Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Search This thread

gmirz2005

Senior Member
Jun 18, 2017
143
42
Yerevan
Hello, got this phone, and it seems like it was bricked(black screen), so i decided to full reflash it with bootloader. Received QHSUSB_BULK(previously phone even booted up and showed some sounds, but display wasn't worked), tried to reflash with thor. For some reason, it's successful:
Thor2 -mode emergency -configfile "emergency_flash_config.xml" -ffufile ffu.ffu
It's flashing ok, without errors, but nothing happens after. Not in uefi mode.
Power cycle the phone (short battery or remove and reinsert it)
 

floribella2005

New member
Jun 23, 2021
1
0
My Lumia 640 xl RM 1065 is dead since 2019. I tried everything and nothing works, Ever the same error. Can anybody help me?


Microsoft Windows [versão 10.0.19043.1052]
(c) Microsoft Corporation. Todos os direitos reservados.

C:\Windows\system32>cd C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool

C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode emergency -hexfile MPRG8x26_fh.ede -edfile RM1065_fh.edp
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile MPRG8x26_fh.ede -edfile RM1065_fh.edp
Process started Wed Jun 23 00:28:44 2021
Logging to file C:\Users\edyke\AppData\Local\Temp\thor2_win_20210623002844_ThreadId-744.log
Debugging enabled for emergency

Initiating emergency download for RnD.
Create emergency messaging...
Create emergency messaging...END
Checking trace_usb...END
setHandshakeMessageStorageStatus...
setHandshakeMessageStorageStatus...END
Get connectionString...
Get connectionString...END
Open messaging...
Open messaging...END
Create EmergencyProgrammer V3..
Create EmergencyProgrammer V3..END
EMERGENCY FLASH START
Emergency Programmer V3 version 2015.03.09.001
ED download selected
Sahara image entries START
0x0D, MPRG8x26_fh.ede, true
Sahara image entries END
Starting Sahara emergency download
Entering state WAIT_HELLO
HELLO packet already received as handshake message
Erased stored HELLO packet
Sending HELLO_RESP
HELLO_RESP sent
Entering state WAIT_COMMAND
READ_DATA received
Opening image MPRG8x26_fh.ede
Image opened successfully
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
END_IMAGE_TX received
END_IMAGE_TX with success status
Closing image MPRG8x26_fh.ede
Image closed successfully
Sending DONE
DONE sent
Entering state WAIT_DONE_RESP
DONE_RESP received
Stopped Sahara emergency download (status code = 0)
Emergency Programmer V3 version 2015.03.09.001
EDPAYLOAD download selected
Sending firehose single image
Waiting for Ed ready message, timeout 500 ms
Waiting for Ed ready message...DONE, status 0
Handling ed image RM1065_fh.edp to partition EMERGENCY
Image opened successfully for reading
Payload tool:
Apr 4 2014 08:12:09 Version 000.000.003
Payload generation info:
Fri Jun 20 06:56:19 2014
SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008050E100000000H, RKH:D76AE35E9D76000F34DD189FFD09DF00055EB3A1H
Send signature
Message receive timeout!
Message send/receive failed with error code 85021
Failed to send signature!
Handling ed image ended with status 85021
EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 43.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)

C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>

C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>

C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>
 

gmirz2005

Senior Member
Jun 18, 2017
143
42
Yerevan
Not really good with V2 Bootloader Lumias, but you need to try to find a hex which doesnt require signature check. Also cannot remember for sure but thor2 has an attribute which disables signature check.
 

