[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

Search This thread
By:
Advanced…
darkspr1te

darkspr1te

Senior Member
Sep 24, 2012
952
595
Hi All,
I've gone throught the thread last night (in between the hours of 1am and 2) , I got the jist of the thread but I have some questions.

1. One user said he got the device into the SD-CARD more, which means the device accepted the the hex which is a small loader file and then was able to write the sd-card mini arm application, is this correct?
2. you have access to a device that has root and is working ?
3. you know what type of partition your using (MBR/EBR aka dos or GPT )
4. you know for sure the cpu type (s)
5. have a large drop box to upload the files for reversing so we can figure out with parition/file is sbl1/2/3/rpm/tz etc
6.google+ account to chat in for live reversing of the files plus remote ssh acccess to a pc with device connected.

Not all of these are required but it will make it go quicker if we have as many as we can.


darkspr1te
 
  • Like
Reactions: fairsimple and mickeyasamoah
mickeyasamoah

mickeyasamoah

Senior Member
Jan 11, 2013
979
230
Accra
darkspr1te said:
Hi All,
I've gone throught the thread last night (in between the hours of 1am and 2) , I got the jist of the thread but I have some questions.

1. One user said he got the device into the SD-CARD more, which means the device accepted the the hex which is a small loader file and then was able to write the sd-card mini arm application, is this correct?
2. you have access to a device that has root and is working ?
3. you know what type of partition your using (MBR/EBR aka dos or GPT )
4. you know for sure the cpu type (s)
5. have a large drop box to upload the files for reversing so we can figure out with parition/file is sbl1/2/3/rpm/tz etc
6.google+ account to chat in for live reversing of the files plus remote ssh acccess to a pc with device connected.

Not all of these are required but it will make it go quicker if we have as many as we can.


darkspr1te
Click to expand...
Click to collapse

1. I downloaded two hex files.( first one was nammed emmcbld.hex and 7x30prg.hex). When i flash 7x30prg.hex through QPST, the device shows up as a motorola fastboot device and requests for adb drivers but this resets to QHSUSB_DLOAD when i do a battery pull or try to flash a file using fastboot.
The next hex file(emmcbld.hex) turns the device into an unknown mass storage device in device manager, in linux, it fails to enumerate the device as the kernel log show. It keeps on giving errors.
But with this same emmcbld.hex file, QPST is able to flash partition.mbn and other files. So i am thinking its partially compactible with the DHD.
So for your answer, after the emmcbld.hex has been flashed, it fails to flash any of the msm7x30.mbn files. In linux its gives an error saying "partition not found after opening multi" something like that.

2. I dont own the working device. It belongs to a friend and trying as much to get it for the backup.

3. I have no idea about those partitions you named.(maybe if you could elabrate more on them)

4. The device runs on an MSM7x30 Qualcomm CPU

5. Personally i dont have a dropbox(i hate that file sharing site....always 404 error), but i do have 4shared,MEGA,Google Drive if thats okay.

6. Yes i do have a plus account..what do you expect,its a must for android users.:p

Thanks for dropping by.
 
  • Like
Reactions: fairsimple
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
Gussta said:
.... His phone didn't want to remember anything because controler for vccq 3,3v in nand was burned. This 3.3v is for tuneling. Something like in picture: http://en.wikipedia.org/wiki/File:Flash-Programming.svg but with 3.3v instead with 12v.


Guys I have to go sleep because it is now 00:04h my local time and I work in the morning. I will stay tuned to help you as much as I can.
Click to expand...
Click to collapse

Thanks to reply at 4 in the morning:) Do you mean that in the case of emmc controler is burned, the phone may also go to the QHSUSB_DLOAD mode? If yes then it is hardware issue, and loading anything or jtag can't fix it, right. Thanks.
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
darkspr1te said:
Hi All,
I've gone throught the thread last night (in between the hours of 1am and 2) , I got the jist of the thread but I have some questions.

