[Guide] Root your Elephone U Pro Manual

Search This thread

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Root Elephone U Pro

Foreword:
It was a long way to get root on the U Pro and dangerous , i could brick my phone , but finally its done!
It wasn't my own work at all. We all shared ideas and thoughts . We that are
Mr. Fünke (not an xda member) @Maherabed1986 @lKinder_Bueno @dypak and me @skeleton1911 .
so thanks goes also to them.
In the last days we spent hours and hours to get not only root . ( but this is another chapter, soon more :D:D )
Took the last OTA 20180227 Build and extracted the payload.bin (in it are all images etc.) Surprise :p
the System has a second partition table of all images . called _a and _b ( example: boot_a.img , boot_b.img)
thats a good thing, because if one gets damaged the Bootloader will boot the other Partition.
i could write many more but lets come to the Topic.



Code:
[SIZE="3"][COLOR="Red"]#/Disclaimer[/COLOR]

* I am not responsible for anything/bricked devices, dead SD cards,
* thermonuclear war, or exploding cars.
[/SIZE]

What do we need for Root our U Pro

1. QPST flashtools (qualcomm)
2. Qualcomm Drivers for the Device
3. a firehose file for SDM660
4. rawprogram_unsparse and patch0.xml
6. patched_boot.img
7.ADB
8.unlocked bootloader

Uploaded all here: https://1drv.ms/u/s!Am93l3qEx-D_hJZQQpXbjL45aKcUiQ only for 20180227

TOOL FILES https://1drv.ms/u/s!Am93l3qEx-D_hOcLmv0inQJ-vrVdLg

IF YOU USE QFIL FLASHTOOLS YOU DONT NEED TO UNLOCK THE BOOTLOADER:
THIS IS ONLY NECCESARY IF YOU WANT TO USE FASTBOOT COMMANDS: SINCE 20180423 BASE

(files are at the bottom of this post)

Also enable USB Debugging in settings/system/developer settings
(tap 7 times on the build number in settings/system/phone info if you dont have developer settings)
we need an unlocked bootloader
Enable OEM unlock in developer settings..

If you unlocked the bootloader , that will wipe your userdata and
you have the google protection password screen.
Notice: if your password dont work , no panic! just enter 30 times a wrong password with minimal 5 letters and the phone will make a factory reset.


for unlock bootloader do:
Code:
adb shell
Code:
reboot bootloader
and
Code:
fastboot flashing unlock
that will wipe userdata!
after that you can enter recovery via bootloader or it reboots itself to it . when you see the red android icon . hold power and vol- 5 seconds and then slide to vol+ and back to vol- or try : press power and then click on vol+
that will enter recovery, then reboot , you will have to enter the google password 30times (look above)
After the phone is back on Homescreen , enable usb debugging again and use adb

Code:
adb shell
Code:
reboot edl



1. install ADB . (newest ADB files are in the zip) . copy the "adb" folder to C:/
2. install the QPST/QFIL Flashtool
3. install Qualcomm Drivers

-----------------------------------------------------------------

Connect your phone to pc
when all is installed open a command (cmd) and go to your adb folder
Code:
C:\>cd adb
we need to reboot the phone to the EDL mode (emergency download mode) to use the Flashtool :
Code:
adb shell
reboot edl
phone will reboot to edl mode ( black screen, no led)

Now check your device manager . the COM & LTP port should show "Qualcomm HS-USB QDLoader 9008"
if not then update the driver and choose it from your internal list. or google for it :D

if the driver is fine, open the QPST/QFIL FLashtool in
Code:
C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe

prepare the Flashtool:

in Select Build Type:
choose: Flat Build

in Select Programmer:
browse and choose the "prog_emmc_ufs_firehose_Sdm660_ddr.elf" file
( you cant see it change to "all files" )

Load XML:
now choose the rawprogram_unsparse.xml and right after the patch0.xml

you can press the "download button"

wait a bit , at the end of the flashing procedure it will make an error, thats normal because i left the patch0.xml empty.

after all disconnect the cable and hold Power button a few seconds. phone will reboot and you have root.
install magisk manager.apk from magisk thread .

enjoy:)


This is the boot.img of the boot_b partition and will root the system_b.
the system_a is untouched , also the boot_a.img . so if an OTA will come you can install it with no problem.
BTW after you installed magisk manager.apk , choose install again and direct download to get magisk files into system.


IF YOU USE QFIL FLASHTOOLS YOU DONT NEED TO UNLOCK THE BOOTLOADER:
THIS IS ONLY NECCESARY IF YOU WANT TO USE FASTBOOT COMMANDS: SINCE 20180423 BASE


20180227 Root Boot.img
Flashable via QFIL Flashtools only!
you dont need to be unlock. just install qfil and its drivers...
Go here: https://1drv.ms/u/s!Am93l3qEx-D_hJZPwPoJzH4zTrkLqQ


20180423 Root Boot.img
use QFil flashtools when you dont want to unlock your bootloader- (unlocking bootloader will wipe your data)
if you want fastboot commands unlock the bootloader and flash the boot.img via fastboot . ( you have to be in bootloader mode )
for this place only the boot.img to your adb folder and do this commands

GO here: https://1drv.ms/u/s!Am93l3qEx-D_hJZODc_2yG3Kl-VTow

20180511 Root Boot.img
Rooted Boot.img .- https://1drv.ms/u/s!Am93l3qEx-D_hJZv4OOlKoGa6BFxdA
you can use this with the files above ( raw.xml etc for QFIL , or flash it via fastboot if you are unlocked

go to bootloader mode with
Code:
adb shell
reboot bootloader

then
Code:
fastboot flash boot_a boot.img

and

Code:
fastboot flash boot_b boot.img

thats all.
easy to do
after install magisk manager to activate root
 
Last edited:

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
maybe some of you are interested in the partitions and sectors of the U pro to take out a dump or make a rawprogram_unparse.xml for a fullrom

i took them out with adb for you :

