Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Heathcliff74 · May 2, 2015 at 9:19 PM

johntheredimid said:
I am very confused, some tell me to stop such a hex files, others pass me another hex files ..

I suggest to new users to read each of the 9 posts., and thus not to create confusion
Greetings!

Ok. It's like this:

1. The bin files in your opening post are fine, but they are probably incomplete. There are Lumia models, which have the same RKH, but they need different MPRG's. Not much we can do about now.

2. The bin files are converted to hex files. Those hex files are in your opening post. But not all of them are correct. I corrected a few of them and those are in post #76. You probably want to update the files in your opening post with these files.

Ciao,
Heathcliff74

MichelLoyen · May 3, 2015 at 8:35 AM

@Heathcliff74: many thanks for your help! I have a Lumia 925 (rm-892) and it can't be restored with the current MPRG/hex. I think you're right about the MPRG bin, it's not suitable for this model. This was also suggested on a Microsoft Insider forum: http://answers.microsoft.com/en-us/i...5e34c7?page=79

There's also another thread here on XDA where i posted some info from the Insider forum: http://forum.xda-developers.com/showpost.php?p=60465438&postcount=63.
I guess we'll have to wait for the correct MPRG, if it ever comes available! :-/

stipetic · Nov 15, 2008 22 0 0

Ativ S

Can somebody please help me unbrick my Samsung Ativ S?
It got bricked returning back to the wp 8. It is completely dead (scenario 2).
Is there anything that can be done?

Thanks.

fosormic · May 3, 2015 at 6:56 PM

stipetic said:
Can anybody tell me if this tutorial can somehow be used to unbrick my Samsung Ativ S? It's been dead for almost a month now.
:crying:

Not at all. By far. Sorry.

---------- Post added at 12:56 PM ---------- Previous post was at 12:53 PM ----------

zapirkon said:
STEP 1 - find RootKeyHash and GPT.bin

locate your FFU file. If your phone bricked during Downgrade, you should have it in
c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
or
c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

open up command line there, and make the dump in folder of your choice

Code:

thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

the log will display also the hash needed for you to find correct HEX file

Code:

Number of partitions found 28 RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

also, the files are large, becaue the above step will make complete dump
you only need GPT.bin which is around 250 KB so get this file only

STEP 2. find the HEX file in the archive attached here

it is named with name starting as the RKH from previous step.
it is the first 40 bytes, so in the example
F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
is infact
F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

STEP 3. try to get RED screen

Code:

thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

STEP 4. flash your phone FFU image

Code:

thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle

{I quoted the whole thing above on purpose}

Followed the steos "to the T" as they say. Worked just fine. You just forgot to mention that at the point of the Green Nokia Screen you can reset/remove batt/issue reset command to restart.

Thank you Zapirkon for summarizing and thanks the OP as well for the finding.

fosormic · May 3, 2015 at 8:15 PM

...your twitter handle off? Wanted to thank you there...

Anyways, thanks!

pankajsammal · May 4, 2015 at 3:53 AM

i am also getting the exact same error, did you find anything?

sabersylar said:

Code:

C:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool>thor2 -m
ode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
THOR2 1.8.2.15
Built for Windows @ 13:33:08 Mar 11 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
Process started Sat May 02 18:24:23 2015
Logging to file C:\Users\Saber\AppData\Local\Temp\thor2_win_20150502182423_Threa
dId-11128.log
Debugging enabled for  emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up
 to 20 seconds
Reading GPT from binary
        -- GPT STARTs--
name:        DPP
startLBA:    4096
endLBA:      20479
size:        0x0000000000800000 bytes
attributes:  0x0


name:        MODEM_FSG
startLBA:    20480
endLBA:      26623
size:        0x0000000000300000 bytes
attributes:  0x0


name:        SSD
startLBA:    28672
endLBA:      28703
size:        0x0000000000004000 bytes
attributes:  0x0


name:        SBL1
startLBA:    32768
endLBA:      35767
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL2
startLBA:    36864
endLBA:      39863
size:        0x0000000000177000 bytes
attributes:  0x0


name:        SBL3
startLBA:    40960
endLBA:      45055
size:        0x0000000000200000 bytes
attributes:  0x0


name:        UEFI
startLBA:    45056
endLBA:      50055
size:        0x0000000000271000 bytes
attributes:  0x0


name:        RPM
startLBA:    53248
endLBA:      54247
size:        0x000000000007d000 bytes
attributes:  0x0


name:        TZ
startLBA:    57344
endLBA:      58343
size:        0x000000000007d000 bytes
attributes:  0x0


name:        WINSECAPP
startLBA:    61440
endLBA:      62463
size:        0x0000000000080000 bytes
attributes:  0x0