nate0

Senior Member
Mar 27, 2015
976
158
Hey, i have Lumia 640xl (RM-1067) it is bricked with QHSUSB_BULK, I also have a 640 that happens to me a lot of times but I always manage to fix it, but that's the problem, I copied the RKH from this 640xl and downloaded a package of emergency files and I looked for Notepad ++ in my RKH files and they are identical to mine in RM-1096 files after trying to install them I wait about 3 minutes and there is a Signature checking error, I checked emergency files from lumia 950 / xl, 640 / xl and nothing. Is there anything else you can do with this phone? :) -Sorry for my bad English

my RKH is 682455784C6A1730952BF78A8EB41A4FAA98B4B4H

E:\640xl>thor2 -mode emergency -protocol sahara -hexfile "E:\640xl\MPRG8x26_fh.ede" -edfile "E:\640xl\RM1096_fh.edp" THOR2 1.8.2.18 Built for Windows @ 13:36:46 Jun 16 2015 Thor2 is running on Windows of version 6.2 thor2 -mode emergency -protocol sahara -hexfile E:\640xl\MPRG8x26_fh.ede -edfile E:\640xl\RM1096_fh.edp Process started Wed May 05 23:22:46 2021 Logging to file C:\Users\OLIWIE~1\AppData\Local\Temp\thor2_win_20210505232246_ThreadId-3688.log Debugging enabled for emergency Initiating emergency download for RnD. Create emergency messaging... Create emergency messaging...END Checking trace_usb...END setHandshakeMessageStorageStatus... setHandshakeMessageStorageStatus...END Get connectionString... Get connectionString...END Open messaging... Open messaging...END Forced Sahara protocol Create EmergencyProgrammer V3.. Create EmergencyProgrammer V3..END EMERGENCY FLASH START Emergency Programmer V3 version 2015.03.09.001 ED download selected Sahara image entries START 0x0D, E:\640xl\MPRG8x26_fh.ede, true Sahara image entries END Starting Sahara emergency download Entering state WAIT_HELLO HELLO packet already received as handshake message Erased stored HELLO packet Sending HELLO_RESP HELLO_RESP sent Entering state WAIT_COMMAND READ_DATA received Opening image E:\640xl\MPRG8x26_fh.ede Image opened successfully Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent END_IMAGE_TX received END_IMAGE_TX with success status Closing image E:\640xl\MPRG8x26_fh.ede Image closed successfully Sending DONE DONE sent Entering state WAIT_DONE_RESP DONE_RESP received Stopped Sahara emergency download (status code = 0) Emergency Programmer V3 version 2015.03.09.001 EDPAYLOAD download selected Sending firehose single image Waiting for Ed ready message, timeout 500 ms Waiting for Ed ready message...DONE, status 0 Handling ed image E:\640xl\RM1096_fh.edp to partition EMERGENCY Image opened successfully for reading Payload tool: Feb 19 2015 12:21:48 Version 000.001.000 Payload generation info: Thu Mar 19 16:12:45 2015 SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008050E100000000H, RKH:682455784C6A1730952BF78A8EB41A4FAA98B4B4H Send signature Message send failed with error code 31 Failed to send signature! Handling ed image ended with status 85021 EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 1 minute, 3 seconds. THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)[ICODE][/ICODE]
Maybe try these for the RM-1067? That error is a generic response error so it could even be related to how the phone interfacing with your PC.
 

Attachments

  • RM-1067.zip
    1.6 MB · Views: 40

nate0

Senior Member
Mar 27, 2015
976
158
The other thing to note here is that the FFU the emg files whether be hex or edp files of that kind, and the device all have to have the matching root key hash. Otherwise if any of those do not line up for any reason it will fail to validate. You cannot skip rkh check unless you have a engineering rom or device that has that ability.
 
  • Like
Reactions: iskender4444

iskender4444

Member
Mar 6, 2016
30
2
Hey, i have Lumia 640xl (RM-1067) it is bricked with QHSUSB_BULK, I also have a 640 that happens to me a lot of times but I always manage to fix it, but that's the problem, I copied the RKH from this 640xl and downloaded a package of emergency files and I looked for Notepad ++ in my RKH files and they are identical to mine in RM-1096 files after trying to install them I wait about 3 minutes and there is a Signature checking error, I checked emergency files from lumia 950 / xl, 640 / xl and nothing. Is there anything else you can do with this phone? :) -Sorry for my bad English

my RKH is 682455784C6A1730952BF78A8EB41A4FAA98B4B4H

E:\640xl>thor2 -mode emergency -protocol sahara -hexfile "E:\640xl\MPRG8x26_fh.ede" -edfile "E:\640xl\RM1096_fh.edp" THOR2 1.8.2.18 Built for Windows @ 13:36:46 Jun 16 2015 Thor2 is running on Windows of version 6.2 thor2 -mode emergency -protocol sahara -hexfile E:\640xl\MPRG8x26_fh.ede -edfile E:\640xl\RM1096_fh.edp Process started Wed May 05 23:22:46 2021 Logging to file C:\Users\OLIWIE~1\AppData\Local\Temp\thor2_win_20210505232246_ThreadId-3688.log Debugging enabled for emergency Initiating emergency download for RnD. Create emergency messaging... Create emergency messaging...END Checking trace_usb...END setHandshakeMessageStorageStatus... setHandshakeMessageStorageStatus...END Get connectionString... Get connectionString...END Open messaging... Open messaging...END Forced Sahara protocol Create EmergencyProgrammer V3.. Create EmergencyProgrammer V3..END EMERGENCY FLASH START Emergency Programmer V3 version 2015.03.09.001 ED download selected Sahara image entries START 0x0D, E:\640xl\MPRG8x26_fh.ede, true Sahara image entries END Starting Sahara emergency download Entering state WAIT_HELLO HELLO packet already received as handshake message Erased stored HELLO packet Sending HELLO_RESP HELLO_RESP sent Entering state WAIT_COMMAND READ_DATA received Opening image E:\640xl\MPRG8x26_fh.ede Image opened successfully Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent READ_DATA received Sending RAW_DATA RAW_DATA sent END_IMAGE_TX received END_IMAGE_TX with success status Closing image E:\640xl\MPRG8x26_fh.ede Image closed successfully Sending DONE DONE sent Entering state WAIT_DONE_RESP DONE_RESP received Stopped Sahara emergency download (status code = 0) Emergency Programmer V3 version 2015.03.09.001 EDPAYLOAD download selected Sending firehose single image Waiting for Ed ready message, timeout 500 ms Waiting for Ed ready message...DONE, status 0 Handling ed image E:\640xl\RM1096_fh.edp to partition EMERGENCY Image opened successfully for reading Payload tool: Feb 19 2015 12:21:48 Version 000.001.000 Payload generation info: Thu Mar 19 16:12:45 2015 SW_ID:00000000ffff0000H, KCI:1303, MSM_ID:008050E100000000H, RKH:682455784C6A1730952BF78A8EB41A4FAA98B4B4H Send signature Message send failed with error code 31 Failed to send signature! Handling ed image ended with status 85021 EMERGENCY FLASH END Emergency messaging closed successfully Operation took about 1 minute, 3 seconds. THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)[ICODE][/ICODE]
try different hex or ede files
 

felipeunderx

Member
Jan 27, 2021
15
1
Hi, I have a lumia 1320 RM-994 phone. It was totally dead, it wouldn't turn on and with the guide and the hex and mbn files I managed to get a black screen with white letters that says NOKIA.

My pc recognizes it as "Nokia USB Connectivity", I would like to know how I could fix this and make this black screen change to red and flash the phone. Windows phone recovery tool does not detect it at all.

Here I leave a picture in the state in which it is:

 

iskender4444

Member
Mar 6, 2016
30
2
Hi, I have a lumia 1320 RM-994 phone. It was totally dead, it wouldn't turn on and with the guide and the hex and mbn files I managed to get a black screen with white letters that says NOKIA.

My pc recognizes it as "Nokia USB Connectivity", I would like to know how I could fix this and make this black screen change to red and flash the phone. Windows phone recovery tool does not detect it at all.

Here I leave a picture in the state in which it is:

Connect Lumia your pc then Open WDRT and select not detect my Phone or like that a option click it and select Lumia. hold power +vol down like 8-10 sec. pc will be see your recovery mode.
 

felipeunderx

Member
Jan 27, 2021
15
1
Connect Lumia your pc then Open WDRT and select not detect my Phone or like that a option click it and select Lumia. hold power +vol down like 8-10 sec. pc will be see your recovery mode.
The phone does not restart even if I press the buttons you tell me (volume down + power) but the pc now recognises the phone as "NOKIA FLASH" but it still has a black screen and white letters.


