Did this work?


  • Total voters
    537
Search This thread

Fuses

Inactive Recognized Developer
Feb 28, 2012
125
1,789
just got a response from cxb01:



80_4747_298641d701e1dfa.jpg

This picture shows that phone has exposed emmc chip as external usb disk. This means that they are in totally different "download mode" that we can have access to... Extremely interesting... Now somebody have to do same thing with sensation.

I can't understant a single word of chinese. What ZTE device was used?
 

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK
Fantastic thread, i've been following this closely since it poped up. I think this is what we need a way of recovering bricked devices, ive bricked mine once so know the pain!

I dont know a lot about this but would be willing to help with whatever i can..

I've seen that some people have managed to dump the whole phone contents in DL mode so i guess thats a good start..
 

RussianBear

Recognized Contributor
Nov 10, 2008
2,050
341
This picture shows that phone has exposed emmc chip as external usb disk. This means that they are in totally different "download mode" that we can have access to... Extremely interesting... Now somebody have to do same thing with sensation.

I can't understant a single word of chinese. What ZTE device was used?

ZTE U960 on msm 8255. the picture makes sense, since emmc is a drive with partitions. now we need to test if we can access sensation's paritions like this. he said to use winhex and clone the phone's emmc. i haven't had a chance to test anything yet, but any volunteers are appreciated. they've been doing some crazy stuff on that Chinese forum. I've had some people contact me and provide some interpreting help, so that's a plus. I'll contact them again about this.

http://www.etotalk.com/zte-u960-skype-video-call-dual-antennas-real-dual-3g-wg_p2796.html

Fantastic thread, i've been following this closely since it poped up. I think this is what we need a way of recovering bricked devices, ive bricked mine once so know the pain!

I dont know a lot about this but would be willing to help with whatever i can..

I've seen that some people have managed to dump the whole phone contents in DL mode so i guess thats a good start..

do you have the phone? if so, follow all the steps in the first post to hook it up with qpst in download mode, then see if you can get winhex and/or parition manager to recognize the phone as a drive. then see if you can clone anything.

---------- Post added at 11:29 AM ---------- Previous post was at 11:01 AM ----------

FYI there's a jtag for Sensation available.
http://mobiletechvideos.mybigcommerce.com/htc-sensation-4g-jtag-brick-repair/
that guy is really good, he fixed my gf's sgs4g after i bricked it lol

not available anymore. i wonder if they jumped the gun too soon.

guys on gsmhosting are still looking for a way:

http://forum.gsmhosting.com/vbb/f634/htc-sensation-does-anyone-have-hw-dead-board-1437249/

---------- Post added at 11:39 AM ---------- Previous post was at 11:29 AM ----------

another interesting pdf here: http://wenku.baidu.com/view/5da95a6ba98271fe910ef9a2.html






got a general translation from out member: arthurire
As for the wenku link,it's about how to flash a ROM.But it doesn't have any information about which device it is.The only information is this cellphone is using screens made by SHARP.
The picture is just the same with the last picture we have talked.
Under the pictures is another method to flash(terminal in Linux System)
Then the passage discussed how to mod the ROM if the cellphone is using AUO(WTF it is?) screen.
After that,flash commands.

i told him AUO is Acer's LCD panel for sensation.


He also translated the thread with the Paragon Parition Manager's picture:

This thread and the picture is just talking about why the ROM is 300M,for example but it requires 900MB freespace.
The picture and the thread says that the official flash tool will divide the ROM into small blocks(64MB each) Even the MISC partition is only 256k but it still needs 64MB free space.
 
Last edited:

Hawke84

Senior Member
Jan 14, 2010
3,330
1,189
Worthing, UK
do you have the phone? if so, follow all the steps in the first post to hook it up with qpst in download mode, then see if you can get winhex and/or parition manager to recognize the phone as a drive. then see if you can clone anything

yes i do have the phone, when it comes to stuff like this i am a bit of a noob so dont really follow exactly how to do this, sorry, i am very willing to try stuff out (within reason) so long as its explained.

as i understand it i need to get the phone into download mode by connecting wire from 1 pin to SD card mount, then connect phone to usb using specific drivers and try and dump the phone as a disk using some windows software?

