FORUMS
Remove All Ads from XDA

HTC One A9 Sprint hard-brick, Need Internal Memory Dump

9 posts
Thanks Meter: 0
 
By bogdan#, Junior Member on 2nd July 2016, 06:22 PM
Post Reply Email Thread
Hi, guys.
I have HTC One A9 Sprint hard-bricked as "Qualcomm HS-USB QDLoader 9008" black screen and not visible in adb/fastboot
fastboot getvar all (before it bricked)
e:\HTC One A9>fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_hiaewhl
(bootloader) version: 1.0
(bootloader) imei: 9900057********
(bootloader) version-main: 1.57.651.1
(bootloader) boot-mode: download
(bootloader) version-baseband: [email protected]
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 2PQ930000
(bootloader) cid: SPCS_001
all:
finished. total time: 0.024s

At first I had new phone with Spint-locked sim.
I unlocked bootloader (via htcdev.com), installed twrp and supersu and unlocked sim using this manual.
Then I decided to updare firmware, returned stock recovery
adb reboot-bootloader
fastboot oem rebootRUU
fastboot flash system system.img
fastboot reboot-bootloader
fastboot oem rebootRUU
fastboot flash zip firmware.zip

where firmware.zip I made by decrypting RUU firmware and manually zipping it (it was a mistake!)

aboot_signed.img 819*664 09.01.2016 18:24 -a--
adsp.img 7*885*824 09.01.2016 17:59 -a--
android-info.txt 725 10.01.2016 14:20 -a--
android-info2.txt 75 10.01.2016 14:20 -a--
apppreload.img 304*087*040 09.01.2016 18:17 -a--
backup_android-info.txt 725 10.01.2016 14:24 -a--
boot_signed.img 55*786*981 09.01.2016 18:24 -a--
cmnlib32.img 164*334 09.01.2016 17:59 -a--
cota.img 62*914*560 09.01.2016 18:17 -a--
dsp.img 16*777*216 09.01.2016 17:59 -a--
dzdata_16g.hdr 12*864 09.01.2016 18:16 -a--
dzdata_16g.img 789*568 09.01.2016 18:16 -a--
dzdata_32g.hdr 20*368 09.01.2016 18:17 -a--
dzdata_32g.img 1*079*184 09.01.2016 18:17 -a--
fsc.img 1*024 09.01.2016 17:59 -a--
gpt_main_16g.img 17*408 09.01.2016 17:49 -a--
gpt_main_32g.img 17*408 09.01.2016 17:49 -a--
hosd_signed.img 59*008*485 09.01.2016 18:24 -a--
hyp-8952-1.img 73*746 09.01.2016 17:59 -a--
keymaster.img 151*462 09.01.2016 17:59 -a--
partition_info 1*431 09.01.2016 17:49 -a--
pg2fs_ship_signkey.img 3*388 09.01.2016 17:59 -a--
radio.img 45*868*032 10.01.2016 14:20 -a--
recovery_signed.img 57*261*545 09.01.2016 18:24 -a--
rfg_1.img 143*872 10.01.2016 14:20 -a--
rfg_2.img 1*048*576 10.01.2016 14:20 -a--
rpm-8952-1.img 168*340 09.01.2016 17:59 -a--
sbl1-8952-1.img 337*010 09.01.2016 17:59 -a--
sensor_hub.img 467*368 09.01.2016 17:59 -a--
splash1.nb0 4*194*304 10.01.2016 14:20 -a--
tp_SYN3708.img 203*052 09.01.2016 17:59 -a--
tz-8952-1.img 628*566 09.01.2016 17:59 -a--
wcnss.img 4*641*792 09.01.2016 17:59 -a--

the output of last command:

e:\HTC One A9\DECrypt\OUT\system>fastboot reboot-bootloader
rebooting into bootloader...
OKAY [ 0.021s]
finished. total time: 0.022s

