Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

[MichelLoyen]

I still don't get it...where does the BIN come from? The instructions only let's you generate the GPT0.bin (rename to msimage.mbn) and the GPT1.bin...there are no other files. It's probably really simple but i just don't get it

That driver can't be installed on windows 8
try this one X2_FlashDriver_Emergency.msi


You need to reinstall the driver, see above


some bin2hex tools arent working for bins larger than 64k.
try another one

The issue appears to be the bin file from ATF tool, it doesn't work for my model (rm892). See this quote from the insiders forum (http://answers.microsoft.com/en-us/...5d072d5-c26e-4a02-907d-fde2ca5e34c7?page=82):


Annan, we really need your help. It seems no one with Lumia 925 RM 892/893 is able to do it.

All of us are getting THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED.

I've tried both 17kb GPT files and the 256 GPT file and I have the same result.

Can this be a hex issue?

Unfortunately not. With the same HEX owners of Lumia 925 (RM-910) are restoring their devices. It means, HEX file is OK, but it's not compatible with our devices somehow.

I've tried applying all available HEX files for all devices. Only CD84... not throwing an error -1 during sending the HEX to the device. So, at least signature is correct. But then, nothing happens, GPT.bin ins't even analyzed at that point.

We need to look for another BIN file for us.

 

[Tsury]

Anyone with Lumia 925 managed to unbrick?

 

[mordebip]

Anyone with Lumia 925 managed to unbrick?

Here is my GPT dump for the 925 (RM-910) from RM910_3051.50009.1424.0001_RETAIL_im_mea2_226_01_439825_prd_signed.ffu

 

[Azrael Masters]

Does not work with german unbranded Lumia 920???

I've got a unbranded german Lumia 920 (RM821 - 059Q9L7).

I tried the mentioned steps with the "RM821_3051.50009.1424.0001_RETAIL_eu_euro2_248_01_452440_prd_signed.ffu" file.
I tried the 00E9427DF118D9E27D098D13BECB6C6C89CE59F4.hex in the Archive attached in the first post, as well with self created *.hex files from gpt.bin/gpt0.bin with bin2hexQ (attached in the first post).

But THOR2 does still not recreate the boot sector. It fails with the Errors:

• THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED
• THOR2 1.8.2.15 exited with error code 85021 (0x14C1D)

Full Output:

c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool>thor2 -m
ode emergency -hexfile "E:\6 Repair Files\00E9427DF118D9E27D098D13BECB6C6C89CE59
F4.hex" -mbnfile "E:\6 Repair Files\msimage.mbn" -orig_gpt
THOR2 1.8.2.15
Built for Windows @ 13:33:08 Mar 11 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile E:\6 Repair Files\00E9427DF118D9E27D098D13BECB6C6
C89CE59F4.hex -mbnfile E:\6 Repair Files\msimage.mbn -orig_gpt
Process started Fri May 01 14:13:59 2015
Logging to file C:\Users\TOBIAS~1.SCH\AppData\Local\Temp\thor2_win_2015050114135
9_ThreadId-10988.log
Debugging enabled for emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Message send failed with error code -1
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 7.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.15 exited with error code 85021 (0x14C1D)​

What I'm doing wrong or mabye the *.hex Files are incorrect?
Does anybody have an Idea or a correct *.hex File for my Phone?

This would be great

 

[miahshodan]

I downloaded the BIN from the lumia.zip in the Original post in this thread.

then generated the hex file using: D:\temp\nokia\bin2hex "D:\temp\nokia\00E9427DF118D9E27D098D13BECB6C6C89CE59F4.bin" hex.hex (substitute the right number for your device.)

Can you explain how generate yours?

 

[K3VYNC]

How can I skip signature check?

Sent from my Moto G using XDA Free mobile app

 

[pdawg17]

That driver can't be installed on windows 8
try this one X2_FlashDriver_Emergency.msi


You need to reinstall the driver, see above


some bin2hex tools arent working for bins larger than 64k.
try another one

What are some options for tools other than bin2hex and bin2hexQ? The bin that I need is not working and is 73kb so wouldn't mind trying another tool...

 

[Heathcliff74]

People who have a problem with the hex file, is because the hex file is invalid. The converter tool does not do a good job with converting bin files which are bigger than 64 KB.

To demonstrate: look at the file size of the original bin-files. Some are 60 KB and some are 74 KB. The conversion of the files with size 74 KB fails.

Look at the output hex-file in Notepad++. Scroll to line 4098. From there on you see that all lines have an extra character. There is an odd number of digits, which is not possible with hex-values.

So.. how to correct it..

Insert this line at linenumber 4098:

:020000042A01CF

All the next lines, except the last 3 lines start with:

:101

Replace that with:

:10

So the last 3 lines should not be changed.
Save the hex-file and it will be ready to use.

Ciao,
Heathcliff74

 

[kozaks]

Thank you!!

You guys are simply awesome! My 620 was sent back by service center saying hardware failure. Now up and running. Thank you!!

 

[sabersylar]

C:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool>thor2 -m
ode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
THOR2 1.8.2.15
Built for Windows @ 13:33:08 Mar 11 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
Process started Sat May 02 18:24:23 2015
Logging to file C:\Users\Saber\AppData\Local\Temp\thor2_win_20150502182423_Threa
dId-11128.log
Debugging enabled for  emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up
 to 20 seconds
Reading GPT from binary
        -- GPT STARTs--
name:        DPP
startLBA:    4096
endLBA:      20479
size:        0x0000000000800000 bytes
attributes:  0x0


name:        MODEM_FSG
startLBA:    20480
endLBA:      26623
size:        0x0000000000300000 bytes
attributes:  0x0


name:        SSD
startLBA:    28672
endLBA:      28703
size:        0x0000000000004000 bytes
attributes:  0x0


name:        SBL1
startLBA:    32768
endLBA:      35767
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL2
startLBA:    36864
endLBA:      39863
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL3
startLBA:    40960
endLBA:      45055
size:        0x0000000000200000 bytes
attributes:  0x0


name:        UEFI
startLBA:    45056
endLBA:      50055
size:        0x0000000000271000 bytes
attributes:  0x0


name:        RPM
startLBA:    53248
endLBA:      54247
size:        0x000000000007d000 bytes
attributes:  0x0


name:        TZ
startLBA:    57344
endLBA:      58343
size:        0x000000000007d000 bytes
attributes:  0x0


name:        WINSECAPP
startLBA:    61440
endLBA:      62463
size:        0x0000000000080000 bytes
attributes:  0x0


name:        BACKUP_SBL1
startLBA:    65536
endLBA:      68535
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL2
startLBA:    69632
endLBA:      72631
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL3
startLBA:    73728
endLBA:      77823
size:        0x0000000000200000 bytes
attributes:  0x0


name:        BACKUP_UEFI
startLBA:    77824
endLBA:      82823
size:        0x0000000000271000 bytes
attributes:  0x0


name:        BACKUP_RPM
startLBA:    86016
endLBA:      87015
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_TZ
startLBA:    90112
endLBA:      91111
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_WINSECAPP
startLBA:    94208
endLBA:      95231
size:        0x0000000000080000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    98304
endLBA:      98815
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    102400
endLBA:      102911
size:        0x0000000000040000 bytes
attributes:  0x0


name:        PLAT
startLBA:    106496
endLBA:      122879
size:        0x0000000000800000 bytes
attributes:  0x0


name:        EFIESP
startLBA:    131072
endLBA:      262143
size:        0x0000000004000000 bytes
attributes:  0x0


name:        MODEM_FS1
startLBA:    262144
endLBA:      268287
size:        0x0000000000300000 bytes
attributes:  0x0


name:        MODEM_FS2
startLBA:    270336
endLBA:      276479
size:        0x0000000000300000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    278528
endLBA:      279039
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    282624
endLBA:      282879
size:        0x0000000000020000 bytes
attributes:  0x0


        -- GPT ENDs --






















Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Checking eMMC read / write test results...
Failed to read number of eMMC sectors. eMMC is not working!!
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 29.00 seconds.

Unknown error code.

THOR2 1.8.2.15 exited with error code 85035 (0x14C2B)

i tried on my lumia 520 but i got this error :|
how can i fix it or whats that mean ?
plzzz help ...