name:        BACKUP_SBL1
startLBA:    65536
endLBA:      68535
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL2
startLBA:    69632
endLBA:      72631
size:        0x0000000000177000 bytes
attributes:  0x0


name:        BACKUP_SBL3
startLBA:    73728
endLBA:      77823
size:        0x0000000000200000 bytes
attributes:  0x0


name:        BACKUP_UEFI
startLBA:    77824
endLBA:      82823
size:        0x0000000000271000 bytes
attributes:  0x0


name:        BACKUP_RPM
startLBA:    86016
endLBA:      87015
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_TZ
startLBA:    90112
endLBA:      91111
size:        0x000000000007d000 bytes
attributes:  0x0


name:        BACKUP_WINSECAPP
startLBA:    94208
endLBA:      95231
size:        0x0000000000080000 bytes
attributes:  0x0


name:        UEFI_BS_NV
startLBA:    98304
endLBA:      98815
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_NV
startLBA:    102400
endLBA:      102911
size:        0x0000000000040000 bytes
attributes:  0x0


name:        PLAT
startLBA:    106496
endLBA:      122879
size:        0x0000000000800000 bytes
attributes:  0x0


name:        EFIESP
startLBA:    131072
endLBA:      262143
size:        0x0000000004000000 bytes
attributes:  0x0


name:        MODEM_FS1
startLBA:    262144
endLBA:      268287
size:        0x0000000000300000 bytes
attributes:  0x0


name:        MODEM_FS2
startLBA:    270336
endLBA:      276479
size:        0x0000000000300000 bytes
attributes:  0x0


name:        UEFI_RT_NV
startLBA:    278528
endLBA:      279039
size:        0x0000000000040000 bytes
attributes:  0x0


name:        UEFI_RT_NV_RPMB
startLBA:    282624
endLBA:      282879
size:        0x0000000000020000 bytes
attributes:  0x0


        -- GPT ENDs --






















Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Checking eMMC read / write test results...
Failed to read number of eMMC sectors. eMMC is not working!!
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 29.00 seconds.

Unknown error code.

THOR2 1.8.2.15 exited with error code 85035 (0x14C2B)

i tried on my lumia 520 but i got this error :|
how can i fix it or whats that mean ?
plzzz help ...

sabersylar · May 4, 2015 at 6:10 AM

pankajsammal said:
i am also getting the exact same error, did you find anything?

Not yet

if anyone find some solution ... Please let us know

trogper · Nov 8, 2012 227 42 0

pdawg17 said:
What are some options for tools other than bin2hex and bin2hexQ? The bin that I need is not working and is 73kb so wouldn't mind trying another tool...

I have used bin2hex on Linux for a small bin, but I doubt it'll work for these "large" ones
I will try tomorrow

compu829 · May 4, 2015 at 6:23 PM

downloaded and re-upped to Mega. https://mega.co.nz/#!nkwyXIjR

@skiddd let me know if you want me to take them down.

pdawg17 · May 4, 2015 at 7:14 PM

Woohoo!!!! Success with my RM-893! Skiddd thanks for the bin package! Not sure where you got the RM-892 bin but I've tried several before yours and they didn't work but yours did!

I converted to hex then had to do the edits since that one is larger than 60kb and now my phone is back to life! I've posted the edited file here for anyone with an RM-892/3 that wants to try it!

MichelLoyen · May 4, 2015 at 9:37 PM

skiddd said:
Hi Guys,

You can download all MPRG binary files that I use on ATF Software here:
http://www.advance-box.com/tmp/ATF_MPRG.rar

I will only HOST these files for 72 hours... Then I will delete them from my Server.
So please download it fast and upload it somewhere else

I have renamed them according to RM-XXX type... So no more mix matching RKH

In total 27 RM-XXX types supported:

RM-820.bin
RM-821.bin
RM-822.bin
RM-824.bin
RM-825.bin
RM-846.bin
RM-860.bin
RM-867.bin
RM-875.bin
RM-876.bin
RM-877.bin
RM-885.bin
RM-887.bin
RM-892.bin
RM-910.bin
RM-913.bin
RM-914.bin
RM-915.bin
RM-917.bin
RM-941.bin
RM-942.bin
RM-955.bin
RM-994.bin
RM-995.bin
RM-996.bin
RM-997.bin
RM-998.bin

Just make sure you convert them properly to HEX before using them on Thor2.exe

B.R.
skiddd
ATF Team

P.S. After you fix your phone, DO NOT PUT 8.1 or 10 on it if your phone has a Samsung eMMC Inside.
Just stick to 8.0, unless you are 100% sure your phone is not using a Samsung eMMC.

