unbrick your Qualcomm device
#1 MPRGxxx.mbn/hex
#2 xxxx_msimage.mbn
(where xxxx is the Qualcomm chipset)
I know the msimage file is unique to the device because of partition structure for each manufacturer and therefore you'd need to create the file using QPST.
From reading here it appears that the MPRG file is defined as RAM
http://www.androidbrick.com/unbrick...-you-have-the-right-kind-of-rom-qhsusb_dload/
Would this file (MPRGxxxx.mbn) be universal among all devices that use the same chipset? Can someone give a yes or no and why? Thanks!
hmm, sam problem with me.
i just flash my phone yesterday ( redmi note 3 sd) and i had bootloop my phone, i tried many method, but its say, that the bootloader is locked and i cant flash the phone, then i found " tool studio" emmc download. i'm missing those mprgxxxx.mbn .. . i try to figure out how to build these file too
Mprgxxxx.mbn and xxxx_msimage.mbn for MSM 8953
Ok
Obi Anointed said:
Mprgxxxx.mbn and xxxx_msimage.mbn for MSM 8953
Click to expand...
Click to collapse
Help me please
As far as i know, someone in a china forum said that he had unlocked the F600S' bootloader successfully.
He first flashed a pre-rooted 5.0 TOT and change the build.prop to h901. Then, he flashed h901 6.0 kdz to his phone and the bootloader became h901 version.
Therefore, he could unlock the bootloader simply by entering "fastboot oem unlock", flashing H901's recovery and rooted the phone.
Some users said this method works but some said didn't and even bricked their phones into "Qualcomm HS-USB QDLoader 9008" mode.
I open this thread for raising attention and investigate whether this method really works or not, but please, DO NOT intend to perform this method unless it was proved to be safe.
If you can read Chinese, here is the source (please remove this link if it violates xda's rules):
http://bbs.gfan.com/android-8325666-1-1.html
i recommend, don't... unless u needed to do that then go
I was attempting something like this awhile back. But I wasn't using the normal build.prop. There is one hiding in /cust/open_com_ds/cust_open_hk.prop that I assumed was what the LGUP program used to check vs the one in /system but apparently I was mistaken. Theoretically there isn't anything hardware wise different between the H901 and the H961N besides the dual sim. Those that don't use dual sim might try this. Otherwise I would wait. If there are any people out there that can make kdz's then all it takes is one person to do it right then everyone else can benefit. I might go ahead and try for shizas and googles.
DarkestSpawn said:
I was attempting something like this awhile back. But I wasn't using the normal build.prop. There is one hiding in /cust/open_com_ds/cust_open_hk.prop that I assumed was what the LGUP program used to check vs the one in /system but apparently I was mistaken. Theoretically there isn't anything hardware wise different between the H901 and the H961N besides the dual sim. Those that don't use dual sim might try this. Otherwise I would wait. If there are any people out there that can make kdz's then all it takes is one person to do it right then everyone else can benefit. I might go ahead and try for shizas and googles.
Click to expand...
Click to collapse
Thanks for your reply. According to the source, those people changed their build.prop as below in order to flash h901's kdz:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
By the way, as a H961N user, I also wonder that whether it works on dual sim model. Can we flash the modem and related apps separately in order to make dual sim working if bootloader has unlocked?
If memory serves correctly, Yes with an unlocked bootloader you could adb flash modem *BLAHBLAHBLAH* but idk how that works with dual sim phones.
I honestly get aggravated when I see certain users that say they make TOT or KDZ files when really they took it from other sites that aren't English and say they made it. If that was the case they would make a KDZ with stock everything for the device its for but replace the bootloader to the version from H901 and every LG v10 would be bootloader unlockable but somehow they are too busy or working on other TOTs and kdzs... Assinine lies. Sorry had to throw my two cents out there.
I'm so glad I didn't do this attempt yet. Just remembered I gave my backup phone away so I have nothing to fall back on if this fails. If no one tries this before I get it back I will try.
DarkestSpawn said:
I was attempting something like this awhile back. But I wasn't using the normal build.prop. There is one hiding in /cust/open_com_ds/cust_open_hk.prop that I assumed was what the LGUP program used to check vs the one in /system but apparently I was mistaken. Theoretically there isn't anything hardware wise different between the H901 and the H961N besides the dual sim. Those that don't use dual sim might try this. Otherwise I would wait. If there are any people out there that can make kdz's then all it takes is one person to do it right then everyone else can benefit. I might go ahead and try for shizas and googles.
Click to expand...
Click to collapse
Even though many of the pieces are the same, there could well be some fairly significant differences hardware-wise between the H901 and H961N. The two that I know are really close are the H961N (Hong Kong) and H962, if the kernel sources are identical then there isn't much difference between the two.
On the flip side though, there could be enough similarity to flash the H901's bootloader onto another device. The bootloader wouldn't need to worry about how any of the radio bits work, just avoid touching them.
DarkestSpawn said:
I'm so glad I didn't do this attempt yet. Just remembered I gave my backup phone away so I have nothing to fall back on if this fails. If no one tries this before I get it back I will try.
Click to expand...
Click to collapse
Please do report if you do this. Anyone else out there who is reading, we'd love to hear from you if you try this. While I hope you succeed, failure could well occur. Could you report what device you're thinking of trying this on?
