[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

Search This thread

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
Hi Everyone. By opening this thread, I hope I can 1) log my work, 2) get input from the wonderful people here, 3) benefit others who has the same type of brick. I have been reading/following/searching stuffs here for a while, and this is my first dirty-work-to-do. Please help me as much as you can. Thank you all!

How I bricked my Telus HTC Desire HD:
  1. Phone has stock Android 2.3 and one day it keeps rebooting
  2. Unlock bootloader by HTCDev
  3. Didn't turn S-OFF
  4. Flash _TOUCHRECOVERY__CWM_5.8.0.0_Touch_Recovery_for_DesireHD successfully
  5. Flash cm-11-20131203-UNOFFICIAL-ace.zip successfully (after one failure) but phone is in boot loop
  6. Unzip boot.img from the CM11 zip and 'fastboot flash boot boot.img' (as in [1]). The command didn't return anything, and I disconnect the cable after about 1m

Now the phone bricks, it doesn't boot to fastboot/hboot, charging LED never on. Connecting to PC shows a QHSUSB_DLOAD device.

The first thing I'd like to know is the root cause of my brick. Is it because the phone has S-ON, or because I disconnected the USB cable before getting the fastboot fully done. As [2] (which is for One X), the S-ON may not be an issue, then why the fastboot command didn't return anything?

What I got to work so far:
  1. Install driver to my PC (QHSUSB_Drivers_(x64).zip from [4], thanks JSLEnterprises)
  2. Enable the driver as test driver since it doesn't have signature (as [6])
  3. Install QPST (QPST_2.7_378.zip, from [5], thanks darkspr1te)
  4. QPST connects to phone and lists as type 'Q/QCP-XXX' which is in '*Download*' mode

As there is an 'HTC Unbricking Project' which doesn't have DHD in its supported phones list [3], I see the hope to unbrick my DHD without JTAG. I am not expecting to have a one-click solution like the unbrick project, and I am open to do some coding if needed, but I think I should be able to restore my boot partition (or multiple partitions) with QPST. And here I need your help:

1. What cause the brick? S-ON of the phone, or failure of fastboot
2. Do you think I can unbrick it just with QPST
3. If someone has a working Desire HD and uses QPST to backup its partitions to files, will I have its IMEI/CID/etc after download those files to my phone
4. Do you think I can manully build the QPST QCN download file from a stock ROM/RUU

Thank you!

[1] http://xdaforums.com/showthread.php?t=2533007 (HTC Desire HD > Desire HD Android Development > [ROM][UNOFFICIAL] CyanogenMod 11 Nightlies)
[2] http://xdaforums.com/showthread.php?t=1603791 (HTC One X > One X Android Development > [WARNING] Flashing boot.img on S-ON devices)
[3] http://xdaforums.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
[4] http://xdaforums.com/showthread.php?t=1041153&page=2 ( HTC Desire HD > Desire HD Q&A, Help & Troubleshooting > [Q]HTC Desire HD QHSUSB_DLOAD driver[brick caused by rom manager sdcard repartition])
[5] http://xdaforums.com/showpost.php?p=33545892 (AT&T Samsung Galaxy Note I717 > AT&T Galaxy Note I717 General > [SOLVED]-[BRICKED]SHV-E160L Korean model)
How to calculate partition info in post #13, 15, 16 thanks darkspr1te
[6] http://windows7themes.net/windows-requires-a-digitally-signed-driver-windows-7.html
[7] http://xdaforums.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
[8] http://xdaforums.com/showthread.php?t=905003
(HTC Desire HD > Desire HD Android Development > [GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6, with download of stock PD98IMG.ZIP)
[9] 7x30 HEX and MBN files in post#39 and partition.mbn and HxD HEX editor in post #48 (thanks mickeyasamoah)
[10] Qualcomm docs in post #87 and post #88 on page 9 (thanks darkspr1te)
[11] QFIT (flash image creation tool) in post #90 (thank darkspr1te)
[12] fixdhd.pl v20140228 in post #98 (based on qdloader.pl thanks JCSullins(Rootz Wiki)) v20140410 in post #161 on page 17
[13] MBN files from HP Pre 3 device in post #126 (thanks mickeyasamoah)
[14] Qualcomm development doc in Chinese and English. Need download file from https://support.cdmatech.com/login/, https://silver.arm.com/browse or https://developer.qualcomm.com/.
[15] Related post: Request for DHD backup and Qualcomm docs
[16] (thanks Gussta) Qualcomm processors and Snapdragon SoCs (post #139 on page 14), and Dual boot DHD with SD
 
Last edited:

Conrail16

Member
Jul 18, 2011
44
17
To answer #1: I'm thinking it's the recovery. Jelly Bean and above roms usually require CWM 6.x (or the equivalent 4EXT or TWRP versions).
 
