Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Search This thread

slimok5

New member
Aug 12, 2017
3
0
Sadly not work for my Lumia 925 RM-892. I propably removed partitions form the device. Has somebody sucsessfuly restored partitions/bootloader in Lumia 925?

My logs
Code:
C:\Users\xxx\Desktop\emmcdl>thor2 -mode emergency -hexfile "C:\Users\xxx\Desktop\luja\FAST8960_CATWALK.hex" -mbnfile "C:\Users\xxx\Desktop\luja\RM892_msimage_v1.0.mbn" -orig_gpt -debug
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile C:\Users\xxx\Desktop\luja\FAST8960_CATWALK.hex -mbnfile C:\Users\xxx\Desktop\luja\RM892_msimage_v1.0.mbn -orig_gpt -debug
Process started Sun Feb 09 00:56:33 2020
Logging to file C:\Users\xxx\AppData\Local\Temp\thor2_win_20200209005633_ThreadId-1164.log
Debugging enabled for  emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
Reading GPT from binary
        -- GPT STARTs--
name:        SBL1
startLBA:    34
endLBA:      243
size:        0x000000000001a400 bytes
attributes:  0x0


name:        SBL2
startLBA:    244
endLBA:      507
size:        0x0000000000021000 bytes
attributes:  0x0


name:        SBL3
startLBA:    508
endLBA:      1193
size:        0x0000000000055c00 bytes
attributes:  0x0


name:        UEFI
startLBA:    1194
endLBA:      3273
size:        0x0000000000104000 bytes
attributes:  0x0


name:        RPM
startLBA:    3274
endLBA:      3559
size:        0x0000000000023c00 bytes
attributes:  0x0


name:        TZ
startLBA:    3560
endLBA:      3985
size:        0x0000000000035400 bytes
attributes:  0x0


name:        WinSecApp
startLBA:    3986
endLBA:      4609
size:        0x000000000004e000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    4610
endLBA:      4865
size:        0x0000000000020000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    4866
endLBA:      4881
size:        0x0000000000002000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    4882
endLBA:      5137
size:        0x0000000000020000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    5138
endLBA:      5153
size:        0x0000000000002000 bytes
attributes:  0x0


name:        SSD
startLBA:    5154
endLBA:      5169
size:        0x0000000000002000 bytes
attributes:  0x0


name:        PLAT
startLBA:    5170
endLBA:      7243
size:        0x0000000000103400 bytes
attributes:  0x0


        -- GPT ENDs --













Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Programming image C
Image opened successfully for reading
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 5.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)
 

slimok5

New member
Aug 12, 2017
3
0
Lumia 925, Full Dead SOLUTION.

Finially I get a solution for a total brick. I spand 2 days for it, and after all it was that simple (I am really idiot that i don't try this earlier) :)

If your phone is seen as "Qualcomm HS-USB QDLoader 9008" and you don't see your phone as MassStorage Device, use command below
Code:
thor2 -mode emergency -hexfile FAST8960_CATWALK.hex -mbnfile RM892_msimage_v1.0.mbn -ffufile RM892.ffu
All needed files you will find on lumiafirmware.com site.

If your phone is not seen by the PC after connectin via usb, you propably need (as I needed) short the resistor R3209 to force "Qualcomm HS-USB QDLoader 9008" mode. Read more about this topic on: https://forum.xda-developers.com/showpost.php?p=69395504&postcount=4
 

loonbg

Senior Member
Jun 4, 2008
131
14
Any one that sucessful unbrick hes Lumia 625 (RM-941) ? Or to have some other idea to give me ?
Bcs i try many times and only once i have luck with this command
Code:
thor2 -mode emergency -hexfile FAST8930_MAXROW.hex -mbnfile RM941_msimage_v1.0.mbn -ffufile RM892.ffu
to make it boot at SAMSUNG logo.. Then i start to flashing it but it fail at 88% (no idea why .. i use correct rom for this device ) and now phone is again at QHSUSB_DLOAD ... but when i try to use again this command it always return again at QHSUSB_DLOAD
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt - giving me Unknown error .. i unplug battery and re-pluging it
and again its at QHSUSB_DLOAD
I guess this files FAST8930_MAXROW.hex RM941_msimage_v1.0.mbn at (lumiafirmware) not working correct
 