There is a tool from Qualcomm which can allow you to write to the flash before the device boots. If your try fails, that tool could be used to write back what is "supposed" to be there and hopefully you won't have a complete brick. A simpler solution might be to use that tool to simply overwrite your device's bootloader with the H901 bootloader. Note there are 2 copies of the bootloader on the H962 and likely other devices and you'd need to get both. I imagine there are several, but here is one tool for extracting the KDZ files (my goal is to be able to construct modified KDZ files, but I haven't analyzed things enough yet, will likely take some time).
EDIT: What look to be the bootloader areas in the H901, H961N and H962 KDZ files appear to be at the same offsets and the same sizes. I cannot be certain, but this might very well be a workable strategy.
EDIT2: If someone does this, it may be helpful to know which H901BK firmware version you use. The known KDZ file is for 20c, so it may be handy to keep links to that. Once you've done the process, it would be helpful for you to dump copies of all the block devices on the phone. Knowing which one(s) have changed could lead us to how LG's bootloader marks a device as unlocked, leading to easier methods of unlocking (hmm, really need a binary diff utility).
emdroidle said:
Even though many of the pieces are the same, there could well be some fairly significant differences hardware-wise between the H901 and H961N. The two that I know are really close are the H961N (Hong Kong) and H962, if the kernel sources are identical then there isn't much difference between the two.
On the flip side though, there could be enough similarity to flash the H901's bootloader onto another device. The bootloader wouldn't need to worry about how any of the radio bits work, just avoid touching them.
Please do report if you do this. Anyone else out there who is reading, we'd love to hear from you if you try this. While I hope you succeed, failure could well occur. Could you report what device you're thinking of trying this on?
There is a tool from Qualcomm which can allow you to write to the flash before the device boots. If your try fails, that tool could be used to write back what is "supposed" to be there and hopefully you won't have a complete brick. A simpler solution might be to use that tool to simply overwrite your device's bootloader with the H901 bootloader. Note there are 2 copies of the bootloader on the H962 and likely other devices and you'd need to get both. I imagine there are several, but here is one tool for extracting the KDZ files (my goal is to be able to construct modified KDZ files, but I haven't analyzed things enough yet, will likely take some time).
EDIT: What look to be the bootloader areas in the H901, H961N and H962 KDZ files appear to be at the same offsets and the same sizes. I cannot be certain, but this might very well be a workable strategy.
EDIT2: If someone does this, it may be helpful to know which H901BK firmware version you use. The known KDZ file is for 20c, so it may be handy to keep links to that. Once you've done the process, it would be helpful for you to dump copies of all the block devices on the phone. Knowing which one(s) have changed could lead us to how LG's bootloader marks a device as unlocked, leading to easier methods of unlocking (hmm, really need a binary diff utility).
Click to expand...
Click to collapse
I think the only worry of trying this method is a complete hard brick. As you have mentioned, any qualcomm phone has a recovery mode and i guess it should be the "Qualcomm HS-USB QDLoader 9008" mode.
I have searched some information and turn out there are two 9008 mode. It depends on whether the phone messed with Qualcomm’s stuffs, if not, then the phone will enter the "new 9008 mode" and it can let you recover the phone easily by a backup emmc image. If it is, then the phone will enter the "old 9008 mode" and it required specific files and "programmer", however, file suitable for msm8992 hasn't been discovered. Therefore, if this method brick the phone into old 9008 mode, no solution at all.
The information i have refered to, don't know if it is correct:
http://www.droidsavvy.com/unbrick-qualcomm-mobiles/
EDIT: The ro.expect.recovery_id should be "0x9260d50f08bef4a761309001fe20e5ab59508e78000000000000000000000000" (if you try it, double check by yourself)
some people said that they bricked the phone because of typing it incorrectly, but i don't know whether it is true or not
I have asked the people who bricked their phones from trying this method. It seems that they really made a typo on ro.expect.recovery_id and cause brick.
Also, i am pretty sure that those phones have gotten into the "old 9008 mode", therefore, "rawprogram0.xml, patch0.xml and prog_emmc_firehose_8992.mbn" are required for using QPST the fix the hard brick.
However, no suitable prog_emmc_firehose_8992.mbn for V10 has been discovered on the internet (even for the G4).
Personally, I injected the H901 aboot into an H962 DZ and flashed it onto my device a few months ago.
Long story made short, it was completely bricked, even without 9008 mode. I recommend you guys to be cautious with this method.
Edit: As I can understand Chinese, I'm currently looking into the tutorial.
ivangundampc said:
I think the only worry of trying this method is a complete hard brick. As you have mentioned, any qualcomm phone has a recovery mode and i guess it should be the "Qualcomm HS-USB QDLoader 9008" mode.
I have searched some information and turn out there are two 9008 mode. It depends on whether the phone messed with Qualcomm’s stuffs, if not, then the phone will enter the "new 9008 mode" and it can let you recover the phone easily by a backup emmc image. If it is, then the phone will enter the "old 9008 mode" and it required specific files and "programmer", however, file suitable for msm8992 hasn't been discovered. Therefore, if this method brick the phone into old 9008 mode, no solution at all.
The information i have refered to, don't know if it is correct:
http://www.droidsavvy.com/unbrick-qualcomm-mobiles/
Click to expand...