Edit: had a bit of a play, cant get the gscript working, fails every time "cannot create /sys/devices/virtual/usb_composite/diag/enable: no such file or diectroty" i have root and FS is mounted R/W. not sure what else to try..

ive had a dig around on root and i cant find usb_composite file where its meant to be, not sure if its moved on ics anyone?

EDIT2: ok think i found it, /sys/devices/virtual/android_usb/android0/f_diag/on
 
Last edited:

q9650

Senior Member
Dec 24, 2009
520
78
Munich
Any of you know tytung from the hd2 section? This dude could help us maybe? He was the only One who able to get agps working on the hd2. He has a lot of knowledge on chips of the hd2. Maybe he can try it for the Sensation too?

Sent from my HTC Sensation XE with Beats Audio using xda premium
 

dexter93

Inactive Recognized Developer
Jul 1, 2010
11,607
2,341
just a small bump. im not able to work on that until the weekend.. also if some volunteers with bricked devices are here, please contact
 

MOVZX

Senior Member
Jan 26, 2012
761
388
Unbricked!

just a small bump. im not able to work on that until the weekend.. also if some volunteers with bricked devices are here, please contact

I have an HTC Sensation bricked (dead-boot). Accidentally I typed a crucial fastboot command:

fastboot oem writesecureflag 3

But I forgot to run the RUU, so that my devices was bricked and won't turn on. :(

Then I send the device to unofficial service center (on another town in my country) and the guy has successfully resurrected the bootloader using a tool called RIFF-BOX. He charges Me for about $35 for the service but I'm happy now since I can start flashing custom ROMs again :) :p

NB: Partially, I have tried using QPST but don't know what to do. So I send the dead-device to someone who is able to repair the bootloader and I thanked him my lovely HTC Sensation is now repaired :cool:
 
  • Like
Reactions: Ekoq and Snake_skw

dexter93

Inactive Recognized Developer
Jul 1, 2010
11,607
2,341
Last edited:

MOVZX

Senior Member
Jan 26, 2012
761
388
So it seems like the riff box got updated to support the sensation. Interesting...



EDIT: Seems like the riff box doesnt support the sensation yet http://www.jtagbox.com/category/riff-jtag-features/

also the riff box guy is still searching for dead devices http://forum.gsmhosting.com/vbb/f634/htc-sensation-does-anyone-have-hw-dead-board-1437249/
are you sure it was riff box?

Sent from my HTC Sensation XE with Beats Audio Z715e using XDA

I'm not sure what flasher-box is He actually using. But He just told Me that the box He used to repair my HTC Sensation is RIFF-BOX and some pin-out (He just said pin-out or pinout, I'm not really understand) combination. But I can see now my device looks like has been dissected/disassembled (maybe for the repair purpose).

I got the guy from this forum: http://www.bandung-flasher.com (In my country, Bandung-Flasher community is the biggest Flasher Guy support center. They even could repair broken devices way faster and cheaper than the official service center, it's why people in my country never repaired the dead phones to official service center. And they have a huge collection of flasher-box equipment. And Bandung -city- well known also with the biggest Independent/Unofficial Flasher Service).


-------edit------------------
I got the image from the guy:
180gwk.jpg
 
Last edited:

duy_ctytvxdkg

Member
Jun 1, 2007
37
5
My friend's phone also become brick, cannot charge, cannot boot, cannot do anything.
I also have HTC SENSATION and try to enter diag mode then I take QCN file already.

1-61.png


2-33.png


3-19.png


4-13.png


5-5.png


6-4.png





- First I install GSscript and run script to enable diag mode
- Then connect the phone and turn on QPST
- Many times get the no phone connect but 1 time I get my lucky. It can connect and can copy NV (qcn file), backup QCN file.
- After backup QCN file, I try to take Multi-image but it tell me that the current phone is not in Download mode then
it reboot and try to go to dowload mode (the process is fail)
- I try with brick phone in restore tab but it warn that the phone is not in diag mode.

:( :(

Now I plus my phone back and get no-phone connect isssue.