e:\HTC One A9\DECrypt\OUT\system>fastboot oem rebootRUU
...
OKAY [ 0.033s]
finished. total time: 0.033s

e:\HTC One A9\DECrypt\OUT\system>fastboot flash zip firmware.zip
target reported max download size of 800000000 bytes
sending 'zip' (103954 KB)...
OKAY [ 5.150s]
writing 'zip'...
(bootloader) HOSD CL#688951
(bootloader) GPT is up-to-dated. [17408]
(bootloader) Perform pre-update
(bootloader) ERR ZIP signature checking failed...
(bootloader) ERR [SD_UPDATE_ERR] Not allow flash image except boot/recov
(bootloader) ery/system
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 14
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 14
(bootloader) [email protected]
FAILED (remote: 14 RU_ZIP_INFO_ERROR android-info missing or malformed )
finished. total time: 10.067s

e:\HTC One A9\DECrypt\OUT\system>fastboot flash zip firmware.zip
target reported max download size of 800000000 bytes
sending 'zip' (609941 KB)...
OKAY [ 25.380s]
writing 'zip'...
(bootloader) HOSD CL#688951
(bootloader) update GPT (gpt_main_32g.img) successfully.
(bootloader) Perform pre-update
(bootloader) ERR ZIP signature checking failed...
(bootloader) ERR [SD_UPDATE_ERR] Not allow flash image except boot/recov
(bootloader) ery/system
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 14
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 14
(bootloader) [email protected]
FAILED (remote: 14 RU_ZIP_INFO_ERROR android-info missing or malformed )
finished. total time: 43.967s

e:\HTC One A9\DECrypt\OUT\system>adb reboot
error: device not found

e:\HTC One A9\DECrypt\OUT\system>fastboot reboot-bootloader
rebooting into bootloader...
OKAY [ 0.003s]
finished. total time: 0.004s

Now phone has black screen and never turns on.
In QPST
Is there any chance of recovery or phone is comletely dead?
 
 
2nd July 2016, 09:13 PM |#2  
Senior Member
Flag New Bern, NC
Thanks Meter: 73
 
More
I believe it is possible. I've been working on a method to unbrick our devices, using the Qualcomm diagnostic interface. Someone over at the oneplus forums has managed to do it with their devices. I haven't completed the method yet. Also, I don't have a bricked A9 to test on, since I won't intentionally brick mine. Do you have a copy of the partition table layout for your A9?
The Following User Says Thank You to CSnowRules For This Useful Post: [ View ] Gift CSnowRules Ad-Free
3rd July 2016, 11:04 PM |#3  
OP Junior Member
Thanks Meter: 0
 
More
Quote:
Originally Posted by CSnowRules

Do you have a copy of the partition table layout for your A9?

I made TWRP backup of boot/recovery/system and there is some information about partitions in the log file.
Partition Logs:
/system | /dev/block/mmcblk0p61 | Size: 3044MB Used: 3027MB Free: 17MB Backup Size: 3027MB
Flags: Can_Be_Mounted Can_Be_Wiped Can_Be_Backed_Up Wipe_Available_in_GUI IsPresent
Primary_Block_Device: /dev/block/mmcblk0p61
Display_Name: System
Storage_Name: System
Backup_Path: /system
Backup_Name: system
Backup_Display_Name: System
Storage_Path: /system
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/system_image | /dev/block/mmcblk0p61 | Size: 3168MB
Flags: Can_Be_Backed_Up IsPresent Can_Flash_Img
Primary_Block_Device: /dev/block/mmcblk0p61
Display_Name: System Image
Storage_Name: system_image
Backup_Path: /system_image
Backup_Name: system_image
Backup_Display_Name: System Image
Storage_Path: /system_image
Current_File_System: emmc
Fstab_File_System: emmc
Backup_Method: dd