Click to collapse
Useful, though I cannot speak to the reliability of that information. A different source has a tool they say comes from Qualcomm, which may be more reliable with newer devices. Please note, this is a source of claims, I don't know how reliable they are (they also don't provide much detail on the limits of the tool).
WillyPillow said:
Personally, I injected the H901 aboot into an H962 DZ and flashed it onto my device a few months ago.
Long story made short, it was completely bricked, even without 9008 mode. I recommend you guys to be cautious with this method.
Edit: As I can understand Chinese, I'm currently looking into the tutorial.
Click to expand...
Click to collapse
I look forward to more detail/reports from that tutorial. Exact details would be invaluable.
I hoped that would work, but I feared the above possibility. The problem is which portions of the flash image sign which other portions of the image, and how many different keys does LG use? Your observation seems to suggest either the key used for signing the H901 aboot was not honored by the rest of the H962 firmware, or the key used for signing the H962 kernel wasn't honored by the non-unlocked H901 aboot (or both).
If the former case, then which are the pieces prior to aboot and can only those pieces be transplanted from a H901 while still preserving the dual-SIM functionality of the H962 (and H961N)? If the latter case, then I suspect you merely need to run a H901 kernel long enough to unlock the bootloader, then you can put back the H962 kernel and run that with the unlocked bootloader.
The other question is, which portions of the data unlock the bootloader? Is it a small change to the aboot portion? Is it changes elsewhere? Can those changes be isolated from the rest of the H901 firmware?
Just in case you didn't notice, I've got lots of questions. I hope I can figure out answers to some, but others I may not be able to answer. I'm currently targeting the kdztools portion.
@emdroidle
TBH I don't see anything not mentioned already. Basically the process is just
Flash 5.1 rooted -> modify build.prop -> flash H901 KDZ
Personally, I'm not going to do more risky experiments since I already RMA'd my last hard brick
Also, you might want to use IDA to take a look at aboot, which is basically an ELF binary. I had been doing that, but stopped after the brick.
WillyPillow said:
@emdroidle
TBH I don't see anything not mentioned already. Basically the process is just
Flash 5.1 rooted -> modify build.prop -> flash H901 KDZ
Personally, I'm not going to do more risky experiments since I already RMA'd my last hard brick
Also, you might want to use IDA to take a look at aboot, which is basically an ELF binary. I had been doing that, but stopped after the brick.
Click to expand...
Click to collapse
I understand. You're in a better position since LG will honor the warranty on your H962. They're a bit tougher if you get one outside Taiwan.
I was fearing we would have to take that approach. Worse, it looks like the firmware updates change aboot, which suggests settling on one version and trying to crack that is best. I wanted to try Plasma, but IDA is likely far enough ahead to beat Plasma. I'm just glad IDA has a Linux version.
WillyPillow said:
Personally, I injected the H901 aboot into an H962 DZ and flashed it onto my device a few months ago.
Long story made short, it was completely bricked, even without 9008 mode. I recommend you guys to be cautious with this method.
Click to expand...
Click to collapse
After some thought, I realized I should ask for some detail about the failed process you used for this. Did you flash both the aboot and abootbak slices? (/dev/mmcblock0p9 and /dev/mmcblock0p15 if I recall correctly)
If you flashed only aboot and ended up bricked, this seems to suggest it did in fact successfully execute the H901BK aboot, but the aboot decided the signature on boot was incorrect and halted. In this scenario if the portion before aboot had decided aboot had a bad signature, then it should have restored abootbak, which likely would have successfully booted the H962 kernel.
If you flashed both aboot and abootbak, this suggests the portion before aboot decided aboot's signature was wrong and it halted there. This doesn't rule out it successfully executing aboot and aboot deciding boot had the wrong signature, but it makes that less likely.
Hate to say it, but flashing only aboot doesn't really give us much information on the likelihood of flashing a full H901BK image onto a H962 being successful or not. The problem is there could be signatures in many places and any one of those could fail yet reproducing the original scenario would work perfectly.
emdroidle said:
After some thought, I realized I should ask for some detail about the failed process you used for this. Did you flash both the aboot and abootbak slices? (/dev/mmcblock0p9 and /dev/mmcblock0p15 if I recall correctly)
If you flashed only aboot and ended up bricked, this seems to suggest it did in fact successfully execute the H901BK aboot, but the aboot decided the signature on boot was incorrect and halted. In this scenario if the portion before aboot had decided aboot had a bad signature, then it should have restored abootbak, which likely would have successfully booted the H962 kernel.
If you flashed both aboot and abootbak, this suggests the portion before aboot decided aboot's signature was wrong and it halted there. This doesn't rule out it successfully executing aboot and aboot deciding boot had the wrong signature, but it makes that less likely.
Hate to say it, but flashing only aboot doesn't really give us much information on the likelihood of flashing a full H901BK image onto a H962 being successful or not. The problem is there could be signatures in many places and any one of those could fail yet reproducing the original scenario would work perfectly.
Click to expand...
Click to collapse
Hmm, I've never thought this deep. I was just like "Sxxt, my phone bricked! Must be a bad signature somwhere..." and stopped messing around with it
To answer your question, I only flashed aboot, without anything else. And for the details of the brick, you can't even see the "powered by Android" bootloader screen. The device just viberates if you want to turn it on. The only way to make the screen display something is remove the battery and connect it to a computer, for which a "no battery" icon is showed. So my guess then was the aboot signature was invalidated. But now you reminded me the existance of abootbak...