Last edited:

loonbg

Senior Member
Jun 4, 2008
131
14
thanks but its still same .. QHSUSB_DLOAD

this with FFU Mode :
Code:
Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Writing GPT
GPT of FFU write ended with status 0
Programming image RM941_msimage_v1.0.mbn
Image opened successfully for reading
Programming SBL1
Programming SBL2
Programming SBL3
Programming UEFI
Programming RPM
Programming TZ
Programming WINSECAPP
No read only data in this partition. Thus skipping programming of UEFI_BS_NV
No read only data in this partition. Thus skipping programming of UEFI_NV
No read only data in this partition. Thus skipping programming of UEFI_RT_NV
No read only data in this partition. Thus skipping programming of UEFI_RT_NV_RPMB
No read only data in this partition. Thus skipping programming of SSD
No read only data in this partition. Thus skipping programming of PLAT
Image closed successfully after reading
Programming of image ended with status 0
Sending CLOSE_REQ
Received valid response to CLOSE_REQ
Resetting device
Device reset done
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
WinUSB in use.
Detecting UEFI responder
Device is not in Lumia UEFI mode
Device mode get failed, mode is 7
Failed to boot to FlashApp
Operation took about 26.00 seconds.

THOR2_ERROR_BOOT_TO_FLASH_APP_FAILED

THOR2 1.8.2.18 exited with error code 84002 (0x14822)

with -orig_gpt is :
Code:
Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Checking eMMC read / write test results...
eMMC Read test passed. eMMC Write test passed!
Programming image C
Image opened successfully for reading
Uploading MBN image 70
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 11.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)
I try 20 times and its always QLOAD after unplug battery and usb cable
 
Last edited:

ToxaMacTep

New member
Mar 2, 2020
2
0
I tried to flash Lumia 640 XL DS (RM-1067) and was given a result like this:

Code:
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode emergency -protocol sahara -hexfile "C:\rm-1067\MPRG8x26_fh.ede" -edfile "C:\rm-1067\RM1067_fh.edp" -orig_gpt
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -protocol sahara -hexfile C:\rm-1067\MPRG8x26_fh.ede -edfile C:\rm-1067\RM1067_fh.edp -orig_gpt
Process started Mon Mar 02 00:33:05 2020
Logging to file C:\Temp\thor2_win_20200302003305_ThreadId-7952.log
Debugging enabled for  emergency

Initiating emergency download for RnD.
Create emergency messaging...
Create emergency messaging...END
Checking trace_usb...END
setHandshakeMessageStorageStatus...
setHandshakeMessageStorageStatus...END
Get connectionString...
Get connectionString...END
Open messaging...
Open messaging...END
Forced Sahara protocol
Create EmergencyProgrammer V3..
Create EmergencyProgrammer V3..END
EMERGENCY FLASH START
Emergency Programmer V3 version 2015.03.09.001
ED download selected
Sahara image entries START
0x0D, C:\rm-1067\MPRG8x26_fh.ede, true
Sahara image entries END
Starting Sahara emergency download
Entering state WAIT_HELLO
HELLO packet already received as handshake message
Erased stored HELLO packet
Sending HELLO_RESP
HELLO_RESP sent
Entering state WAIT_COMMAND
READ_DATA received
Opening image C:\rm-1067\MPRG8x26_fh.ede
Image opened successfully
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
END_IMAGE_TX received
END_IMAGE_TX with success status
Closing image C:\rm-1067\MPRG8x26_fh.ede
Image closed successfully
Sending DONE
DONE sent
Entering state WAIT_DONE_RESP
DONE_RESP received
Stopped Sahara emergency download (status code = 0)
Emergency Programmer V3 version 2015.03.09.001
EDPAYLOAD download selected
Sending firehose single image
Waiting for Ed ready message, timeout 500 ms
Waiting for Ed ready message...DONE, status 0
Handling ed image C:\rm-1067\RM1067_fh.edp to partition EMERGENCY
Image opened successfully for reading
Payload tool:
Apr  4 2014 08:12:09 Version 000.000.003
Payload generation info:
Fri Jun 20 06:56:17 2014
 SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008000E100000000H, RKH:D76AE35E9D76000F34DD189FFD09DF00055EB3A1H
Send signature
And it hangs just like that. What is the solution?
 

gmirz2005

Senior Member
Jun 18, 2017
134
39
Yerevan
Hello... So I tried all available HEX/MBN files on my lumia...
I used the short R3209 resistor method and my computer recognized it as QHSUSB_DLOAD.
Every time I try to flash it, here is what is going on.