Code:
Number  Start      End         Size        File system  Name          Flags
 1      131072s    138239s     7168s                    xbl_a
 2      138240s    145407s     7168s                    xbl_b
 3      145408s    153599s     8192s                    tz_a
 4      153600s    161791s     8192s                    tz_b
 5      161792s    162815s     1024s                    rpm_a
 6      162816s    163839s     1024s                    rpm_b
 7      163840s    164863s     1024s                    hyp_a
 8      164864s    165887s     1024s                    hyp_b
 9      165888s    166911s     1024s                    pmic_a
10      166912s    167935s     1024s                    pmic_b
11      167936s    172031s     4096s                    fsg
12      262144s    393215s     131072s                  boot_a
13      393216s    524287s     131072s                  boot_b
14      524288s    6815743s    6291456s    ext4         system_a
15      6815744s   13107199s   6291456s    ext4         system_b
16      13107200s  14745599s   1638400s    ext4         vendor_a
17      14745600s  16383999s   1638400s    ext4         vendor_b
18      16384000s  16386047s   2048s                    keymaster_a
19      16386048s  16388095s   2048s                    keymaster_b
20      16388096s  16390143s   2048s                    cmnlib_a
21      16390144s  16392191s   2048s                    cmnlib64_a
22      16392192s  16394239s   2048s                    cmnlib_b
23      16394240s  16396287s   2048s                    cmnlib64_b
24      16396288s  16404479s   8192s                    mdtpsecapp_a
25      16404480s  16412671s   8192s                    mdtpsecapp_b
26      16412672s  16478207s   65536s                   mdtp_a
27      16478208s  16543743s   65536s                   mdtp_b
28      16543744s  16769023s   225280s     fat16        modem_a
29      16769024s  16994303s   225280s     fat16        modem_b
30      16994304s  17027071s   32768s      ext4         dsp_a
31      17027072s  17059839s   32768s      ext4         dsp_b
32      17059840s  17061887s   2048s                    abl_a
33      17061888s  17063935s   2048s                    abl_b
34      17063936s  17065983s   2048s                    dip
35      17065984s  17065991s   8s                       devinfo
36      17065992s  17066503s   512s                     apdp
37      17066504s  17067015s   512s                     msadp
38      17067016s  17067017s   2s                       dpo
39      17067024s  17133871s   66848s                   splash
40      17133872s  17133879s   8s                       limits
41      17133880s  17135927s   2048s                    toolsfv
42      17170432s  17186815s   16384s                   logfs
43      17301504s  17303551s   2048s                    ddr
44      17303552s  17303583s   32s                      sec
45      17303584s  17305631s   2048s                    bluetooth_a
46      17305632s  17307679s   2048s                    bluetooth_b
47      17432576s  17436671s   4096s                    prodinfo
48      17436672s  17457151s   20480s      ext4         factory
49      17457152s  17477631s   20480s      ext4         factorybak
50      17477632s  17477633s   2s                       fsc
51      17477640s  17477655s   16s                      ssd
52      17477656s  17481751s   4096s                    modemst1
53      17481752s  17485847s   4096s                    modemst2
54      17485848s  17551383s   65536s      ext4         persist
55      17551384s  17553431s   2048s                    misc
56      17553432s  17554455s   1024s                    keystore
57      17554456s  17556503s   2048s                    devcfg_a
58      17556504s  17558551s   2048s                    devcfg_b
59      17558552s  17559575s   1024s                    frp
60      17559576s  17690647s   131072s                  logdump
61      17690648s  17694743s   4096s                    sti
6
2      17825792s  17826047s   256s                     storsec
63      17956864s  18219007s   262144s                  rawdump
64      18219008s  18219135s   128s                     vbmeta_a
65      18219136s  18219263s   128s                     vbmeta_b
66      18350080s  244277214s  225927135s               userdata


Code:
[SIZE="3"]1|U_Pro:/ # ls -l /dev/block/platform/soc/c0c4000.sdhci/by-name
total 0
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 abl_a -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 abl_b -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 apdp -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 bluetooth_a -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 bluetooth_b -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 boot_a -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 boot_b -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib64_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib64_b -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib_a -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib_b -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 ddr -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devcfg_a -> /dev/block/mmcblk0p57
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devcfg_b -> /dev/block/mmcblk0p58
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devinfo -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dip -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dpo -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dsp_a -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dsp_b -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 factory -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 factorybak -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 frp -> /dev/block/mmcblk0p59
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 fsc -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 fsg -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 hyp_a -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 hyp_b -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keymaster_a -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keymaster_b -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keystore -> /dev/block/mmcblk0p56
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 limits -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 logdump -> /dev/block/mmcblk0p60
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 logfs -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtp_a -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtp_b -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtpsecapp_a -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtpsecapp_b -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 misc -> /dev/block/mmcblk0p55
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modem_a -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modem_b -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modemst1 -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modemst2 -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 msadp -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 persist -> /dev/block/mmcblk0p54
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 pmic_a -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 pmic_b -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 prodinfo -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 rawdump -> /dev/block/mmcblk0p63
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 rpm_a -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 rpm_b -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 sec -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 splash -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 ssd -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 sti -> /dev/block/mmcblk0p61
lrwxrwxrwx 1 root root 21 19
70-01-08 10:22 storsec -> /dev/block/mmcblk0p62
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 system_a -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 system_b -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 toolsfv -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 tz_a -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 tz_b -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 userdata -> /dev/block/mmcblk0p66
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vbmeta_a -> /dev/block/mmcblk0p64
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vbmeta_b -> /dev/block/mmcblk0p65
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vendor_a -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vendor_b -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 xbl_a -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 20 1970-01-08 10:22 xbl_b -> /dev/block/mmcblk0p2[/SIZE]
 

Laptapper

Senior Member
Jan 17, 2016
3,070
2,277
Root Elephone U Pro

Foreword:
It was a long way to get root on the U Pro and dangerous , i could brick my phone , but finally its done!
It wasn't my own work at all. We all shared ideas and thoughts . We that are
Mr. Fünke (not an xda member) @Maherabed1986 @lKinder_Bueno @dypak and me @skeleton1911 .
so thanks goes also to them.
In the last days we spent hours and hours to get not only root . ( but this is another chapter, soon more :D:D )
Took the last OTA 20180227 Build and extracted the payload.bin (in it are all images etc.) Surprise :p
the System has a second partition table of all images . called _a and _b ( example: boot_a.img , boot_b.img)
thats a good thing, because if one gets damaged the Bootloader will boot the other Partition.
i could write many more but lets come to the Topic.