If someone is interested to make a simple tool to read eMMC Manufacturer via USB (FLASH MODE),

Use command:
NOKXFR CID
0x4E, 0x4F, 0x4B, 0x58, 0x46, 0x52, 0x00, 0x43, 0x49, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00

If (reply_buffer[18] == 0x15) then eMMC_Samsung = True;

It's alive! It's alive!!! Thank you!!!
Lumia 925/rm-892 is working fine now (had the black screen/QHUSB issue from WPRT). I generated my own hex using bin2hex and edited the beginning and end using info here on XDA.

To everyone who helped, you guys rock!

SoloRazr · May 5, 2015 at 3:05 PM

zapirkon said:
STEP 1 - find RootKeyHash and GPT.bin

locate your FFU file. If your phone bricked during Downgrade, you should have it in
c:\ProgramData\Microsoft\Packages\Products\rm-XXX...
or
c:\ProgramData\NOKIA\Packages\Products\rm-XXX...

It should be best if you have the Windows Phone Recovery Tool updated to 1.2.4

then go to the Microsoft / Windows Phone recovery folder (thor2.exe is there)
c:\Program Files (x86)\Microsoft Care Suite\Windows Phone Recovery Tool\

open up command line there, and make the dump in folder of your choice

Code:

thor2 -mode ffureader -dump_partitions -ffufile "RM9xx*.ffu" -filedir "c:\dump"

the log will display also the hash needed for you to find correct HEX file

Code:

Number of partitions found 28 RKH of SBL1: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD RKH of UEFI: F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD

also, the files are large, becaue the above step will make complete dump
you only need GPT.bin which is around 250 KB so get this file only

STEP 2. find the HEX file in the archive attached here

it is named with name starting as the RKH from previous step.
it is the first 40 bytes, so in the example
F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACECAEF3F808C868FD
is infact
F771E62AF89994064F77CD3BC16829503BDF9A3D.hex

STEP 3. try to get RED screen

Code:

thor2 -mode emergency -hexfile bin.hex -mbnfile gpt.bin -orig_gpt

the process above will not finish with success, as the provided GPT file is not only file needed to flash it. so I tried to flash it several times, reseting the phone ... etc., after 3-4 times, the phone vibrated, with red screen

STEP 4. flash your phone FFU image

Code:

thor2 -mode vpl -maxtransfersizekb 1 -vplfile "C:\ProgramData\Microsoft\Packages\Products\RM .... \* .vpl"

don't forget the -maxtransfersizekb flag because this flag perhaps was omitted in the Microsoft tool, making the flash procedure stop in the middle

You are such a lifesaver mate! I almost give up until I found this! Thank you so much! :good: :victory:

---------- Post added at 10:05 PM ---------- Previous post was at 10:04 PM ----------

zapirkon said:
please link my hex files in the OP since there is a difference in content of generated hex files from different sources

You are such a lifesaver mate! I almost give up until I found this! Thank you so much!

djamol · May 5, 2015 at 4:28 PM

How To Restore EFIESP Partition ?

I've messed up with EFIESP Partition and i'm unable to flash my Device.
I've Lumia 520.
Replaced with dev ROM,
DisableWriteProtect.test
ffuloader.efi
mmosloader.efi
mobilestartup.efi
resetphone.efi
sigcheck.efi
and its packages.

Only efisimpleio.efi is original.

Stuck at Red Screen. (.FFU is not signed for this device or Invalid signature)
Stuck at "NOKIA BOOTMGR".

Code:

thor2 -mode uefiflash -partitionname efiesp -partitionimagefile "efiesp.bin" -restorepartition

Code:

C:\Program Files\Microsoft Care Suite\Windows Phone Recovery Tool>thor2 -mode uefiflash -partitionname efiesp -partit
imagefile "efiesp.bin" -restorepartition
THOR2 1.8.2.15
Built for Windows @ 13:33:08 Mar 11 2015
Thor2 is running on Windows of version 6.2
thor2 -mode uefiflash -partitionname efiesp -partitionimagefile efiesp.bin -restorepartition
Process started Tue May 05 09:34:18 2015
Logging to file C:\Users\Saurabh\AppData\Local\Temp\thor2_win_20150505093418_ThreadId-960.log
Debugging enabled for  partitionimageflash

Initiating flash of partition image operations
WinUSB in use.
Using restoring of partition backup method
isDeviceInNcsdMode
isDeviceInNcsdMode is false
Detecting UEFI responder
HELLO success
Lumia Flash detected
Protocol version 1.15 Implementation version 1.28
Disable timeouts
Get flashing parameters
Lumia Flash detected
Protocol version 1.15 Implementation version 1.28
Size of one transfer is 2363392
Size of buffer is 2359296
Number of eMMC sectors: 15155200
Platform ID of device: Nokia.MSM8227.P6036.1.2
Async protocol version: 01
Security info:
Platform secure boot enabled
Secure FFU enabled
JTAG eFuse blown
RDC not found
Authentication not done
UEFI secure boot enabled
SHK enabled
Device supports FFU protocols: 0019
Cannot flash partition image. Write the RDC into the device or use open/RnD HW & SW
Operation took about 0.00 seconds.

THOR2_ERROR_UEFI_RDC_OR_AUTHENTICATION_REQUIRED

THOR2 1.8.2.15 exited with error code 84214 (0x148F6)

shearsey · May 5, 2015 at 7:12 PM

Fixed

skiddd said:
Hi Guys,

You can download all MPRG binary files that I use on ATF Software here:
http://www.advance-box.com/tmp/ATF_MPRG.rar

I will only HOST these files for 72 hours... Then I will delete them from my Server.
So please download it fast and upload it somewhere else

I have renamed them according to RM-XXX type... So no more mix matching RKH

In total 27 RM-XXX types supported:

RM-820.bin
RM-821.bin
RM-822.bin
RM-824.bin
RM-825.bin
RM-846.bin
RM-860.bin
RM-867.bin
RM-875.bin
RM-876.bin
RM-877.bin
RM-885.bin
RM-887.bin
RM-892.bin
RM-910.bin
RM-913.bin
RM-914.bin
RM-915.bin
RM-917.bin
RM-941.bin
RM-942.bin
RM-955.bin
RM-994.bin
RM-995.bin
RM-996.bin
RM-997.bin
RM-998.bin

Just make sure you convert them properly to HEX before using them on Thor2.exe

B.R.
skiddd
ATF Team

P.S. After you fix your phone, DO NOT PUT 8.1 or 10 on it if your phone has a Samsung eMMC Inside.
Just stick to 8.0, unless you are 100% sure your phone is not using a Samsung eMMC.

If someone is interested to make a simple tool to read eMMC Manufacturer via USB (FLASH MODE),

Use command:
NOKXFR CID
0x4E, 0x4F, 0x4B, 0x58, 0x46, 0x52, 0x00, 0x43, 0x49, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00

If (reply_buffer[18] == 0x15) then eMMC_Samsung = True;

my RM-892 is finally alive again, thanks to everyone for their hard work, maybe it will make Microsoft realise the value of XDA Developers again

Shad0wguy · May 5, 2015 at 9:57 PM

I knew XDA would come through. MS didn't care, but the fine folks here at XDA did it!

Shad0wguy · May 6, 2015 at 2:08 AM

OK, I'm stuck on step one. Not sure what I'm missing...

[19:45:11.753] D_MSG : THOR2 1.8.2.15
[19:45:11.768] D_MSG : Built for Windows @ 13:33:08 Mar 11 2015
[19:45:11.768] D_MSG : Thor2 is running on Windows of version 6.2
[19:45:11.768] D_MSG : thor2 -mode ffureader -dump_partitions -ffufile RM893*.ffu -filedir c:\temp
[19:45:11.768] D_MSG : Process started Tue May 05 19:45:11 2015
[19:45:11.768] D_MSG : Debugging enabled for ffureader

[19:45:11.768] D_MSG : Initiating do FFUReader operations
[19:45:11.768] D_MSG : Version of FfuReader is 2015021601
[19:45:11.768] D_MSG : Parsing and dumping partitions of FFU... Please wait...
[19:45:11.784] D_ERR : Failed to parse FFU file. Header size: 0x00000000, Payload size: 0x0000000000000000, Chunk size: 0x00000000, Header offset: 0x00000000, Payload offset: 0x0000000000000000
[19:45:11.784] D_ERR : File open failed
[19:45:11.784] D_ERR : THOR2 1.8.2.15 exited with error code -1 (0xFFFFFFFF)

---------- Post added at 08:02 PM ---------- Previous post was at 07:53 PM ----------

And the navifirm public account is not available.

---------- Post added at 09:00 PM ---------- Previous post was at 08:02 PM ----------

Ok, got a new ffu, but the hex seems to have failed and now I have the windows button flashing and it no longer shows as QHSUSB in device manager. Not sure what to do at this point.

---------- Post added at 09:08 PM ---------- Previous post was at 09:00 PM ----------

It's alive! Thanks everyone!

Habith · Jul 12, 2013 19 1 0

Hi guys,

Can you help me, I can't continue after step.
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt

Somebody?

trogper · May 6, 2015 at 2:20 PM

Habith said:
Hi guys,

Can you help me, I can't continue after step.
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
Somebody?

invalid hex file

Habith · Jul 12, 2013 19 1 0

trogper said:
invalid hex file

¿Sure? I tried make file again and again in one way or another and nothign... ¿Another idea?

trogper · May 6, 2015 at 2:58 PM

Habith said:
¿Sure? I tried make file again and again in one way or another and nothign... ¿Another idea?

what model and rkh do you have?

Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

Inactive Recognized Developer

Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Attachments

Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Member

Senior Member

Member

Senior Member