Did this work?


  • Total voters
    537
Search This thread

dexter93

Inactive Recognized Developer
Jul 1, 2010
11,607
2,341
@ movzx: crazy idea of the day: since you are on hboot, you will probably have access to fastboot. Try writing a secuflag 0 instead of 3. That could unlock the hboot. Remember that the sensation has radio s off, meaning that it might be possible to turn bootloader s off with that command

Sent from my HTC Sensation XE with Beats Audio Z715e using Tapatalk
 

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK
@ movzx: crazy idea of the day: since you are on hboot, you will probably have access to fastboot. Try writing a secuflag 0 instead of 3. That could unlock the hboot. Remember that the sensation has radio s off, meaning that it might be possible to turn bootloader s off with that command

Sent from my HTC Sensation XE with Beats Audio Z715e using Tapatalk

Perhaps he needs to do rev s-off process from start? Not sure if he's tried that?

Sent from my HTC Sensation XE with Beats Audio using xda premium
 

dmcb123

Senior Member
Mar 11, 2011
540
59
Monaghan
Awesome work here guys :)

@Movx try dexter's idea it seems pretty simple but it sounds like iit might actually work :)
if that doesnt work you could try extract the radio from the ruu and inject it into the correct partition in emmc mode and try booting then? just an idea
 

Snake_skw

Senior Member
Oct 25, 2011
99
12
great news guys,i knew you can do it :)
now,if i'm not wrong,in emmc mode we should overwrite hboot(or is it neccesary if we overwrite radio thus changing from s-on to s-off???),radio(you say that's the location of secuflag so we need to dump it from a phone that already has s-off) and recovery(to be able to restore the functioning rom)...
what do you guys think about this idea?
 

miamivice

Member
Jul 20, 2010
16
2
please, can anyone tell me, how to get drivers for QUALCOMM CDMA TECHNOLOGIES MSM installed, i think, this might be the problem, why with win7 my emmc mounts and unmounts some seconds later again -.-

greetz miami
 

MOVZX

Senior Member
Jan 26, 2012
761
388
fastboot oem writesecureflag 0 (doesn't work, permission denied)
fastboot oem writecid 11111111 (doesn't work, looks like it's requesting sdcard or so)

Revolutionary S-OFF - It needs a phone which is booted right into the Android OS, mine just stucked at bootloader.

Any ideas? Or is there any Revolutionary that works with a phone on fastboot mode?

Or what should I do to make it bricked again? Because with wire trick I can't access eMMC like before.


PS: Do not even said to Me to run adb because I have described that my phones stucked at bootloader with fastboot as the only option, no recovery at all.
 

RussianBear

Recognized Contributor
Nov 10, 2008
2,050
341
fastboot oem writesecureflag 0 (doesn't work, permission denied)
fastboot oem writecid 11111111 (doesn't work, looks like it's requesting sdcard or so)

Revolutionary S-OFF - It needs a phone which is booted right into the Android OS, mine just stucked at bootloader.

Any ideas? Or is there any Revolutionary that works with a phone on fastboot mode?

Or what should I do to make it bricked again? Because with wire trick I can't access eMMC like before.


PS: Do not even said to Me to run adb because I have described that my phones stucked at bootloader with fastboot as the only option, no recovery at all.

we need to find your ruu for 1.50.707.1, as that will most likely work for you. i wasn't able to locate it.
that's the closes, but it includes aftermarket kernels (you can just not flash them).

http://bbs.anzhi.com/thread-4799292-1-1.html

http://115.com/file/e7h67rfx#
pyramid_asia_wwe_1507071_v3_Bricked.zip

http://115.com/file/e7h67v65#
pyramid_asia_wwe_1507071_v3_Faux.zip

more: http://bbs.zhangku.com/thread-54417-1-1.html

dl.dbank.com/c0xdflo9ft
 
Last edited:

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK
fastboot oem writesecureflag 0 (doesn't work, permission denied)
fastboot oem writecid 11111111 (doesn't work, looks like it's requesting sdcard or so)

Revolutionary S-OFF - It needs a phone which is booted right into the Android OS, mine just stucked at bootloader.

Any ideas? Or is there any Revolutionary that works with a phone on fastboot mode?

Or what should I do to make it bricked again? Because with wire trick I can't access eMMC like before.


PS: Do not even said to Me to run adb because I have described that my phones stucked at bootloader with fastboot as the only option, no recovery at all.

Hmm I wonder if u could put a recovery image on sale as hboot image? Someone has been pm me and phone just loaded find after doing what u did...

Sent from my HTC Sensation XE with Beats Audio using xda premium
 

MOVZX

Senior Member
Jan 26, 2012
761
388
Hmm I wonder if u could put a recovery image on sale as hboot image? Someone has been pm me and phone just loaded find after doing what u did...