1. One user said he got the device into the SD-CARD more, which means the device accepted the the hex which is a small loader file and then was able to write the sd-card mini arm application, is this correct?
2. you have access to a device that has root and is working ?
3. you know what type of partition your using (MBR/EBR aka dos or GPT )
4. you know for sure the cpu type (s)
5. have a large drop box to upload the files for reversing so we can figure out with parition/file is sbl1/2/3/rpm/tz etc
6.google+ account to chat in for live reversing of the files plus remote ssh acccess to a pc with device connected.

Not all of these are required but it will make it go quicker if we have as many as we can.


darkspr1te
Click to expand...
Click to collapse

Hi darkspr1te, I think we make a big progress as getting you the QHSUSB_DLOAD exporter involved:) Thank you to spend time on this thread!

I did read your brixfix thread (v1 mostly since it has your working history) and after we got some HEX and MBN files (thinks mickeyasamoah found them), mickeyasamoah and I tried them with both QPST and qdload.pl. With QPST, I got mostly same rsult as mickeyasamoah replys above (I didn't get partition.mbn loaded successfully as him). With my modifed qdload.pl, I confirmed the HEX/BIN file works since after that the phone reboots and reply to some streaming download message. However, I can't go ahead to loading MBN file. You can see the result from post #44 (http://xdaforums.com/showpost.php?p=50274440&postcount=44 ). Personally I don't think we get into the SD mode yet.

FYI as mickeyasamoah and tjnapster555 suggested, we open a new thread in Desire HD forum to ask partition info and emmc backup (http://xdaforums.com/showthread.php?p=50631137), also another post to ask for streaming download protocol doc (http://xdaforums.com/showthread.php?p=50632205). No input so far yet.

BTW, DHD has Qualcomm 8255 chip. When connect to QPST, QPST use 7x30xxx.hex as default file, and some posts mention 7x30 is the code name of 8255 chip.

Also FYI: Fuese replied my PM mentioned he thought our DHD is emmc issue, riffbox should be able to fix it without jtag. So riffbox must have the HEX/MBN/PartitionTable/partitions for DHD.

Thanks for your help!
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
mickeyasamoah said:
I found this and it seems like a program for generating .hex files.
Here is the link.

http://picprojects.org.uk/projects/mplab/mplabhowto.htm
Click to expand...
Click to collapse

As my understanding this is to generate HEX from code binary, but normally no one can have Qualcomm's binary. Also I think the HEX files your found works somehow, we just can't move forward from there, either the motorola/fastboot mode (after loading MPRG7x30.hex), or streaming dl mode (after loading ARMPRG.HEX/EMMCBLD.HEX). Anyway, this is a good reference so let us keep it for now. Thanks.
 
darkspr1te

darkspr1te

Senior Member
Sep 24, 2012
952
595
fairsimple said:
Hi darkspr1te, I think we make a big progress as getting you the QHSUSB_DLOAD exporter involved:) Thank you to spend time on this thread!

I did read your brixfix thread (v1 mostly since it has your working history) and after we got some HEX and MBN files (thinks mickeyasamoah found them), mickeyasamoah and I tried them with both QPST and qdload.pl. With QPST, I got mostly same rsult as mickeyasamoah replys above (I didn't get partition.mbn loaded successfully as him). With my modifed qdload.pl, I confirmed the HEX/BIN file works since after that the phone reboots and reply to some streaming download message. However, I can't go ahead to loading MBN file. You can see the result from post #44 (http://xdaforums.com/showpost.php?p=50274440&postcount=44 ). Personally I don't think we get into the SD mode yet.
Click to expand...
Click to collapse
I checked DMSS manual you provided on that thread, thats the limited instruction set, also thats a very old document and as E:V:A pointed out to me once, often the qualcomm docs are far behind the actual reality , please find attached a revised copy of the same document, if you compare section 3.3 between the two you will see what i mean.
 

Attachments

  • 80-39912-1_E_DMSS_Download_Protocol.pdf.zip
    302.5 KB · Views: 628
  • 80-N2967-1_C_eMMC_Software_Download_Tool.pdf.zip
    569.3 KB · Views: 641
  • 80-N3887-1_A_Factory_Image_Download_Tool_QFIT.pdf.zip
    431.8 KB · Views: 599
  • 80-V1294-1_YP_DMSS_Serial_Data_ICD.pdf.zip
    3.8 MB · Views: 624
  • Like
Reactions: adfree, fairsimple and mickeyasamoah
darkspr1te

darkspr1te

Senior Member
Sep 24, 2012
952
595
FYI as mickeyasamoah and tjnapster555 suggested, we open a new thread in Desire HD forum to ask partition info and emmc backup (http://xdaforums.com/showthread.php?p=50631137), also another post to ask for streaming download protocol doc (http://xdaforums.com/showthread.php?p=50632205). No input so far yet.