I stuck here, will update if have any information

(sorry about my English)
 

Attachments

  • files.zip
    62.1 KB · Views: 433
Last edited:

MOVZX

Senior Member
Jan 26, 2012
761
388
This is interesting...

I remember there is a way to forcefully boot up your phone.
Try supercharge, I can't find the post for supercharging, but it is like opening up your phone charger's wire, tweak and make its voltage or what so higher, forcing you to temporarily open up your phone, boot into recovery and reflash.
Erm, trying searching through the forum, I remembered I saw it under Sensation or Desire HD's thread.

:) Your warranty is void when you S-Off your phone, I do not really think the store will replace a new phone for you, but... you can try corrupt the whole phone and say it is not your fault, HTC has nice reputations for replacing their phones because of the manufacturing flaws. (HTC is infamous for its of manufacturing problems...)

As long as you do not flash hboot or radio, your phone has a high chance of reviving, good luck :)

http://xdaforums.com/showpost.php?p=17537143&postcount=26


I think I will brick my phone again to test the 'supercharge' method to force boot of bricked HTC Sensation. No worry about it because I have another HTC Sensation too :)
 
Last edited:
  • Like
Reactions: Mohamed Ab M

RussianBear

Recognized Contributor
Nov 10, 2008
2,050
341
My friend's phone also become brick, cannot charge, cannot boot, cannot do anything.
I also have HTC SENSATION and try to enter diag mode then I take QCN file already.


- First I install GSscript and run script to enable diag mode
- Then connect the phone and turn on QPST
- Many times get the no phone connect but 1 time I get my lucky. It can connect and can copy NV (qcn file), backup QCN file.
- After backup QCN file, I try to take Multi-image but it tell me that the current phone is not in Download mode then
it reboot and try to go to dowload mode (the process is fail)
- I try with brick phone in restore tab but it warn that the phone is not in diag mode.

:( :(

Now I plus my phone back and get no-phone connect isssue.

I stuck here, will update if have any information

(sorry about my English)

the "bad" (bricked) phone is in the download mode, which is different from the diagnostic mode the script enables. besides, those qcn files are not what's needed to restore the phone.
see this post and try it: http://xdaforums.com/showpost.php?p=23106274&postcount=29


This is interesting...


http://xdaforums.com/showpost.php?p=17537143&postcount=26


I think I will brick my phone again to test the 'supercharge' method to force boot of bricked HTC Sensation. No worry about it because I have another HTC Sensation too :)

i don't think that will do you any good, but if you're set on trying, don't let me discourage you :)
rather try this: http://xdaforums.com/showpost.php?p=23106274&postcount=29

i haven't been able to tinker with the phone lately, but anybody is more than welcome to.
 

MOVZX

Senior Member
Jan 26, 2012
761
388
Someone from Droid Incredible is reviving the bricked devices I think...

a BIG thanks to wildstang83 for this!

If you are getting vibrates when trying to boot your phone. do the following:

Download

build-3.26.605.1-release-152016-baseband-2.15.00.07.28-hboot-0.92.0000_PB31IMG.zip

google, you will find it.

backup your SD card, format it fat 32 and place this file on the root of your card. Be sure to rename it PB31IMG.zip

Once it is on your sd card, verify the MD5 to ensure the file was not corrupted during the download or during the transfer.

Hold Vol down + power. you will feel 5 vibrations

wait for a god 2 to 3 min. if everything is going correctly, your phone is verifying the IMG file and this takes a bit.

after 2 to 3 min. wait one more min

now, press vol up. this tells the phone to update.

wait 2 to 3 min for the update to happen then wait one more.

press vol up again. you should feel the phone single vibrate and then presto.. working phone again :)

next time be more careful :)

Please let me know if this did not work for you.