/cache | /dev/block/mmcblk0p58 | Size: 247MB Used: 0MB Free: 247MB Backup Size: 0MB
Flags: Can_Be_Mounted Can_Be_Wiped Can_Be_Backed_Up Wipe_During_Factory_Reset Wipe_Available_in_GUI IsPresent
Primary_Block_Device: /dev/block/mmcblk0p58
Display_Name: Cache
Storage_Name: Cache
Backup_Path: /cache
Backup_Name: cache
Backup_Display_Name: Cache
Storage_Path: /cache
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/data | /dev/block/mmcblk0p62 | Size: 25472MB
Flags: Can_Be_Wiped Can_Be_Backed_Up Wipe_During_Factory_Reset Wipe_Available_in_GUI IsPresent Can_Be_Encrypted Is_Encrypted Has_Data_Media Can_Encrypt_Backup Use_Userdata_Encryption Is_Storage Is_Settings_Storage
Symlink_Path: /data/media
Symlink_Mount_Point: /sdcard
Primary_Block_Device: /dev/block/mmcblk0p62
Crypto_Key_Location: /dev/block/bootdevice/by-name/extra
Length: -16384
Display_Name: data
Storage_Name: Internal Storage
Backup_Path: /data
Backup_Name: data
Backup_Display_Name: Data
Storage_Path: /data/media
Current_File_System: emmc
Fstab_File_System: ext4
Backup_Method: dd
MTP_Storage_ID: 65539

/boot | /dev/block/mmcblk0p59 | Size: 64MB
Flags: Can_Be_Backed_Up IsPresent Can_Flash_Img
Primary_Block_Device: /dev/block/mmcblk0p59
Display_Name: Boot
Storage_Name: boot
Backup_Path: /boot
Backup_Name: boot
Backup_Display_Name: Boot
Storage_Path: /boot
Current_File_System: emmc
Fstab_File_System: emmc
Backup_Method: dd

/recovery | /dev/block/mmcblk0p60 | Size: 64MB
Flags: Can_Be_Backed_Up IsPresent Can_Flash_Img
Primary_Block_Device: /dev/block/mmcblk0p60
Display_Name: Recovery
Storage_Name: recovery
Backup_Path: /recovery
Backup_Name: recovery
Backup_Display_Name: Recovery
Storage_Path: /recovery
Current_File_System: emmc
Fstab_File_System: emmc
Backup_Method: dd

/misc | /dev/block/mmcblk0p28 | Size: 1MB
Flags: IsPresent
Primary_Block_Device: /dev/block/mmcblk0p28
Display_Name: misc
Storage_Name: misc
Backup_Path: /misc
Backup_Name: misc
Backup_Display_Name: misc
Storage_Path: /misc
Current_File_System: emmc
Fstab_File_System: emmc
Backup_Method: dd

/devlog | /dev/block/mmcblk0p32 | Size: 25MB Used: 22MB Free: 3MB Backup Size: 22MB
Flags: Can_Be_Mounted Can_Be_Wiped IsPresent
Primary_Block_Device: /dev/block/mmcblk0p32
Display_Name: devlog
Storage_Name: devlog
Backup_Path: /devlog
Backup_Name: devlog
Backup_Display_Name: devlog
Storage_Path: /devlog
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/carrier | /dev/block/mmcblk0p46 | Size: 40MB Used: 0MB Free: 39MB Backup Size: 0MB
Flags: Can_Be_Mounted Can_Be_Wiped IsPresent
Primary_Block_Device: /dev/block/mmcblk0p46
Display_Name: carrier
Storage_Name: carrier
Backup_Path: /carrier
Backup_Name: carrier
Backup_Display_Name: carrier
Storage_Path: /carrier
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/cota | /dev/block/mmcblk0p50 | Size: 55MB Used: 0MB Free: 55MB Backup Size: 0MB
Flags: Can_Be_Mounted Can_Be_Wiped IsPresent
Primary_Block_Device: /dev/block/mmcblk0p50
Display_Name: cota
Storage_Name: cota
Backup_Path: /cota
Backup_Name: cota
Backup_Display_Name: cota
Storage_Path: /cota
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/preload | /dev/block/mmcblk0p49 | Size: 280MB Used: 1MB Free: 279MB Backup Size: 1MB
Flags: Can_Be_Mounted Can_Be_Wiped IsPresent
Primary_Block_Device: /dev/block/mmcblk0p49
Display_Name: preload
Storage_Name: preload
Backup_Path: /preload
Backup_Name: preload
Backup_Display_Name: preload
Storage_Path: /preload
Current_File_System: ext4
Fstab_File_System: ext4
Backup_Method: files