BTW, DHD has Qualcomm 8255 chip. When connect to QPST, QPST use 7x30xxx.hex as default file, and some posts mention 7x30 is the code name of 8255 chip.

Also FYI: Fuese replied my PM mentioned he thought our DHD is emmc issue, riffbox should be able to fix it without jtag. So riffbox must have the HEX/MBN/PartitionTable/partitions for DHD.

Thanks for your help!
Click to expand...
Click to collapse

plus some more reading :)
 

Attachments

  • 80-V5348-1_J_Streaming_DLoad_Protocol.pdf.zip
    325 KB · Views: 328
  • 80-VG639-29_A_HSUSB_SW_Dload_Mem_Dump.pdf.zip
    643.4 KB · Views: 323
  • 80-VG639-28_B_QHSUSB.pdf.zip
    196.8 KB · Views: 339
  • 80-VP758-1_B_Emergency_Download_Feature.pdf.zip
    312.2 KB · Views: 307
  • Like
Reactions: fairsimple and mickeyasamoah
darkspr1te

darkspr1te

Senior Member
Sep 24, 2012
952
595
@fairsimple , a hex file is just a format of file like a word doc , but you can also have a docx and .wri files, it contains the same data but different format , in our case we take a compiled binary(.bin file from the compiled code) and convert it to the .hex format for upload(text version of the bin file, see hexdump linux tool). the .hex format is used in anything from a arduino/atmega chip to a PIC micro (as per your link)


For completeness i have included the 7x30 compiled for me by a 'ahem' qualcomm coder , worth a try.
I will try and get the .mbn file too.

if we have a device that is in sdcard mode i would like to analyze it via a ssh session, if my theory is right then the bootloaders are still on the emmc, in my case the first 100mb was left free for this same reason, on two other msm devices (churt burst and a chineese clone s4) i found the first 100mb was free also, this allowed me to copy the entire emmc, remove the 100mb and i am left with the entire boot table, from here i just compared each parition (manually using a hex editor, no auto tools for this) to a backup copy from another device, this also allowed me to find the damaged bootloader and write a specific brickfix for the devices.
 

Attachments

  • m7x30-emmcbld.hex.zip
    134.5 KB · Views: 241
  • Like
Reactions: fairsimple and mickeyasamoah
mickeyasamoah

mickeyasamoah

Senior Member
Jan 11, 2013
979
230
Accra
I have being running the FixDHD.pl in linux.
The Error it gives is:
root@ubuntu:~/Documents/XdaFix# ./fixdhd.pl --fixdhd
fixdhd.pl version 20140212.
This function is for HTC Desire HD which is in QDLoader mode only.
!! You are running it on your own risk!!
Please plugin your DHD and press enter...
Qualcomm device is (05c6:9008/9025): Bus 001 Device 043: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

Please input lower case 'y' if you confirm to move forward.
Device found, load ARMPRG.bin? y
Opening ttyUSB port...
Loading ARMPRG.bin at 2147483648...
....................................................................................................................................................................................................................................................................................................Executing file...
..So far so good, load 7x30_msimage.mbn? y
Opening ttyUSB port...
Sending MAGIC...
..Good magic response from DHD
Sending secureMode...
SENDING: 7e 17 01 57 c6 7e
RECEIVED: 18 b1 6c
Sending openMulti ...
SENDING: 7e 1b 21 f5 4e 7e
RECEIVED: 0e 4e 6f 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 20 72 65 63 65 69 76 65 64 20 62 65 66 6f 72 65 20 6f 70 65 6e 20 6d 75 6c 74 69 0a f5 8f
MSG: No partition table received before open multi
RECEIVED: 0d 0f 00 00 00 4e 6f 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 20 72 65 63 65 69 76 65 64 20 62 65 66 6f 72 65 20 6f 70 65 6e 20 6d 75 6c 74 69 a4 c3
ERROR: No partition table received before open multi
Invalid openMulti response.
Click to expand...
Click to collapse