Still the WPRT tool does not recognise the device.

 
Last edited:
Jun 18, 2021
6
0
Power cycle the phone (short battery or remove and reinsert it)
Hi, sad but not working. Tried to charge battery, falsh with or without battery. eMMC isn't dead since i've flashed phone using wdrt.

May be someone got different hex/edp files for lumia 730? Since ones from lumiafirmware aren't booting, and phone is in emergency mode.

It seems like that secureboot can't check signature of flashed bootloader, so nothing happen.

Log:
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
Thor2 -mode emergency -configfile emergency_flash_config.xml -ffufile ffu.ffu
Process started Fri Jun 18 11:22:36 2021
Logging to file C:\Users\9234~1\AppData\Local\Temp\thor2_win_20210618112236_ThreadId-9664.log
Debugging enabled for emergency

Initiating emergency download
Using Sahara emergency protocol
QUATTRO EMERGENCY FLASH START
Quattro Emergency Programmer version 2014.11.25.001
ED download selected
EXECUTE EMERGENCY DOWNLOAD START, FIREHOSE
Emergency Programmer V3 version 2015.03.09.001
ED download selected
Sahara image entries START
0x0D, MPRG8x26_fh.ede, true
Sahara image entries END
Starting Sahara emergency download
Entering state WAIT_HELLO
HELLO packet already received as handshake message
Erased stored HELLO packet
Sending HELLO_RESP
HELLO_RESP sent
Entering state WAIT_COMMAND
READ_DATA received
Opening image MPRG8x26_fh.ede
Image opened successfully
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
READ_DATA received
Sending RAW_DATA
RAW_DATA sent
END_IMAGE_TX received
END_IMAGE_TX with success status
Closing image MPRG8x26_fh.ede
Image closed successfully
Sending DONE
DONE sent
Entering state WAIT_DONE_RESP
DONE_RESP received
Stopped Sahara emergency download (status code = 0)
EXECUTE EMERGENCY DOWNLOAD END, FIREHOSE
Quattro Emergency Programmer version 2014.11.25.001
EDPAYLOAD download selected
EXECUTE EMERGENCY DOWNLOAD START, FIREHOSE
Emergency Programmer V3 version 2015.03.09.001
EDPAYLOAD download selected
Sending firehose single image
Waiting for Ed ready message, timeout 500 ms
Waiting for Ed ready message...DONE, status 0
Handling ed image RM1040_fh.edp to partition EMERGENCY
Image opened successfully for reading
Payload tool:
Apr 4 2014 08:12:09 Version 000.000.003
Payload generation info:
Fri Jun 20 06:56:16 2014
SW_ID:00000000ffff0000H, KCI:1289, MSM_ID:008000E100000000H, RKH:B68498287D74BB4247C4F8D0C3B19C1FCBCE9AB4H
Send signature
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Validation is enabled." /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="EMMC: size_in_sectors:15269888, mfr_id:21, oem_id:0, prod_rev:1, mfr_date:9/2014" /></data>
Send signature. DONE.
Send hashtable
Send hashtable.DONE.( 0 )
Configure FIREHOSE
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="32768" MaxPayloadSizeToTargetInBytesSupported="32768" MaxXMLSizeInBytes="4096" Version="May 7 2014_14:06:49" Revision="1" ChipSerialNumber="88707571" TargetName="8x26" /></data>
Successfully configured FIREHOSE
<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 53248, num 509" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 53757" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 65536, num 306" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 65842" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 69632, num 690" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 70322" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 61440, num 2229" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 63669" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 73728, num 538" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 74266" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 77824, num 1327" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 79151" /></data>
Rawmode: OFF

<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 57344, num 36" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 57380" /></data>
Rawmode: OFF

Erase start. (FireHose)
<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 36864, num 32" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished address 36896" /></data>
Erase end. (FireHose)
Erase start. (FireHose)
<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 167936, num 16384" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished address 184320" /></data>
Erase end. (FireHose)
Erase start. (FireHose)
<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 184320, num 65536" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished address 249856" /></data>
Erase end. (FireHose)
<?xml version="1.0" encoding="UTF-8" ?><data><log value="start 0, num 34" /></data>
Rawmode: ON

<?xml version="1.0" encoding="UTF-8" ?><data><log value="Finished sector address 34" /></data>
Rawmode: OFF

Send power cmd.
Send power cmd. Done.
Handling ed image ended with status 0
Payload data transfer speed(FH_SINGLE_IMAGE) (903.1 KB/s) Elapsed time 3.2 sec, data sent 2920413 bytes
EXECUTE EMERGENCY DOWNLOAD END, FIREHOSE
Resetting device
Due to configuration, reset is skipped!
QUATTRO EMERGENCY FLASH END
Emergency messaging closed successfully
WinUSB in use.
Detecting UEFI responder
Device is not in Lumia UEFI mode
Device mode get failed, mode is 7
Failed to boot to FlashApp
Operation took about 11.00 seconds.

THOR2_ERROR_BOOT_TO_FLASH_APP_FAILED
 

felipeunderx

Member
Jan 27, 2021
15
1
did u trying to with flash thor2 command ?
I need help!

It turns out that I changed the motherboard of the phone, it's a nokia lumia 1320, I live in Chile, Latin America. The reason is because it was bricked, but I'm a total noob when it comes to changing motherboards. The phone where I got the replacement plate, did not bring the sticker product code, then I do not know if I flash with the same firmware from the previous phone or what firmware should I put this phone.

Currently I tried to flash it with thor2 and when I flashed it, it disconnected and reconnected and now again it recognizes it as "Qualcomm hs usb qd-load 9008", should I try with other firmwares of my region and country?

Translated with www.DeepL.com/Translator (free version)
 

iskender4444

Member
Mar 6, 2016
30
2
I need help!

It turns out that I changed the motherboard of the phone, it's a nokia lumia 1320, I live in Chile, Latin America. The reason is because it was bricked, but I'm a total noob when it comes to changing motherboards. The phone where I got the replacement plate, did not bring the sticker product code, then I do not know if I flash with the same firmware from the previous phone or what firmware should I put this phone.

Currently I tried to flash it with thor2 and when I flashed it, it disconnected and reconnected and now again it recognizes it as "Qualcomm hs usb qd-load 9008", should I try with other firmwares of my region and country?

Translated with www.DeepL.com/Translator (free version)
NOT try different product number BUT you can different country and regions codes ffu to flash 😄
 
Jun 18, 2021
6
0
Hi, sad but not working. Tried to charge battery, falsh with or without battery. eMMC isn't dead since i've flashed phone using wdrt.

May be someone got different hex/edp files for lumia 730? Since ones from lumiafirmware aren't booting, and phone is in emergency mode.

It seems like that secureboot can't check signature of flashed bootloader, so nothing happen.

Log:
Maybe someone got idea? Bricked from trying to unlock bootloader.
Still not working :(
 

felipeunderx

Member
Jan 27, 2021
15
1
NOT try different product number BUT you can different country and regions codes ffu to flash 😄
I have tried to flash it with thor2, and when I flash the phone reaches about 21% and ends the fhasheo and can not continue, or reaches 6% or 19%, the same is with the windows phone recovery tool and windows phone internals, it may be a problem of battery charge?

If so, how do I charge the battery in flash mode? I know it's a stupid question, but I've plugged the phone with the charger for an hour or two and it doesn't charge anything.

Translated with www.DeepL.com/Translator (free version)
 
Jun 18, 2021
6
0
I have tried to flash it with thor2, and when I flash the phone reaches about 21% and ends the fhasheo and can not continue, or reaches 6% or 19%, the same is with the windows phone recovery tool and windows phone internals, it may be a problem of battery charge?

If so, how do I charge the battery in flash mode? I know it's a stupid question, but I've plugged the phone with the charger for an hour or two and it doesn't charge anything.

Translated with www.DeepL.com/Translator (free version)
Use this
1626198861556.png


In Ru they are everywhere on mobile phone stores.
 

felipeunderx

Member
Jan 27, 2021
15
1
Use this
View attachment 5361243

In Ru they are everywhere on mobile phone stores.
The battery of my phone is not removable, and I do not know how to connect it, it should charge rebooted or connected to the pc but it does not charge, so I ask if it is already hardware problem of my phone lumia 1320.

Regarding your problem, have you tried the emergency files that are left at the beginning of this topic?

I will leave the command that helped me to recover my device from the emergency state, maybe it will help you:

Code:

thor2 -mode emergency -hexfile %HomePath%\Desktop\YOUR_HEX_FILE.hex -mbnfile %HomePath%\Desktop\YOUR_MBN_FILE.mbn -ffufile %HomePath%\Desktop\YOUR_ROM_FILE.ffu -skipffuflash
 

HCA_YT

New member
Jun 5, 2019
2
0
Hello. I tried but it doesen't work for me.
Can someone help me? Please
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 60
    04/30/2015
    And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

    Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.

    05/25/2015
    Simple method:

    Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
    Here is the link.

    --------------------------------------
    If this does not work, try the advanced method:

    Let's to the steps:
    Attachment files in the same thread.

    1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
    2) Download your firmware lumia with NaviFirm
    3) Install Drivers
    4) Go to the folder where it is thor 2 from cmd (run administrator)
    cd C:...

    Use this command line to extract gtp0.bin from ffu image

    Code:
    thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump

    this command will create gpt0.bin and rename it as msimage.mbn

    mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

    convert this binary file to hex using bin2hex.exe

    Code:
    bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex

    open .hex file in notepad
    insert :020000042A00D0 in first line
    and :040000052A000000CD before the last line

    or
    Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


    Now you have HEX.hex and msimage.mbn

    the use this command line

    Code:
    thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

    Ready, disconnect the battery and reconnect. Now connect your phone to the PC
    Yeah, his phone started life with red screen!
    Charge the battery

    5) Flash rom: Now, in the case of Lumia 520/521

    Code:
    thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl

    .VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

    Code:
    thor2 -mode rnd -bootnormalmode
    :highfive:


    Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
    thanks @Heathcliff74


    thanks @zapirkon and others users participated
    thanks @ TheBITLINK aka BIT of Windows Insider.

    Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
    Thanks all... :fingers-crossed: they are the best :):):)
    11
    draft for steps

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle
    5
    Woohoo!!!! Success with my RM-893! Skiddd thanks for the bin package! Not sure where you got the RM-892 bin but I've tried several before yours and they didn't work but yours did!

    I converted to hex then had to do the edits since that one is larger than 60kb and now my phone is back to life! I've posted the edited file here for anyone with an RM-892/3 that wants to try it!
    3
    Now in every new Lumia from Microsoft there is way to force device to switch into emergency flash mode:
    3
    Can anybody tell me if this tutorial can somehow be used to unbrick my Samsung Ativ S? It's been dead for almost a month now.
    :crying:

    Not at all. By far. Sorry.:(

    ---------- Post added at 12:56 PM ---------- Previous post was at 12:53 PM ----------

    STEP 1 - find RootKeyHash and GPT.bin

    locate your FFU file. If your phone bricked during Downgrade, you should have it in
    c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
    or
    c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

    It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

    then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
    c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

    open up command line there, and make the dump in folder of your choice

    Code:
    thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

    the log will display also the hash needed for you to find correct HEX file

    Code:
    Number of partitions found 28
    RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

    also, the files are large, becaue the above step will make complete dump
    you only need GPT.bin which is around 250 KB so get this file only

    STEP 2. find the HEX file in the archive attached here

    it is named with name starting as the RKH from previous step.
    it is the first 40 bytes, so in the example
    F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
    is infact
    F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

    STEP 3. try to get RED screen

    Code:
    thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

    the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

    STEP 4. flash your phone FFU image
    Code:
    thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

    don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle



    {I quoted the whole thing above on purpose}

    Followed the steos "to the T" as they say. Worked just fine. You just forgot to mention that at the point of the Green Nokia Screen you can reset/remove batt/issue reset command to restart.

    Thank you Zapirkon for summarizing and thanks the OP as well for the finding.