/external_sd | /dev/block/mmcblk1p1 | Size: 14796MB Used: 12897MB Free: 1898MB Backup Size: 12897MB
Flags: Can_Be_Mounted Can_Be_Wiped Wipe_Available_in_GUI Removable IsPresent Is_Storage
Primary_Block_Device: /dev/block/mmcblk1p1
Alternate_Block_Device: /dev/block/mmcblk1
Display_Name: Micro SDcard
Storage_Name: Micro SDcard
Backup_Path: /external_sd
Backup_Name: external_sd
Backup_Display_Name: Micro SDcard
Storage_Path: /external_sd
Current_File_System: vfat
Fstab_File_System: vfat
Backup_Method: files
MTP_Storage_ID: 65537

/usb_otg | | Size: 0MB Used: 0MB Free: 0MB Backup Size: 0MB
Flags: Can_Be_Mounted Can_Be_Wiped Wipe_Available_in_GUI Removable Is_Storage
Primary_Block_Device: /dev/block/sda1
Alternate_Block_Device: /dev/block/sda
Display_Name: USB-OTG
Storage_Name: USB-OTG
Backup_Path: /usb_otg
Backup_Name: usb_otg
Backup_Display_Name: USB-OTG
Storage_Path: /usb_otg
Current_File_System: vfat
Fstab_File_System: vfat
Backup_Method: files
MTP_Storage_ID: 65538

Also there are files gpt_main_16g.img, gpt_main_32g.img, partition_info in the decrypted RUU firmware.
Partition Info:[0.01]
board_info board_info.bin 32 90
pg1fs none 8192 93
sbl1 sbl1.img 2048 77
devcfg none 512 120
dip none 2048 129
reserve_1 none 19902 98
mfg mfg.bin 512 115
pg2fs none 48510 91
rpm rpm.img 1024 71
tz tz.img 4096 70
hyp hyp.img 4096 78
aboot aboot.img 8192 80
tool_diag none 20480 98
sp1 none 20480 52
ddr none 64 171
wcnss wcnss.img 10240 73
rfg_0 none 2048 116
rfg_1 none 2048 116
rfg_2 rfg_2.img 2048 116
rfg_3 none 2048 116
rfg_4 none 2048 116
fsg none 3072 172
radio radio.img 120834 73
adsp adsp.img 40960 73
dsp dsp.img 32768 73
limits none 2 99
reserve_2 none 2110 98
misc misc.nb0 2048 118
modemst1 modemst1.img 3072 74
modemst2 modemst2.img 3072 75
fataldevlog none 40960 25
devlog devlog.img 61440 25
pdata none 512 35
local none 2562 51
control none 32 98
extra none 128 131
fsc none 2 173
ssd none 16 174
sensor_hub sensor_hub.img 1024 73
persist none 65536 83
sec none 128 82
rfg_8 none 2048 116
frp none 1024 114
ramdump none 20480 84
skylink none 2 131
carrier none 92160 87
battery none 20480 112
keystore none 1024 98
apppreload apppreload.img 593920 53
cota none 122880 55
mota none 2048 133
cmnlib32 cmnlib32.img 512 122
keymaster keymaster.img 512 136
devinfo none 2048 137
reserve none 8906 98
hosd hosd.img 131072 113
mdtp none 65536 130
cache none 524288 131
boot boot.img 131072 72
recovery recovery.img 131072 113
system system_raw.img 6488064 131
###LAST###
userdata none 21889024 131