I'll do some research and thinking right now
WillyPillow said:
Hmm, I've never thought this deep. I was just like "Sxxt, my phone bricked! Must be a bad signature somwhere..." and stopped messing around with it
To answer your question, I only flashed aboot, without anything else. And for the details of the brick, you can't even see the "powered by Android" bootloader screen. The device just viberates if you want to turn it on. The only way to make the screen display something is remove the battery and connect it to a computer, for which a "no battery" icon is showed. So my guess then was the aboot signature was invalidated. But now you reminded me the existance of abootbak...
I'll do some research and thinking right now
Click to expand...
Click to collapse
Well, i think that you have bricked your phone into the "Qualcomm HS-USB QDLoader 9008" mode
The phone should be able to fix if you can see "Qualcomm MMC Storage USB Device" in "Devices Manager" when the phone is connecting to the computer.
WillyPillow said:
Hmm, I've never thought this deep. I was just like "Sxxt, my phone bricked! Must be a bad signature somwhere..." and stopped messing around with it
Click to expand...
Click to collapse
I was thinking about it, since I would very much like to somehow unlock the bootloader. While this way may or may not be tweaked to work, it does sound plausible. Analyzing failures can be very valuable.
WillyPillow said:
To answer your question, I only flashed aboot, without anything else. And for the details of the brick, you can't even see the "powered by Android" bootloader screen. The device just viberates if you want to turn it on. The only way to make the screen display something is remove the battery and connect it to a computer, for which a "no battery" icon is showed. So my guess then was the aboot signature was invalidated. But now you reminded me the existance of abootbak...
Click to expand...
Click to collapse
So this may suggest aboot successfully executed, but found a mismatched signature and halted. At which point, flashing the H901BK aboot and boot may be enough to make this work. This may though also require the H901BK recovery image. I do not know where the unlock process actually does its magic, so part of it could be in recovery.
I'd love to hear if you can get it to be successful.
Two threads relevant to this topic have shown up.
First, apparently someone somehow managed to accidentally flash a H901 firmware onto a H960A. That person was looking for help with restoring their device, but it leaves me hopeful this method could in fact work on other devices. Most likely you'd end up with a mix of some portions of the flash being copied from a H901 and some from whatever your phone is normally supposed to run, but this does confirm it is possible to run H901 firmware on other devices.
Second, a method has been found to recover devices from Qualcomm 9008 mode. This is big news since it greatly lessens the danger of a bad flash. Problem is it requires root on the phone to generate the initial image, though I suspect the images produced by my kdztools may well work for the job too.
I very much want to unlock the bootloader of my device, so I'm still doing research trying to estimate how plausible this method is. At this point there are enough reports of wrong V10 device images not being fatal to other V10-type devices for me to consider this method "likely".
Examining KDZ files for several devices, there is quite a bit of overlap between device images. There are 9 slices though which seem to warrant special attention based upon them having backup copies. These are named "sbl1", "pmic", "hyp", "tz", "rpm", "aboot", "sdi", and "raw_resources".
My guess is install a H901 image, do `fastboot oem unlock` and then you can copy everything aside these slices from your original device. My concern is these may need to remain the H901 versions in order to remain unlocked (unless all V10 devices share the unlock method, which may or may not be the case).
It may also work to use my KDZ Tools to copy the PrimaryGPT and BackupGPT areas from the target device onto a H901 image, at which point the process could be done without even needing a factory reset!
I'm pretty sure "sbl1"/"sbl1bak" are the first-stage bootloader. All the others aside from "raw_resources" look to be ELF executables.
Open request to Qualcomm here, could you please make your chips either alternate between trying to boot off of "sbl1" and "sbl1bak" (a single MRAM or PCRAM cell should take too much space, should it?), or else make them randomly choose between booting off them upon power-on? Too often one or the other gets corrupted in such a way that booting fails, but either isn't so corrupt to trigger them to try the backup, or else the primary is so badly damaged it is unable to try the backup. Alternating (and passing to the Linux kernel which one it successfully booted off of!) would greatly increase the chances of successful recovery without specialized tools.
Wiki + Likelyhood evaluation
Having examined the situation enough, I'm pretty sure this method should work. Experimentation though is risky.
I'm now working on creating 2 software tools for this project. One is a simple tool to remark the device a KDZ is for. This is pretty simple and the reports are, once this is done LGUP will happily flash a KDZ onto other devices. The second goal is a tool for modifying the GPT afterwords. While the H901 has a GPT similar to other V10s, it isn't quite identical. Of major note, many other devices have a /cust partition which has some extra software.
These two tools may actually be unnecessary. My KDZ Tools expose all of the data in an inconvenient, but workable format. The KDZ Tools can also be used to replace the GPT for the H901 with a GPT from another device, and they also expose the areas which mark which device a KDZ is for. Problem with using the KDZ Tools for this is there is what looks to be an extra checksum, and I've got no idea whether it covers the GPT (I hope not, but...).
