[UNBRICK] HTC Unbricking Project

dexter93 · Feb 28, 2012

We are proud to announce that the Sensation is now UNbrickable. Users with the QHSUSB_DLOAD issue can now fully recover their phones and get them fully functional.

Note: This will fix only devices which were bricked by turning S ON. And bricks caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device. Any devices bricked with other ways are currently *not* supported. We are working on it

The "core" of the unbricking project dev team:
MOVZX
RussianBear
Fuses
Dexter93
Testing stuff and irc support:
globatron
Deceptivechaos
dburgd84
Snake_skw
Other stuff:
dmcb123
xIndirect
Hawke84

Thanks to trevE, xHausx and the rest of the evo3d team that gave us the basic info to work on and made us curious to see if we could get something out of it. Also thanks to ief and his team @revolutionary for helping us understand the bootloaders better. We should also not forget to thank cxb01 of malshenzu.com and xda members arthurire and untrueparadox who helped in translation.

dexter93 · Feb 28, 2012

Prerequisites

a linux box/live cd with automount disabled and without unity
the appropriate package for the device
the latest RUU for your device
a device bricked by writing security flag 3 with an unsigned hboot, or caused by a damaged hboot via interrupted OTA update/RUU flash on a S-ON device
a usb cable
some basic linux experience
patience

DISCLAIMER: We do NOT guarantee that this method will work for you, or that it is flawless. We are also not responsible if your phone is completely dead after the procedure, or your house burns down because your phone exploded. You are doing this in YOUR OWN RISK.

Instructions

Detailed video on the process. Thanks kgs1992

Boot the linux box and download the appropriate package for the device.
WARNING: IT IS DEVICE SPECIFIC. DO NOT USE THE XE VERSION ON A 4G/ORIGINAL SENSATION AND VICE VERSA
Extract the package in the home directory
Open up a terminal
Remove SIM, microSD card and battery and connect the device using the USB cable. This procedure must be done without battery
Detect the device using the script provided. Type this in the terminal
Code:
```
./brickdetect.sh
```
You should get something like sdX. We are interested on that "X"
Unplug the usb cable from the device
Backup the hboot currently in the phone by using this command. Plug the device in ONLY when asked to
Code:
```
sudo ./emmc_recover --backup b_hboot.img --device /dev/sdX12
```
Replace the "X" with the letter the script gave you
Follow the on-screen instructions from emmc_recover

Hexdump the b_hboot to check the hboot version

Code:

hexdump -C b_hboot.img |less

The output should be like this:

Code:

00000000  05 00 00 00 03 00 00 00  00 00 00 00 00 00 10 40  |...............@|
00000010  d8 fc 0f 00 d8 fb 0f 00  d8 fb 1f 40 00 01 00 00  |...........@....|
00000020  d8 fc 1f 40 00 00 00 00  12 00 00 ea 31 2e 31 37  |...@........[B]1.17[/B]|
00000030  2e 31 31 31 31 00 00 00  38 32 36 30 20 53 50 4c  |.1111...8260 SPL|
00000040  00 00 00 00 00 f0 20 e3  53 48 49 50 00 00 00 00  |...... .SHIP....|
00000050  00 f0 20 e3 00 f0 20 e3  48 42 4f 4f 54 2d 38 32  |.. ... .HBOOT-82|
00000060  36 30 00 00 00 f0 20 e3  39 32 65 35 33 37 31 30  |60.... .92e53710|

This is the typical hex of a hboot. We are interested to check if that is the hboot partition and if it is, to get to know the version. In this case it is 1.17

If in the above step you failed to identify the hboot, unplug all devices connected to that pc, reboot and try again
Unplug the device
Check again it is the right version, because if you do a mistake here, you won't be able to go back
You can only flash the same version as the one in the device.

!!!!!DO NOT ATTEMPT TO FLASH ANOTHER VERSION OR DOWNGRADE!!!IT HAS BEEN PROVEN FATAL!!!!
Flash the hboot on the device. Replace "V.VV" with hboot version (eg. 1.17, 1.18, 1.19, 1.20, 1.23, 1.27) and "X" with the one you got from the detect script. Plug the device in ONLY when asked to
Code:
```
sudo ./emmc_recover --flash pyrV.VV.nb0 --device /dev/sdX12 --backupafter hboot_f.nb0
```
Follow the on-screen instructions from emmc_recover. A successful flash should have this output:
Code:
```
511+1 records in
511+1 records out
1047808 bytes(1.0 MB) copied
```
Unplug the device, put SIM, microSD card and battery in and power on
Congratulations, the device is unbricked.
FLASH THE RUU IMMEDIATELY AFTER RECOVERING!! The device will be unstable after the recovery if you don't flash it.