but as I understand the output of brick-making command, gpt_main_32g.img was flashed while other partitions were not. So I'm not sure about correctness of it.
I put link to all mentioned files in PM.
As I understand unbricking for htc a9 much harder than oneplus, because original firmware does not include files needed for low-level flashing like various *8952*.mbn and *.xml and same files from other phones, even if you find them, could be useless because phone can accept only signed by HTC files (I'm not sure though).
Nevertheless I am ready to help testing your method.
26th July 2016, 08:19 PM |#4  
OP Junior Member
Thanks Meter: 0
 
More
I need internal memory dump of HTC One A9 Sprint (modelid: 2PQ930000 cidnum: SPCS_001 mainver: >=1.57.651.1)
need first 1167 MB (2392030 blocks) to include boot and recovery partitions. + 100 MB for insurance (1267 MB totally).

Trying to boot from an external SD card.
Thanx to CSnowRules who gave me dump of his HTC One A9 ATT.
With his dump I was able to change 9008 state (pure PBL) to 900E (probably one of SBL's on Ext SD).
e:\HTC One A9\emmcdl\qcpartsprocess12>emmcdl.exe -p com22 -info
Version 2.16
SerialNumber: 0x00315bc6
MSM_HW_ID: 0x00000010
OEM_PK_HASH: 0x04000000100000000000000001000000652bc17700000000 7006700095dfc077
SBL SW Version: 0x00000004
Status: 0 The operation completed successfully.

Now original HTC One A9 Sprint image is my last chance. I will be very grateful.
7th August 2016, 09:49 AM |#5  
Member
Flag Seattle
Thanks Meter: 15
 
More
Quote:
Originally Posted by bogdan#

I need internal memory dump of HTC One A9 Sprint (modelid: 2PQ930000 cidnum: SPCS_001 mainver: >=1.57.651.1)
need first 1167 MB (2392030 blocks) to include boot and recovery partitions. + 100 MB for insurance (1267 MB totally).

Trying to boot from an external SD card.
Thanx to CSnowRules who gave me dump of his HTC One A9 ATT.
With his dump I was able to change 9008 state (pure PBL) to 900E (probably one of SBL's on Ext SD).

e:\HTC One A9\emmcdl\qcpartsprocess12>emmcdl.exe -p com22 -info
Version 2.16
SerialNumber: 0x00315bc6
MSM_HW_ID: 0x00000010
OEM_PK_HASH: 0x04000000100000000000000001000000652bc17700000000 7006700095dfc077
SBL SW Version: 0x00000004
Status: 0 The operation completed successfully.

Now original HTC One A9 Sprint image is my last chance. I will be very grateful.

If all you need now is a system image to flash....I already posted that, firmware, boot and recovery on the RUU Collection area. I'm curious....as I have not completely bricked my A9....if your phone is blacked out and wont turn on, how exactly would you be able to boot it from your SD? Was it also not registering via USB under fastboot after your attempt?
Sprint 1.60.651.4
https://1drv.ms/f/s!AtVcVcbLOGTdgP9-e2NAN2fNHHIKVQ
7th August 2016, 01:59 PM |#6  
OP Junior Member
Thanks Meter: 0
 
More
Quote:
Originally Posted by mcbright80

If all you need now is a system image to flash....I already posted that, firmware, boot and recovery on the RUU Collection area. I'm curious....as I have not completely bricked my A9....if your phone is blacked out and wont turn on, how exactly would you be able to boot it from your SD? Was it also not registering via USB under fastboot after your attempt?
Sprint 1.60.651.4
http://www.mediafire.com/download/ki...1.60.651.4.exe

also

http://www.mediafire.com/download/d5...1/firmware.zip - for the Firmware zip to be flashed via RUU mode

System/recovery/boot images for stock are below:
http://www.mediafire.com/download/xe...zfh3x/boot.img
http://www.mediafire.com/download/oa...p/recovery.img
http://www.mediafire.com/download/48...g7j/system.img