I'm now looking to create the above two tools on GitHub, the LGE Tools. Alas, what may be more valuable is the Wiki on GitHub. I've got speculative instructions a little ways from the top. Towards the bottom I've got a list of which areas you'd need to restore from your original device. I guess I'm a bit unsure of "persist", the content is identical for my device, but the differing timestamps might trigger a flag that something has happened.
Hopefully we can get some testers who can risk needing to RMA their devices (I hope they don't need to, but this IS risky).
emdroidle said:
Having examined the situation enough, I'm pretty sure this method should work. Experimentation though is risky.
I'm now working on creating 2 software tools for this project. One is a simple tool to remark the device a KDZ is for. This is pretty simple and the reports are, once this is done LGUP will happily flash a KDZ onto other devices. The second goal is a tool for modifying the GPT afterwords. While the H901 has a GPT similar to other V10s, it isn't quite identical. Of major note, many other devices have a /cust partition which has some extra software.
These two tools may actually be unnecessary. My KDZ Tools expose all of the data in an inconvenient, but workable format. The KDZ Tools can also be used to replace the GPT for the H901 with a GPT from another device, and they also expose the areas which mark which device a KDZ is for. Problem with using the KDZ Tools for this is there is what looks to be an extra checksum, and I've got no idea whether it covers the GPT (I hope not, but...).
I'm now looking to create the above two tools on GitHub, the LGE Tools. Alas, what may be more valuable is the Wiki on GitHub. I've got speculative instructions a little ways from the top. Towards the bottom I've got a list of which areas you'd need to restore from your original device. I guess I'm a bit unsure of "persist", the content is identical for my device, but the differing timestamps might trigger a flag that something has happened.
Hopefully we can get some testers who can risk needing to RMA their devices (I hope they don't need to, but this IS risky).
Click to expand...
Click to collapse
Wow, i am very surprised that you are still working on this method! You have really paid a lot of effort on it!
After taking a look on your works, i really think that this method may really works to help us to unlock the bootloader.
In fact, the T-Mobile variant of both G5 and V20 have bootloader unlocked and so other version of G5 and V20 may also be able to unlock their booloader through a method like this, therefore, I think we should be able to draw more attention (more devs?) on studying this method.
Hey guys,
So thanks to this thread : https://forum.xda-developers.com/pixel-2-xl/how-to/guide-qxdm-port-activation-pixel-2-xl-t3884967
I got my com ports open (see attached photo)
I cant however get past the part about pdc , as pdc gives me "QMI connection not ready, please use USB driver version 1.00.32 or later and fix the connection before using PDC tool."
I'm not sure how to go about fixing this but if we can, then there is the possibility that we could enable voLTE/voWIFI on the pixel 3 with carriers who don't support it(such as bouygues, who supports voLTE but not anything else)
I'm wondering if it is the qpst version I am using or something else?
I am on windows 7 and also had to disable driver signature enforcement.
Hello!
Did you achieve progress in this issue after the publication of the message?
Any success?? I have this damn same issue on my Redmi 4x...
Has anyone figured out the correct drivers yet?
Ingenium13 said:
Has anyone figured out the correct drivers yet?
Click to expand...
Click to collapse
Check this method! Hope this helps.
crok.bic said:
Check this method! Hope this helps.
Click to expand...
Click to collapse
He already mentioned in his last line that he is using windows 7 and also disabled driver signature enforcement.
can you tell me steps for enable QPST on pixel 3
Xdevillived666 said:
Hey guys,
So thanks to this thread : https://forum.xda-developers.com/pixel-2-xl/how-to/guide-qxdm-port-activation-pixel-2-xl-t3884967
I got my com ports open (see attached photo)
I cant however get past the part about pdc , as pdc gives me "QMI connection not ready, please use USB driver version 1.00.32 or later and fix the connection before using PDC tool."
I'm not sure how to go about fixing this but if we can, then there is the possibility that we could enable voLTE/voWIFI on the pixel 3 with carriers who don't support it(such as bouygues, who supports voLTE but not anything else)
I'm wondering if it is the qpst version I am using or something else?
I am on windows 7 and also had to disable driver signature enforcement.
Click to expand...
Click to collapse
can you tell me steps for enable QPST on pixel i am unable to open port on my pixel
Gautamgzb2 said:
can you tell me steps for enable QPST on pixel i am unable to open port on my pixel
Click to expand...
Click to collapse
Hey. I honestly dont remember now. Its been a long time and it was a lot of trial and error by reading that thread I linked. In the end it was useless because A-google no longer provides images for debugging purposes and B-PDC tool doesnt recognize pixel 3 even after opening the ports. Sorry man.
i hve enabled diag port fully edited values in qxdm took ota updates but upon re locking bootloader pixel 3 resets every change i made what the hell how can factory reset revert nvram changes.
"QPST" stands for "Qualcomm Product Support Tool". It's a proprietary tool used to directly write a binary image to the NAND devices on the device. Neither QPST nor the binary images are freely available, and are generally only used during the factory process to flash the initial firmware to the device.
V0latyle said:
"QPST" stands for "Qualcomm Product Support Tool". It's a proprietary tool used to directly write a binary image to the NAND devices on the device. Neither QPST nor the binary images are freely available, and are generally only used during the factory process to flash the initial firmware to the device.
Click to expand...
Click to collapse
Hmmm, no, not true. Qpst / qfil is freely available, We've used it many times with various LG devices especially.