Notes on the procedure:

If the device doesn't power on, get a copy of the hboot_f.nb0 and b_hboot.img (should be located in the home directory) and contact us
The connection between the device and the pc will be unstable, and will time out. You have to be quick when doing the above, specially while flashing. If the connection times out don't panic, just unplug and replug the device
Unity and automount are known to cause issues in ubuntu 11.04 and 11.10. We recommend getting rid of both, or use a 12.04, or 10.04/.10 liveCD
USB3 ports do not work properly. Please plug the device in a USB2 port
The liveCD provided has autoount enabled. please disable it

How to disable automount on ubuntu

Code:

gsettings set org.gnome.desktop.media-handling automount false

Downloads

For Sensation and Sensation 4G:
32bit version MD5: 859cf1c8f4cc96a9c911ecf696579e6f
64bit version MD5: d160e90234999a0f8e5ed632d3a2bb4e

For Sensation XE:
32bit version MD5: dec2309cc06dbc01398a4a49f8ae13cf
64bit version MD5: de677136626fe2e096f0a7f48e438978

Don't have a linux distro installed on your pc? We highly recommend this livecd

RussianBear · Feb 28, 2012

awesome!

any people that know chinese, we need your help:

a chinese forum where a member posted a guide on how to de-brick a phone (zte u960) from qhsusb_mode:

http://bbs.malshenzu.com/read-htm-tid-38591-page-1.html

http://bbs.malshenzu.com/read-htm-tid-41957-page-1.html ( Sales MultiDL tool guide)

they use an additional tool (Sales MultiDL) that backs up alot of .mbn and .img files that we don't have (yet), so i'm not sure if we can pull those files out of the phone manually, or what?

translation per untrueparadox:

1. choose program mode
2. select the .hex and .mbn files from the included package
3. load the .xml included in the package
____ the path to xml file will show here
4. after selecting everything, click download to revive the brick

the files they used to flash:

anyone knows Chinese (google chrome translator is ok for basic understanding, but nothing more than that)?

i did pm the op of those threads to see what he thinks.

dmcb123 · Feb 28, 2012

Yes a devs thread

So now we basically just have to wait to find out how to get the mbn files?

Sent from my HTC Sensation Z710e using XDA Premium App

RussianBear · Feb 28, 2012

dexter93 said:
----//notes//----

*the phone wont connect in diag mode using custom roms other than stock. certainly not with ics roms
*more pictures are available in the two threads mentioned

Dex, i'm on gb build of insert coin and diag works for me

dexter93 · Feb 28, 2012

RussianBear said:
Dex, i'm on gb build of insert coin and diag works for me

thanks. fixed it
it wouldnt work on ics insertcoin for me. it was missing some files( probably those werent even in the test ruu, or baad removed them)

RussianBear · Feb 28, 2012

if somebody doesn't like this thread (the one star rating), then contact a moderator or the op with your concerns. i don't see what is there not to like?

dmcb123 · Feb 28, 2012

Found this. not sure if it helps but it's worth a look

http://www.scribd.com/doc/19215998/Qualcomm-Qpst-27-Users-Guide-2006

Some stuff about creating an mbn.

RussianBear · Feb 28, 2012

dmcb123 said:
Found this. not sure if it helps but it's worth a look
http://www.scribd.com/doc/19215998/Qualcomm-Qpst-27-Users-Guide-2006

Some stuff about creating an mbn.

search for "amss" in that pdf- seems like they've already had mentions of dual core msm chips back in 2006 (page 60). this guide is pretty cool! look up page 155-onwards as well.

need to find a newer version of this guide as well.

dexter93 · Feb 28, 2012

RussianBear said:
search for "amss" in that pdf- seems like they've already had mentions of dual core msm chips back in 2006 (page 60). this guide is pretty cool! look up page 155-onwards as well.

need to find a newer version of this guide as well.

the new version is included in the qpst download. check it

RussianBear · Feb 28, 2012

http://tjworld.net/wiki/Android/HTC/Vision

very cool stuff there. the guy dissects everything!

---------- Post added at 04:28 PM ---------- Previous post was at 04:27 PM ----------

dexter93 said:
the new version is included in the qpst download. check it

i skimmed thru it last night, will do again tonight

dmcb123 · Feb 28, 2012

RussianBear said:
http://tjworld.net/wiki/Android/HTC/Vision

very cool stuff there. the guy dissects everything!

---------- Post added at 04:28 PM ---------- Previous post was at 04:27 PM ----------

i skimmed thru it last night, will do again tonight

Damn that is pretty comprehensive

RussianBear · Feb 28, 2012

another translation request, please.

http://wenku.baidu.com/view/5da95a6ba98271fe910ef9a2.html

---------- Post added at 05:41 PM ---------- Previous post was at 05:34 PM ----------

check this: http://android.modaco.com/topic/351690-zte-firmware-package-for-v11a-aka-vodafone-smarttab10/

i'll try to find a ruu or some kind of firmware for sensation to see if it has anything similar.
i think the phone's partition layout gets erased and we need the xml file to re-map it again. just a guess...

dexter93 · Feb 28, 2012

Guys we have to abandon it too... there is no fix with the way we are trying

I finally found IEF on the revolutionary irc and he told me that all these bricks happened because people went s on with modified, unsigned by htc, hboots. He also told me that under s on, we cant try anything, not even via QSPT, cause we would gain nothing. The only way of fixing that is by flashing the eMMC externally, using JTAG.
here is the conversation

[01:06] <@IEF> dexter93: you can't.
[01:06] <@IEF> simply put.
[01:06] <dexter93> not even via qspt?
[01:06] <@IEF> no
[01:06] <@IEF> that is for radio flashing
[01:07] <@IEF> and will get you nowhere under S-ON, even if you had all the other pieces.
[01:07] <dexter93> couldnt we just flash the phone again?
[01:07] <@IEF> that's what I said, not by software
[01:08] <@IEF> unless you consider JTAG sofware.
[01:08] <dexter93> but?
[01:08] <dexter93> by putting the device n download mode, do i gain something?
[01:08] <T-Junk> no butts..
[01:08] <@IEF> QCDL *is* download mode.
[01:08] <dexter93> qcdl?
[01:09] <@IEF> sigh
[01:09] <@IEF> the serial ports you get after bricking hboot.
[01:09] <dexter93> sorry... im a noob on those
[01:09] <@IEF> most people are, because you won't get anywhere without a proper loader
[01:10] <dexter93> and there is no way to bring it back to life?
[01:10] <@IEF> RMA
[01:10] <dexter93> any chance we can get that proper loader?
[01:11] <@IEF> did you honestly expect me to put it in those terms if I already had it?
[01:11] <@IEF> and again, it would gain you very little. QCDL is traditionally for baseband flashing
[01:11] <dexter93> i get it..
[01:12] <@IEF> signed hboots are a *security* measure for a reason.
[01:12] <dexter93> restoring a factory mbn wouldnt do the job?
[01:13] <@IEF> that's the same thing
[01:13] <dexter93> so that means that even htc cant fix that?
[01:14] <@IEF> ofcourse they can
[01:14] <@IEF> they can just flash the eMMC externally
[01:14] <dexter93> and why cant we?
[01:14] <dexter93> externally?
[01:14] <@IEF> ffs
[01:14] <@IEF> JTAG.
[01:14] <@IEF> this is getting pretty tiresome
[01:15] <dexter93> sorry to bother you ief
[01:15] <dexter93> and thanks for your time
[01:15] <dexter93> im just looking for some answers
[01:15] <@IEF> yeah, you could at least read up on some basic recovery procedures
[01:16] <@IEF> this is not exactly secret information
[01:16] <dexter93> i searched, but couldnt find anything
[01:16] <@IEF> if you don't have the skills to understand that or apply them, or do not have the access to it, there's really no point in asking
[01:16] <@IEF> that's what RMA is for
[01:16] <@IEF> and they may charge you for it, well within their rights
[01:17] <sfrost> trying to use revolutionary, I put in the correct info and got a key, but the program is saying its invalid ( thunderbolt with 1.04
[01:17] <dexter93> well, im patient and willing to learn
[01:18] <@IEF> it's not about willing to learn
[01:18] <@IEF> it's about having access to tools that only a chipset manufacturer has.
[01:19] <dexter93> i suppose that jtag development is out of the question without board schematics, right?
[01:22] <@IEF> no idea. you'd ask someone with a lot of JTAG experience.
[01:30] <dexter93> anyway, ill do a small research on that...
[01:30] <dexter93> thanks for the info

As you see there is no hope. And from a quick google search, JTAG is not available yet for our devices. That means only HTC RMA can deal with it...

RussianBear · Feb 29, 2012

dexter93 said:
Guys we have to abandon it too... there is no fix with the way we are trying

I finally found IEF on the revolutionary irc and he told me that all these bricks happened because people went s on with modified, unsigned by htc, hboots. He also told me that under s on, we cant try anything, not even via QSPT, cause we would gain nothing. The only way of fixing that is by flashing the eMMC externally, using JTAG.
here is the conversation

As you see there is no hope. And from a quick google search, JTAG is not available yet for our devices. That means only HTC RMA can deal with it...

i don't know, man. those chinese guys seem to be on it. check this pdf:

http://www.docin.com/p-323426686.html

page 30.

AndroidNeophyte · Feb 29, 2012

Well fix or not... Thank you for all the efforts you guys put in for the community... You guys are awesome...

Sent from my HTC Sensation 4G with Beats Audio

untrueparadox · Feb 29, 2012

1、下载售后线刷。http://bbs.malshenzu.com/read-htm-tid-41602-fpage-2.html
download program for flashing here
2、安装SalesMultiDL_U960V1.00.03.exe，到SalesMultiDL安装好的目录（x:\Program Files\ZTE\SalesMultiDL_U960V1.00.03\Win32Driver）找SP驱动(ZTE_SPRD_TD_Handset_USB_DRIVER.exe)，双击安装。(win7 32位的机油请右键选定该文件，选“兼容性”设为“XP”)
install sales...1.00.03.exe, go to SalesMultiDL folder (x:\program..\Win32Driver) to find the driver ZTE_SPRD_TD_Handset_USB_DRIVER.exe. install it . for windows 7 32 bit, right click, go to properties, run with xp compatibility.
3、装完驱动后接USB线，手机拨号界面输入 *983*376#，选“SP_download”，系统会进行驱动安装。
（此时装驱动比刷到89%才装会有更高的成功率）
after installing the driver and connecting the usb cable, dial that *983...# and choose SP_download, system will go into download mode.
4、下载setmode，运行setmode，手机重启。
download setmode, run it and reboot phone
5、拨掉USB线，开SalesMultiDL，选好线刷包目录，及SP的bin包。
disconnect usb cable, open salesmultidl, choose package to flash in the menu and sp bin file.
6、接上USB线，手机再次重启。手机重启时拔掉USB线，避免进入充电模式。
connect usb, reboot phone again and disconnect usb to avoid going into usb charging mode
7、手机见到G3首屏后接上USB线，售后官刷将显示“点右键下载”，点右键进行下载。
（点下载之前你怎样拔USB线都无所谓，但点了“下载”之后就不能拔线了。）
after seeing g3 boot screen, connect usb. in the software, right click on the menu that says right click to download. after you click download, do not unplug usb.

hope this helps guys. the link above shows similar stuff except if you dont see the setmode command and if you have a virtual cd drive from joinme or any other service, disable it.

不到一个月，已遇上两例“Qhsusb-Dload”的砖机，貌似这种情形还在蔓延，还是写个教程，方便大伙自救
大伙不爱回帖，只好隐一下，有怪莫怪。
after a month, i had two similar bricked phones. this situation is not rare so here's a tutorial. hope it helps.

1、安装Qhsusb-Dload驱动。
download Qh...load driver
装完驱动会有端口出现（由于俺没砖，只能模拟了）
after install, ports will show up. it will be virtual (i have no idea what this means)
【音量加和减同时按着，再点开机，无震动，但插USB有驱动安装，没砖的机油可先用此法装上驱动，以备不时之需】
hold volume up + down, turn on phone, no vibrate. when you insert usb and install driver, the driver will install.

2、QPST添加端口。
add port in QPST

3、打开线刷工具emmc software download。
open flashing tool

4、线刷包中对应的.hex和.mbn文件。
select packages

5、刷机。
flash phone

and if you guys need this too

RussianBear said:
hey, man! thanks for the translation!

could you translate this pic, please?

from this guide: http://bbs.malshenzu.com/read-htm-tid-38591-page-1.html

i'm really interested what the whole guide means

p.s. that picture is hidden in step 5. you need to post something on that forum to unlock it, but i guess, you can read Chinese

Thank you!

1. choose program mode
2. select the .hex and .mbn files from the included package
3. load the .xml included in the package
____ the path to xml file will show here
4. after selecting everything, click download to revive the brick

cpittman · Feb 29, 2012

i think you're missing ief's point. most if not all sensation bricks aside from failed eMMC, are caused by flashing a non signed hboot during the process of returning to s-ON. Once you are s-ON the eMMC becomes write protected meaning even if you did manage to write anything it wouldn't stick.

RussianBear · Feb 29, 2012

cpittman said:
i think you're missing ief's point. most if not all sensation bricks aside from failed eMMC, are caused by flashing a non signed hboot during the process of returning to s-ON. Once you are s-ON the eMMC becomes write protected meaning even if you did manage to write anything it wouldn't stick.

appreciate all the constructive criticism.

from here: http://android.modaco.com/topic/335078-retrieving-mbn-files/page__view__findpost__p__1642041

Unfortunately , you can't get a raw nand image dump by just using QPST. You can however get a full RAM dump by putting the phone in download mode (by switching it on while holding the Vol+ and Vol- keys) and using revskills. You can then "cut" the obtained image and extract oemsbl & C.

P.S. Diagnostic (FTM) Mode and Download Mode are not the same. While in Download Mode, you can send the phone a bootloader and have it run on the ARM9 (baseband) processor. With a properly written/patched bootloader you have full access to the phone hardware, including the nand. Phone flasher sends its own bootloader (armprgZTE.bin) to the phone and then use it to flash the images... we could patch it to allow nand reading.

P.P.S. NV items contain values that must be stored in a Non-Volatile way (e.g. IMEI, lock status, ...).

and also, how do you explain Chinese guys successfully (allegedly) de-bricking their phones?

either way, once we can get something similar to this (same msm chip as ours):

http://android.modaco.com/topic/351724-flashing-zte-unsigned-roms/page__p__1902193#entry1902193

rawprogram0.xml 7.762 17.11.2011 16:49 -a--c
patch0.xml 1.573 17.11.2011 16:49 -a--c
partition.xml 3.705 02.09.2011 15:38 -a--c
tz.mbn 103.960 17.11.2011 16:00 -a--c
sbl3.mbn 622.592 17.11.2011 16:00 -a--c
sbl2.mbn 108.652 17.11.2011 15:58 -a--c
sbl1.mbn 71.840 17.11.2011 15:56 -a--c
rpm.mbn 116.420 17.11.2011 15:59 -a--c
partition.mbn 9.728 17.11.2011 16:49 -a--c
emmcbld.mbn 167.008 26.10.2011 10:31 -a--c
emmc_appsboot.mbn 72.000 06.12.2011 05:17 -a--c
cefs2.mbn 3.145.728 18.11.2011 15:21 -a--c
cefs1.mbn 3.145.728 18.11.2011 15:21 -a--c
amss.mbn 18.969.240 17.11.2011 16:48 -a--c
8660_msimage.mbn 1.679.872 18.11.2011 15:36 -a--c
recovery.img 5.195.776 06.12.2011 05:17 -a--c
boot.img 4.620.288 06.12.2011 05:17 -a--c
MPRG8660.hex 467.026 18.08.2011 16:02 -a--c
userdata.img.ext4 4.096.000 11.08.2011 05:54 -a--c
system.img.ext4 660.602.880 06.12.2011 05:17 -a--c
persist.img.ext4 4.496.000 06.12.2011 05:17 -a--c
cache.img.ext4 4.096.000 06.12.2011 05:17 -a--c
partition.bin 26.112 17.11.2011 16:49 -a--c
NON-HLOS.bin 25.081.344 17.11.2011 16:49 -a--c
MBR0.bin 512 17.11.2011 16:49 -a--c
EBR0.bin 9.216 17.11.2011 16:49 -a--c
cdrom.bin 10.485.760 16.11.2011 15:09 -a--c

or

and have a person with a brick try it out, then i will admit that this either failed or succeeded.

dexter93 · Feb 29, 2012

RussianBear said:
appreciate all the constructive criticism.

from here: http://android.modaco.com/topic/335078-retrieving-mbn-files/page__view__findpost__p__1642041

and also, how do you explain Chinese guys successfully (allegedly) de-bricking their phones?

either way, once we can get something similar to this (same msm chip as ours):

http://android.modaco.com/topic/351724-flashing-zte-unsigned-roms/page__p__1902193#entry1902193

or

and have a person with a brick try it out, then i will admit that this either failed or succeeded.

As I told you in the pm, we could unbrick that way only S OFF phones -really rare cases to be bricked that way. Also the Chinese guys were messing with ZTE bootloaders, which I doubt that they have the security of HTC's . If you insist and we find a volunteer with a bricked device, I guess we could try it... The worst case scenario is to stay bricked.

Sent from my HTC Sensation XE with Beats Audio Z715e using Tapatalk

[UNBRICK] HTC Unbricking Project

Did this work?

Yes!

No

I'm Waiting For Release

Inactive Recognized Developer

Inactive Recognized Developer

Recognized Contributor

Senior Member

Recognized Contributor

Inactive Recognized Developer

Recognized Contributor

Senior Member

Recognized Contributor

Inactive Recognized Developer

Recognized Contributor

Senior Member

Recognized Contributor

Inactive Recognized Developer

Recognized Contributor

Senior Member

Senior Member

Senior Member

Recognized Contributor

Inactive Recognized Developer

Similar threads

Top Liked Posts