Code:
[SIZE="3"][COLOR="Red"]#/Disclaimer[/COLOR]

* I am not responsible for anything/bricked devices, dead SD cards,
* thermonuclear war, or exploding cars.
[/SIZE]

What do we need for Root our U Pro

1. QPST flashtools (qualcomm)
2. Qualcomm Drivers for the Device
3. a firehose file for SDM660
4. rawprogram_unsparse and patch0.xml
5. python-2.7.13.amd64
6. patched_boot.img
7.ADB

Uploaded all here: https://androidfilehost.com/?fid=673956719939832819

Also enable USB Debugging in settings/system/developer settings
(tap 7 times on the build number in settings/system/phone info if you dont have developer settings)
we dont need an unlocked bootloader.
If you unlocked the bootloader already and dont locked it again the flashtool will do it , that could wipe all userdata and
you have the google protection password screen.
Notice: if your password dont work , no panic! just enter 30 times a wrong password with minimal 5 letters and the phone will make a factory reset.


1. install ADB . (newest ADB files are in the zip) . copy the "adb" folder to C:/
2. install the QPST/QFIL Flashtool
3. install python 2.7.13
4. install Qualcomm Drivers

-----------------------------------------------------------------

Connect your phone to pc
when all is installed open a command (cmd) and go to your adb folder
Code:
C:\>cd adb
we need to reboot the phone to the EDL mode (emergency download mode) to use the Flashtool :
Code:
adb shell
reboot edl
phone will reboot to edl mode ( black screen, no led)

Now check your device manager . the COM & LTP port should show "Qualcomm HS-USB QDLoader 9008"
if not then update the driver and choose it from your internal list. or google for it :D

if the driver is fine, open the QPST/QFIL FLashtool in
Code:
C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe

prepare the Flashtool:

in Select Build Type:
choose: Flat Build

in Select Programmer:
browse and choose the "prog_emmc_ufs_firehose_Sdm660_ddr.elf" file
( you cant see it change to "all files" )

Load XML:
now choose the rawprogram_unsparse.xml and right after the patch0.xml

you can press the "download button"

wait a bit , at the end of the flashing procedure it will make an error, thats normal because i left the patch0.xml empty.

after all disconnect the cable and hold Power button a few seconds. phone will reboot and you have root.
install magisk manager.apk from magisk thread .

enjoy:)


This is the boot.img of the boot_b partition and will root the system_b.
the system_a is untouched , also the boot_a.img . so if an OTA will come you can install it with no problem.
BTW after you installed magisk manager.apk , choose install again and direct download to get magisk files into system.



Hello skeleton
Thanks for the perfect job!
May you can help me, I've done all steps and all went fine except after magisk manager installation I've to choose download zip only or patch boot.img. I tried both but only download is for twrp and patching boot.img I can only patch it on as card ?
What's the next step ?
 

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Hello skeleton
Thanks for the perfect job!
May you can help me, I've done all steps and all went fine except after magisk manager installation I've to choose download zip only or patch boot.img. I tried both but only download is for twrp and patching boot.img I can only patch it on as card ?
What's the next step ?
In magisk manager tap on install , a new window pops up. Choose directly install.

That's all. After it downloaded and flashed the file you can reboot.


Wait.
Do you see direct install?


Gesendet von meinem U_Pro mit Tapatalk
 

Laptapper

Senior Member
Jan 17, 2016
3,070
2,277
No I didn't see direct install

---------- Post added at 10:36 AM ---------- Previous post was at 10:32 AM ----------

In magisk manager tap on install , a new window pops up. Choose directly install.

That's all. After it downloaded and flashed the file you can reboot.


Wait.
Do you see direct install?


Gesendet von meinem U_Pro mit Tapatalk

No I didn't see direct install.
 

mzsquared

Senior Member
Feb 22, 2018
710
342
CT
Success! I have gotten my UPro rooted! Thanks so much Skeleton! I'm new to it, I did something wrong at my first attempt, the flushing stopped, wrong path
on my pc or something, but it gave me a scare when I had to enter like, x10 a pin and at some point there was some warnings that the phone will be locked out after 9 more trials. I've managed to shut it off and go manually to recovery and do factory reset. The second time was the charm, the end of the flushing hangs on some error(as you predicted) and then this big relief, the phone comes to life!

https://drive.google.com/file/d/1RYP40jVhYsQXAu8ZBxz_zrByGxEIXtzw/view?usp=sharing
 
Last edited:
  • Like
Reactions: skeleton1911

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Success! I have gotten my UPro rooted! Thanks so much Skeleton! I'm new to it, I did something wrong at my first attempt, the flushing stopped, wrong path
on my pc or something, but it gave me a scare when I had to enter like, x10 a pin and at some point there was some warnings that the phone will be locked out after 9 more trials. I've managed to shut it off and go manually to recovery and do factory reset. The second time was the charm, the end of the flushing hangs on some error(as you predicted) and then this big relief, the phone comes to life!

https://drive.google.com/file/d/1RYP40jVhYsQXAu8ZBxz_zrByGxEIXtzw/view?usp=sharing

yep . that it hangs at the end of the flashtool is normal. because i left the patch0.xml empty...
also you didnt reboot to recovery. just enter the password . 10 times and phone display. please reboot info. after that another 10 times. phone displays a reboot info. after that it shows that it will reboot itself and delete userdata after another 10 times .... that is not part of my mistaken. its because of googles protection laws....
 

mzsquared

Senior Member
Feb 22, 2018
710
342
CT
In magisk manager tap on install , a new window pops up. Choose directly install.

That's all. After it downloaded and flashed the file you can reboot.


Wait.
Do you see direct install?


Gesendet von meinem U_Pro mit Tapatalk

I used Total Commander from Google Play, had MagiskAPK on mu sd card, Total Commander asks for permission to install "other sources app" and it's done.
 