THANKS WILDSTANG!! You're what these forums are all about :)

http://xdaforums.com/showpost.php?p=14831391&postcount=9


I will try this method also and I will post the results here, else I will just send back the phone for repair service.
 

duy_ctytvxdkg

Member
Jun 1, 2007
37
5
the "bad" (bricked) phone is in the download mode, which is different from the diagnostic mode the script enables. besides, those qcn files are not what's needed to restore the phone.
see this post and try it: http://xdaforums.com/showpost.php?p=23106274&postcount=29

Bro! The problem here is: I cannot change mode of the good phone to download mode (If I can, I will take a full backup which produce several mbn file), also cannot change mode of the bad phone to diag mode. :mad:
 

skygear

Senior Member
Apr 7, 2006
798
144
I'm not sure what flasher-box is He actually using. But He just told Me that the box He used to repair my HTC Sensation is RIFF-BOX and some pin-out (He just said pin-out or pinout, I'm not really understand) combination. But I can see now my device looks like has been dissected/disassembled (maybe for the repair purpose).

I got the guy from this forum: http://www.bandung-flasher.com (In my country, Bandung-Flasher community is the biggest Flasher Guy support center. They even could repair broken devices way faster and cheaper than the official service center, it's why people in my country never repaired the dead phones to official service center. And they have a huge collection of flasher-box equipment. And Bandung -city- well known also with the biggest Independent/Unofficial Flasher Service).


-------edit------------------
I got the image from the guy:
180gwk.jpg


gpg - furious team...

http://www.gpgindustries.com/news/
thats there new box. I could buy it and charge small amount for repair if people shipped to me in the USA...
20120306GPGJTAG-V1.22-update!!-Samsung-I9100G-and-Samsung-I9108,-OMAP4430-CPU-Supported-630.png
 
Last edited:

RussianBear

Recognized Contributor
Nov 10, 2008
2,050
341
Bro! The problem here is: I cannot change mode of the good phone to download mode (If I can, I will take a full backup which produce several mbn file), also cannot change mode of the bad phone to diag mode. :mad:

why can't you change the good phone into the dl mode? grab a wire and do the pin trick like posted.
forget about the bricked phone for now.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 167
    We are proud to announce that the Sensation is now UNbrickable. Users with the QHSUSB_DLOAD issue can now fully recover their phones and get them fully functional.

    Unbrick-proj-Sensation.jpg


    Note: This will fix only devices which were bricked by turning S ON. And bricks caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device. Any devices bricked with other ways are currently *not* supported. We are working on it

    The "core" of the unbricking project dev team:
    MOVZX
    RussianBear
    Fuses
    Dexter93

    Testing stuff and irc support:
    globatron
    Deceptivechaos
    dburgd84
    Snake_skw

    Other stuff:
    dmcb123
    xIndirect
    Hawke84

    Thanks to trevE, xHausx and the rest of the evo3d team that gave us the basic info to work on and made us curious to see if we could get something out of it. Also thanks to ief and his team @revolutionary for helping us understand the bootloaders better. We should also not forget to thank cxb01 of malshenzu.com and xda members arthurire and untrueparadox who helped in translation.
    82
    Prerequisites
    • a linux box/live cd with automount disabled and without unity
    • the appropriate package for the device
    • the latest RUU for your device
    • a device bricked by writing security flag 3 with an unsigned hboot, or caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device
    • a usb cable
    • some basic linux experience
    • patience

    DISCLAIMER: We do NOT guarantee that this method will work for you, or that it is flawless. We are also not responsible if your phone is completely dead after the procedure, or your house burns down because your phone exploded. You are doing this in YOUR OWN RISK.