Phone is not visible via fastboot / adb, so I can not flash any RUU image or standalone partition image. Most probably that partition table in internal memory is broken, and phone stuck in PBL mode (Primary BootLoader, memory partition with bootable code inside of msm chip), which is visible through usb as "qualcomm 9008 com port".
I have information about other qaulcomm based phones in similar condition were revived with bootable sd card. The idea is that when emmc memory is not accessible or not bootable, msm chip trying to use sd card as internal memory, so i can boot into adb mode and get access to emmc as external memory.
I am not sure if it would work with htc a9, but I already tried internal memory image of HTC One A9 ATT and it changed state to 900E and programm emmcdl.exe recognized it as SBL(Secondary BootLoader) mode, which means that booting from sd card is happening, but stopping on some step probably because of wrong signature (HTC One A9 ATT GSM vs HTC One A9 Sprint CDMA).
8th August 2016, 07:09 AM |#7  
Member
Flag Seattle
Thanks Meter: 15
 
More
I see, I see......interesting! Well, hopefully you can pull it off. Let me know if you need an Internal Memory Dump still and I'll send you one. Thanks for the insight on that issue in case i ever have the same someday. ^_^
8th August 2016, 07:17 AM |#8  
OP Junior Member
Thanks Meter: 0
 
More
Quote:
Originally Posted by mcbright80

I see, I see......interesting! Well, hopefully you can pull it off. Let me know if you need an Internal Memory Dump still and I'll send you one. Thanks for the insight on that issue in case i ever have the same someday. ^_^

Yes, I still need it. It would be great if you send me one. Thank you.
8th August 2016, 09:01 PM |#9  
Member
Flag Seattle
Thanks Meter: 15
 
More
Links have been updated....
The Following User Says Thank You to mcbright80 For This Useful Post: [ View ] Gift mcbright80 Ad-Free
12th August 2016, 10:17 AM |#10  
OP Junior Member
Thanks Meter: 0
 
More
Quote:
Originally Posted by mcbright80

Links have been updated....

Unfortunately this files are not what I am looking for. I need image of a whole internal disk (first 1300MB, system.img and userdata could be excluded) I would be grateful if you make it. Here is the instruction:
0. Your phone has to be rooted and S-OFF (may be), USB debugging ON. On your computer has to be installed HTC drivers and ADB.
1. Insert SD card with at least 1400MB free to phone.
2. Connect phone to computer.
3. run this commands in windows cmd.exe:
Code:
adb shell 
su            /*accept request of gettint root on your phone.*/
dd if=/dev/block/mmcblk0 of=/sdcard/dump.img bs=512 count=2596830
4. after command complete take file dump.img from sd card and archive it.
15th August 2016, 04:38 AM |#11  
Member
Flag Seattle
Thanks Meter: 15
 
More
Quote:
Originally Posted by bogdan#

Unfortunately this files are not what I am looking for. I need image of a whole internal disk (first 1300MB, system.img and userdata could be excluded) I would be grateful if you make it. Here is the instruction:
0. Your phone has to be rooted and S-OFF (may be), USB debugging ON. On your computer has to be installed HTC drivers and ADB.
1. Insert SD card with at least 1400MB free to phone.
2. Connect phone to computer.
3. run this commands in windows cmd.exe:

Code:
adb shell 
su            /*accept request of gettint root on your phone.*/
dd if=/dev/block/mmcblk0 of=/sdcard/dump.img bs=512 count=2596830
4. after command complete take file dump.img from sd card and archive it.

I know, i'm sorry I've been sick as a damn dog since i replaced those links and now somewhat better. Not your prob but its why ive not been here or been able to get a dump file uploaded. Imma get back to it and post it tonight for you.
The Following User Says Thank You to mcbright80 For This Useful Post: [ View ] Gift mcbright80 Ad-Free
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes