Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Search This thread

lris

Member
Nov 28, 2012
21
2
Samsung Galaxy S10+
i Tried everything But my old Lumia 925 RM-892 looks like cant be fixed:
HE is detected: QHSUSB_DLOAD
There a JTAG scheme to be able to recover or at least recover the files ?
what i need more is files inside it.
I also have another working Lumia 925 same model, Maybe someone can help ?
 

gmirz2005

Senior Member
Jun 18, 2017
143
43
Yerevan
i Tried everything But my old Lumia 925 RM-892 looks like cant be fixed:
HE is detected: QHSUSB_DLOAD
There a JTAG scheme to be able to recover or at least recover the files ?
what i need more is files inside it.
I also have another working Lumia 925 same model, Maybe someone can help ?

Can you send the log?
 

lris

Member
Nov 28, 2012
21
2
Samsung Galaxy S10+
Can you send the log?

Code:
Debugging enabled for  emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Message send failed with error code -1
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 7.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)

Looks like cant comunicate to device at all
 

arashtix

Member
Aug 31, 2011
10
0
it failed, failed on sending signature again.

Hi , I Have same problem

I have Lumia 640 ds(RM-1077) detects as QHSUSB_BULK / Qualcomm HS-USB QDloader 9008
When phone connect to PC, then vibrate,about 10 second later ,will vibrate and reboot , and this reboot loop

i've tried everything
Code:
thor2 -mode emergency -hexfile "C:\Lumia\Emergency Files\MPRG8x26_fh.ede" -edfile "C:\Lumia\Emergency Files\RM1077_fh.edp" -orig_gpt

the result is :
Code:
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile C:\Lumia\Emergency Files\MPRG8x26_fh.ede -edfile C:\Lumia\Emergency Files\RM1077_fh.edp -orig_gpt
Process started Fri Nov 27 13:43:08 2020
Logging to file C:\Users\arash\AppData\Local\Temp\thor2_win_20201127134308_ThreadId-2984.log
Debugging enabled for  emergency

Initiating emergency download for RnD.
Create emergency messaging...
Create emergency messaging...END
Checking trace_usb...END
setHandshakeMessageStorageStatus...
setHandshakeMessageStorageStatus...END
Get connectionString...
Get connectionString...END
Open messaging...
Open messaging...END
Create EmergencyProgrammer V3..
Create EmergencyProgrammer V3..END
EMERGENCY FLASH START
Emergency Programmer V3 version 2015.03.09.001
ED download selected
Sahara image entries START
0x0D, C:\Lumia\Emergency Files\MPRG8x26_fh.ede, true
Sahara image entries END
Starting Sahara emergency download
Entering state WAIT_HELLO
HELLO packet already received as handshake message
Erased stored HELLO packet
Sending HELLO_RESP
HELLO_RESP sent
Entering state WAIT_COMMAND
READ_DATA received
Opening image C:\Lumia\Emergency Files\MPRG8x26_fh.ede
Image opened successfully
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
END_IMAGE_TX received
END_IMAGE_TX with success status
Closing image C:\Lumia\Emergency Files\MPRG8x26_fh.ede
Image closed successfully
Sending DONE
DONE sent
Entering state WAIT_DONE_RESP
DONE_RESP received
Stopped Sahara emergency download (status code = 0)
Emergency Programmer V3 version 2015.03.09.001
EDPAYLOAD download selected
Sending firehose single image
Waiting for Ed ready message, timeout 500 ms
Waiting for Ed ready message...DONE, status 0
Handling ed image C:\Lumia\Emergency Files\RM1077_fh.edp to partition EMERGENCY
Image opened successfully for reading
Payload tool:
Apr  4 2014 08:12:09 Version 000.000.003
Payload generation info:
Fri Jun 20 06:56:21 2014
 SW_ID:00000000ffff0000H, KCI:1302, MSM_ID:008000E100000000H, RKH:C3430DDD2E4D6405DB388280A085298C32112D91H
Send signature
Message send failed with error code 31
Failed to send signature!
Handling ed image ended with status 85021
EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 36.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)

I have correct files from lumiafirmware.com or downloaded file from WDRT
Also have "EFIESP.bin","MainOS.bin","Data.bin" and Win32DiskImager Backup
Maybe boot repair is needed:confused::rolleyes:

Can Somebody Help me:(
 

srdrhl146

New member
Oct 11, 2016
3
0
After I try installings through Vpl the FFu starts flashing, but the screen is still not on and one of the main error seems to do with UEFI Mode. Any solution for this?


THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\Users\srdrh\Downloads\RM914_059S1N6_3058.50000.1425.0001_790.vpl
Process started Sat Dec 05 10:46:42 2020
Logging to file C:\Users\srdrh\AppData\Local\Temp\thor2_win_20201205104642_ThreadId-2984.log
Parsing VPL file C:\Users\srdrh\Downloads\RM914_059S1N6_3058.50000.1425.0001_790.vpl
Successfully parsed VPL
Flashing .ffu file RM914_3058.50000.1425.0001_RETAIL_im_india_269_01_444377_prd_signed.ffu (SW version 3058.50000.1425.0001)
Debugging enabled for uefiflash

Initiating FFU flash operation
WinUSB in use.
isDeviceInNcsdMode
isDeviceInNcsdMode is false
Device mode 7 Emergency mode
[THOR2_flash_state] Pre-programming operations
Disable timeouts
Detecting UEFI responder
Device is not in Lumia UEFI mode
Device mode get failed, mode is 7
Connection lost, trying to re-connect
Rebooting to the normal mode...
Rebooting from the WP/MMOS failed.
Operation took about 5 minutes, 6 seconds.

THOR2_ERROR_TO_COMMUNICATE_WITH_DEVICE

THOR2 1.8.2.18 exited with error code 84102 (0x14886)
 

Freyz08

New member
Dec 9, 2020
1
0
Hello, I bricked my Lumia 950XL completely when flashing emergency files into the phone. Seems like cable is loose and the partition on the ram is damaged. It does not boot up or vibrate when plugged in, appears in device manager as QHSUSB_BULK. I tried to recover it using thor2, but it doesn't work. Here is the log:
Code:
 ./thor2 -mode emergency -protocol sahara -hexfile RM1085.ede -edfile RM1085.edp
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\thor2.exe -mode emergency -protocol sahara -hexfile RM1085.ede -edfile RM1085.edp
Process started Wed Dec 09 14:17:07 2020
Logging to file C:\Users\zhaoy\AppData\Local\Temp\thor2_win_20201209141707_ThreadId-7344.log
Debugging enabled for  emergency

Initiating emergency download for RnD.
Create emergency messaging...
Create emergency messaging...END
Checking trace_usb...END
setHandshakeMessageStorageStatus...
setHandshakeMessageStorageStatus...END
Get connectionString...
Get connectionString...END
Open messaging...
Open messaging...END
Forced Sahara protocol
Create EmergencyProgrammer V3..
Create EmergencyProgrammer V3..END
EMERGENCY FLASH START
Emergency Programmer V3 version 2015.03.09.001
ED download selected
Sahara image entries START
0x0D, RM1085.ede, true
Sahara image entries END
Starting Sahara emergency download
Entering state WAIT_HELLO
HELLO packet already received as handshake message
Erased stored HELLO packet
Sending HELLO_RESP
HELLO_RESP sent
Entering state WAIT_COMMAND
READ_DATA received
Opening image RM1085.ede
Image opened successfully
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
END_IMAGE_TX received
END_IMAGE_TX with success status
Closing image RM1085.ede
Image closed successfully
Sending DONE
DONE sent
Entering state WAIT_DONE_RESP
DONE_RESP received
Stopped Sahara emergency download (status code = 0)
Emergency Programmer V3 version 2015.03.09.001
EDPAYLOAD download selected
Sending firehose single image
Waiting for Ed ready message, timeout 500 ms
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Chip serial num: 21519581 (0x1485cdd)"/></data>â<â≤
Waiting for Ed ready message...DONE, status 0
Handling ed image RM1085.edp to partition EMERGENCY
Image opened successfully for reading
Payload tool:
Apr 16 2015 13:55:10 Version 000.001.000
Payload generation info:
Thu Oct 15 09:12:55 2015
SW_ID:000000000000001AH, KCI:1318, MSM_ID:009400E100450000H, RKH:427D8FD5A7F227820D5B11BF8C6F7670C0A0622CH
Send signature
<?xml version="1.0" encoding="UTF-8" ?><data><log value="VIP - Validated Image Programming is enabled - Validation is enabled."/></data>
Send signature. DONE.
Send hashtable
<?xml version="1.0" encoding="UTF-8" ?><data><log value="(P0000) (H0255) Using Table 0"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="VIP - HASH of packet ACCEPTED"/></data>
Send hashtable.DONE.( 0 )
Configure FIREHOSE
<?xml version="1.0" encoding="UTF-8" ?><data><log value="(P0001) (H0000) Using Table 1"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="VIP - HASH of packet ACCEPTED"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Calling hotplug_poll_device('MMC')"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Storage device of type 'MMC' cannot be opened"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><error code="1" value="HW_INIT:init storage:fail"/></data>
NAK received, ACK expected
Message send/receive failed with error code 85033
Failed to get response to configure req.
Handling ed image ended with status 85033
EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 8.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85033 (0x14C29)

I am suspecting if the chip is in write protection. If it is the case, am I able to flash it back without the use of JTAG?

I would really appreciate it if anyone could help me.
 
Last edited:

BootVirtual

New member
Jan 15, 2021
3
1
Earth
I think I got it finally working. My issues were the bin/hex file provided in the article were incorrect so I downloaded some off the internet from lumiafirmware.com. The second issue was that the files I downloaded were blocked by Windows because they were files from the internet. So I had to manually unblock them by going into their properties.

Hope this helped anyone who still owns a Lumia in 2021 :)

BootVirtual
 
Last edited:
  • Like
Reactions: iskender4444

reinierg

New member
Feb 19, 2021
1
0
Hello, good to all. My Nokia Lumia 635 Rm-975 has been bricked with the two red arrows, I have tried thor2 but for that model on the web there is no .hex file, how can I create it or if someone has it. The RKH of my device is B2F6BECAAED8735388C21591177EDEBE44E5D762 which does not appear in the resource list. I have tried almost everything. Could someone help me?
 

BootVirtual

New member
Jan 15, 2021
3
1
Earth
Hello, good to all. My Nokia Lumia 635 Rm-975 has been bricked with the two red arrows, I have tried thor2 but for that model on the web there is no .hex file, how can I create it or if someone has it. The RKH of my device is B2F6BECAAED8735388C21591177EDEBE44E5D762 which does not appear in the resource list. I have tried almost everything. Could someone help me?

Hello! I think you can get the .hex file from lumiafirmware.com, you'll need your RM number and product code (you can usually find these two things under the battery) Let me know if it works!
 

EgeBeyTR

New member
Apr 15, 2021
1
1
I have this Lumia 1320 (RM-994, 059V6F2) back from Noah's time. Today I finally replaced its charging board and it booted up, displaying my text messages from the past and totally freezing up when I enter the PIN.

Anyway, I bricked it while trying to unlock its bootloader using WPI. (I guess I passed the wrong loader file??) Here we are at 05:40am and the phone still thinks it's a QHSUSB_DLOAD.

1. I have tried files from LumiaFirmware: it fails with error 85021.

2. I have tried using the files from the attachment: it flashes something but then fails with error 85034. I know it means "probably flashed", but yeah, disconnecting the battery, waiting ten seconds, running it 5-6 times etc. it never gets past QHSUSB_DLOAD.

In the Device Manager it shows up as "Care Suite Emergency Connectivity".

3. When I run the command with the FFU file, here is the log I get:

Code:
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.1
thor2.exe -mode emergency -hexfile C:\Users\[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_prg_v1.0.hex -mbnfile C:\Users

\[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_msimage_v1.0.mbn -ffufile C:\ProgramData\WPInternals\Repository\RM-

994\RM994_3058.50000.1424.0002_RETAIL_eu_turkey_1167_02_447944_prd_signed.ffu
Process started Thu Apr 15 05:56:50 2021
Logging to file C:\Users\[redacted]\AppData\Local\Temp\thor2_win_20210415055650_ThreadId-12880.log
Debugging enabled for  emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Reading FFU partition table
FFU RKH: 64356634FCA08BC9E0D02C14BDB230B0076D31099C9779483D27F9938EDB99C9
FFU Platform ID: Nokia.MSM8930.P6145
    -- GPT STARTs--
name:        DPP
startLBA:    4096
endLBA:      20479
size:        0x0000000000800000 bytes
attributes:  0x0


name:        MODEM_FSG
startLBA:    20480
endLBA:      26623
size:        0x0000000000300000 bytes
attributes:  0x0


name:        SSD
startLBA:    28672
endLBA:      28703
size:        0x0000000000004000 bytes
attributes:  0x0


name:        SBL1
startLBA:    32768
endLBA:      35767
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL2
startLBA:    36864
endLBA:      39863
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL3
startLBA:    40960
endLBA:      45055
size:        0x0000000000200000 bytes
attributes:  0x0


name:        UEFI
startLBA:    45056
endLBA:      50055
size:        0x0000000000271000 bytes
attributes:  0x0


name:        RPM
startLBA:    53248
endLBA:      54247
size:        0x000000000007d000 bytes
attributes:  0x0


name:        TZ
startLBA:    57344
endLBA:      58343
size:        0x000000000007d000 bytes
attributes:  0x0


name:        WINSECAPP
startLBA:    61440
endLBA:      62463
size:        0x0000000000080000 bytes
attributes:  0x0


name:        BACKUP_SBL1
startLBA:    65536
endLBA:      68535
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL2
startLBA:    69632
endLBA:      72631
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL3
startLBA:    73728
endLBA:      77823
size:        0x0000000000200000 bytes
attributes:  0x0


name:        BACKUP_UEFI
startLBA:    77824
endLBA:      82823
size:        0x0000000000271000 bytes
attributes:  0x0


name:        BACKUP_RPM
startLBA:    86016
endLBA:      87015
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_TZ
startLBA:    90112
endLBA:      91111
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_WINSECAPP
startLBA:    94208
endLBA:      95231
size:        0x0000000000080000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    98304
endLBA:      98815
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    102400
endLBA:      102911
size:        0x0000000000040000 bytes
attributes:  0x0


name:        PLAT
startLBA:    106496
endLBA:      122879
size:        0x0000000000800000 bytes
attributes:  0x0


name:        EFIESP
startLBA:    131072
endLBA:      262143
size:        0x0000000004000000 bytes
attributes:  0x0


name:        MODEM_FS1
startLBA:    262144
endLBA:      268287
size:        0x0000000000300000 bytes
attributes:  0x0


name:        MODEM_FS2
startLBA:    270336
endLBA:      276479
size:        0x0000000000300000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    278528
endLBA:      279039
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    282624
endLBA:      282879
size:        0x0000000000020000 bytes
attributes:  0x0


name:        MMOS
startLBA:    286720
endLBA:      456415
size:        0x00000000052dc000 bytes
attributes:  0x0


name:        MainOS
startLBA:    458752
endLBA:      5205631
size:        0x0000000090dd0000 bytes
attributes:  0x0


name:        Data
startLBA:    5210112
endLBA:      15151103
size:        0x000000012f600000 bytes
attributes:  0x0


    -- GPT ENDs --
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
FFU Platform ID: Nokia.MSM8930.P6145
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
Reading GPT from binary
    -- GPT STARTs--
name:        DPP
startLBA:    4096
endLBA:      20479
size:        0x0000000000800000 bytes
attributes:  0x0


name:        MODEM_FSG
startLBA:    20480
endLBA:      26623
size:        0x0000000000300000 bytes
attributes:  0x0


name:        SSD
startLBA:    28672
endLBA:      28703
size:        0x0000000000004000 bytes
attributes:  0x0


name:        SBL1
startLBA:    32768
endLBA:      35767
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL2
startLBA:    36864
endLBA:      39863
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL3
startLBA:    40960
endLBA:      45055
size:        0x0000000000200000 bytes
attributes:  0x0


name:        UEFI
startLBA:    45056
endLBA:      50055
size:        0x0000000000271000 bytes
attributes:  0x0


name:        RPM
startLBA:    53248
endLBA:      54247
size:        0x000000000007d000 bytes
attributes:  0x0


name:        TZ
startLBA:    57344
endLBA:      58343
size:        0x000000000007d000 bytes
attributes:  0x0


name:        WINSECAPP
startLBA:    61440
endLBA:      62463
size:        0x0000000000080000 bytes
attributes:  0x0


name:        BACKUP_SBL1
startLBA:    65536
endLBA:      68535
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL2
startLBA:    69632
endLBA:      72631
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL3
startLBA:    73728
endLBA:      77823
size:        0x0000000000200000 bytes
attributes:  0x0


name:        BACKUP_UEFI
startLBA:    77824
endLBA:      82823
size:        0x0000000000271000 bytes
attributes:  0x0


name:        BACKUP_RPM
startLBA:    86016
endLBA:      87015
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_TZ
startLBA:    90112
endLBA:      91111
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_WINSECAPP
startLBA:    94208
endLBA:      95231
size:        0x0000000000080000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    98304
endLBA:      98815
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    102400
endLBA:      102911
size:        0x0000000000040000 bytes
attributes:  0x0


name:        PLAT
startLBA:    106496
endLBA:      122879
size:        0x0000000000800000 bytes
attributes:  0x0


name:        EFIESP
startLBA:    131072
endLBA:      262143
size:        0x0000000004000000 bytes
attributes:  0x0


name:        MODEM_FS1
startLBA:    262144
endLBA:      268287
size:        0x0000000000300000 bytes
attributes:  0x0


name:        MODEM_FS2
startLBA:    270336
endLBA:      276479
size:        0x0000000000300000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    278528
endLBA:      279039
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    282624
endLBA:      282879
size:        0x0000000000020000 bytes
attributes:  0x0


name:        MMOS
startLBA:    286720
endLBA:      456415
size:        0x00000000052dc000 bytes
attributes:  0x0


name:        MainOS
startLBA:    458752
endLBA:      5205631
size:        0x0000000090dd0000 bytes
attributes:  0x0


name:        Data
startLBA:    5210112
endLBA:      15151103
size:        0x000000012f600000 bytes
attributes:  0x0


name:        Overflow
startLBA:    5210112
endLBA:      15151103
size:        0x000000012f600000 bytes
attributes:  0x0


name:        SBL1
startLBA:    34
endLBA:      289
size:        0x0000000000020000 bytes
attributes:  0x0


name:        SBL2
startLBA:    290
endLBA:      545
size:        0x0000000000020000 bytes
attributes:  0x0


name:        SBL3
startLBA:    546
endLBA:      1313
size:        0x0000000000060000 bytes
attributes:  0x0


name:        UEFI
startLBA:    1314
endLBA:      3513
size:        0x0000000000113000 bytes
attributes:  0x0


name:        RPM
startLBA:    3514
endLBA:      3897
size:        0x0000000000030000 bytes
attributes:  0x0


name:        TZ
startLBA:    3898
endLBA:      4305
size:        0x0000000000033000 bytes
attributes:  0x0


name:        WinSecApp
startLBA:    4306
endLBA:      5073
size:        0x0000000000060000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    5074
endLBA:      5329
size:        0x0000000000020000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    5330
endLBA:      5345
size:        0x0000000000002000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    5346
endLBA:      5601
size:        0x0000000000020000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    5602
endLBA:      5617
size:        0x0000000000002000 bytes
attributes:  0x0


name:        SSD
startLBA:    5618
endLBA:      5633
size:        0x0000000000002000 bytes
attributes:  0x0


name:        PLAT
startLBA:    5634
endLBA:      8033
size:        0x000000000012c000 bytes
attributes:  0x0


    -- GPT ENDs --













Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Checking eMMC read / write test results...
eMMC Read test passed. eMMC Write test passed!
Writing GPT
GPT of FFU write ended with status 0
Programming image C:\Users\[redacted]\Downloads\RM-994\Emergency Flash Files\RM994_msimage_v1.0.mbn
Image opened successfully for reading
Programming SBL1
Programming SBL2
Programming SBL3
Programming UEFI
Programming RPM
Programming TZ
Programming WINSECAPP
No read only data in this partition. Thus skipping programming of UEFI_BS_NV
No read only data in this partition. Thus skipping programming of UEFI_NV
No read only data in this partition. Thus skipping programming of UEFI_RT_NV
No read only data in this partition. Thus skipping programming of UEFI_RT_NV_RPMB
No read only data in this partition. Thus skipping programming of SSD
No read only data in this partition. Thus skipping programming of PLAT
Image closed successfully after reading
Programming of image ended with status 0
Sending CLOSE_REQ
Received valid response to CLOSE_REQ
Resetting device
Device reset done
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
WinUSB in use.
Detecting UEFI responder
Device is not in Lumia UEFI mode
Device mode get failed, mode is 7
Failed to boot to FlashApp
Operation took about 23.00 seconds.

THOR2_ERROR_BOOT_TO_FLASH_APP_FAILED

THOR2 1.8.2.18 exited with error code 84002 (0x14822)

4. The thing doesn't show up on WDRT.

So yeah, similar stuff with the 1320 guy up a few pages. Except I couldn't get to a blue screen yet.

Is there anyone who could save a 1320 like this? Or should I go looking for a new motherboard from another time capsule? :D

Bonus question: Why can't we flash partitions with Qualcomm's tool?
 
  • Like
Reactions: iskender4444

Oliwier332

New member
May 5, 2021
2
0
Hey, i have Lumia 640xl (RM-1067) it is bricked with QHSUSB_BULK, I also have a 640 that happens to me a lot of times but I always manage to fix it, but that's the problem, I copied the RKH from this 640xl and downloaded a package of emergency files and I looked for Notepad ++ in my RKH files and they are identical to mine in RM-1096 files after trying to install them I wait about 3 minutes and there is a Signature checking error, I checked emergency files from lumia 950 / xl, 640 / xl and nothing. Is there anything else you can do with this phone? :) -Sorry for my bad English

my RKH is 682455784C6A1730952BF78A8EB41A4FAA98B4B4H

E:\640xl>thor2 -mode emergency -protocol sahara -hexfile "E:\640xl\MPRG8x26_fh.ede" -edfile "E:\640xl\RM1096_fh.edp" THOR2 1.8.2.18 Built for Windows @ 13:36:46 Jun 16 2015 Thor2 is running on Windows of version 6.2 thor2 -mode emergency -protocol sahara -hexfile E:\640xl\MPRG8x26_fh.ede -edfile E:\640xl\RM1096_fh.edp Process started Wed May 05 23:22:46 2021 Logging to file C:\Users\OLIWIE~1\AppData\Local\Temp\thor2_win_20210505232246_ThreadId-3688.log Debugging enabled for emergency Initiating emergency download for RnD. Create emergency messaging... Create emergency messaging...END Checking trace_usb...END setHandshakeMessageStorageStatus... setHandshakeMessageStorageStatus...END Get connectionString... Get connectionString...END Open messaging... Open messaging...END Forced Sahara protocol Create EmergencyProgrammer V3.. Create EmergencyProgrammer V3..END EMERGENCY FLASH START Emergency Programmer V3 version 2015.03.09.001 ED download selected Sahara image entries START 0x0D, E:\640xl\MPRG8x26_fh.ede, true Sahara image entries END Starting Sahara emergency download Entering state WAIT_HELLO HELLO packet already received as handshake message Erased stored HELLO packet Sending HELLO_RESP HELLO_RESP sent Entering state WAIT_COMMAND READ_DATA received Opening image E:\640xl\MPRG8x26_fh.ede Image opened successfully Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent END_IMAGE_TX received END_IMAGE_TX with success status Closing image E:\640xl\MPRG8x26_fh.ede Image closed successfully Sending DONE DONE sent Entering state WAIT_DONE_RESP DONE_RESP received Stopped Sahara emergency download (status code = 0) Emergency Programmer V3 version 2015.03.09.001 EDPAYLOAD download selected Sending firehose single image Waiting for Ed ready message, timeout 500 ms Waiting for Ed ready message...DONE, status 0 Handling ed image E:\640xl\RM1096_fh.edp to partition EMERGENCY Image opened successfully for reading Payload tool: Feb 19 2015 12:21:48 Version 000.001.000 Payload generation info: Thu Mar 19 16:12:45 2015 SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008050E100000000H, RKH:682455784C6A1730952BF78A8EB41A4FAA98B4B4H Send signature Message send failed with error code 31 Failed to send signature! Handling ed image ended with status 85021 EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 1 minute, 3 seconds. THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)[ICODE][/ICODE]
 

iskender4444

Member
Mar 6, 2016
31
2
Hey, i have Lumia 640xl (RM-1067) it is bricked with QHSUSB_BULK, I also have a 640 that happens to me a lot of times but I always manage to fix it, but that's the problem, I copied the RKH from this 640xl and downloaded a package of emergency files and I looked for Notepad ++ in my RKH files and they are identical to mine in RM-1096 files after trying to install them I wait about 3 minutes and there is a Signature checking error, I checked emergency files from lumia 950 / xl, 640 / xl and nothing. Is there anything else you can do with this phone? :) -Sorry for my bad English

my RKH is 682455784C6A1730952BF78A8EB41A4FAA98B4B4H

E:\640xl>thor2 -mode emergency -protocol sahara -hexfile "E:\640xl\MPRG8x26_fh.ede" -edfile "E:\640xl\RM1096_fh.edp" THOR2 1.8.2.18 Built for Windows @ 13:36:46 Jun 16 2015 Thor2 is running on Windows of version 6.2 thor2 -mode emergency -protocol sahara -hexfile E:\640xl\MPRG8x26_fh.ede -edfile E:\640xl\RM1096_fh.edp Process started Wed May 05 23:22:46 2021 Logging to file C:\Users\OLIWIE~1\AppData\Local\Temp\thor2_win_20210505232246_ThreadId-3688.log Debugging enabled for emergency Initiating emergency download for RnD. Create emergency messaging... Create emergency messaging...END Checking trace_usb...END setHandshakeMessageStorageStatus... setHandshakeMessageStorageStatus...END Get connectionString... Get connectionString...END Open messaging... Open messaging...END Forced Sahara protocol Create EmergencyProgrammer V3.. Create EmergencyProgrammer V3..END EMERGENCY FLASH START Emergency Programmer V3 version 2015.03.09.001 ED download selected Sahara image entries START 0x0D, E:\640xl\MPRG8x26_fh.ede, true Sahara image entries END Starting Sahara emergency download Entering state WAIT_HELLO HELLO packet already received as handshake message Erased stored HELLO packet Sending HELLO_RESP HELLO_RESP sent Entering state WAIT_COMMAND READ_DATA received Opening image E:\640xl\MPRG8x26_fh.ede Image opened successfully Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent END_IMAGE_TX received END_IMAGE_TX with success status Closing image E:\640xl\MPRG8x26_fh.ede Image closed successfully Sending DONE DONE sent Entering state WAIT_DONE_RESP DONE_RESP received Stopped Sahara emergency download (status code = 0) Emergency Programmer V3 version 2015.03.09.001 EDPAYLOAD download selected Sending firehose single image Waiting for Ed ready message, timeout 500 ms Waiting for Ed ready message...DONE, status 0 Handling ed image E:\640xl\RM1096_fh.edp to partition EMERGENCY Image opened successfully for reading Payload tool: Feb 19 2015 12:21:48 Version 000.001.000 Payload generation info: Thu Mar 19 16:12:45 2015 SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008050E100000000H, RKH:682455784C6A1730952BF78A8EB41A4FAA98B4B4H Send signature Message send failed with error code 31 Failed to send signature! Handling ed image ended with status 85021 EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 1 minute, 3 seconds. THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)[ICODE][/ICODE]
you must be do the another hex files to try dude
 
Jun 18, 2021
6
0
Hello, got this phone, and it seems like it was bricked(black screen), so i decided to full reflash it with bootloader. Received QHSUSB_BULK(previously phone even booted up and showed some sounds, but display wasn't worked), tried to reflash with thor. For some reason, it's successful:
Thor2 -mode emergency -configfile "emergency_flash_config.xml" -ffufile ffu.ffu
It's flashing ok, without errors, but nothing happens after. Not in uefi mode.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    I tried to unbrick my Nokia Lumia 720 and it's fixed LOL, I have some error with thor 2 but after I removed battery and install right driver and it's worked LOL!
    My phone has been felt to QHSUSB_DLOAD after I used Windows Phone Internals to unlock bootloader, and I think I have put wrong bootloader hex file... or something.
    command: thor2 -mode emergency -hexfile FAST8930_RMxxx.hex -mbnfile RMxxx_msimage_v1.0.mbn -ffufile RMxxx.ffu
    the ffu you can download on lumia firmware:
    First install Windows Device Recovery Tools from Microsoft, or you can download in thread 1.
    And secondly, install the QHUSB driver because the Lumia use Qualcomm SOC, so you can you any Qualcomm USB driver.
    And driver is QHUSB: https://androidfilehost.com/?fid=674106145207490601
    NOTE: IF YOU USE WINDOWS 8 OR 10 YOU NEED TO RESTART TO ADVANCED BOOT OPTION TO INSTALL UNSIGNED DRIVER BECAUSE THIS DRIVER IS OLD ENOUGH.
    and all Lumia hex file I collect from someone on Youtube:
    you need to put the all file needed to C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\
    and run the command:
    thor2 -mode emergency -hexfile FAST8930_RMxxx.hex -mbnfile RMxxx_msimage_v1.0.mbn -ffufile RMxxx.ffu
    It's error or not, don't worry disconnect the battery and turn power on.
    flash the ffu file with WP internals: https://windows-phone-internals.en.lo4d.com/windows
    You can search how to flash default FFU on the internet.
    with xxx is the model of your phone.
    if the link died, tell me. I will update soon.
    YouTube Tutorial:
    Peace!
    310753002_482253610392320_5455420814667957969_n.jpg
    1
    oh, I see you use Windows 11. Do you have any different Windows version like Windows 10? And I see the QHSUSB_BULK but in my opinion, have you try uninstall your driver and you install my driver, link in my post. You can try it and if it recognize Qualcomm HS-USB QLoader 9008 in my video that. You can try to use thor2 in cmd.View attachment 5766891
    Okay, Bro. I'll try your method with Windows 7 or 10, & let you know what will happen :)
  • 60
    04/30/2015
    And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

    Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.

    05/25/2015
    Simple method:

    Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
    Here is the link.

    --------------------------------------
    If this does not work, try the advanced method:

    Let's to the steps:
    Attachment files in the same thread.

    1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
    2) Download your firmware lumia with NaviFirm
    3) Install Drivers
    4) Go to the folder where it is thor 2 from cmd (run administrator)
    cd C:...

    Use this command line to extract gtp0.bin from ffu image

    Code:
    thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump

    this command will create gpt0.bin and rename it as msimage.mbn

    mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

    convert this binary file to hex using bin2hex.exe

    Code:
    bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex

    open .hex file in notepad
    insert :020000042A00D0 in first line
    and :040000052A000000CD before the last line

    or
    Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


    Now you have HEX.hex and msimage.mbn

    the use this command line

    Code:
    thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

    Ready, disconnect the battery and reconnect. Now connect your phone to the PC
    Yeah, his phone started life with red screen!
    Charge the battery

    5) Flash rom: Now, in the case of Lumia 520/521

    Code:
    thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl

    .VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

    Code:
    thor2 -mode rnd -bootnormalmode
    :highfive:


    Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
    thanks @Heathcliff74


    thanks @zapirkon and others users participated
    thanks @ TheBITLINK aka BIT of Windows Insider.

    Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
    Thanks all... :fingers-crossed: they are the best :):):)
    11
    draft for steps

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle
    5
    Woohoo!!!! Success with my RM-893! Skiddd thanks for the bin package! Not sure where you got the RM-892 bin but I've tried several before yours and they didn't work but yours did!

    I converted to hex then had to do the edits since that one is larger than 60kb and now my phone is back to life! I've posted the edited file here for anyone with an RM-892/3 that wants to try it!
    3
    Now in every new Lumia from Microsoft there is way to force device to switch into emergency flash mode:
    3
    Can anybody tell me if this tutorial can somehow be used to unbrick my Samsung Ativ S? It's been dead for almost a month now.
    :crying:

    Not at all. By far. Sorry.:(

    ---------- Post added at 12:56 PM ---------- Previous post was at 12:53 PM ----------

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle



    {I quoted the whole thing above on purpose}

    Followed the steos "to the T" as they say. Worked just fine. You just forgot to mention that at the point of the Green Nokia Screen you can reset/remove batt/issue reset command to restart.

    Thank you Zapirkon for summarizing and thanks the OP as well for the finding.