  • Like
Reactions: fairsimple
D

droid_ilari

Guest
Have you tried to see if you have fastboot or adb connection? Have you tried pulling the battery for a minute and then doing pwr + volume (-)? Afaik, what you have done could not have damaged your Hboot doing what you did. With it responding as if it is in download mode it sounds as though it is in oem RUU mode. If so, you should be able to flash the PD98 zip of the same version of android/sense you were on by using fastboot flash zip Name-of-your.zip. With S-on it has to be the same version or higher. You can extract the PD98IMG.zip from the latest RUU for your device.
 
Last edited:

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
Have you tried to see if you have fastboot or adb connection? Have you tried pulling the battery for a minute and then doing pwr + volume (-)? Afaik, what you have done could not have damaged your Hboot doing what you did. With it responding as if it is in download mode it sounds as though it is in oem RUU mode. If so, you should be able to flash the PD98 zip of the same version of android/sense you were on by using fastboot flash zip Name-of-your.zip. With S-on it has to be the same version or higher. You can extract the PD98IMG.zip from the latest RUU for your device.

I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.
 
D

droid_ilari

Guest
Download mode

I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.

I may be mistaken but, I believe that download mode is mode the phone goes into when running an RUU. If that is the case then it uses a different set of fastboot commands. I am not that tech savy but, if you are in the mode I believe you are then you would need to:
1) Put the PD98IMG.zip file in the folder where your adb/fastboot stuff is.
2) Plug your DHD into your computer
3) Issue exactly this command minus the quotes "fastboot flash zip PD98IMG.zip

If I am right, the htc logo will appear on the black screen and it will flash the stock rom, Hboot and all. I hope this helps you.
 
D

droid_ilari

Guest
fastboot protocol

no, fairsimple, that is higher than my knowledge level, sorry.
I connected my inspire to the pc and ran fastboot oem rebootRUU to double check what I was telling you. In the device manager, it still shows as an android phone. So, it appears I have been no help at all, sorry.
 
Last edited:

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
no, fairsimple, that is higher than my knowledge level, sorry.
I connected my inspire to the pc and ran fastboot oem rebootRUU to double check what I was telling you. In the device manager, it still shows as an android phone. So, it appears I have been no help at all, sorry.
Thanks for your help anyway:) I add a new link in the top post which I found today. I think I will spend some time to do my homework with it.

[7] http://xdaforums.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
 
Last edited:
D

droid_ilari

Guest
I did read in one of your links that the problem you experienced is supposedly a confirmed bug in CWM recovery. The person posting said it was confirmed by koush him/herself. It apparently messes up your internal partitions so you were probably doomed as soon as you flashed CyanogenMod. At least that may explain why you got bricked. The fastboot flashing of the boot.img is a common method of flashing custom roms on dev unlocked HTC's with S-On. That is the way it is on the One X and the Vivid. So, at least now you know why your phone is bricked. Sorry I wasn't more help in fixing it.
Edit: I wanted to clarify so there is no confusion. This was actually a bug with older versions of ROM manager that have been fixed.
 
Last edited:

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
I did read in one of your links that the problem you experienced is supposedly a confirmed bug in CWM recovery. The person posting said it was confirmed by koush him/herself. It apparently messes up your internal partitions so you were probably doomed as soon as you flashed CyanogenMod. At least that may explain why you got bricked. The fastboot flashing of the boot.img is a common method of flashing custom roms on dev unlocked HTC's with S-On. That is the way it is on the One X and the Vivid. So, at least now you know why your phone is bricked. Sorry I wasn't more help in fixing it.

I didn't find the post but as I remember, the CWM bug is when you use it to format or partition external SD, and it was in CWM v3.xx or something. Thanks.
 
D

droid_ilari

Guest
Yeah, reread the post, it is when formatting SD card.