    Instructions
    Detailed video on the process. Thanks kgs1992


    1. Boot the linux box and download the appropriate package for the device.
      WARNING: IT IS DEVICE SPECIFIC. DO NOT USE THE XE VERSION ON A 4G/ORIGINAL SENSATION AND VICE VERSA
    2. Extract the package in the home directory
    3. Open up a terminal
    4. Remove SIM, microSD card and battery and connect the device using the USB cable. This procedure must be done without battery
    5. Detect the device using the script provided. Type this in the terminal
      Code:
      ./brickdetect.sh
      You should get something like sdX. We are interested on that "X"
    6. Unplug the usb cable from the device
    7. Backup the hboot currently in the phone by using this command. Plug the device in ONLY when asked to
      Code:
      sudo ./emmc_recover --backup b_hboot.img --device /dev/sdX12
      Replace the "X" with the letter the script gave you
    8. Follow the on-screen instructions from emmc_recover
    9. Hexdump the b_hboot to check the hboot version
      Code:
      hexdump -C b_hboot.img |less
      The output should be like this:
      Code:
      00000000  05 00 00 00 03 00 00 00  00 00 00 00 00 00 10 40  |...............@|
      00000010  d8 fc 0f 00 d8 fb 0f 00  d8 fb 1f 40 00 01 00 00  |...........@....|
      00000020  d8 fc 1f 40 00 00 00 00  12 00 00 ea 31 2e 31 37  |...@........[B]1.17[/B]|
      00000030  2e 31 31 31 31 00 00 00  38 32 36 30 20 53 50 4c  |.1111...8260 SPL|
      00000040  00 00 00 00 00 f0 20 e3  53 48 49 50 00 00 00 00  |...... .SHIP....|
      00000050  00 f0 20 e3 00 f0 20 e3  48 42 4f 4f 54 2d 38 32  |.. ... .HBOOT-82|
      00000060  36 30 00 00 00 f0 20 e3  39 32 65 35 33 37 31 30  |60.... .92e53710|
      This is the typical hex of a hboot. We are interested to check if that is the hboot partition and if it is, to get to know the version. In this case it is 1.17
    10. If in the above step you failed to identify the hboot, unplug all devices connected to that pc, reboot and try again
    11. Unplug the device
    12. Check again it is the right version, because if you do a mistake here, you won't be able to go back
      You can only flash the same version as the one in the device.


      !!!!!DO NOT ATTEMPT TO FLASH ANOTHER VERSION OR DOWNGRADE!!!IT HAS BEEN PROVEN FATAL!!!!
    13. Flash the hboot on the device. Replace "V.VV" with hboot version (eg. 1.17, 1.18, 1.19, 1.20, 1.23, 1.27) and "X" with the one you got from the detect script. Plug the device in ONLY when asked to
      Code:
      sudo ./emmc_recover --flash pyrV.VV.nb0 --device /dev/sdX12 --backupafter hboot_f.nb0
    14. Follow the on-screen instructions from emmc_recover. A successful flash should have this output:
      Code:
      511+1 records in
      511+1 records out
      1047808 bytes(1.0 MB) copied
    15. Unplug the device, put SIM, microSD card and battery in and power on
    16. Congratulations, the device is unbricked.
    17. FLASH THE RUU IMMEDIATELY AFTER RECOVERING!! The device will be unstable after the recovery if you don't flash it.

    Notes on the procedure:

    • If the device doesn't power on, get a copy of the hboot_f.nb0 and b_hboot.img (should be located in the home directory) and contact us
    • The connection between the device and the pc will be unstable, and will time out. You have to be quick when doing the above, specially while flashing. If the connection times out don't panic, just unplug and replug the device
    • Unity and automount are known to cause issues in ubuntu 11.04 and 11.10. We recommend getting rid of both, or use a 12.04, or 10.04/.10 liveCD
    • USB3 ports do not work properly. Please plug the device in a USB2 port
    • The liveCD provided has autoount enabled. please disable it
    • How to disable automount on ubuntu
      Code:
      gsettings set org.gnome.desktop.media-handling automount false


    Downloads

    For Sensation and Sensation 4G:
    32bit version MD5: 859cf1c8f4cc96a9c911ecf696579e6f
    64bit version MD5: d160e90234999a0f8e5ed632d3a2bb4e

    For Sensation XE:
    32bit version MD5: dec2309cc06dbc01398a4a49f8ae13cf
    64bit version MD5: de677136626fe2e096f0a7f48e438978


    Don't have a linux distro installed on your pc? We highly recommend this livecd
    18
    It is unbelievable how many writesecureflag bricked devices there are in this world!!

    I write this little tool to help people to unbrick those phones. It also helps unbrick those phones that can be in emmc_mode only few seconds. It uses dd to flash images into device.

    In this guide I will assume that hboot is causing that brick and hboot is at /dev/sdb12 when emmc_mode enabled phone is connected.

    What you need:
    1) Bricked sensation :D
    2) Linux, If you want to use windows you have to wait that somebody makes emmc_mode stable. If you don't have Linux installed, some Live-cd should be fine.
    3) signed hboot from original rom you are using
    4) This little tool called emmc_recover
    5) Figure out what will be correct device node when phone is in emmc_mode
    It is usually /dev/sda /dev/sdb /dev/sdc etc.