The binary images are freely available for many devices, here's a list of the binary images free to download for the pixel 3 (from google):
In addition, for LG devices, anyone can freely download the kdz image, which is the entire rom, and use the kdz extraction tool to retrieve any individual partition image.
Not all carriers, like at&t / sprint, don't make their kdz available, thus no access to those images, but most do.
AsItLies said:
Hmmm, no, not true. Qpst / qfil is freely available, We've used it many times with various LG devices especially.
The binary images are freely available for many devices, here's a list of the binary images free to download for the pixel 3 (from google):
In addition, for LG devices, anyone can freely download the kdz image, which is the entire rom, and use the kdz extraction tool to retrieve any individual partition image.
Not all carriers, like at&t / sprint, don't make their kdz available, thus no access to those images, but most do.
Click to expand...
Click to collapse
So QPST can be used to flash bootloader, at which point someone should be able to use adb to flash the factory images? Wouldn't someone need to know the starting/ending addresses when writing to block devices?
Is there a reputable source from which to download QPST?
V0latyle said:
So QPST can be used to flash bootloader, at which point someone should be able to use adb to flash the factory images? Wouldn't someone need to know the starting/ending addresses when writing to block devices?
Is there a reputable source from which to download QPST?
Click to expand...
Click to collapse
QPST / qfil links can be found in many places, I've found them in LG v35, v40, v50, G8 forums in guides section, usual title names include 'unlock bootloader' as qfil is used to flash the 'engineering abl' to gain fastboot.
addresses of the partitions are in the partition table of ea device. Depending on how you flash a partition you may need to know it specifically, but almost always you don't. The RawprogramX.xml has them in it if needed though.
There is one caveat, for qfil to work (or any EDL access to happen), with any device, one has to have the 'programmer firehose', which is a signed specific file, for that specific device type. Many mfgs make that file available, Google does not.
AsItLies said:
QPST / qfil links can be found in many places, I've found them in LG v35, v40, v50, G8 forums in guides section, usual title names include 'unlock bootloader' as qfil is used to flash the 'engineering abl' to gain fastboot.
addresses of the partitions are in the partition table of ea device. Depending on how you flash a partition you may need to know it specifically, but almost always you don't. The RawprogramX.xml has them in it if needed though.
There is one caveat, for qfil to work (or any EDL access to happen), with any device, one has to have the 'programmer firehose', which is a signed specific file, for that specific device type. Many mfgs make that file available, Google does not.
Click to expand...
Click to collapse
This was going to be my next question. We aren't talking about LG devices here; we're talking specifically about the Pixel 3. So if the firehose files aren't available, exactly how is QPST any good to anyone?
V0latyle said:
This was going to be my next question. We aren't talking about LG devices here; we're talking specifically about the Pixel 3. So if the firehose files aren't available, exactly how is QPST any good to anyone?
Click to expand...
Click to collapse
I know what we're talkin about here, and I know it's not LG devices. And I never said qpst was any good to anybody here, I just said that it is available, and you said it wasn't, and I said the stock images are available, and you said they weren't.
AsItLies said:
I know what we're talkin about here, and I know it's not LG devices. And I never said qpst was any good to anybody here, I just said that it is available, and you said it wasn't, and I said the stock images are available, and you said they weren't.
Click to expand...
Click to collapse
I think you misunderstand me. As I asked before, please post a legitimate and trustworthy source of QPST. According to Qualcomm, it's only available for specific commercial use.
Secondly, I was specific by what I meant by "binary images" - files to be flashed directly to the NAND devices by means of JTAG or other hardware level protocols. This would include the firehose images, although I admit I'm not sure if those are binary.
Either way, I reiterate that we are talking about the Pixel 3 here. If you know of a trustworthy source for QPST, that's a start. However, the fact remains that the files needed are not available, so what may or may not be possible with LG devices is not relevant in this thread.
V0latyle said:
I think you misunderstand me. As I asked before, please post a legitimate and trustworthy source of QPST. According to Qualcomm, it's only available for specific commercial use.
Secondly, I was specific by what I meant by "binary images" - files to be flashed directly to the NAND devices by means of JTAG or other hardware level protocols. This would include the firehose images, although I admit I'm not sure if those are binary.
Either way, I reiterate that we are talking about the Pixel 3 here. If you know of a trustworthy source for QPST, that's a start. However, the fact remains that the files needed are not available, so what may or may not be possible with LG devices is not relevant in this thread.
Click to expand...
Click to collapse
I think you misunderstood me. You indicated that QPST / qfil is not availabel, it is, I told you where to find it, put in the effort.
And what you mean by 'binary images' is obviously open to interpretation, how in the world would I (or anyone) know you mean anything other than what is available (from google), which are the binary images one would flash with qfil for that device. So again, you're wrong as they are available.
And I'll repeat again, I know we're talking about the p3 and not LG devices. You're using that as a deflection, to try to avoid that your post was obviously wrong in it's information. I bring up LG devices only because they have lots of documentation here on XDA re these utilities, while the p3 does not.
"what may or may not be possible with LG"... yer again wrong. Ea and every qualcomm device can be put in EDL mode, that's what QPST is used for, it's relevant to all devices that have a qualcomm chip.
AsItLies said:
I think you misunderstood me. You indicated that QPST / qfil is not availabel, it is, I told you where to find it, put in the effort.