Sent from my Nexus 5 using xda app-developers app
 

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.

Update: disconnect the battery for two days, then reboot with USB connected. Nothing changed, and none of the following command worked:

adb shell
fastboot devices
fastboot reboot

This confirms my understanding: adb works when phone is in developer mode, and fastboot works with bootloader/fastboot.
 

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
As my understanding, QPST/QHSUSB_DLOAD may use a QUALCOMM DMSS protocol...

Now I confirm that the phone is using DMSS protocol since I can get version info with command 0C.

Code:
Device opened
MSG trx[5]: 7E 0C 14 3A 7E 
Device wrote 5/5 bytes
MSG rcv[24]: 7E 0D 14 50 42 4C 5F 44 6F 77 6E 6C 6F 61 64 65 72 56 45 52 31 2E 30 7E 
Close device 0
Version [PBL_DownloaderVER1.0]

[3] http://xdaforums.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
[7] http://xdaforums.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
 
Last edited:

NikolayIII

Member
Jan 21, 2014
5
0
Hi. My phone dead. Model - Desire HD. PC define his QHSUSB_DLOAD. Can you help me restore Phone?
Do you restore phone?
Sorry for my English. I am vary bad speak English.
 

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
I don't know. This is HDH my nephew. He installed games. Battery is discharged and phone is dead.:( So he said.:) He just has not updated HDH.:)

I noticed the phone is determined by ODIN. Possible through ODIN to flash bootloader?

As my understanding, ODIN is for Samsung phone and not work with HTC devices. Does the screen on, or charging light on when you plugin the USB cable or charger, and press the power on button.
 

fairsimple

Senior Member
Aug 23, 2013
83
35
Toronto
More info (thanks qdload.pl):
Code:
 ./qd.pl --check
Requesting SoftwareVersion...
SENDING: 7e 0c 14 3a 7e
RECEIVED: 0d 14 50 42 4c 5f 44 6f 77 6e 6c 6f 61 64 65 72 56 45 52 31 2e 30
Version: PBL_DownloaderVER1
Requesting Params...
SENDING: 7e 07 c7 84 7e
RECEIVED: 08 06 01 01 00 90 00 00 14 70
Params: 06 01 01 00 90 00 00
Unlocking...
SENDING: 7e 0b 00 00 00 00 00 00 00 00 2a 18 7e
RECEIVED: 03 00 06 9e 4c
Invalid Response: 03 00 06
Dumping chunk...
SENDING: 7e 09 2a 00 00 00 00 80 2f e5 7e
RECEIVED: 03 00 06 9e 4c
Response: 03 00 06
Requesting Reboot...
SENDING: 7e 0a 22 5f 7e
requestReboot send ok
RECEIVED: 02 6a d3
Param: 02
Parameter response has flash size as zero. Don't know if this indicates an EMMC failure.
 

Attachments

  • qd.7z
    4.6 KB · Views: 168
  • Like
Reactions: adfree

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    Hi Everyone. By opening this thread, I hope I can 1) log my work, 2) get input from the wonderful people here, 3) benefit others who has the same type of brick. I have been reading/following/searching stuffs here for a while, and this is my first dirty-work-to-do. Please help me as much as you can. Thank you all!

    How I bricked my Telus HTC Desire HD:
    1. Phone has stock Android 2.3 and one day it keeps rebooting
    2. Unlock bootloader by HTCDev
    3. Didn't turn S-OFF
    4. Flash _TOUCHRECOVERY__CWM_5.8.0.0_Touch_Recovery_for_DesireHD successfully
    5. Flash cm-11-20131203-UNOFFICIAL-ace.zip successfully (after one failure) but phone is in boot loop
    6. Unzip boot.img from the CM11 zip and 'fastboot flash boot boot.img' (as in [1]). The command didn't return anything, and I disconnect the cable after about 1m

    Now the phone bricks, it doesn't boot to fastboot/hboot, charging LED never on. Connecting to PC shows a QHSUSB_DLOAD device.

    The first thing I'd like to know is the root cause of my brick. Is it because the phone has S-ON, or because I disconnected the USB cable before getting the fastboot fully done. As [2] (which is for One X), the S-ON may not be an issue, then why the fastboot command didn't return anything?