And i am thinking the mbn file we are using lacks a file called partition.xml used in creating the mbn files. As it stated Here, the 6TH topic.
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
darkspr1te said:
...
For completeness i have included the 7x30 compiled for me by a 'ahem' qualcomm coder , worth a try.
I will try and get the .mbn file too.
...
Click to expand...
Click to collapse

Thank you for all the docs, looks I have enough to read over this weekend. :)

I quick checked the streaming dload doc, and find the magic/hello, securitymode and openMulti commands which I used not to understand in qdload.pl. However looks we need to send PartitionTable command (0x19) before openMulti(0x1b), and this matched the error message we got before (as post #44 http://xdaforums.com/showpost.php?p=50274440&postcount=44 )

The m7x30-emmcbld.hex you attached is same as the ARMPRG.HEX which we used in post #44
(thanks mickeyasamoah who attached it in the zip in post #39 http://xdaforums.com/showpost.php?p=50232279&postcount=39)

I will read the protocol doc first, then to add the partitiontable command and try to use the partition.mbn from mickeyasamoah.
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
mickeyasamoah said:
I have being running the FixDHD.pl in linux.
The Error it gives is:


And i am thinking the mbn file we are using lacks a file called partition.xml used in creating the mbn files. As it stated Here, the 6TH topic.
Click to expand...
Click to collapse

So we got same output. As I mention above, I will edit fixdhd.pl and try the partition.mbn you found before (in post #48 http://xdaforums.com/showpost.php?p=50347790&postcount=48).

Yes I think that xml is one important input to build MBN. However, darkspr1te is super good on partition table and MBN so he can help us after getting some input from working DHD phones.
 
darkspr1te

darkspr1te

Senior Member
Sep 24, 2012
952
595
fairsimple said:
Thank you for all the docs, looks I have enough to read over this weekend. :)

I quick checked the streaming dload doc, and find the magic/hello, securitymode and openMulti commands which I used not to understand in qdload.pl. However looks we need to send PartitionTable command (0x19) before openMulti(0x1b), and this matched the error message we got before (as post #44 http://xdaforums.com/showpost.php?p=50274440&postcount=44 )

The m7x30-emmcbld.hex you attached is same as the ARMPRG.HEX which we used in post #44
(thanks mickeyasamoah who attached it in the zip in post #39 http://xdaforums.com/showpost.php?p=50232279&postcount=39)

I will read the protocol doc first, then to add the partitiontable command and try to use the partition.mbn from mickeyasamoah.
Click to expand...
Click to collapse

I think ive posted wrong hex file, i will hunt down the other, i've archived a lot of stuff and still not setup my file server. i somewhere have a hex file given to me for this device (7x30 not specifically the DHD)

darkspr1te

---------- Post added at 07:25 AM ---------- Previous post was at 07:09 AM ----------

was hunting around and found this, worth a read and it includes info on creating certain MBN files

http://94it.net/a/jingxuanboke/2013/1206/203631_19.html
 
Last edited:
  • Like
Reactions: fairsimple
J

Jengo

Member
Jan 16, 2012
9
2
(New) member in the club

Hi guys,

I also have a DHD in QHSUSB_DLOAD mode.

Here’s my story:
• I had a running “taktiK 4.4.2” for some weeks, before that a “JellyTime“ for many months without any problems. (4ext Recovery, latest)
• One day I had many frozen black screens where I had to pull the battery. Each time after that it was working again (for some time).
• So I decided to wipe cache and dalvik cache in recovery.
• After that the ROM wasn’t booting, stuck at the ROM boot screen.
• So I tried to dirty flash the ROM again, which gave me an error during flashing.
• Then I wanted to do a clean install, so I tried to format all partitions, which also gave me an error.
• After a reboot 4ext Recovery wasn't able to locate/mount the system partition.
• After next reboot into recovery everything seemed to be working again, so I formated everything and flashed the ROM, which worked without any error.
• Reboot -> frozen black screen -> pulled the battery
• DHD was dead.
Now, I could have bricked it or it is a faulty eMMC.