Click to expand...
Click to collapse
I asked you to provide a specific source. I don't know which forums you're talking about on what site. They could be here on XDA, or Reddit, or any LG forum out there. Your response is akin to "just Google it". The only reputable source I know of is Qualcomm themselves, who, as I stated, are pretty picky about who gets access to the software. Sure, a Google search will turn up a handful of third party sites that claim to have it, but are they trustworthy?
AsItLies said:
And what you mean by 'binary images' is obviously open to interpretation
Click to expand...
Click to collapse
Not really. Binary images = files in purely binary format. Not Java, not hex - ones and zeroes, the file you would use to directly flash a memory device. I was pretty specific about that.
AsItLies said:
how in the world would I (or anyone) know you mean anything other than what is available (from google), which are the binary images one would flash with qfil for that device. So again, you're wrong as they are available.
Click to expand...
Click to collapse
Two posts ago you stated:
AsItLies said:
for qfil to work (or any EDL access to happen), with any device, one has to have the 'programmer firehose', which is a signed specific file, for that specific device type. Many mfgs make that file available, Google does not.
Click to expand...
Click to collapse
So, since no "firehouse" files are available from Google, could QPST be used to flash the partition images in the factory zips?
AsItLies said:
And I'll repeat again, I know we're talking about the p3 and not LG devices. You're using that as a deflection, to try to avoid that your post was obviously wrong in it's information. I bring up LG devices only because they have lots of documentation here on XDA re these utilities, while the p3 does not.
Click to expand...
Click to collapse
No, I'm pointing out that information on LG devices is not relevant. There might be documentation regarding the use of QPST but if the necessary files are not available, that's not much use.
AsItLies said:
"what may or may not be possible with LG"... yer again wrong. Ea and every qualcomm device can be put in EDL mode, that's what QPST is used for, it's relevant to all devices that have a qualcomm chip.
Click to expand...
Click to collapse
I'm specifically referring to the possibility of hardware level device recovery which may be possible on LG devices due to the availability of the required files, but is not currently possible on the Pixel series because we do NOT have the required files.
I'm not going to continue this argument as we are rather OT at this point. This isn't conducive to finding a solution.
XDA thrives on the willingness of users to help out everyone else - the ability and willingness to solve problems. You said there is a solution to this problem; I am asking you provide it. It doesn't matter who is right or wrong in the end; it only matters that we find a solution.
Search of the file .mbn for QPSP. For H932 - to restore bricks. Through qualcomm 9008. Or any help on getting out of the state of a brick.
B0PoH said:
Search of the file .mbn for QPSP. For H932 - to restore bricks. Through qualcomm 9008. Or any help on getting out of the state of a brick.
Click to expand...
Click to collapse
this file not exist .
you need a flashing box like octoplus... to boot the phone , take it to a repair shop.
Thanks for the answer. Is octoplus in a nutshell or how to restore using octoplus? There, too, I need the mbn file as far as I understand.
ufs8998 use .elf file
I tried to search for a long time. Finally, end with the box.
sandking707 said:
ufs8998 use .elf file
I tried to search for a long time. Finally, end with the box.
Click to expand...
Click to collapse
Thanks for the answer and not tell me where to download ??
sandking707 said:
ufs8998 use .elf file
I tried to search for a long time. Finally, end with the box.
Click to expand...
Click to collapse
B0PoH said:
Thanks for the answer and not tell me where to download ??
Click to expand...
Click to collapse
He said he never found a place to download and used Octopus box instead.
ChazzMatt said:
He said he never found a place to download and used Octopus box instead.
Click to expand...
Click to collapse
I have Octoplus, but it sews only in a Download mod. Perhaps the new version has the ability to sew flash memory. Who can flash the phone remotely on Octoplus??
B0PoH said:
I have Octoplus, but it sews only in a Download mod. Perhaps the new version has the ability to sew flash memory. Who can flash the phone remotely on Octoplus??
Click to expand...
Click to collapse
you need octopus with box not the cracked one because you must disassemble the phone and connect the cable.
Maybe someone already has a dump file from lg v30 h932 T-mobile if there is, please contact me. After searching for solutions, there were two possible solutions. The phone and port 9008 sees XiaoMiFlash but you need to correctly convert the KDZ file to XiaoMiFlash format. The second is still looking for a nbm file that can sew QPSP. Or options for converting KDZ to nmb. Who has a tutorial on flashing the phone through octoplus and connecting via cable to JTAG?
@runningnak3d is the expert. Maybe he may have some insight.
I hope you don't me mentioning you here Brian.
----Aakash
I don't know of any T-Mobile firehoses that have leaked... not just the H932, but ANY LG T-Mobile phone. Since T-Mobile uses their own RSA cert for signing, and the firehose is signed just like the firmware, there is less of a chance of it leaking.
Now with that said, if Octopus can flash an H932 in EDL mode (9008), then they got the firehose from somewhere. However, those douche nozzles encrypt the firehose, and you need one of their boxes to use it. I have contemplated buying one, and then sniffing the USB traffic to obtain the decrypted firehoses for every phone that I can get my hands on. You should never have to pay for something that they got from a leaked source.