    What I got to work so far:
    1. Install driver to my PC (QHSUSB_Drivers_(x64).zip from [4], thanks JSLEnterprises)
    2. Enable the driver as test driver since it doesn't have signature (as [6])
    3. Install QPST (QPST_2.7_378.zip, from [5], thanks darkspr1te)
    4. QPST connects to phone and lists as type 'Q/QCP-XXX' which is in '*Download*' mode

    As there is an 'HTC Unbricking Project' which doesn't have DHD in its supported phones list [3], I see the hope to unbrick my DHD without JTAG. I am not expecting to have a one-click solution like the unbrick project, and I am open to do some coding if needed, but I think I should be able to restore my boot partition (or multiple partitions) with QPST. And here I need your help:

    1. What cause the brick? S-ON of the phone, or failure of fastboot
    2. Do you think I can unbrick it just with QPST
    3. If someone has a working Desire HD and uses QPST to backup its partitions to files, will I have its IMEI/CID/etc after download those files to my phone
    4. Do you think I can manully build the QPST QCN download file from a stock ROM/RUU

    Thank you!

    [1] http://xdaforums.com/showthread.php?t=2533007 (HTC Desire HD > Desire HD Android Development > [ROM][UNOFFICIAL] CyanogenMod 11 Nightlies)
    [2] http://xdaforums.com/showthread.php?t=1603791 (HTC One X > One X Android Development > [WARNING] Flashing boot.img on S-ON devices)
    [3] http://xdaforums.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
    [4] http://xdaforums.com/showthread.php?t=1041153&page=2 ( HTC Desire HD > Desire HD Q&A, Help & Troubleshooting > [Q]HTC Desire HD QHSUSB_DLOAD driver[brick caused by rom manager sdcard repartition])
    [5] http://xdaforums.com/showpost.php?p=33545892 (AT&T Samsung Galaxy Note I717 > AT&T Galaxy Note I717 General > [SOLVED]-[BRICKED]SHV-E160L Korean model)
    How to calculate partition info in post #13, 15, 16 thanks darkspr1te
    [6] http://windows7themes.net/windows-requires-a-digitally-signed-driver-windows-7.html
    [7] http://xdaforums.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
    [8] http://xdaforums.com/showthread.php?t=905003
    (HTC Desire HD > Desire HD Android Development > [GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6, with download of stock PD98IMG.ZIP)
    [9] 7x30 HEX and MBN files in post#39 and partition.mbn and HxD HEX editor in post #48 (thanks mickeyasamoah)
    [10] Qualcomm docs in post #87 and post #88 on page 9 (thanks darkspr1te)
    [11] QFIT (flash image creation tool) in post #90 (thank darkspr1te)
    [12] fixdhd.pl v20140228 in post #98 (based on qdloader.pl thanks JCSullins(Rootz Wiki)) v20140410 in post #161 on page 17
    [13] MBN files from HP Pre 3 device in post #126 (thanks mickeyasamoah)
    [14] Qualcomm development doc in Chinese and English. Need download file from https://support.cdmatech.com/login/, https://silver.arm.com/browse or https://developer.qualcomm.com/.
    [15] Related post: Request for DHD backup and Qualcomm docs
    [16] (thanks Gussta) Qualcomm processors and Snapdragon SoCs (post #139 on page 14), and Dual boot DHD with SD
    3
    Hi darkspr1te, I think we make a big progress as getting you the QHSUSB_DLOAD exporter involved:) Thank you to spend time on this thread!

    I did read your brixfix thread (v1 mostly since it has your working history) and after we got some HEX and MBN files (thinks mickeyasamoah found them), mickeyasamoah and I tried them with both QPST and qdload.pl. With QPST, I got mostly same rsult as mickeyasamoah replys above (I didn't get partition.mbn loaded successfully as him). With my modifed qdload.pl, I confirmed the HEX/BIN file works since after that the phone reboots and reply to some streaming download message. However, I can't go ahead to loading MBN file. You can see the result from post #44 (http://xdaforums.com/showpost.php?p=50274440&postcount=44 ). Personally I don't think we get into the SD mode yet.
    I checked DMSS manual you provided on that thread, thats the limited instruction set, also thats a very old document and as E:V:A pointed out to me once, often the qualcomm docs are far behind the actual reality , please find attached a revised copy of the same document, if you compare section 3.3 between the two you will see what i mean.
    3
    Files for 8x25(karbonn a9+) from this post: http://forum.gsmhosting.com/vbb/f824/karbonn-a9-dead-qualcomm-hs-usb-qdloader-9008-how-fix-1740061/#post9962431

    Code:
    12-19-2013, 10:00	   #12 (permalink)
    umesh gaba
    Product Manager
    
     
    
     
    Join Date: Aug 2012
    Location: jalandhar,india
    Posts: 4,034 
    Member: 1792140 
    Status: Online
    Sonork: 100.1618782;gaba
    Thanks Meter: 4,644
    QPST 2.7 build 399QPST-2.7.399
    
    
    BP Firmware BP_JB_Firmware
    
    drivers ICS_pcdrivers
    
    drivers JB_pcdrivers
    
    
    
    Install QPST
    1. Extract QPST-2.7.399.rar. Run SETUP.EXE
    2. Run SETUP.EXE, press INSTALL when it prmpt to insall additional Visual C++ runtime libraries. Follow the defaults, press NEXT until it is finished with the install.
    
    Install drivers
    1. Connect deadboot flare to PC / Laptop.
    2. Go to device manager, expand PORTS (COM & LPT). Check if there is an item called Qualcomm HSUSB QDLOADER 9008. If the item is there, you are done with driver install. If it does not exist, proceed to step3.
    3. If there is no item under PORTS (COM & LPT), check device manager under OTHER DEVICES > Unknown Device
    4. Double click UNKNOWN DEVICE > UPDATE DRIVER > BROWSE MY COMPUTER > browse to the folder where you saved extracted the ICS / JB drivers. It will install the driver, if it prompts for unsigned drivers, press INSTALL ANYWAY.
    5. It should now be listed under COM PORTS > Qualcomm HSUSB QDLOADER 9008.
    
    Run QPST and reprogram EMMC (this is where the magic begins)
    If you are on Win7, make sure you run it under compatibility XP Sp3 and RUN AS ADMINISTRATOR
    
    1. Run EMMC SOFTWARE DOWNLOAD.
    2. Press BROWSE, it will detect your phone. Look for the PHONE TAB that says DOWNLOAD. Press OK.
    3. Put check mark on PROGRAM BOOTLOADERS, PROGRAM MMC DEVICE, TRUSTED.
    4. Under FLASH PROGRAMMER FILENAME, enter MPRG8X25.hex
    5. Under BOOT IMAGE, enter 8X25_msimage.mbn
    6. Press LOAD XML DEF > navigate to your extracted JB firmware > select rawprogram0 > press OPEN.
    7. Press LOAD PATCH DEF > navigate to your extracted JB firmware > select patch0 > press OPEN
    8. PRESS DOWNLOAD
    9. An warning message may appear, TIME OUT WAITING etc etc or COOKIE NOT RECEIVED. If the error is TIME OUT WAITING, press OK and then press SWITCH DEVICE TO DLOAD. Check the flare, it will show RESET FOR ENTRY QPST.
    10. Exit EMMC SOFTWARE DOWNLOAD. Proceed to flash Jelly Bean BP Firmware and then flash Jelly Bean img dump.
    11. IF ERROR IS COOKIE NOT RECEIVED, sorry it is still bricked.
    3
    Can you zip and attach the files you have, or post the link where you download them. Again I will try to use qd.pl (which should use the same MDSS protocol as QPST, but for this program we have better control:) Please also zip those files which doesn't work for you, I may also try them then.

    I was beginning to think you have had your DHD fixed by RiffBox or JTAG thats why you werent commenting.
    Any way, i have uploaded the files.

    MPRG7x30.hex and ARMPRG.HEX are the working files
    The rest arent working.
    2
    I can't find the 'multi-sec 2.0'. I have QPST v2.7 b378.

    Also if you have access to a working DHD (I think we need it as rooted), we need backup the whole internal memory as #2 of this post, then we may can get the partition table from the backup file.

    http://xdaforums.com/showthread.php?t=1188510

    Its there check the image below.

    And i was thinking of backing up another DHD so that we can get all the files for unbricking the device.
    But i dont have another DHD. So then, how about we put up a thread in the DHD forum giving the guidelines on how to backup the DHD for unbricking purpose.
    What do you think?

    Also do you have any idea on how to backup the DHDs mbn files?