Then I read this thread in an early stage and started hoping. But I also found a local shop who does RIFFBOX JTAG repairs for 20 €. So I asked for the USB debrick method and obviously he didn’t know about that because he told me it wasn’t possible. So we agreed that I disassemble the phone (I find electronics quite interesting) and bring in the mainboard for JTAG flashing. After disassembling I googled for the JTAG pin descriptions and found out that it is possible via pure USB with the RIFFBOX. So I got back to this thread.

I can still ask in the shop, but I think it is more fun to do it by yourself. So if I can be of any help, I’d love to do so.

btw: I did already the “./qd.pl --check” one month ago and got exact your same results.
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
Jengo said:
Hi guys,

I also have a DHD in QHSUSB_DLOAD mode.
...
Now, I could have bricked it or it is a faulty eMMC.
...
Click to expand...
Click to collapse

Welcome to the club:)

Since your phone went brick step by step (more and more flashing error) so I got a feeling that the eMMC wore out. If this is true, even JTAG can't help since it is hw faulty. Actually this is the biggest concern of my phone also.

Anyway it doesn't make anything worse to stay tuned and try whatever we attempt here. Good luck all!
 
mickeyasamoah

mickeyasamoah

Senior Member
Jan 11, 2013
979
230
Accra
fairsimple said:
Welcome to the club:)

Since your phone went brick step by step (more and more flashing error) so I got a feeling that the eMMC wore out. If this is true, even JTAG can't help since it is hw faulty. Actually this is the biggest concern of my phone also.

Anyway it doesn't make anything worse to stay tuned and try whatever we attempt here. Good luck all!
Click to expand...
Click to collapse

The partition.mbn file i uploaded isnt for the desire hd specifically. So maybe we should edit it before we use it.
What do you think?
 
F

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
After adding the command 0x19(partitionTable command) to the perl script, our partition.mbn is accepted by the phone, but loading 7x30_msimage.mbn still failed.
Code: 
$ ./fixdhd.pl -fixdhd
fixdhd.pl version 20140228.
This function is for HTC Desire HD which is in QDLoader mode only. 
!! You are running it on your own risk!!
Please plugin your DHD and press enter...
Qualcomm device is (05c6:9008/9025): Bus 001 Device 007: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

Please input lower case 'y' if you confirm to move forward.
Device found, load ARMPRG.bin? y
Opening ttyUSB port...
Loading ARMPRG.bin ...
...
..Executing file...
..So far so good, load emmc? y
Opening ttyUSB port...
Sending MAGIC...
..Good magic response from DHD
Sending secureMode...
SENDING: 7e 17 01 57 c6 7e
RECEIVED: 18 b1 6c
Checking partition table...
SENDING: 7e 19 00 aa 73 ee 55 db bd 5e e3 
...00 00 00 d1 c2 7e
RECEIVED: 1a 00 a6 67
Partition table accepted.
Write partition table? y
Writing partition table...
SENDING: 7e 19 01 aa 73 ee 55 db bd 5e...
66 a9 7e
RECEIVED: 1a 00 a6 67
Partition table accepted.
Loading 7x30_msimage.mbn ...
Writing 1024 bytes to 0x00000000; 1981480 bytes left.
SENDING: 7e 07 00 00 00 00 0a ...
ae 7e
RECEIVED: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a 65 ac
Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a

[57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c: Write unsuccessful]
 

Attachments

  • fixdhd20140228.zip
    563.3 KB · Views: 139
  • Like
Reactions: Core2idiot
mickeyasamoah

mickeyasamoah

Senior Member
Jan 11, 2013
979
230
Accra
fairsimple said:
After adding the command 0x19(partitionTable command) to the perl script, our partition.mbn is accepted by the phone, but loading 7x30_msimage.mbn still failed.
Code: 
$ ./fixdhd.pl -fixdhd
fixdhd.pl version 20140228.
This function is for HTC Desire HD which is in QDLoader mode only. 
!! You are running it on your own risk!!
Please plugin your DHD and press enter...
Qualcomm device is (05c6:9008/9025): Bus 001 Device 007: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