    With this tool you can reflash any partition you want. SO BE CAREFUL.

    There are few options in this tool:
    Code:
    emmc_recovery 0.1 usage:
    emmc_recovery [OPTIONS]
    	-h | --help: display this help
    	-b | --backup
    	-f | --flash
    	-d | --device

    How to use it (You have to root):
    1) First BACKUP partition
    Code:
    ./emmc_recover --backup backupfile.img --device /dev/sdb12
    This will backup current sensation hboot into file backupfile.img.

    2) Check that this really is correct partition
    Code:
    hexdump -C backupfile.img |less
    It should be something like this for hboot
    Code:
    00000000  05 00 00 00 03 00 00 00  00 00 00 00 00 00 10 40  |...............@|
    00000010  d8 fc 0f 00 d8 fb 0f 00  d8 fb 1f 40 00 01 00 00  |...........@....|
    00000020  d8 fc 1f 40 00 00 00 00  12 00 00 ea 31 2e 31 38  |...@........1.18|
    00000030  2e 30 30 30 30 00 00 00  38 32 36 30 20 53 50 4c  |.0000...8260 SPL|
    00000040  00 00 00 00 00 f0 20 e3  53 48 49 50 00 00 00 00  |...... .SHIP....|
    00000050  00 f0 20 e3 00 f0 20 e3  48 42 4f 4f 54 2d 38 32  |.. ... .HBOOT-82|
    00000060  36 30 00 00 00 f0 20 e3  39 64 32 34 31 32 33 66  |60.... .9d24123f|
    3) If backup was successfull, flash new hboot
    Code:
    ./emmc_recover --flash hboot_xxxx.xxx.xx.xx.xx.nb0 --device /dev/sdb12
    4) Done.

    Below are usual output from tool:
    Code:
    emmc_recovery 0.1
    Messing up with device /dev/sdb12, ARE YOU SURE? (CTRL+C if not)
    
    Flashing image file is hboot_xxxx.xxx.xx.xx.xx.nb0
    Device is /dev/sdb12
    
    Press ENTER if everything is correct, CTRL+C if not
    
    Connect device into emmc partition mode NOW
    Waiting device /dev/sdb12.......
    Foundit!
    512+0 records in
    512+0 records out
    1048576 bytes (1.0 MB) copied, 0.740003 s, 1.4 MB/s
    Return code is 0

    Connect device into computer when you see line.
    Code:
    Waiting device /dev/sdb12.......

    Not before!!

    NOTE: There may be bugs present....
    11
    awesome!

    any people that know chinese, we need your help:

    a chinese forum where a member posted a guide on how to de-brick a phone (zte u960) from qhsusb_mode:

    http://bbs.malshenzu.com/read-htm-tid-38591-page-1.html

    http://bbs.malshenzu.com/read-htm-tid-41957-page-1.html ( Sales MultiDL tool guide)

    they use an additional tool (Sales MultiDL) that backs up alot of .mbn and .img files that we don't have (yet), so i'm not sure if we can pull those files out of the phone manually, or what?

    80_4747_74ac8bc91c00562.jpg


    translation per untrueparadox:

    1. choose program mode
    2. select the .hex and .mbn files from the included package
    3. load the .xml included in the package
    ____ the path to xml file will show here
    4. after selecting everything, click download to revive the brick

    the files they used to flash:

    80_4747_6a6329c38cb962f.jpg




    anyone knows Chinese (google chrome translator is ok for basic understanding, but nothing more than that)? :)
    i did pm the op of those threads to see what he thinks.
    11
    Oh my God...

    Dude... Looks like I have my God besides Me... And my heart is now crying (really)...

    MY PHONE IS NOW ON!! IT COULD BE TURNED ON AGAIN!!


    Thanks God! I really need a beer, I'm going to go now for a celebration...

    PS: I will write tutorials to resurrect the bootloader as soon as possible...


    Thanks XDA Dev... And now I'm sure we'll be able too so ressurrect any phone with MSM8260/MSM8660 including EVO 3D...