 

[pdawg17]

People who have a problem with the hex file, is because the hex file is invalid. The converter tool does not do a good job with converting bin files which are bigger than 64 KB.

To demonstrate: look at the file size of the original bin-files. Some are 60 KB and some are 74 KB. The conversion of the files with size 74 KB fails.

Look at the output hex-file in Notepad++. Scroll to line 4098. From there on you see that all lines have an extra character. There is an odd number of digits, which is not possible with hex-values.

So.. how to correct it..

Insert this line at linenumber 4098:

:020000042A01CF

All the next lines, except the last 3 lines start with:

:101

Replace that with:

:10

So the last 3 lines should not be changed.
Save the hex-file and it will be ready to use.

Ciao,
Heathcliff74

Do you mean I should insert that line and drop everything down a line? Or replace line 4098 with this? Or insert it at the beginning of that line of text and leave the rest there?

 

[Heathcliff74]

Do you mean I should insert that line and drop everything down a line? Or replace line 4098 with this? Or insert it at the beginning of that line of text and leave the rest there?

That line must be put at line 4098. And everything below will go down one line. Look at the lengths of the lines. In the original hex-file all lines from 4098 and below have an extra character. That is wrong. To go beyond the 64 KB limit, this extra line is needed and then the bad characters from the lines below must be removed as described.
@johntheredimid The hex-files in the opening post should be updated accordingly. The big hex-files are not correct.

Ciao,
Heathcliff74

 

[pdawg17]

That line must be put at line 4098. And everything below will go down one line. Look at the lengths of the lines. In the original hex-file all lines from 4098 and below have an extra character. That is wrong. To go beyond the 64 KB limit, this extra line is needed and then the bad characters from the lines below must be removed as described.

@johntheredimid The hex-files in the opening post should be updated accordingly. The big hex-files are not correct.

Ciao,
Heathcliff74

Well darn that doesn't fix the MSG_SEND_RECEIVE_FAILED error on my 925. Still good to know that the hex file was wrong but even after fixing it I still get the same error...

Someone else please try this though in case I goofed up somewhere...

 

[Heathcliff74]

Well darn that doesn't fix the MSG_SEND_RECEIVE_FAILED error on my 925. Still good to know that the hex file was wrong but even after fixing it I still get the same error...

Someone else please try this though in case I goofed up somewhere...

Here are the corrected files. Try them.

 

[pdawg17]

Here are the corrected files. Try them.

Well thanks for eliminating that as a possible problem but still no go for me

If it helps, the error comes after these 3 lines:

Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded
Alpha Emergency Flash End

 

[Heathcliff74]

Well thanks for eliminating that as a possible problem but still no go for me

If it helps, the error comes after these 3 lines:

Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded
Alpha Emergency Flash End

Hmm. You say you have the Lumia 925, which is RM-892. There is also the Lumia 925T, which is RM-910. These are different models, but they both have the same RKH: CD84376222AAF204C85119532BF34EA55C8844E4CEA35F3E508D25AA34D96637. It's possible that these different models need different hex-files. The files from ATF may not be complete.

 

[pdawg17]

Hmm. You say you have the Lumia 925, which is RM-892. There is also the Lumia 925T, which is RM-910. These are different models, but they both have the same RKH: CD84376222AAF204C85119532BF34EA55C8844E4CEA35F3E508D25AA34D96637. It's possible that these different models need different hex-files. The files from ATF may not be complete.

I actually have RM-893 (T-Mobile with same RKH) but yes both the 892 and 893 are not successful...RM-910 is...

Someone with an RM-892 should try this though just in case...

 

[Heathcliff74]

I actually have RM-893 (T-Mobile with same RKH) but yes both the 892 and 893 are not successful...RM-910 is...

Someone with an RM-892 should try this though just in case...

You have an RM-910 which can be successfully repaired with my corrected files?

 

[pdawg17]

You have an RM-910 which can be successfully repaired with my corrected files?

No there is someone on the Microsoft Insider forum that says he successfully recovered his RM-910. This was several days ago. Not sure if he edited his hex file or not but he got it fixed...

 

[johntheredimid]

I am very confused, some tell me to stop such a hex files, others pass me another hex files ..

I suggest to new users to read each of the 9 posts., and thus not to create confusion
Greetings!