Please input lower case 'y' if you confirm to move forward.
Device found, load ARMPRG.bin? y
Opening ttyUSB port...
Loading ARMPRG.bin ...
...
..Executing file...
..So far so good, load emmc? y
Opening ttyUSB port...
Sending MAGIC...
..Good magic response from DHD
Sending secureMode...
SENDING: 7e 17 01 57 c6 7e
RECEIVED: 18 b1 6c
Checking partition table...
SENDING: 7e 19 00 aa 73 ee 55 db bd 5e e3 
...00 00 00 d1 c2 7e
RECEIVED: 1a 00 a6 67
Partition table accepted.
Write partition table? y
Writing partition table...
SENDING: 7e 19 01 aa 73 ee 55 db bd 5e...
66 a9 7e
RECEIVED: 1a 00 a6 67
Partition table accepted.
Loading 7x30_msimage.mbn ...
Writing 1024 bytes to 0x00000000; 1981480 bytes left.
SENDING: 7e 07 00 00 00 00 0a ...
ae 7e
RECEIVED: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a 65 ac
Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a

[57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c: Write unsuccessful]
Click to expand...
Click to collapse

I am going to try other mbns over night.
Would give my conclusion tomorrow afternoon.

I have also been PMing @connexion2005 for him to pay us a visit hope he does.
 
You must log in or register to reply here.

Similar threads

P
  • Sticky
[Ask Your Questions Here] Questions And Answers for Desire HD Users
Replies
3K
Views
333K
MAXILORD
MAXILORD
X
[Q]HTC Desire HD QHSUSB_DLOAD driver[brick caused by rom manager sdcard repartition]
Replies
52
Views
144K
S
suyashysingh
H
[Q] HTC Desire HD Official Latest Stock ROM Untouched
Replies
67
Views
184K
marknoll
marknoll
hamdir
[GUIDE] HTC Desire HD Camera guide - all issues resolved
Replies
296
Views
200K
shaw6096
shaw6096
A
[Q] How to take a screenshot on HTC Desire HD
Replies
14
Views
99K
D
d_bizzzz

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 5
    F
    fairsimple
    Hi Everyone. By opening this thread, I hope I can 1) log my work, 2) get input from the wonderful people here, 3) benefit others who has the same type of brick. I have been reading/following/searching stuffs here for a while, and this is my first dirty-work-to-do. Please help me as much as you can. Thank you all!

    How I bricked my Telus HTC Desire HD:
    1. Phone has stock Android 2.3 and one day it keeps rebooting
    2. Unlock bootloader by HTCDev
    3. Didn't turn S-OFF
    4. Flash _TOUCHRECOVERY__CWM_5.8.0.0_Touch_Recovery_for_DesireHD successfully
    5. Flash cm-11-20131203-UNOFFICIAL-ace.zip successfully (after one failure) but phone is in boot loop
    6. Unzip boot.img from the CM11 zip and 'fastboot flash boot boot.img' (as in [1]). The command didn't return anything, and I disconnect the cable after about 1m

    Now the phone bricks, it doesn't boot to fastboot/hboot, charging LED never on. Connecting to PC shows a QHSUSB_DLOAD device.

    The first thing I'd like to know is the root cause of my brick. Is it because the phone has S-ON, or because I disconnected the USB cable before getting the fastboot fully done. As [2] (which is for One X), the S-ON may not be an issue, then why the fastboot command didn't return anything?

    What I got to work so far:
    1. Install driver to my PC (QHSUSB_Drivers_(x64).zip from [4], thanks JSLEnterprises)
    2. Enable the driver as test driver since it doesn't have signature (as [6])
    3. Install QPST (QPST_2.7_378.zip, from [5], thanks darkspr1te)
    4. QPST connects to phone and lists as type 'Q/QCP-XXX' which is in '*Download*' mode

    As there is an 'HTC Unbricking Project' which doesn't have DHD in its supported phones list [3], I see the hope to unbrick my DHD without JTAG. I am not expecting to have a one-click solution like the unbrick project, and I am open to do some coding if needed, but I think I should be able to restore my boot partition (or multiple partitions) with QPST. And here I need your help:

    1. What cause the brick? S-ON of the phone, or failure of fastboot
    2. Do you think I can unbrick it just with QPST
    3. If someone has a working Desire HD and uses QPST to backup its partitions to files, will I have its IMEI/CID/etc after download those files to my phone
    4. Do you think I can manully build the QPST QCN download file from a stock ROM/RUU

    Thank you!