-- Brian
B0PoH said:
Maybe someone already has a dump file from lg v30 h932 T-mobile if there is, please contact me. After searching for solutions, there were two possible solutions. The phone and port 9008 sees XiaoMiFlash but you need to correctly convert the KDZ file to XiaoMiFlash format. The second is still looking for a nbm file that can sew QPSP. Or options for converting KDZ to nmb. Who has a tutorial on flashing the phone through octoplus and connecting via cable to JTAG?[/QUOT]
How to backup dump file from working LG v30 and flash it on "9008 bricked phone". (I have two v300L phones. One is working another one is hard bricked)
Click to expand...
Click to collapse
Please upload this tool if you have it so i can fix my phone .. at this point t-mobile, metro pcs and god knows what they all were able not only to fix their phone but install the unlocked rom without the bloatware .. Honestly i don't get why OP refuses to release this .. or maybe they have but its not posted here ..
So if you bought your phone from oneplus.com and have the unbricking tool .. please upload it or tell me how you managed to fix your phone
Contact OnePlus support, and request a remote session to repair your phone.
If they set one up, they'll send you a link to download the MSMDownload Tools ahead of time.
So far everyone with unlocked version has been told to mail their phone in, rather than doing the remote session. Once someone gets the remote session, they'll be able to upload the MSMDownload Tools.
edale1 said:
Contact OnePlus support, and request a remote session to repair your phone.
If they set one up, they'll send you a link to download the MSMDownload Tools ahead of time.
So far everyone with unlocked version has been told to mail their phone in, rather than doing the remote session. Once someone gets the remote session, they'll be able to upload the MSMDownload Tools.
Click to expand...
Click to collapse
already went thru that and instead of sending my phone in chose to wait for the tool.. looks like i made a huge mistake and now is too late to send it in ... but thanks for suggesting
Also waiting for an ops for the unlocked variant - I have a theory that converts between variants without unlocking BL, but without the ops it can't be verified.
I believe One Plus is not releasing their MSM tool specifically because it could be used to convert variants to unlocked / retail. They have refused multiple board members, myself included, to utilize the tool to remotely fix broken devices.
Dimitrimem, check the unbrick thread for my instructions on how to fix phones using fastboot and a super.img or fastbootd and the OTA.
Un-bricking my Nord N200
Don't ask me why, but I tried to upload a GSI using fastboot to my N200. And that didn't work. So I then read online about other people getting the same error I had, and their fix was deleting the "product" partition and erasing the system...
forum.xda-developers.com
oCAPTCHA said:
I believe One Plus is not releasing their MSM tool specifically because it could be used to convert variants to unlocked / retail. They have refused multiple board members, myself included, to utilize the tool to remotely fix broken devices.
Dimitrimem, check the unbrick thread for my instructions on how to fix phones using fastboot and a super.img or fastbootd and the OTA.
Un-bricking my Nord N200
Don't ask me why, but I tried to upload a GSI using fastboot to my N200. And that didn't work. So I then read online about other people getting the same error I had, and their fix was deleting the "product" partition and erasing the system...
forum.xda-developers.com
Click to expand...
Click to collapse
Bootloader is locked so fastboot is not an option ..
Do you have the unlock code bin file?
If so do the following, because booting in fastboot itself will give you an error saying you cannot unlock the bootloader, you most boot into recovery, fastboot is not recovery it's considered the master recovery Incase if the Android recovery fails or you flashed the wrong file to the wrong partition.
Winnower Amber said:
Do you have the unlock code bin file?
Click to expand...
Click to collapse
I don't
You'll need to give that information. Check the box, your serial number should be on it.
Does Android recovery work?
Winnower Amber said:
You'll need to give that information. Check the box, your serial number should be on it.
Click to expand...
Click to collapse
I threw the box away .. let me see if I can find it in my mail with oneplus
Winnower Amber said:
You'll need to give that information. Check the box, your serial number should be on it.
Click to expand...
Click to collapse
The only thing I have from my mail with oneplus is the IMEI number from the form they made me fill in for the remote session only that later on they told me they don't have the files(msm) for my phone
If IMEI and serial number are the same let me know and I'll post thst here
The most you could do is get the unlock code bin. Then wait 7 days for a reply, flash your device with the TMobile msm, and then follow the TMobile to oem, that should do it.
If you need to reach me for stuff like this, I am available on discord via the xda,
Winnower Amber said:
Does Android recovery work?
Click to expand...
Click to collapse
From the screen itself. No it boots back to the error .. but I was able to get into recovery by pressing volume up and down
Winnower Amber said:
The most you could do is get the unlock code bin. Then wait 7 days for a reply, flash your device with the TMobile msm, and then follow the TMobile to oem, that should do it.
Click to expand...
Click to collapse
I have the fully paid variant.. so I don't need the unlock code... That's t-mobile.. my bootloader is locked or OEM is locked
Your phone comes preloaded with an emergency boot chip called Qualcomm download mode. Use the TMobile msm tool to flash your device back to factory, then you can essentially do what you need. To get back to oem.
I keep forgetting to quote reply I hate this lol.
Winnower Amber said:
Your phone comes preloaded with an emergency boot chip called Qualcomm download mode. Use the TMobile msm tool to flash your device back to factory, then you can essentially do what you need. To get back to oem.
Click to expand...
Click to collapse
My phone does not work with the MSM tool for TMobile... already tried that ( others already tried it so I'm not alone)