Deep in the weeds with a bricked OnePlus 5 - Specific technical questions for you experts!

[Pseudorando]

Hi XDA!

(tl;dr - The "specific technical questions" are in the last section. )

I'll spare everyone a detailed explanation of what I've been through with this phone in the last few weeks, except to say that I have exhausted all simple solutions.

The current state of the phone is that both its main and recovery partitions hang with a white LED.

There are two states in which I understand it should at least register to a USB host as a visible device, whether or not proper drivers are installed (though I have tried many drivers as well):

1. FastBoot

I can Power+Vol-Up into the FastBoot menu, which appears and operates, but there is no contact with the computer over USB.

2. Qualcomm

I can Vol-Up then plug-in which should boot into "Qualcomm mode" (a.k.a. EDL mode?), but there is also no indication of a low-level device reporting itself as "Qualcomm" or "QHUSB_BULK", or the presence of any device at all on four different laptops, both Windows (via Device Manager) and Linux (via lsusb).

2a. Each of these cable/port/laptop combinations do work for charging the OnePlus 5

2b. The same cable and ports function properly for FastBoot/data with another phone.

2c. The vol-up+plug-in method for inducing "Qualcomm mode" does appear to do something, which is that it stays on a black screen doing nothing instead of booting upon plug-in, which is what it does with no vol-up. (Before, plugging it in would send it to the "battery charge" screen, but now, having broken it further, it boots into white-LED failure).


Failure modes eliminated:

1. The USB-C/headphone port assembly was also replaced because the previous one had been unstable for a while and I wanted to ensure that a loose connection was not the cause of the FastBoot issue. The new port is now solid and reliable. I also inspected the internal ribbon port where the ports connect to the board to ensure that the tiny fragile connectors were not damaged during the swap.

2. I have also tried all methods of gaining access after disconnecting the battery for a while, and attempting to connect before pressing any keys.


Specific Technical Questions:

1. Is there another way to get the OnePlus 5 into EDL mode other than Vol-Up+cable-connect? Such as with an EDL cable or by shorting test points on the board?

2. Is there a way to boot from another device, such as via OTG, connecting to a port on the board, or using special service hardware?

3. Is it possible to communicate with a USB device even when it does not appear to low-level USB inspection tools running on the host machine, such as lsusb (Linux) or various Windows USB utilities that scan all attached USB controllers for registered devices? (Or shall I continue to interpret the phone's invisibility to any such tool as an indication that no possible driver could recognize it, and thus avoid trying the dozen or so candidates I've collected?)

4. Is it theoretically possible for (buggy, incorrect, malicious) software being written to the recovery partition to break USB data connectivity or impair FastBoot?

5. Is it possible that a hardware issue might break the USB port for data, while allowing it to function correctly for charging?

6. Are there any other suggestions for a way forward I haven't considered here?

Thanks!

 

[V0latyle]

2. Is there a way to boot from another device, such as via OTG, connecting to a port on the board, or using special service hardware?

The only ability Android platforms have for external boot is by providing a boot image via ADB. This is done while the device is in bootloader mode, with this command:
fastboot boot <image>

This instructs the device to boot the image provided instead of what is written to the /boot partition.

If the bootloader is corrupt, the only thing that can be done is a low level reflash, as the board does not have the capability to load external software on its own - only the bootloader can.

3. Is it possible to communicate with a USB device even when it does not appear to low-level USB inspection tools running on the host machine, such as lsusb (Linux) or various Windows USB utilities that scan all attached USB controllers for registered devices? (Or shall I continue to interpret the phone's invisibility to any such tool as an indication that no possible driver could recognize it, and thus avoid trying the dozen or so candidates I've collected?)

No - if Windows does not even display an unidentified USB device, it's dead as a stone.

4. Is it theoretically possible for (buggy, incorrect, malicious) software being written to the recovery partition to break USB data connectivity or impair FastBoot?

I'm not familiar with OnePlus, but /recovery is a separate partition from /bootloader; as long as /bootloader is not corrupt, the device should at least start into bootloader mode, which would allow flashing partitions such as /recovery (if the bootloader is unlocked).
Fastbootd is a part of recovery mode that allows directly flashing partitions as well; normally, the recovery engine does not allow external flashing of partitions, and is meant to unpack and flash software packages.

5. Is it possible that a hardware issue might break the USB port for data, while allowing it to function correctly for charging?

Yes. As noted above, if any of the "cold boot" code such as bootloader is corrupt, the device may not communicate via USB, because that's a software issue. However, the onboard power management hardware continues to function and will charge the battery when power is connected via USB.

6. Are there any other suggestions for a way forward I haven't considered here?

Again...I'm not familiar with OnePlus devices, but as a generally universal rule of thumb, a device in a state such as yours is completely bricked and cannot be resurrected. If you can seek repair, do so - it most likely won't be cheap, as you'll be buying a new mainboard for the device, and you'll lose all your data anyway. Best course of action: Buy a replacement device.

 

[Pseudorando]

The only ability Android platforms have for external boot is by providing a boot image via ADB. This is done while the device is in bootloader mode, with this command:
fastboot boot <image>

This instructs the device to boot the image provided instead of what is written to the /boot partition.

If the bootloader is corrupt, the only thing that can be done is a low level reflash, as the board does not have the capability to load external software on its own - only the bootloader can.

No - if Windows does not even display an unidentified USB device, it's dead as a stone.

I'm not familiar with OnePlus, but /recovery is a separate partition from /bootloader; as long as /bootloader is not corrupt, the device should at least start into bootloader mode, which would allow flashing partitions such as /recovery (if the bootloader is unlocked).
Fastbootd is a part of recovery mode that allows directly flashing partitions as well; normally, the recovery engine does not allow external flashing of partitions, and is meant to unpack and flash software packages.

Yes. As noted above, if any of the "cold boot" code such as bootloader is corrupt, the device may not communicate via USB, because that's a software issue. However, the onboard power management hardware continues to function and will charge the battery when power is connected via USB.

Again...I'm not familiar with OnePlus devices, but as a generally universal rule of thumb, a device in a state such as yours is completely bricked and cannot be resurrected. If you can seek repair, do so - it most likely won't be cheap, as you'll be buying a new mainboard for the device, and you'll lose all your data anyway. Best course of action: Buy a replacement device.

Thanks for your fast and detailed reply. I'm still holding out some hope that I just need to properly induce a mode where the phone will become responsive to flashing tools which address the Qualcomm controller directly, which appears to be a mode separate from the /bootloader (which itself does appear to at least load properly, displaying the FastBoot menu, which lets me navigate to select a boot partition, restart the bootloader, or power off).

Other phones which use this Qualcomm chip can be put into EDL mode by either on-board test points or a cable that shorts out (or otherwise modifies the signal on) specific pins. But in the case of the OnePlus 5, the mode is either software accessible (not in my case), or accessible by a held key-combo (which appears not to work for me).

I found this nicely-detailed write-up of the EDL mode and its internals:

Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals

Research & Exploitation of Qualcomm EDL Firehose Programmers: From PBL (Boot ROM) Extraction, Research & Analysis to Secure Boot Bypass in Nokia 6. (Part 1)

alephsecurity.com

 

[V0latyle]

Thanks for your fast and detailed reply. I'm still holding out some hope that I just need to properly induce a mode where the phone will become responsive to flashing tools which address the Qualcomm controller directly, which appears to be a mode separate from the /bootloader (which itself does appear to at least load properly, displaying the FastBoot menu, which lets me navigate to select a boot partition, restart the bootloader, or power off).

Other phones which us this Qualcomm chip can be put into EDL mode by either on-board test points or a cable that shorts out (or otherwise modifies the signal on) specific pins. But in the case of the OnePlus 5, the mode is either software accessible (not in my case), or accessible by a held key-combo (which appears not to work for me).

I found this nicely-detailed write-up of the EDL mode and its internals:

Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals

Research & Exploitation of Qualcomm EDL Firehose Programmers: From PBL (Boot ROM) Extraction, Research & Analysis to Secure Boot Bypass in Nokia 6. (Part 1)

alephsecurity.com

I'm familiar with EDL mode, many Qualcomm devices automatically go into EDL mode when the bootloader fails to start. However if EDL mode is corrupted too...there's nothing you can do.

 

[alex.py]

Maybe you can try an EDL Deep Flash Cable, which gets the device into EDL Mode with the press of a button on the cable. It also works on hard-bricked devices.

 

[mvikrant97]

@Pseudorando
Has your issue resolved or do you still need help to get in edl mode?

 

[Pseudorando]

Well this is a pretty thorough brick so the follow-up is not as much for help as for closure.

(tl;dr: The old data is still inaccessible, I have replaced it with a new phone, and the old one is a time-capsule project for another day.)

I got my hands on another OnePlus 5 to verify that my diagnostic procedures were being done correctly by seeing if they work on a non-bricked device.

And they do. In every mode, the new phone identified itself (even without drivers) as predicted-- FastBoot, EDL, and as a storage device when booted normally.

I also eliminated a hardware issue with the USB-C connector assembly by swapping the phones' rear panels which include the jacks and the ribbon cable to the board. The new phone worked with the old phone's jacks, and the old phone did not work with the new phone's jacks.

Upon swapping the back panels to the original phones again, I damaged the USB port's ribbon connector to the motherboard of the old phone, which seems unrecoverable without just replacing the motherboard. This led me to stripping the board to identify the flash chip where all my data is still stored.

It's a Samsung KLUCG4J1ED. (eUFS, BGA 153, UFS 2.1, 1.8/3.3v, 11.5 x 13 x 1mm, G3 2-lane)

My current plan for recovering the photos and Signal account to let my contacts know I'm still alive is to extract the flash chip and read it with a test socket.

Thanks for asking