    [1] http://xdaforums.com/showthread.php?t=2533007 (HTC Desire HD > Desire HD Android Development > [ROM][UNOFFICIAL] CyanogenMod 11 Nightlies)
    [2] http://xdaforums.com/showthread.php?t=1603791 (HTC One X > One X Android Development > [WARNING] Flashing boot.img on S-ON devices)
    [3] http://xdaforums.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
    [4] http://xdaforums.com/showthread.php?t=1041153&page=2 ( HTC Desire HD > Desire HD Q&A, Help & Troubleshooting > [Q]HTC Desire HD QHSUSB_DLOAD driver[brick caused by rom manager sdcard repartition])
    [5] http://xdaforums.com/showpost.php?p=33545892 (AT&T Samsung Galaxy Note I717 > AT&T Galaxy Note I717 General > [SOLVED]-[BRICKED]SHV-E160L Korean model)
    How to calculate partition info in post #13, 15, 16 thanks darkspr1te
    [6] http://windows7themes.net/windows-requires-a-digitally-signed-driver-windows-7.html
    [7] http://xdaforums.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
    [8] http://xdaforums.com/showthread.php?t=905003
    (HTC Desire HD > Desire HD Android Development > [GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6, with download of stock PD98IMG.ZIP)
    [9] 7x30 HEX and MBN files in post#39 and partition.mbn and HxD HEX editor in post #48 (thanks mickeyasamoah)
    [10] Qualcomm docs in post #87 and post #88 on page 9 (thanks darkspr1te)
    [11] QFIT (flash image creation tool) in post #90 (thank darkspr1te)
    [12] fixdhd.pl v20140228 in post #98 (based on qdloader.pl thanks JCSullins(Rootz Wiki)) v20140410 in post #161 on page 17
    [13] MBN files from HP Pre 3 device in post #126 (thanks mickeyasamoah)
    [14] Qualcomm development doc in Chinese and English. Need download file from https://support.cdmatech.com/login/, https://silver.arm.com/browse or https://developer.qualcomm.com/.
    [15] Related post: Request for DHD backup and Qualcomm docs
    [16] (thanks Gussta) Qualcomm processors and Snapdragon SoCs (post #139 on page 14), and Dual boot DHD with SD
    View
    3
    darkspr1te
    darkspr1te
    fairsimple said:
    Hi darkspr1te, I think we make a big progress as getting you the QHSUSB_DLOAD exporter involved:) Thank you to spend time on this thread!

    I did read your brixfix thread (v1 mostly since it has your working history) and after we got some HEX and MBN files (thinks mickeyasamoah found them), mickeyasamoah and I tried them with both QPST and qdload.pl. With QPST, I got mostly same rsult as mickeyasamoah replys above (I didn't get partition.mbn loaded successfully as him). With my modifed qdload.pl, I confirmed the HEX/BIN file works since after that the phone reboots and reply to some streaming download message. However, I can't go ahead to loading MBN file. You can see the result from post #44 (http://xdaforums.com/showpost.php?p=50274440&postcount=44 ). Personally I don't think we get into the SD mode yet.
    Click to expand...
    Click to collapse
    I checked DMSS manual you provided on that thread, thats the limited instruction set, also thats a very old document and as E:V:A pointed out to me once, often the qualcomm docs are far behind the actual reality , please find attached a revised copy of the same document, if you compare section 3.3 between the two you will see what i mean.
    View
    3
    F
    fairsimple
    Files for 8x25(karbonn a9+) from this post: http://forum.gsmhosting.com/vbb/f824/karbonn-a9-dead-qualcomm-hs-usb-qdloader-9008-how-fix-1740061/#post9962431

    Code: 
    12-19-2013, 10:00	   #12 (permalink)
umesh gaba
Product Manager

 

 
Join Date: Aug 2012
Location: jalandhar,india
Posts: 4,034 
Member: 1792140 
Status: Online
Sonork: 100.1618782;gaba
Thanks Meter: 4,644
QPST 2.7 build 399QPST-2.7.399


BP Firmware BP_JB_Firmware

drivers ICS_pcdrivers

drivers JB_pcdrivers



Install QPST
1. Extract QPST-2.7.399.rar. Run SETUP.EXE
2. Run SETUP.EXE, press INSTALL when it prmpt to insall additional Visual C++ runtime libraries. Follow the defaults, press NEXT until it is finished with the install.

Install drivers
1. Connect deadboot flare to PC / Laptop.
2. Go to device manager, expand PORTS (COM & LPT). Check if there is an item called Qualcomm HSUSB QDLOADER 9008. If the item is there, you are done with driver install. If it does not exist, proceed to step3.
3. If there is no item under PORTS (COM & LPT), check device manager under OTHER DEVICES > Unknown Device
4. Double click UNKNOWN DEVICE > UPDATE DRIVER > BROWSE MY COMPUTER > browse to the folder where you saved extracted the ICS / JB drivers. It will install the driver, if it prompts for unsigned drivers, press INSTALL ANYWAY.
5. It should now be listed under COM PORTS > Qualcomm HSUSB QDLOADER 9008.

Run QPST and reprogram EMMC (this is where the magic begins)
If you are on Win7, make sure you run it under compatibility XP Sp3 and RUN AS ADMINISTRATOR

1. Run EMMC SOFTWARE DOWNLOAD.
2. Press BROWSE, it will detect your phone. Look for the PHONE TAB that says DOWNLOAD. Press OK.
3. Put check mark on PROGRAM BOOTLOADERS, PROGRAM MMC DEVICE, TRUSTED.
4. Under FLASH PROGRAMMER FILENAME, enter MPRG8X25.hex
5. Under BOOT IMAGE, enter 8X25_msimage.mbn
6. Press LOAD XML DEF > navigate to your extracted JB firmware > select rawprogram0 > press OPEN.
7. Press LOAD PATCH DEF > navigate to your extracted JB firmware > select patch0 > press OPEN
8. PRESS DOWNLOAD
9. An warning message may appear, TIME OUT WAITING etc etc or COOKIE NOT RECEIVED. If the error is TIME OUT WAITING, press OK and then press SWITCH DEVICE TO DLOAD. Check the flare, it will show RESET FOR ENTRY QPST.
10. Exit EMMC SOFTWARE DOWNLOAD. Proceed to flash Jelly Bean BP Firmware and then flash Jelly Bean img dump.
11. IF ERROR IS COOKIE NOT RECEIVED, sorry it is still bricked.
    View
    3
    mickeyasamoah
    mickeyasamoah
    fairsimple said:
    Can you zip and attach the files you have, or post the link where you download them. Again I will try to use qd.pl (which should use the same MDSS protocol as QPST, but for this program we have better control:) Please also zip those files which doesn't work for you, I may also try them then.
    Click to expand...
    Click to collapse

    I was beginning to think you have had your DHD fixed by RiffBox or JTAG thats why you werent commenting.
    Any way, i have uploaded the files.

    MPRG7x30.hex and ARMPRG.HEX are the working files
    The rest arent working.
    View
    2
    mickeyasamoah
    mickeyasamoah
    fairsimple said:
    I can't find the 'multi-sec 2.0'. I have QPST v2.7 b378.

    Also if you have access to a working DHD (I think we need it as rooted), we need backup the whole internal memory as #2 of this post, then we may can get the partition table from the backup file.

    http://xdaforums.com/showthread.php?t=1188510
    Click to expand...
    Click to collapse

    Its there check the image below.

    And i was thinking of backing up another DHD so that we can get all the files for unbricking the device.
    But i dont have another DHD. So then, how about we put up a thread in the DHD forum giving the guidelines on how to backup the DHD for unbricking purpose.
    What do you think?

    Also do you have any idea on how to backup the DHDs mbn files?
    View

New posts