• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Search This thread
Mar 25, 2011
40
67
04/30/2015
And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.

05/25/2015
Simple method:

Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
Here is the link.

--------------------------------------
If this does not work, try the advanced method:

Let's to the steps:
Attachment files in the same thread.

1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
2) Download your firmware lumia with NaviFirm
3) Install Drivers
4) Go to the folder where it is thor 2 from cmd (run administrator)
cd C:...

Use this command line to extract gtp0.bin from ffu image

Code:
thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump

this command will create gpt0.bin and rename it as msimage.mbn

mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

convert this binary file to hex using bin2hex.exe

Code:
bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex

open .hex file in notepad
insert :020000042A00D0 in first line
and :040000052A000000CD before the last line

or
Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


Now you have HEX.hex and msimage.mbn

the use this command line

Code:
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

Ready, disconnect the battery and reconnect. Now connect your phone to the PC
Yeah, his phone started life with red screen!
Charge the battery

5) Flash rom: Now, in the case of Lumia 520/521

Code:
thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl

.VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

Code:
thor2 -mode rnd -bootnormalmode
:highfive:


Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
thanks @Heathcliff74


thanks @zapirkon and others users participated
thanks @ TheBITLINK aka BIT of Windows Insider.

Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
Thanks all... :fingers-crossed: they are the best :):):)
 

Attachments

  • Lumia.zip
    785.4 KB · Views: 38,388
  • MPRG_HEX.zip
    1.2 MB · Views: 73,630
  • bin2hexQ_src.zip
    831 bytes · Views: 19,967
  • bin2hexQ.zip
    2.6 KB · Views: 26,202
  • CorrectedHexFiles.zip
    442.2 KB · Views: 37,248
Last edited by a moderator:

zapirkon

Member
Mar 26, 2012
42
16
you have extracted ffu using 7-Zip ? is that right ?

either with thor2 or with imgmount

---------- Post added at 02:05 PM ---------- Previous post was at 01:44 PM ----------

from thor2 manual I see that it can flash the bin or mbn files
I tried that once, but later today I will try it again and post here

as for the mbn file i mentioned, I think it is too small to be the one.
 

zapirkon

Member
Mar 26, 2012
42
16
in the ffu there is MMOS.WIM file
inside it i found xml file with some partitioning info


Code:
<?xml version="1.0" encoding="utf-8"?>
<DeviceLayout xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/embedded/2004/10/ImageUpdate">
  <Partitions>
    <!-- READ-ONLY SECTION START -->

    <!-- Device Provisioning Partition (FIRST READ-ONLY) -->
    <Partition>
      <Name>DPP</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <TotalSectors>16384</TotalSectors>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- QUALCOMM 8960 SPECIFIC READ-ONLY PARTITIONS -->

    <!-- Modem golden file system - MUST FOLLOW DPP -->
    <Partition>
      <Name>MODEM_FSG</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{638FF8E2-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Secure Software Download -->
    <Partition>
      <Name>SSD</Name>
      <TotalSectors>16</TotalSectors>
      <Type>{2C86E742-745E-4FDD-BFD8-B6A7AC638772}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Bootloaders -->
    <Partition>
      <Name>SBL1</Name>
      <TotalSectors>3000</TotalSectors>
      <!-- Qualcomm defined for SBL1 -->
      <Type>{DEA0BA2C-CBDD-4805-B4F9-F428251C3E98}</Type>
      <Bootable>true</Bootable>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>SBL2</Name>
      <TotalSectors>3000</TotalSectors>
      <Type>{8C6B52AD-8A9E-4398-AD09-AE916E53AE2D}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>SBL3</Name>
      <TotalSectors>4096</TotalSectors>
      <Type>{05E044DF-92F1-4325-B69E-374A82E97D6E}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI</Name>
      <TotalSectors>5000</TotalSectors>
      <Type>{400FFDCD-22E0-47E7-9A23-F16ED9382388}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
    <Name>RPM</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{098DF793-D712-413D-9D4E-89D711772228}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>TZ</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- fTPM Application -->
    <Partition>
      <Name>WINSECAPP</Name>
      <TotalSectors>1024</TotalSectors>
      <Type>{69B4201F-A5AD-45EB-9F49-45B38CCDAEF5}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Bootloaders Backup Section (Sizes must match) -->
    <Partition>
      <Name>BACKUP_SBL1</Name>
      <TotalSectors>3000</TotalSectors>
      <!-- Qualcomm defined for SBL1 -->
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <Bootable>true</Bootable>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_SBL2</Name>
      <TotalSectors>3000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_SBL3</Name>
      <TotalSectors>4096</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_UEFI</Name>
      <TotalSectors>5000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
   <Name>BACKUP_RPM</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_TZ</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- fTPM Application Backup Section (Sizes must match) -->
    <Partition>
      <Name>BACKUP_WINSECAPP</Name>
      <TotalSectors>1024</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>