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
I used Total Commander from Google Play, had MagiskAPK on mu sd card, Total Commander asks for permission to install "other sources app" and it's done.

thanks. but thats not the problem of @Laptapper.
i think he is not on the latest build. because we have _a and _b system.
the latest build is on _b . also the root is only in _b

he could use cmd and adb in bootlader mode
fastboot set_active b
Setting current slot to 'b'...

but that will not work . the bootloader in the u pro is a bit strange. :D tested many things
 

abbas

Senior Member
Dec 10, 2003
266
40
Ibadan, NIGERIA
Did u finally get root?

---------- Post added at 09:40 PM ---------- Previous post was at 09:37 PM ----------

thanks. but thats not the problem of @Laptapper.
i think he is not on the latest build. because we have _a and _b system.
the latest build is on _b . also the root is only in _b

he could use cmd and adb in bootlader mode
fastboot set_active b
Setting current slot to 'b'...

but that will not work . the bootloader in the u pro is a bit strange. :D tested many things

Same boat. I could not get root.
 

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Did u finally get root?

---------- Post added at 09:40 PM ---------- Previous post was at 09:37 PM ----------



Same boat. I could not get root.

Strange . For many users it works. For some not.
One user told me that he installed the ota with the fota app.
And then he flashed the ota.zip again. So he did installed it twice.
For him the root also don't work.
So maybe _a and _b partitions are the same now.
And the system is running in _a partition now.
The root only goes to _b partition.
That could be an explaining for it..

Also can you send me the Qfil log ?
 

abbas

Senior Member
Dec 10, 2003
266
40
Ibadan, NIGERIA
Strange . For many users it works. For some not.
One user told me that he installed the ota with the fota app.
And then he flashed the ota.zip again. So he did installed it twice.
For him the root also don't work.
So maybe _a and _b partitions are the same now.
And the system is running in _a partition now.
The root only goes to _b partition.
That could be an explaining for it..

Also can you send me the Qfil log ?

Thanks for your help. This is my log

Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
RESETSAHARASTATEEMACHINE:False
SEARCHPATH:C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM:
rawprogram_unsparse.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
AUTOPRESERVEPARTITIONS:False
PARTITIONPRESERVEMODE:0
PRESERVEDPARTITIONS:0
PRESERVEDPARTITIONS:
ERASEALL:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM file path: C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml
PATCH file path:C:\Users\abbas\Desktop\boot_b_root__QPST\patch0.xml
Programmer Path:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
Process Index:0
Image Search Path: C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM file path: C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml
PATCH file path:C:\Users\abbas\Desktop\boot_b_root__QPST\patch0.xml
Start Download
Program Path:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
22:52:17: Requested ID 13, file: "C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf"
22:52:18: 629284 bytes transferred in 0.313000 seconds (1.9174MBps)
22:52:18: File transferred successfully
22:52:18: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Base Version: 16.10.28.15.28
Binary build date: Oct 31 2016 @ 22:51:02
Incremental Build version: 16.10.31.22.51.02
22:52:22: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM10 --sendxml=rawprogram_unsparse.xml --search_path=C:\Users\abbas\Desktop\boot_b_root__QPST --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
************************************************
22:52:22: INFO: Current working dir (cwd): C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\
22:52:22: INFO: Showing network mappings to allow debugging
22:52:22: INFO:
22:52:22: INFO: Trying to store 'rawprogram_unsparse.xml' in string table
22:52:22: INFO: Looking for file 'rawprogram_unsparse.xml'
22:52:22: INFO: User wants to talk to port '\\.\COM10'
22:52:22: INFO: Took 0.00000000 seconds to open port
22:52:22: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
22:52:22: INFO: If you don't want this, use --dontsorttags
22:52:22: INFO: Looking for file 'boot.img'
22:52:22: INFO:
Total to be tansferd with <program> or <read> is 47.79 MB
22:52:22: INFO: Sending <configure>
22:52:22: INFO: TARGET SAID: 'UFS DEVICE RESET'
22:52:22: INFO: TARGET SAID: 'Binary build date: Dec 8 2017 @ 13:33:11'
22:52:22: INFO: TARGET SAID: 'Chip serial num: 0 (0x0)'
22:52:22: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '
22:52:22: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
22:52:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
22:52:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
22:52:22: INFO: In handleProgram('boot.img')
22:52:22: INFO: Looking for file 'boot.img'
22:52:22: INFO: =======================================================
22:52:22: INFO: {<program> FILE: 'C:\Users\abbas\Desktop\boot_b_root__QPST\boot.img'}
22:52:22: INFO: {<program> (47.79 MB) 97883 sectors needed at location 393216 on LUN 0}
22:52:22: INFO: =======================================================
22:52:23: INFO: TARGET SAID: 'start 393216, num 97883'
22:52:24: INFO: Overall to target 1.391 seconds (34.36 MBps)
22:52:24: INFO: {percent files transferred 100.00%}
22:52:24: INFO: TARGET SAID: 'Finished programming start_sector 491099 and TotalSectorsToProgram 97883'
22:52:24: INFO:
22:52:24: INFO: =======================================================
22:52:24: INFO: ==================== {SUCCESS} ========================
22:52:24: INFO: =======================================================
22:52:24: INFO: {percent files transferred 100.00%}
22:52:24: INFO: ==============================================================
22:52:24: INFO: Files used and their paths
22:52:24: INFO: 1 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
22:52:24: INFO: 2 'C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml'
22:52:24: INFO: 3 'C:\Users\abbas\Desktop\boot_b_root__QPST\boot.img'
22:52:24: INFO: _ (done)
22:52:24: INFO: | |
22:52:24: INFO: __| | ___ _ __ ___
22:52:24: INFO: / _` |/ _ \| '_ \ / _ \
22:52:24: INFO: | (_| | (_) | | | | __/
22:52:24: INFO: \__,_|\___/|_| |_|\___|
22:52:24: INFO: {All Finished Successfully}
22:52:24: INFO: Overall to target 1.657 seconds (28.84 MBps)
22:52:24: INFO: {percent files transferred 100.00%}
Writing log to 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt', might take a minute
Log is 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Base Version: 16.10.28.15.28
Binary build date: Oct 31 2016 @ 22:51:02
Incremental Build version: 16.10.31.22.51.02
22:52:27: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM10 --sendxml=patch0.xml --search_path=C:\Users\abbas\Desktop\boot_b_root__QPST --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
************************************************
22:52:27: INFO: Current working dir (cwd): C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\
22:52:27: INFO: Showing network mappings to allow debugging
22:52:28: INFO:
22:52:28: INFO: Trying to store 'patch0.xml' in string table
22:52:28: INFO: Looking for file 'patch0.xml'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:52:28: {ERROR: XML packet not formed correctly. Ran out of room looking for TAG}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:52:28: {ERROR: XML is not formatted correctly. Could not find closing />
}
Writing log to 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt', might take a minute
Log is 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
Download Fail:FireHose Fail:FHLoader Fail:process fail
Finish Download
 