Logs:
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode emergency -hexfile "C:\dump\HEX2.hex" -mbnfile "C:\dump\MSIMAGE.mbn" -orig_gpt
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile C:\dump\HEX2.hex -mbnfile C:\dump\MSIMAGE.mbn -orig_gpt
Process started Fri Mar 27 15:55:44 2020
Logging to file C:\Users\gmirz\AppData\Local\Temp\thor2_win_20200327155544_ThreadId-13272.log
Debugging enabled for emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 7 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 8 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 9 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 10 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 11 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 12 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 13 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 14 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 15 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 16 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 17 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 18 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 19 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 20 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 21 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 22 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 23 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 24 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 25 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 26 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 27 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 28 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 29 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 30 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 31 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 32 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 33 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 34 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 35 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 36 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 37 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 38 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 39 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 40 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 41 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 42 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 43 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 44 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 45 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 46 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 47 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 48 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
Waiting to reconnect: 49 of 80
Connecting to flash programmer
Message send failed with error code -1
Failed to get response to HELLO_REQ
and so on... and so on....
Help me please.
I don't think the eMMC is blown.
 

Jane11

Member
Jul 5, 2013
20
0
I tried to unbrick Lumia 520 according to the procedure described here but
how can I find the correct HEX file?

I received
09:16:32.494] D_MSG : Received valid response to OPEN_MULTI_REQ
[09:16:32.495] D_MSG : Checking eMMC read / write test results...
[09:16:32.495] D_MSG : eMMC Read test passed. eMMC Write test passed!
[09:16:32.502] D_MSG : Programming image C
[09:16:32.504] D_MSG : Image opened successfully for reading
[09:16:32.531] D_MSG : Uploading MBN image 70%
[09:16:32.544] D_ERR : SAFE hex file was used and unallowed memory address was being written.
[09:16:32.545] D_ERR : Reset the device and use the correct HEX file.
[09:16:32.547] D_MSG : ALPHA EMERGENCY FLASH END
[09:16:32.548] D_MSG : Emergency messaging closed successfully
[09:16:32.553] D_MSG : Operation took about 20.00 seconds.
[09:16:32.592] D_ERR : THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)
Thanks
 

augustinionut

Senior Member
Apr 21, 2015
1,562
204
If no hex then use these command:
thor2.exe -mode rnd -bootflashapp
thor2 -mode emergency -hexfile MPRG8x26_fh.ede -edfile RM1096_fh.edp -orig_gpt

Change names
Without battery
 
Last edited:

Jane11

Member
Jul 5, 2013
20
0
Thank you for your reply. I tried but failed , please see:

:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2.exe -mode rnd -bootflashapp
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2.exe -mode rnd -bootflashapp
Process started Wed Apr 22 09:14:29 2020
Logging to file C:\Users\expor\AppData\Local\Temp\thor2_win_20200422091429_ThreadId-21116.log
Initiating do RnD operations
WinUSB in use.
Debugging enabled for rnd

Detecting UEFI responder
Reading device mode failed
Detecting UEFI responder
Reading device mode failed

THOR2_ERROR_BOOT_TO_FLASH_APP_FAILED

THOR2 1.8.2.18 exited with error code 84002 (0x14822)

One more question
You told me to use
thor2 -mode emergency -hexfile MPRG8x26_fh.ede -edfile RM1096_fh.edp -orig_gpt
but I can not find fiiles with edp extensions in firmware. What kind of the files are these?
Thanks
 

augustinionut

Senior Member
Apr 21, 2015
1,562
204
Are the same....
FAST8930_SAND.hex - RM846_msimage_v1.0.mbn
thor2 -mode emergency -hexfile FAST8930_SAND.hex -edfile RM846_msimage_v1.0.mbn -orig_gpt

All the operations must be made without battery

But first try wdrt without battery,.
 