    <!-- UEFI Variable Services Partitions - Read-Only -->
    <Partition>
      <Name>UEFI_BS_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{F0B4F48B-AEBA-4ECF-9142-5DC30CDC3E77}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{74DA3EE7-D422-487C-A573-CE03C261362F}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
  
    <!-- ACPI table storage -->
    <Partition>
      <Name>PLAT</Name>
      <TotalSectors>16384</TotalSectors>
      <FileSystem>FAT</FileSystem>
      <Type>{543C031A-4CB6-4897-BFFE-4B485768A8AD}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- EFI System Partition (LAST READ-ONLY) --> 
    <Partition>
      <Name>EFIESP</Name>
      <FileSystem>FAT</FileSystem>
      <TotalSectors>131072</TotalSectors>
      <ByteAlignment>0x4000000</ByteAlignment>
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- READ-ONLY SECTION END -->

    <!-- START QUALCOMM 8960 SPECIFIC READ-WRITE PARTITIONS -->

    <!-- Modem live file systems -->
    <Partition>
      <Name>MODEM_FS1</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{EBBEADAF-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
      <ByteAlignment>0x4000000</ByteAlignment>
    </Partition>
    <Partition>
      <Name>MODEM_FS2</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{0A288B1F-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- UEFI Variable Services Partitions - Read-Write -->
    <Partition>
      <Name>UEFI_RT_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{6BB94537-7D1C-44D0-9DFE-6D77C011DBFC}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI_RT_NV_RPMB</Name>
      <TotalSectors>256</TotalSectors>
      <Type>{E35F99CF-0025-4252-A608-CAAA1289CAF4}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

   <!-- END QUALCOMM 8960 SPECIFIC READ-WRITE PARTITIONS -->

   <!-- START MICROSOFT READ-WRITE PARTITIONS -->
    <Partition>
      <Name>MMOS</Name>
      <FileSystem>FAT</FileSystem>
      <MinFreeSectors>8192</MinFreeSectors>
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
    </Partition>

   <Partition>
      <Name>MainOS</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <!-- Accounts for 400MB free sectors and 256MB page file as defined in registry by package src\baseos\prod\packages\arm\armmemory -->
      <MinFreeSectors>1343488</MinFreeSectors>
      <ByteAlignment>0x800000</ByteAlignment>
      <ClusterSize>0x4000</ClusterSize>
      <FileSystem>NTFS</FileSystem>
      <AttachDriveLetter>false</AttachDriveLetter>
    </Partition>
    <Partition>
      <Name>Data</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <UseAllSpace>true</UseAllSpace>
      <ByteAlignment>0x800000</ByteAlignment>
      <ClusterSize>0x4000</ClusterSize>
      <FileSystem>NTFS</FileSystem>
    </Partition>
  </Partitions>
  <!-- END MICROSOFT READ-WRITE PARTITIONS -->

  <SectorSize>512</SectorSize>
  <ChunkSize>128</ChunkSize>
  <DefaultPartitionByteAlignment>0x200000</DefaultPartitionByteAlignment>
</DeviceLayout>

also, i found

qcadsp8930.mbn
qcdsp1v18930.mbn
qcdsp1v28930.mbn
qcdsp28930.mbn
qcwcnss8930.mbn

but, I notice that when thor2 is started in emergency mode, and I provide any mbn file, the error is

Code:
QUATTRO EMERGENCY FLASH START
Quattro Emergency Programmer version 2014.11.25.001
ED download selected
Failed to load XML configuration file
Quattro emergency flash exited with error code 85000
QUATTRO EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 6.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_XML_PARSING_FAILED

THOR2 1.8.2.15 exited with error code 85000 (0x14C08)

also from the WMI file I see buld info:
Code:
collins_engine_8227/PRx_engine_integration
which indicates to me that emergency programming should be done with
Code:
 -protocol streaming
but I always get error THOR2_ERROR_NO_SAHARA_HANDSHAKE
how to change the emergency protocol?
 
Last edited:

zapirkon

Member
Mar 26, 2012
42
16
did you read it?

Please do try to recover and share your results.


---------- Post added at 12:00 PM ---------- Previous post was at 11:43 AM ----------

comparing
8960_msimage.mbn
to
GPT.bin
(extracted with thor2 -mode ffureader -ffufile "...ffu" -dump_partitions -filedir c:\temp)

they seem similar in contents

is this the mbn file? I still can't find hex file
 

WojtasXda

Senior Member
Jan 19, 2009
256
362
PRG
Nokia uses own Sahara implementation, called "FireHose" , which will NOT work with QPST. And not open mass storage mode. And MSM image is also not usable for repair. Funny, isn't it?
 