Attachments

  • 131675251591104689.log
    8.1 KB · Views: 28

Laptapper

Senior Member
Jan 17, 2016
3,070
2,277
thanks. but thats not the problem of @Laptapper.
i think he is not on the latest build. because we have _a and _b system.
the latest build is on _b . also the root is only in _b

he could use cmd and adb in bootlader mode
fastboot set_active b
Setting current slot to 'b'...

but that will not work . the bootloader in the u pro is a bit strange. :D tested many things


Hello skeleton
Many thanks for your private chat support! I've tried a lot of things alone but only in case of your know-how to get a bricked phone working again.
I've got root now :highfive:
For me it's clear now that the problem was in my manually update of the full it's file. The phone has booted alone after the update and so I think it changed from image a to b.
I've done the update again and it has booted again.
Then I've removed all flashing software from Windows 10 and deleted old drivers. Complete clean up with registry clean with temp clean........
Then I've installed all of your tools again except python , here I took python 3 (by the way: we've talked about my short flashing time.....it was exactly short as before).
So may be also python could be the problem before but I guess it was the full ota.
Anyway ....for those who had problems like me try to flash the ota again (if before was done) or because better AND clean up all and then try again.
Many thanks again to the elephone u pro conqueror skeleton
Hopefully he will go further on with a full rom with twrp. And for this I've send him some dollars and I'll hope the other users will do it like me.
 

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Hello skeleton
Many thanks for your private chat support! I've tried a lot of things alone but only in case of your know-how to get a bricked phone working again.
I've got root now :highfive:
For me it's clear now that the problem was in my manually update of the full it's file. The phone has booted alone after the update and so I think it changed from image a to b.
I've done the update again and it has booted again.
Then I've removed all flashing software from Windows 10 and deleted old drivers. Complete clean up with registry clean with temp clean........
Then I've installed all of your tools again except python , here I took python 3 (by the way: we've talked about my short flashing time.....it was exactly short as before).
So may be also python could be the problem before but I guess it was the full ota.
Anyway ....for those who had problems like me try to flash the ota again (if before was done) or because better AND clean up all and then try again.
Many thanks again to the elephone u pro conqueror skeleton
Hopefully he will go further on with a full rom with twrp. And for this I've send him some dollars and I'll hope the other users will do it like me.

Thank you very much :) i appreciate it
 

skeleton1911

Senior Member
May 4, 2012
10,488
14,765
münster
Thanks for your help. This is my log

Validating Application Configuration
Load APP Configuration
COM:-1
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
RESETSAHARASTATEEMACHINE:False
SEARCHPATH:C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM:
rawprogram_unsparse.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
AUTOPRESERVEPARTITIONS:False
PARTITIONPRESERVEMODE:0
PRESERVEDPARTITIONS:0
PRESERVEDPARTITIONS:
ERASEALL:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM file path: C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml
PATCH file path:C:\Users\abbas\Desktop\boot_b_root__QPST\patch0.xml
Programmer Path:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
Process Index:0
Image Search Path: C:\Users\abbas\Desktop\boot_b_root__QPST
RAWPROGRAM file path: C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml
PATCH file path:C:\Users\abbas\Desktop\boot_b_root__QPST\patch0.xml
Start Download
Program Path:C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf
22:52:17: Requested ID 13, file: "C:\Users\abbas\Desktop\boot_b_root__QPST\prog_emmc_ufs_firehose_Sdm660_ddr.elf"
22:52:18: 629284 bytes transferred in 0.313000 seconds (1.9174MBps)
22:52:18: File transferred successfully
22:52:18: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Base Version: 16.10.28.15.28
Binary build date: Oct 31 2016 @ 22:51:02
Incremental Build version: 16.10.31.22.51.02
22:52:22: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM10 --sendxml=rawprogram_unsparse.xml --search_path=C:\Users\abbas\Desktop\boot_b_root__QPST --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
************************************************
22:52:22: INFO: Current working dir (cwd): C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\
22:52:22: INFO: Showing network mappings to allow debugging
22:52:22: INFO:
22:52:22: INFO: Trying to store 'rawprogram_unsparse.xml' in string table
22:52:22: INFO: Looking for file 'rawprogram_unsparse.xml'
22:52:22: INFO: User wants to talk to port '\\.\COM10'
22:52:22: INFO: Took 0.00000000 seconds to open port
22:52:22: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
22:52:22: INFO: If you don't want this, use --dontsorttags
22:52:22: INFO: Looking for file 'boot.img'
22:52:22: INFO:
Total to be tansferd with <program> or <read> is 47.79 MB
22:52:22: INFO: Sending <configure>
22:52:22: INFO: TARGET SAID: 'UFS DEVICE RESET'
22:52:22: INFO: TARGET SAID: 'Binary build date: Dec 8 2017 @ 13:33:11'
22:52:22: INFO: TARGET SAID: 'Chip serial num: 0 (0x0)'
22:52:22: INFO: TARGET SAID: 'Supported Functions: program configure nop firmwarewrite patch setbootablestoragedrive ufs emmc power benchmark read getstorageinfo getsha256digest erase peek poke '
22:52:22: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''
22:52:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
22:52:22: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
22:52:22: INFO: In handleProgram('boot.img')
22:52:22: INFO: Looking for file 'boot.img'
22:52:22: INFO: =======================================================
22:52:22: INFO: {<program> FILE: 'C:\Users\abbas\Desktop\boot_b_root__QPST\boot.img'}
22:52:22: INFO: {<program> (47.79 MB) 97883 sectors needed at location 393216 on LUN 0}
22:52:22: INFO: =======================================================
22:52:23: INFO: TARGET SAID: 'start 393216, num 97883'
22:52:24: INFO: Overall to target 1.391 seconds (34.36 MBps)
22:52:24: INFO: {percent files transferred 100.00%}
22:52:24: INFO: TARGET SAID: 'Finished programming start_sector 491099 and TotalSectorsToProgram 97883'
22:52:24: INFO:
22:52:24: INFO: =======================================================
22:52:24: INFO: ==================== {SUCCESS} ========================
22:52:24: INFO: =======================================================
22:52:24: INFO: {percent files transferred 100.00%}
22:52:24: INFO: ==============================================================
22:52:24: INFO: Files used and their paths
22:52:24: INFO: 1 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
22:52:24: INFO: 2 'C:\Users\abbas\Desktop\boot_b_root__QPST\rawprogram_unsparse.xml'
22:52:24: INFO: 3 'C:\Users\abbas\Desktop\boot_b_root__QPST\boot.img'
22:52:24: INFO: _ (done)
22:52:24: INFO: | |
22:52:24: INFO: __| | ___ _ __ ___
22:52:24: INFO: / _` |/ _ \| '_ \ / _ \
22:52:24: INFO: | (_| | (_) | | | | __/
22:52:24: INFO: \__,_|\___/|_| |_|\___|
22:52:24: INFO: {All Finished Successfully}
22:52:24: INFO: Overall to target 1.657 seconds (28.84 MBps)
22:52:24: INFO: {percent files transferred 100.00%}
Writing log to 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt', might take a minute
Log is 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
***** Working Folder:C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10
Base Version: 16.10.28.15.28
Binary build date: Oct 31 2016 @ 22:51:02
Incremental Build version: 16.10.31.22.51.02
22:52:27: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM10 --sendxml=patch0.xml --search_path=C:\Users\abbas\Desktop\boot_b_root__QPST --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc
************************************************
22:52:27: INFO: Current working dir (cwd): C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\
22:52:27: INFO: Showing network mappings to allow debugging
22:52:28: INFO:
22:52:28: INFO: Trying to store 'patch0.xml' in string table
22:52:28: INFO: Looking for file 'patch0.xml'
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:52:28: {ERROR: XML packet not formed correctly. Ran out of room looking for TAG}
_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|
22:52:28: {ERROR: XML is not formatted correctly. Could not find closing />
}
Writing log to 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt', might take a minute
Log is 'C:\Users\abbas\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
Download Fail:FireHose Fail:FHLoader Fail:process fail
Finish Download

Flash was fine.
look a post above . maybe thats also the solution for you
 
  • Like
Reactions: abbas

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    maybe some of you are interested in the partitions and sectors of the U pro to take out a dump or make a rawprogram_unparse.xml for a fullrom

    i took them out with adb for you :

    Code:
    Number  Start      End         Size        File system  Name          Flags
     1      131072s    138239s     7168s                    xbl_a
     2      138240s    145407s     7168s                    xbl_b
     3      145408s    153599s     8192s                    tz_a
     4      153600s    161791s     8192s                    tz_b
     5      161792s    162815s     1024s                    rpm_a
     6      162816s    163839s     1024s                    rpm_b
     7      163840s    164863s     1024s                    hyp_a
     8      164864s    165887s     1024s                    hyp_b
     9      165888s    166911s     1024s                    pmic_a
    10      166912s    167935s     1024s                    pmic_b
    11      167936s    172031s     4096s                    fsg
    12      262144s    393215s     131072s                  boot_a
    13      393216s    524287s     131072s                  boot_b
    14      524288s    6815743s    6291456s    ext4         system_a
    15      6815744s   13107199s   6291456s    ext4         system_b
    16      13107200s  14745599s   1638400s    ext4         vendor_a
    17      14745600s  16383999s   1638400s    ext4         vendor_b
    18      16384000s  16386047s   2048s                    keymaster_a
    19      16386048s  16388095s   2048s                    keymaster_b
    20      16388096s  16390143s   2048s                    cmnlib_a
    21      16390144s  16392191s   2048s                    cmnlib64_a
    22      16392192s  16394239s   2048s                    cmnlib_b
    23      16394240s  16396287s   2048s                    cmnlib64_b
    24      16396288s  16404479s   8192s                    mdtpsecapp_a
    25      16404480s  16412671s   8192s                    mdtpsecapp_b
    26      16412672s  16478207s   65536s                   mdtp_a
    27      16478208s  16543743s   65536s                   mdtp_b
    28      16543744s  16769023s   225280s     fat16        modem_a
    29      16769024s  16994303s   225280s     fat16        modem_b
    30      16994304s  17027071s   32768s      ext4         dsp_a
    31      17027072s  17059839s   32768s      ext4         dsp_b
    32      17059840s  17061887s   2048s                    abl_a
    33      17061888s  17063935s   2048s                    abl_b
    34      17063936s  17065983s   2048s                    dip
    35      17065984s  17065991s   8s                       devinfo
    36      17065992s  17066503s   512s                     apdp
    37      17066504s  17067015s   512s                     msadp
    38      17067016s  17067017s   2s                       dpo
    39      17067024s  17133871s   66848s                   splash
    40      17133872s  17133879s   8s                       limits
    41      17133880s  17135927s   2048s                    toolsfv
    42      17170432s  17186815s   16384s                   logfs
    43      17301504s  17303551s   2048s                    ddr
    44      17303552s  17303583s   32s                      sec
    45      17303584s  17305631s   2048s                    bluetooth_a
    46      17305632s  17307679s   2048s                    bluetooth_b
    47      17432576s  17436671s   4096s                    prodinfo
    48      17436672s  17457151s   20480s      ext4         factory
    49      17457152s  17477631s   20480s      ext4         factorybak
    50      17477632s  17477633s   2s                       fsc
    51      17477640s  17477655s   16s                      ssd
    52      17477656s  17481751s   4096s                    modemst1
    53      17481752s  17485847s   4096s                    modemst2
    54      17485848s  17551383s   65536s      ext4         persist
    55      17551384s  17553431s   2048s                    misc
    56      17553432s  17554455s   1024s                    keystore
    57      17554456s  17556503s   2048s                    devcfg_a
    58      17556504s  17558551s   2048s                    devcfg_b
    59      17558552s  17559575s   1024s                    frp
    60      17559576s  17690647s   131072s                  logdump
    61      17690648s  17694743s   4096s                    sti
    6
    2      17825792s  17826047s   256s                     storsec
    63      17956864s  18219007s   262144s                  rawdump
    64      18219008s  18219135s   128s                     vbmeta_a
    65      18219136s  18219263s   128s                     vbmeta_b
    66      18350080s  244277214s  225927135s               userdata


    Code:
    [SIZE="3"]1|U_Pro:/ # ls -l /dev/block/platform/soc/c0c4000.sdhci/by-name
    total 0
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 abl_a -> /dev/block/mmcblk0p32
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 abl_b -> /dev/block/mmcblk0p33
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 apdp -> /dev/block/mmcblk0p36
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 bluetooth_a -> /dev/block/mmcblk0p45
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 bluetooth_b -> /dev/block/mmcblk0p46
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 boot_a -> /dev/block/mmcblk0p12
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 boot_b -> /dev/block/mmcblk0p13
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib64_a -> /dev/block/mmcblk0p21
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib64_b -> /dev/block/mmcblk0p23
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib_a -> /dev/block/mmcblk0p20
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 cmnlib_b -> /dev/block/mmcblk0p22
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 ddr -> /dev/block/mmcblk0p43
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devcfg_a -> /dev/block/mmcblk0p57
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devcfg_b -> /dev/block/mmcblk0p58
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 devinfo -> /dev/block/mmcblk0p35
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dip -> /dev/block/mmcblk0p34
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dpo -> /dev/block/mmcblk0p38
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dsp_a -> /dev/block/mmcblk0p30
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 dsp_b -> /dev/block/mmcblk0p31
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 factory -> /dev/block/mmcblk0p48
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 factorybak -> /dev/block/mmcblk0p49
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 frp -> /dev/block/mmcblk0p59
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 fsc -> /dev/block/mmcblk0p50
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 fsg -> /dev/block/mmcblk0p11
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 hyp_a -> /dev/block/mmcblk0p7
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 hyp_b -> /dev/block/mmcblk0p8
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keymaster_a -> /dev/block/mmcblk0p18
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keymaster_b -> /dev/block/mmcblk0p19
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 keystore -> /dev/block/mmcblk0p56
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 limits -> /dev/block/mmcblk0p40
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 logdump -> /dev/block/mmcblk0p60
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 logfs -> /dev/block/mmcblk0p42
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtp_a -> /dev/block/mmcblk0p26
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtp_b -> /dev/block/mmcblk0p27
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtpsecapp_a -> /dev/block/mmcblk0p24
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 mdtpsecapp_b -> /dev/block/mmcblk0p25
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 misc -> /dev/block/mmcblk0p55
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modem_a -> /dev/block/mmcblk0p28
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modem_b -> /dev/block/mmcblk0p29
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modemst1 -> /dev/block/mmcblk0p52
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 modemst2 -> /dev/block/mmcblk0p53
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 msadp -> /dev/block/mmcblk0p37
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 persist -> /dev/block/mmcblk0p54
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 pmic_a -> /dev/block/mmcblk0p9
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 pmic_b -> /dev/block/mmcblk0p10
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 prodinfo -> /dev/block/mmcblk0p47
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 rawdump -> /dev/block/mmcblk0p63
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 rpm_a -> /dev/block/mmcblk0p5
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 rpm_b -> /dev/block/mmcblk0p6
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 sec -> /dev/block/mmcblk0p44
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 splash -> /dev/block/mmcblk0p39
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 ssd -> /dev/block/mmcblk0p51
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 sti -> /dev/block/mmcblk0p61
    lrwxrwxrwx 1 root root 21 19
    70-01-08 10:22 storsec -> /dev/block/mmcblk0p62
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 system_a -> /dev/block/mmcblk0p14
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 system_b -> /dev/block/mmcblk0p15
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 toolsfv -> /dev/block/mmcblk0p41
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 tz_a -> /dev/block/mmcblk0p3
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 tz_b -> /dev/block/mmcblk0p4
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 userdata -> /dev/block/mmcblk0p66
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vbmeta_a -> /dev/block/mmcblk0p64
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vbmeta_b -> /dev/block/mmcblk0p65
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vendor_a -> /dev/block/mmcblk0p16
    lrwxrwxrwx 1 root root 21 1970-01-08 10:22 vendor_b -> /dev/block/mmcblk0p17
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 xbl_a -> /dev/block/mmcblk0p1
    lrwxrwxrwx 1 root root 20 1970-01-08 10:22 xbl_b -> /dev/block/mmcblk0p2[/SIZE]
    3
    Root Elephone U Pro

    Foreword:
    It was a long way to get root on the U Pro and dangerous , i could brick my phone , but finally its done!
    It wasn't my own work at all. We all shared ideas and thoughts . We that are
    Mr. Fünke (not an xda member) @Maherabed1986 @lKinder_Bueno @dypak and me @skeleton1911 .
    so thanks goes also to them.
    In the last days we spent hours and hours to get not only root . ( but this is another chapter, soon more :D:D )
    Took the last OTA 20180227 Build and extracted the payload.bin (in it are all images etc.) Surprise :p
    the System has a second partition table of all images . called _a and _b ( example: boot_a.img , boot_b.img)
    thats a good thing, because if one gets damaged the Bootloader will boot the other Partition.
    i could write many more but lets come to the Topic.



    Code:
    [SIZE="3"][COLOR="Red"]#/Disclaimer[/COLOR]
    
    * I am not responsible for anything/bricked devices, dead SD cards,
    * thermonuclear war, or exploding cars.
    [/SIZE]

    What do we need for Root our U Pro

    1. QPST flashtools (qualcomm)
    2. Qualcomm Drivers for the Device
    3. a firehose file for SDM660
    4. rawprogram_unsparse and patch0.xml
    6. patched_boot.img
    7.ADB
    8.unlocked bootloader

    Uploaded all here: https://1drv.ms/u/s!Am93l3qEx-D_hJZQQpXbjL45aKcUiQ only for 20180227

    TOOL FILES https://1drv.ms/u/s!Am93l3qEx-D_hOcLmv0inQJ-vrVdLg

    IF YOU USE QFIL FLASHTOOLS YOU DONT NEED TO UNLOCK THE BOOTLOADER:
    THIS IS ONLY NECCESARY IF YOU WANT TO USE FASTBOOT COMMANDS: SINCE 20180423 BASE

    (files are at the bottom of this post)

    Also enable USB Debugging in settings/system/developer settings
    (tap 7 times on the build number in settings/system/phone info if you dont have developer settings)
    we need an unlocked bootloader
    Enable OEM unlock in developer settings..

    If you unlocked the bootloader , that will wipe your userdata and
    you have the google protection password screen.
    Notice: if your password dont work , no panic! just enter 30 times a wrong password with minimal 5 letters and the phone will make a factory reset.


    for unlock bootloader do:
    Code:
    adb shell
    Code:
    reboot bootloader
    and
    Code:
    fastboot flashing unlock
    that will wipe userdata!
    after that you can enter recovery via bootloader or it reboots itself to it . when you see the red android icon . hold power and vol- 5 seconds and then slide to vol+ and back to vol- or try : press power and then click on vol+
    that will enter recovery, then reboot , you will have to enter the google password 30times (look above)
    After the phone is back on Homescreen , enable usb debugging again and use adb

    Code:
    adb shell
    Code:
    reboot edl



    1. install ADB . (newest ADB files are in the zip) . copy the "adb" folder to C:/
    2. install the QPST/QFIL Flashtool
    3. install Qualcomm Drivers

    -----------------------------------------------------------------

    Connect your phone to pc
    when all is installed open a command (cmd) and go to your adb folder
    Code:
    C:\>cd adb
    we need to reboot the phone to the EDL mode (emergency download mode) to use the Flashtool :
    Code:
    adb shell
    reboot edl
    phone will reboot to edl mode ( black screen, no led)

    Now check your device manager . the COM & LTP port should show "Qualcomm HS-USB QDLoader 9008"
    if not then update the driver and choose it from your internal list. or google for it :D

    if the driver is fine, open the QPST/QFIL FLashtool in
    Code:
    C:\Program Files (x86)\Qualcomm\QPST\bin\QFIL.exe

    prepare the Flashtool:

    in Select Build Type:
    choose: Flat Build

    in Select Programmer:
    browse and choose the "prog_emmc_ufs_firehose_Sdm660_ddr.elf" file
    ( you cant see it change to "all files" )

    Load XML:
    now choose the rawprogram_unsparse.xml and right after the patch0.xml

    you can press the "download button"

    wait a bit , at the end of the flashing procedure it will make an error, thats normal because i left the patch0.xml empty.

    after all disconnect the cable and hold Power button a few seconds. phone will reboot and you have root.
    install magisk manager.apk from magisk thread .

    enjoy:)


    This is the boot.img of the boot_b partition and will root the system_b.
    the system_a is untouched , also the boot_a.img . so if an OTA will come you can install it with no problem.
    BTW after you installed magisk manager.apk , choose install again and direct download to get magisk files into system.


    IF YOU USE QFIL FLASHTOOLS YOU DONT NEED TO UNLOCK THE BOOTLOADER:
    THIS IS ONLY NECCESARY IF YOU WANT TO USE FASTBOOT COMMANDS: SINCE 20180423 BASE


    20180227 Root Boot.img
    Flashable via QFIL Flashtools only!
    you dont need to be unlock. just install qfil and its drivers...
    Go here: https://1drv.ms/u/s!Am93l3qEx-D_hJZPwPoJzH4zTrkLqQ


    20180423 Root Boot.img
    use QFil flashtools when you dont want to unlock your bootloader- (unlocking bootloader will wipe your data)
    if you want fastboot commands unlock the bootloader and flash the boot.img via fastboot . ( you have to be in bootloader mode )
    for this place only the boot.img to your adb folder and do this commands

    GO here: https://1drv.ms/u/s!Am93l3qEx-D_hJZODc_2yG3Kl-VTow

    20180511 Root Boot.img
    Rooted Boot.img .- https://1drv.ms/u/s!Am93l3qEx-D_hJZv4OOlKoGa6BFxdA
    you can use this with the files above ( raw.xml etc for QFIL , or flash it via fastboot if you are unlocked

    go to bootloader mode with
    Code:
    adb shell
    reboot bootloader

    then
    Code:
    fastboot flash boot_a boot.img

    and

    Code:
    fastboot flash boot_b boot.img

    thats all.
    easy to do
    after install magisk manager to activate root
    3
    Great job buddy very clear explaining
    Wish you the best as always
    3
    thanks. but thats not the problem of @Laptapper.
    i think he is not on the latest build. because we have _a and _b system.
    the latest build is on _b . also the root is only in _b

    he could use cmd and adb in bootlader mode
    fastboot set_active b
    Setting current slot to 'b'...

    but that will not work . the bootloader in the u pro is a bit strange. :D tested many things


    Hello skeleton
    Many thanks for your private chat support! I've tried a lot of things alone but only in case of your know-how to get a bricked phone working again.
    I've got root now :highfive:
    For me it's clear now that the problem was in my manually update of the full it's file. The phone has booted alone after the update and so I think it changed from image a to b.
    I've done the update again and it has booted again.
    Then I've removed all flashing software from Windows 10 and deleted old drivers. Complete clean up with registry clean with temp clean........
    Then I've installed all of your tools again except python , here I took python 3 (by the way: we've talked about my short flashing time.....it was exactly short as before).
    So may be also python could be the problem before but I guess it was the full ota.
    Anyway ....for those who had problems like me try to flash the ota again (if before was done) or because better AND clean up all and then try again.
    Many thanks again to the elephone u pro conqueror skeleton
    Hopefully he will go further on with a full rom with twrp. And for this I've send him some dollars and I'll hope the other users will do it like me.
    3
    After Many hours of coding i was able to build a working 20180227 Stock image!

    wow i made the first stock base, faster then official release of elephone. xD

    a new thread will come soon