Last edited:

Jane11

Member
Jul 5, 2013
20
0
I tried Windows Device Recovery Tool( WDRT) but the phone( Lumia 520, RM-914) was not detected and I could not find the Lumia 520 among the listed phones( Device Selection option).
What should I try now? Thank you help
 

Jane11

Member
Jul 5, 2013
20
0
Thanks for the reply. I tried more files but they finishes like this
Logging to file C:\Users\expor\AppData\Local\Temp\thor2_win_20200422090148_ThreadId-10536.log
Debugging enabled for emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
Reading GPT from binary
-- GPT STARTs--
name: SBL1
startLBA: 34
endLBA: 289
size: 0x0000000000020000 bytes
attributes: 0x0


name: SBL2
startLBA: 290
endLBA: 545
size: 0x0000000000020000 bytes
attributes: 0x0


name: SBL3
startLBA: 546
endLBA: 1313
size: 0x0000000000060000 bytes
attributes: 0x0


name: UEFI
startLBA: 1314
endLBA: 3513
size: 0x0000000000113000 bytes
attributes: 0x0


name: RPM
startLBA: 3514
endLBA: 3897
size: 0x0000000000030000 bytes
attributes: 0x0


name: TZ
startLBA: 3898
endLBA: 4305
size: 0x0000000000033000 bytes
attributes: 0x0


name: WinSecApp
startLBA: 4306
endLBA: 5073
size: 0x0000000000060000 bytes
attributes: 0x0


name: UEFI_BS_NV
startLBA: 5074
endLBA: 5329
size: 0x0000000000020000 bytes
attributes: 0x0


name: UEFI_NV
startLBA: 5330
endLBA: 5345
size: 0x0000000000002000 bytes
attributes: 0x0


name: UEFI_RT_NV
startLBA: 5346
endLBA: 5601
size: 0x0000000000020000 bytes
attributes: 0x0


name: UEFI_RT_NV_RPMB
startLBA: 5602
endLBA: 5617
size: 0x0000000000002000 bytes
attributes: 0x0


name: SSD
startLBA: 5618
endLBA: 5633
size: 0x0000000000002000 bytes
attributes: 0x0


name: PLAT
startLBA: 5634
endLBA: 8033
size: 0x000000000012c000 bytes
attributes: 0x0


-- GPT ENDs --













Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Programming image C
Image opened successfully for reading
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 16.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)
Where do you the problem is? Or do you have tested hex and mbn files?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I have this Lumia 1320 (RM-994, 059V6F2) back from Noah's time. Today I finally replaced its charging board and it booted up, displaying my text messages from the past and totally freezing up when I enter the PIN.

    Anyway, I bricked it while trying to unlock its bootloader using WPI. (I guess I passed the wrong loader file??) Here we are at 05:40am and the phone still thinks it's a QHSUSB_DLOAD.

    1. I have tried files from LumiaFirmware: it fails with error 85021.

    2. I have tried using the files from the attachment: it flashes something but then fails with error 85034. I know it means "probably flashed", but yeah, disconnecting the battery, waiting ten seconds, running it 5-6 times etc. it never gets past QHSUSB_DLOAD.

    In the Device Manager it shows up as "Care Suite Emergency Connectivity".

    3. When I run the command with the FFU file, here is the log I get:

    Code:
    THOR2 1.8.2.18
    Built for Windows @ 13:36:46 Jun 16 2015
    Thor2 is running on Windows of version 6.1
    thor2.exe -mode emergency -hexfile C:\Users\[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_prg_v1.0.hex -mbnfile C:\Users
    
    \[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_msimage_v1.0.mbn -ffufile C:\ProgramData\WPInternals\Repository\RM-
    
    994\RM994_3058.50000.1424.0002_RETAIL_eu_turkey_1167_02_447944_prd_signed.ffu
    Process started Thu Apr 15 05:56:50 2021
    Logging to file C:\Users\[redacted]\AppData\Local\Temp\thor2_win_20210415055650_ThreadId-12880.log
    Debugging enabled for  emergency
    