Mar 25, 2011
40
67
Nokia uses own Sahara implementation, called "FireHose" , which will NOT work with QPST. And not open mass storage mode. And MSM image is also not usable for repair. Funny, isn't it?

And why the application makes mention thor2 files used in QPST?

------------------------------------------------------------------------

PD: I updated the theard to current information, thanks.
 

whoadood

Senior Member
Oct 11, 2012
473
193
I don't know if it's me, but the fact that the phone seems to be in download mode indicates that we should be able to flash any kind of thing on it, surpassing the signature checks. Am I right?
 

ngame

Senior Member
Mar 13, 2012
1,126
546
Mashad
I don't know if it's me, but the fact that the phone seems to be in download mode indicates that we should be able to flash any kind of thing on it, surpassing the signature checks. Am I right?

if your phone is locked on the red screen yes it's download mode .
but if you mean you can bypass sign check in this mode ? I think no.
It's nothing else than one NOKIA Care Suite loads .
If you try to flash your phone using NCS you see this screen but it starts flashing phone in a little while .
 

whoadood

Senior Member
Oct 11, 2012
473
193
if your phone is locked on the red screen yes it's download mode .
but if you mean you can bypass sign check in this mode ? I think no.
It's nothing else than one NOKIA Care Suite loads .
If you try to flash your phone using NCS you see this screen but it starts flashing phone in a little while .

No. I mean the black screen. It looks like it's some Qualcomm's (very low level) flashing mode. I would say it will swallow everything you feed it.
 

ngame

Senior Member
Mar 13, 2012
1,126
546
Mashad
No. I mean the black screen. It looks like it's some Qualcomm's (very low level) flashing mode. I would say it will swallow everything you feed it.

Everything you need is a Qualcomm MSM device ?
OK lets hold vol up key and turn your phone on and don't release vol up while you see a gear + a thunder .
 

whoadood

Senior Member
Oct 11, 2012
473
193
Everything you need is a Qualcomm MSM device ?
OK lets hold vol up key and turn your phone on and don't release vol up while you see a gear + a thunder .

I'm telling you the phone is completely and absolutely dead. All I see is a QHSUSB_DLOAD device when I plug it into a computer. But the screen never shows anything.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 59
    04/30/2015
    And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

    Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.

    05/25/2015
    Simple method:

    Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
    Here is the link.

    --------------------------------------
    If this does not work, try the advanced method:

    Let's to the steps:
    Attachment files in the same thread.

    1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
    2) Download your firmware lumia with NaviFirm
    3) Install Drivers
    4) Go to the folder where it is thor 2 from cmd (run administrator)
    cd C:...

    Use this command line to extract gtp0.bin from ffu image

    Code:
    thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump

    this command will create gpt0.bin and rename it as msimage.mbn

    mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

    convert this binary file to hex using bin2hex.exe

    Code:
    bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex

    open .hex file in notepad
    insert :020000042A00D0 in first line
    and :040000052A000000CD before the last line

    or
    Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


    Now you have HEX.hex and msimage.mbn

    the use this command line

    Code:
    thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

    Ready, disconnect the battery and reconnect. Now connect your phone to the PC
    Yeah, his phone started life with red screen!
    Charge the battery

    5) Flash rom: Now, in the case of Lumia 520/521

    Code:
    thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl

    .VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

    Code:
    thor2 -mode rnd -bootnormalmode
    :highfive:


    Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
    thanks @Heathcliff74


    thanks @zapirkon and others users participated
    thanks @ TheBITLINK aka BIT of Windows Insider.

    Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
    Thanks all... :fingers-crossed: they are the best :):):)
    11
    draft for steps

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle
    5
    Woohoo!!!! Success with my RM-893! Skiddd thanks for the bin package! Not sure where you got the RM-892 bin but I've tried several before yours and they didn't work but yours did!

    I converted to hex then had to do the edits since that one is larger than 60kb and now my phone is back to life! I've posted the edited file here for anyone with an RM-892/3 that wants to try it!
    3
    Now in every new Lumia from Microsoft there is way to force device to switch into emergency flash mode:
    3
    Can anybody tell me if this tutorial can somehow be used to unbrick my Samsung Ativ S? It's been dead for almost a month now.
    :crying:

    Not at all. By far. Sorry.:(

    ---------- Post added at 12:56 PM ---------- Previous post was at 12:53 PM ----------

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle



    {I quoted the whole thing above on purpose}

    Followed the steos "to the T" as they say. Worked just fine. You just forgot to mention that at the point of the Green Nokia Screen you can reset/remove batt/issue reset command to restart.

    Thank you Zapirkon for summarizing and thanks the OP as well for the finding.