Sent from my HTC Sensation XE with Beats Audio using xda premium

What do You mean with 'put a recovery image on sale as hboot image'?

I have 2 devices already on hand, both of them are stuck at bootloader. And I wonder if someone has any idea to make my devices bricked again because I need to do so.
 

Fuses

Inactive Recognized Developer
Feb 28, 2012
125
1,789
Just short and fast reply.
Try to create goldcard and flash rom from any region into the phone. Make sure that new rom has greater mainver than 1.50.
 

bonesy

Senior Member
Jan 28, 2009
2,211
336
39
Cornwall, united kingdom
Don't put is as P58.img it wont work..Put it as PG58IMG.zip

---------- Post added at 10:46 PM ---------- Previous post was at 10:44 PM ----------

One other thing...has anyone tried the old "goldcard" for any of this?
 

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK
What do You mean with 'put a recovery image on sale as hboot image'?

I have 2 devices already on hand, both of them are stuck at bootloader. And I wonder if someone has any idea to make my devices bricked again because I need to do so.

Sorry typo meant to say same as hboot, I'm confuses why its stuck at bootloader when In theory it should be normal now but with locked hboot. I was wondering I'd u could push a custom recovery image to allow u to flash stuff?

Sent from my HTC Sensation XE with Beats Audio using xda premium
 

MOVZX

Senior Member
Jan 26, 2012
761
388
Hmm I wonder if u could put a recovery image on sale as hboot image? Someone has been pm me and phone just loaded find after doing what u did...

Sent from my HTC Sensation XE with Beats Audio using xda premium

Just short and fast reply.
Try to create goldcard and flash rom from any region into the phone. Make sure that new rom has greater mainver than 1.50.

How to make a goldcard?
 

MOVZX

Senior Member
Jan 26, 2012
761
388
What happens if you put a recovery image on the root of your sdcard as a pg58.IMG and try to flash it through bootloader screen


from my HTC Sensation XE with Beats Audio using xda premium

Already done this with no luck!

Mainversion is older
press power to reboot
 

RussianBear

Recognized Contributor
Nov 10, 2008
2,050
341
I think I should dump and analyze something (secure flag) inside partition 9, since secuflag stored inside it (CMIIW):



INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=cache
INFOaARM_Partion[5].name=userdata
INFOaARM_Partion[6].name=devlog
INFOaARM_Partion[7].name=pdata
INFOaARM_Partion[8].name=radio
INFOaARM_Partion[9].name=radio_config
INFOaARM_Partion[A].name=modem_st1
INFOaARM_Partion.name=modem_st2
---------- Post added at 10:26 PM ---------- Previous post was at 10:21 PM ----------

How do I re-brick it again since I typed fastboot oem writesecureflag 3 and no response, I mean it's not going to be bricked again so I could access the eMMC the way I like and overwrite the HBOOT again.


i wonder if you can export the misc partition (if everything else fails) and modify it. that's where the image version is, according to this guide:

http://xdaforums.com/showthread.php?t=843544 or http://xdaforums.com/showthread.php?t=1467099

pm'ed you more links with that ruu
 
Last edited:

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK

Top Liked Posts

  • There are no posts matching your filters.
  • 167
    We are proud to announce that the Sensation is now UNbrickable. Users with the QHSUSB_DLOAD issue can now fully recover their phones and get them fully functional.

    Unbrick-proj-Sensation.jpg


    Note: This will fix only devices which were bricked by turning S ON. And bricks caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device. Any devices bricked with other ways are currently *not* supported. We are working on it

    The "core" of the unbricking project dev team:
    MOVZX
    RussianBear
    Fuses
    Dexter93

    Testing stuff and irc support:
    globatron
    Deceptivechaos
    dburgd84
    Snake_skw

    Other stuff:
    dmcb123
    xIndirect
    Hawke84

    Thanks to trevE, xHausx and the rest of the evo3d team that gave us the basic info to work on and made us curious to see if we could get something out of it. Also thanks to ief and his team @revolutionary for helping us understand the bootloaders better. We should also not forget to thank cxb01 of malshenzu.com and xda members arthurire and untrueparadox who helped in translation.
    82
    Prerequisites
    • a linux box/live cd with automount disabled and without unity
    • the appropriate package for the device
    • the latest RUU for your device
    • a device bricked by writing security flag 3 with an unsigned hboot, or caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device
    • a usb cable
    • some basic linux experience
    • patience

    DISCLAIMER: We do NOT guarantee that this method will work for you, or that it is flawless. We are also not responsible if your phone is completely dead after the procedure, or your house burns down because your phone exploded. You are doing this in YOUR OWN RISK.

    Instructions
    Detailed video on the process. Thanks kgs1992


    1. Boot the linux box and download the appropriate package for the device.
      WARNING: IT IS DEVICE SPECIFIC. DO NOT USE THE XE VERSION ON A 4G/ORIGINAL SENSATION AND VICE VERSA
    2. Extract the package in the home directory
    3. Open up a terminal
    4. Remove SIM, microSD card and battery and connect the device using the USB cable. This procedure must be done without battery
    5. Detect the device using the script provided. Type this in the terminal
      Code:
      ./brickdetect.sh
      You should get something like sdX. We are interested on that "X"
    6. Unplug the usb cable from the device
    7. Backup the hboot currently in the phone by using this command. Plug the device in ONLY when asked to
      Code:
      sudo ./emmc_recover --backup b_hboot.img --device /dev/sdX12
      Replace the "X" with the letter the script gave you
    8. Follow the on-screen instructions from emmc_recover
    9. Hexdump the b_hboot to check the hboot version
      Code:
      hexdump -C b_hboot.img |less
      The output should be like this:
      Code:
      00000000  05 00 00 00 03 00 00 00  00 00 00 00 00 00 10 40  |...............@|
      00000010  d8 fc 0f 00 d8 fb 0f 00  d8 fb 1f 40 00 01 00 00  |...........@....|
      00000020  d8 fc 1f 40 00 00 00 00  12 00 00 ea 31 2e 31 37  |...@........[B]1.17[/B]|
      00000030  2e 31 31 31 31 00 00 00  38 32 36 30 20 53 50 4c  |.1111...8260 SPL|
      00000040  00 00 00 00 00 f0 20 e3  53 48 49 50 00 00 00 00  |...... .SHIP....|
      00000050  00 f0 20 e3 00 f0 20 e3  48 42 4f 4f 54 2d 38 32  |.. ... .HBOOT-82|
      00000060  36 30 00 00 00 f0 20 e3  39 32 65 35 33 37 31 30  |60.... .92e53710|
      This is the typical hex of a hboot. We are interested to check if that is the hboot partition and if it is, to get to know the version. In this case it is 1.17
    10. If in the above step you failed to identify the hboot, unplug all devices connected to that pc, reboot and try again
    11. Unplug the device
    12. Check again it is the right version, because if you do a mistake here, you won't be able to go back
      You can only flash the same version as the one in the device.


      !!!!!DO NOT ATTEMPT TO FLASH ANOTHER VERSION OR DOWNGRADE!!!IT HAS BEEN PROVEN FATAL!!!!
    13. Flash the hboot on the device. Replace "V.VV" with hboot version (eg. 1.17, 1.18, 1.19, 1.20, 1.23, 1.27) and "X" with the one you got from the detect script. Plug the device in ONLY when asked to
      Code:
      sudo ./emmc_recover --flash pyrV.VV.nb0 --device /dev/sdX12 --backupafter hboot_f.nb0
    14. Follow the on-screen instructions from emmc_recover. A successful flash should have this output:
      Code:
      511+1 records in
      511+1 records out
      1047808 bytes(1.0 MB) copied
    15. Unplug the device, put SIM, microSD card and battery in and power on
    16. Congratulations, the device is unbricked.
    17. FLASH THE RUU IMMEDIATELY AFTER RECOVERING!! The device will be unstable after the recovery if you don't flash it.

    Notes on the procedure:

    • If the device doesn't power on, get a copy of the hboot_f.nb0 and b_hboot.img (should be located in the home directory) and contact us
    • The connection between the device and the pc will be unstable, and will time out. You have to be quick when doing the above, specially while flashing. If the connection times out don't panic, just unplug and replug the device
    • Unity and automount are known to cause issues in ubuntu 11.04 and 11.10. We recommend getting rid of both, or use a 12.04, or 10.04/.10 liveCD
    • USB3 ports do not work properly. Please plug the device in a USB2 port
    • The liveCD provided has autoount enabled. please disable it
    • How to disable automount on ubuntu
      Code:
      gsettings set org.gnome.desktop.media-handling automount false


    Downloads

    For Sensation and Sensation 4G:
    32bit version MD5: 859cf1c8f4cc96a9c911ecf696579e6f
    64bit version MD5: d160e90234999a0f8e5ed632d3a2bb4e

    For Sensation XE:
    32bit version MD5: dec2309cc06dbc01398a4a49f8ae13cf
    64bit version MD5: de677136626fe2e096f0a7f48e438978


    Don't have a linux distro installed on your pc? We highly recommend this livecd
    18
    It is unbelievable how many writesecureflag bricked devices there are in this world!!

    I write this little tool to help people to unbrick those phones. It also helps unbrick those phones that can be in emmc_mode only few seconds. It uses dd to flash images into device.

    In this guide I will assume that hboot is causing that brick and hboot is at /dev/sdb12 when emmc_mode enabled phone is connected.

    What you need:
    1) Bricked sensation :D
    2) Linux, If you want to use windows you have to wait that somebody makes emmc_mode stable. If you don't have Linux installed, some Live-cd should be fine.
    3) signed hboot from original rom you are using
    4) This little tool called emmc_recover
    5) Figure out what will be correct device node when phone is in emmc_mode
    It is usually /dev/sda /dev/sdb /dev/sdc etc.

    With this tool you can reflash any partition you want. SO BE CAREFUL.

    There are few options in this tool:
    Code:
    emmc_recovery 0.1 usage:
    emmc_recovery [OPTIONS]
    	-h | --help: display this help
    	-b | --backup
    	-f | --flash
    	-d | --device

    How to use it (You have to root):
    1) First BACKUP partition
    Code:
    ./emmc_recover --backup backupfile.img --device /dev/sdb12
    This will backup current sensation hboot into file backupfile.img.

    2) Check that this really is correct partition
    Code:
    hexdump -C backupfile.img |less
    It should be something like this for hboot
    Code:
    00000000  05 00 00 00 03 00 00 00  00 00 00 00 00 00 10 40  |...............@|
    00000010  d8 fc 0f 00 d8 fb 0f 00  d8 fb 1f 40 00 01 00 00  |...........@....|
    00000020  d8 fc 1f 40 00 00 00 00  12 00 00 ea 31 2e 31 38  |...@........1.18|
    00000030  2e 30 30 30 30 00 00 00  38 32 36 30 20 53 50 4c  |.0000...8260 SPL|
    00000040  00 00 00 00 00 f0 20 e3  53 48 49 50 00 00 00 00  |...... .SHIP....|
    00000050  00 f0 20 e3 00 f0 20 e3  48 42 4f 4f 54 2d 38 32  |.. ... .HBOOT-82|
    00000060  36 30 00 00 00 f0 20 e3  39 64 32 34 31 32 33 66  |60.... .9d24123f|
    3) If backup was successfull, flash new hboot
    Code:
    ./emmc_recover --flash hboot_xxxx.xxx.xx.xx.xx.nb0 --device /dev/sdb12
    4) Done.

    Below are usual output from tool:
    Code:
    emmc_recovery 0.1
    Messing up with device /dev/sdb12, ARE YOU SURE? (CTRL+C if not)
    
    Flashing image file is hboot_xxxx.xxx.xx.xx.xx.nb0
    Device is /dev/sdb12
    
    Press ENTER if everything is correct, CTRL+C if not
    
    Connect device into emmc partition mode NOW
    Waiting device /dev/sdb12.......
    Foundit!
    512+0 records in
    512+0 records out
    1048576 bytes (1.0 MB) copied, 0.740003 s, 1.4 MB/s
    Return code is 0

    Connect device into computer when you see line.
    Code:
    Waiting device /dev/sdb12.......

    Not before!!

    NOTE: There may be bugs present....
    11
    awesome!

    any people that know chinese, we need your help:

    a chinese forum where a member posted a guide on how to de-brick a phone (zte u960) from qhsusb_mode:

    http://bbs.malshenzu.com/read-htm-tid-38591-page-1.html

    http://bbs.malshenzu.com/read-htm-tid-41957-page-1.html ( Sales MultiDL tool guide)

    they use an additional tool (Sales MultiDL) that backs up alot of .mbn and .img files that we don't have (yet), so i'm not sure if we can pull those files out of the phone manually, or what?

    80_4747_74ac8bc91c00562.jpg


    translation per untrueparadox:

    1. choose program mode
    2. select the .hex and .mbn files from the included package
    3. load the .xml included in the package
    ____ the path to xml file will show here
    4. after selecting everything, click download to revive the brick

    the files they used to flash:

    80_4747_6a6329c38cb962f.jpg




    anyone knows Chinese (google chrome translator is ok for basic understanding, but nothing more than that)? :)
    i did pm the op of those threads to see what he thinks.
    11
    Oh my God...

    Dude... Looks like I have my God besides Me... And my heart is now crying (really)...

    MY PHONE IS NOW ON!! IT COULD BE TURNED ON AGAIN!!


    Thanks God! I really need a beer, I'm going to go now for a celebration...

    PS: I will write tutorials to resurrect the bootloader as soon as possible...


    Thanks XDA Dev... And now I'm sure we'll be able too so ressurrect any phone with MSM8260/MSM8660 including EVO 3D...