    Initiating emergency download
    Using default emergency protocol
    ALPHA EMERGENCY FLASH START
    Emergency Programmer V1 version 2014.10.31.001
    Hex download selected
    Check if device in Dload
    Connection to DLOAD mode succeeded
    Get Dload parameters
    Sending HEX flasher to the device
    Sending GO command if HEX flasher successfully uploaded.
    Emergency Programmer V1 version 2014.10.31.001
    Mbn download selected
    Reading FFU partition table
    FFU RKH: 64356634FCA08BC9E0D02C14BDB230B0076D31099C9779483D27F9938EDB99C9
    FFU Platform ID: Nokia.MSM8930.P6145
        -- GPT STARTs--
    name:        DPP
    startLBA:    4096
    endLBA:      20479
    size:        0x0000000000800000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FSG
    startLBA:    20480
    endLBA:      26623
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        SSD
    startLBA:    28672
    endLBA:      28703
    size:        0x0000000000004000 bytes
    attributes:  0x0
    
    
    name:        SBL1
    startLBA:    32768
    endLBA:      35767
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        SBL2
    startLBA:    36864
    endLBA:      39863
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        SBL3
    startLBA:    40960
    endLBA:      45055
    size:        0x0000000000200000 bytes
    attributes:  0x0
    
    
    name:        UEFI
    startLBA:    45056
    endLBA:      50055
    size:        0x0000000000271000 bytes
    attributes:  0x0
    
    
    name:        RPM
    startLBA:    53248
    endLBA:      54247
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        TZ
    startLBA:    57344
    endLBA:      58343
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        WINSECAPP
    startLBA:    61440
    endLBA:      62463
    size:        0x0000000000080000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL1
    startLBA:    65536
    endLBA:      68535
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL2
    startLBA:    69632
    endLBA:      72631
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL3
    startLBA:    73728
    endLBA:      77823
    size:        0x0000000000200000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_UEFI
    startLBA:    77824
    endLBA:      82823
    size:        0x0000000000271000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_RPM
    startLBA:    86016
    endLBA:      87015
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_TZ
    startLBA:    90112
    endLBA:      91111
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_WINSECAPP
    startLBA:    94208
    endLBA:      95231
    size:        0x0000000000080000 bytes
    attributes:  0x0
    
    
    name:        UEFI_BS_NV
    startLBA:    98304
    endLBA:      98815
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        UEFI_NV
    startLBA:    102400
    endLBA:      102911
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        PLAT
    startLBA:    106496
    endLBA:      122879
    size:        0x0000000000800000 bytes
    attributes:  0x0
    
    
    name:        EFIESP
    startLBA:    131072
    endLBA:      262143
    size:        0x0000000004000000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FS1
    startLBA:    262144
    endLBA:      268287
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FS2
    startLBA:    270336
    endLBA:      276479
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV
    startLBA:    278528
    endLBA:      279039
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV_RPMB
    startLBA:    282624
    endLBA:      282879
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        MMOS
    startLBA:    286720
    endLBA:      456415
    size:        0x00000000052dc000 bytes
    attributes:  0x0
    
    
    name:        MainOS
    startLBA:    458752
    endLBA:      5205631
    size:        0x0000000090dd0000 bytes
    attributes:  0x0
    
    
    name:        Data
    startLBA:    5210112
    endLBA:      15151103
    size:        0x000000012f600000 bytes
    attributes:  0x0
    
    
        -- GPT ENDs --
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    FFU Platform ID: Nokia.MSM8930.P6145
    Waiting for connection to flash programmer
    Connecting to flash programmer
    Received valid HELLO_RSP
    Safe version=true, transfer size=15360
    Received valid SECURITY_RSP
    Successfully connected to flash programmer
    Connection to flash programmer succeeded
    Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
    Reading GPT from binary
        -- GPT STARTs--
    name:        DPP
    startLBA:    4096
    endLBA:      20479
    size:        0x0000000000800000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FSG
    startLBA:    20480
    endLBA:      26623
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        SSD
    startLBA:    28672
    endLBA:      28703
    size:        0x0000000000004000 bytes
    attributes:  0x0
    
    
    name:        SBL1
    startLBA:    32768
    endLBA:      35767
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        SBL2
    startLBA:    36864
    endLBA:      39863
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        SBL3
    startLBA:    40960
    endLBA:      45055
    size:        0x0000000000200000 bytes
    attributes:  0x0
    
    
    name:        UEFI
    startLBA:    45056
    endLBA:      50055
    size:        0x0000000000271000 bytes
    attributes:  0x0
    
    
    name:        RPM
    startLBA:    53248
    endLBA:      54247
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        TZ
    startLBA:    57344
    endLBA:      58343
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        WINSECAPP
    startLBA:    61440
    endLBA:      62463
    size:        0x0000000000080000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL1
    startLBA:    65536
    endLBA:      68535
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL2
    startLBA:    69632
    endLBA:      72631
    size:        0x0000000000177000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_SBL3
    startLBA:    73728
    endLBA:      77823
    size:        0x0000000000200000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_UEFI
    startLBA:    77824
    endLBA:      82823
    size:        0x0000000000271000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_RPM
    startLBA:    86016
    endLBA:      87015
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_TZ
    startLBA:    90112
    endLBA:      91111
    size:        0x000000000007d000 bytes
    attributes:  0x0
    
    
    name:        BACKUP_WINSECAPP
    startLBA:    94208
    endLBA:      95231
    size:        0x0000000000080000 bytes
    attributes:  0x0
    
    
    name:        UEFI_BS_NV
    startLBA:    98304
    endLBA:      98815
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        UEFI_NV
    startLBA:    102400
    endLBA:      102911
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        PLAT
    startLBA:    106496
    endLBA:      122879
    size:        0x0000000000800000 bytes
    attributes:  0x0
    
    
    name:        EFIESP
    startLBA:    131072
    endLBA:      262143
    size:        0x0000000004000000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FS1
    startLBA:    262144
    endLBA:      268287
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        MODEM_FS2
    startLBA:    270336
    endLBA:      276479
    size:        0x0000000000300000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV
    startLBA:    278528
    endLBA:      279039
    size:        0x0000000000040000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV_RPMB
    startLBA:    282624
    endLBA:      282879
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        MMOS
    startLBA:    286720
    endLBA:      456415
    size:        0x00000000052dc000 bytes
    attributes:  0x0
    
    
    name:        MainOS
    startLBA:    458752
    endLBA:      5205631
    size:        0x0000000090dd0000 bytes
    attributes:  0x0
    
    
    name:        Data
    startLBA:    5210112
    endLBA:      15151103
    size:        0x000000012f600000 bytes
    attributes:  0x0
    
    
    name:        Overflow
    startLBA:    5210112
    endLBA:      15151103
    size:        0x000000012f600000 bytes
    attributes:  0x0
    
    
    name:        SBL1
    startLBA:    34
    endLBA:      289
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        SBL2
    startLBA:    290
    endLBA:      545
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        SBL3
    startLBA:    546
    endLBA:      1313
    size:        0x0000000000060000 bytes
    attributes:  0x0
    
    
    name:        UEFI
    startLBA:    1314
    endLBA:      3513
    size:        0x0000000000113000 bytes
    attributes:  0x0
    
    
    name:        RPM
    startLBA:    3514
    endLBA:      3897
    size:        0x0000000000030000 bytes
    attributes:  0x0
    
    
    name:        TZ
    startLBA:    3898
    endLBA:      4305
    size:        0x0000000000033000 bytes
    attributes:  0x0
    
    
    name:        WinSecApp
    startLBA:    4306
    endLBA:      5073
    size:        0x0000000000060000 bytes
    attributes:  0x0
    
    
    name:        UEFI_BS_NV
    startLBA:    5074
    endLBA:      5329
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        UEFI_NV
    startLBA:    5330
    endLBA:      5345
    size:        0x0000000000002000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV
    startLBA:    5346
    endLBA:      5601
    size:        0x0000000000020000 bytes
    attributes:  0x0
    
    
    name:        UEFI_RT_NV_RPMB
    startLBA:    5602
    endLBA:      5617
    size:        0x0000000000002000 bytes
    attributes:  0x0
    
    
    name:        SSD
    startLBA:    5618
    endLBA:      5633
    size:        0x0000000000002000 bytes
    attributes:  0x0
    
    
    name:        PLAT
    startLBA:    5634
    endLBA:      8033
    size:        0x000000000012c000 bytes
    attributes:  0x0
    
    
        -- GPT ENDs --
    
    
    
    
    
    
    
    
    
    
    
    
    
    Sending OPEN_MULTI_REQ
    Received valid response to OPEN_MULTI_REQ
    Checking eMMC read / write test results...
    eMMC Read test passed. eMMC Write test passed!
    Writing GPT
    GPT of FFU write ended with status 0
    Programming image C:\Users\[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_msimage_v1.0.mbn
    Image opened successfully for reading
    Programming SBL1
    Programming SBL2
    Programming SBL3
    Programming UEFI
    Programming RPM
    Programming TZ
    Programming WINSECAPP
    No read only data in this partition. Thus skipping programming of UEFI_BS_NV
    No read only data in this partition. Thus skipping programming of UEFI_NV
    No read only data in this partition. Thus skipping programming of UEFI_RT_NV
    No read only data in this partition. Thus skipping programming of UEFI_RT_NV_RPMB
    No read only data in this partition. Thus skipping programming of SSD
    No read only data in this partition. Thus skipping programming of PLAT
    Image closed successfully after reading
    Programming of image ended with status 0
    Sending CLOSE_REQ
    Received valid response to CLOSE_REQ
    Resetting device
    Device reset done
    ALPHA EMERGENCY FLASH END
    Emergency messaging closed successfully
    WinUSB in use.
    Detecting UEFI responder
    Device is not in Lumia UEFI mode
    Device mode get failed, mode is 7
    Failed to boot to FlashApp
    Operation took about 23.00 seconds.
    
    THOR2_ERROR_BOOT_TO_FLASH_APP_FAILED
    
    THOR2 1.8.2.18 exited with error code 84002 (0x14822)

    4. The thing doesn't show up on WDRT.

    So yeah, similar stuff with the 1320 guy up a few pages. Except I couldn't get to a blue screen yet.

    Is there anyone who could save a 1320 like this? Or should I go looking for a new motherboard from another time capsule? :D

    Bonus question: Why can't we flash partitions with Qualcomm's tool?
  • 58
    04/30/2015
    And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

    Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.

    05/25/2015
    Simple method:

    Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
    Here is the link.

    --------------------------------------
    If this does not work, try the advanced method:

    Let's to the steps:
    Attachment files in the same thread.

    1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
    2) Download your firmware lumia with NaviFirm
    3) Install Drivers
    4) Go to the folder where it is thor 2 from cmd (run administrator)
    cd C:...

    Use this command line to extract gtp0.bin from ffu image

    Code:
    thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump

    this command will create gpt0.bin and rename it as msimage.mbn

    mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

    convert this binary file to hex using bin2hex.exe

    Code:
    bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex

    open .hex file in notepad
    insert :020000042A00D0 in first line
    and :040000052A000000CD before the last line

    or
    Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


    Now you have HEX.hex and msimage.mbn

    the use this command line

    Code:
    thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

    Ready, disconnect the battery and reconnect. Now connect your phone to the PC
    Yeah, his phone started life with red screen!
    Charge the battery

    5) Flash rom: Now, in the case of Lumia 520/521

    Code:
    thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl

    .VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

    Code:
    thor2 -mode rnd -bootnormalmode
    :highfive:


    Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
    thanks @Heathcliff74


    thanks @zapirkon and others users participated
    thanks @ TheBITLINK aka BIT of Windows Insider.

    Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
    Thanks all... :fingers-crossed: they are the best :):):)
    11
    draft for steps

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle
    5
    Woohoo!!!! Success with my RM-893! Skiddd thanks for the bin package! Not sure where you got the RM-892 bin but I've tried several before yours and they didn't work but yours did!

    I converted to hex then had to do the edits since that one is larger than 60kb and now my phone is back to life! I've posted the edited file here for anyone with an RM-892/3 that wants to try it!
    3
    Now in every new Lumia from Microsoft there is way to force device to switch into emergency flash mode:
    3
    Can anybody tell me if this tutorial can somehow be used to unbrick my Samsung Ativ S? It's been dead for almost a month now.
    :crying:

    Not at all. By far. Sorry.:(

    ---------- Post added at 12:56 PM ---------- Previous post was at 12:53 PM ----------

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle



    {I quoted the whole thing above on purpose}

    Followed the steos "to the T" as they say. Worked just fine. You just forgot to mention that at the point of the Green Nokia Screen you can reset/remove batt/issue reset command to restart.

    Thank you Zapirkon for summarizing and thanks the OP as well for the finding.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone