• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[FIX] Unbrick Nexus 5 stucked in Qualcomm HS-USB QDLoader 9008 mode

Search This thread

bitdomo

Senior Member
Nov 3, 2011
1,542
1,240
29
Göd
Requirements:

  • Bricked Nexus 5
  • EMMC should not be fried
  • Image files: 16GB (mirror) and 32GB (mirror)
  • BoardDiag (mirror) tool for Nexus 5
  • Windows XP - 7 - 8 - 8.1 (Virutal Box or VMware good too)
Let's start!
  • Connect the phone to your PC
  • Open Device Manager
x_www.kepfeltoltes.hu_.png

1: Find Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT) and note the COMxy port (in my case it is COM3).
If you dont see Qualcomm HS-USB QDLoader 9008 click on the CLICK TO SHOW CONTENT button bellow, otherwise don't and follow the guide.
zs_www.kepfeltoltes.hu_.png

y_www.kepfeltoltes.hu_.png

1: If you see LG Android USB Device under Other devices or LGE AndroidNet USB Serial Port under Ports (COM & LPT), then press VOLUME_UP+VOLUME_DOWN+POWER keys until you see QHSUSB_BULK under Other devices or Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT).
z_www.kepfeltoltes.hu_.png

1: If you see QHSUSB_BULK under Other devices, then you have to install drivers (mirror). Just click on Next, Next... and Finish.
You have to turn off driver signature enforcement if you are using Windows 8 or Windows 8.1 to make the drivers work.

  • Extract the downloaded images 16GB.rar or 32GB.rar to get the image files
  • Start BoardDiag
3_www.kepfeltoltes.hu__www.kepfeltoltes.hu_.png

1: Select Nexus5 (MSM8974_HammerHead).
2: Select the Com Port you see in Device manager (in my case it is COM3).
3: Select the 16GB or 32GB folder.
4: Select AP check.
5: Select RESTORE BOOT IMG.
6151548745221504014_www.kepfeltoltes.hu__www.kepfeltoltes.hu_.png

1: Click on START.
5_www.kepfeltoltes.hu_.png

If you were successful you should see Boot images download completed.
Your phone should turn on, but it may stuck at Google logo. If it is stucked at Google logo you have to reflash a stock rom. You can use either LG FlashTool or fastboot method. You can also flash custom rom from custom recovery if it didn't get replaced by the stock recovery, otherwise flash custom recovery from fastboot.

Extra fun

OP updated.

I want to make a little comment about this boarddiag tool, and how it works.

Emmc test:
Erase: erase the whole emmc. Even if you select a partition from the dropdown menu,
Read only: Only reads random blocks from the emmc. If you check DUMP it will read back the amount of blocks of a the chosen partition given in the partition.txt
Write only: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition).
Read/Write: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition) and then verify them by reading it back​

SDRAM test:
I think this test the memory. There is a Level option for it. I dont know what is the differance between the two.​

PIMC ON:
No idea, but in some LG documentations it is for only APQ8064 chipset.​

Restore boot img:
Restores the images.​

How it know which partitions have to be restored?
There is a rawprogram0.xml in model\Nexus5 (MSM8974_HammerHead)\boot_partition_info folder.
The partitions declared here will be flashed to the device if you select nothing in the partititon dropdown menu or in the restore boot img dropdown menu
Boarddiag only cares about the "label" value (have to be tha same as in partition.txt) from rawprogram0.xml. The rest info like startblock, files size and file name will be acquired from the partition.txt.
Partition.txt is a binary file:
0x00-0x03: start block
0x04-0x07: file size in block numbers ( 1 block = 512 byte)
0x08-0x0F: always zero
0x10-0x2F: partition name (must be the same as the label value in rawprogram0.xml)
0x30-0x4F: file name
and the pattern goes on.​
I wrote a little program which converts this binary partition.txt to an actual txt. You can get it from here
Copy the partition.txt to the same folder where the bin2txt and txt2bin exes are. Run bin2txt then it will create a readable_partition.txt file. Edit it with notepad++. The start block is in HEX and the file size is in bytes (must be multiple of 512). Partition entries is the number of partition declared in the partition.txt. If you done with the editing then run txt2bin and it will create a new_partition.txt file.​


Old OP
Requirements:

  • Bricked Nexus 5
  • EMMC should not be fried
  • Firmware file: D820 and D821
  • BoardDiag tool for Nexus 5
  • Windows XP - 7 - 8 - 8.1 (Virutal Box or VMware good too)
Let's start!
  • Connect the phone to your PC
  • Open Device Manager
x_www.kepfeltoltes.hu_.png

1: Find Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT) and note the COMxy port (in my case it is COM3).
If you dont see Qualcomm HS-USB QDLoader 9008 click on the CLICK TO SHOW CONTENT button bellow, otherwise don't and follow the guide.
zs_www.kepfeltoltes.hu_.png

y_www.kepfeltoltes.hu_.png

1: If you see LG Android USB Device under Other devices or LGE AndroidNet USB Serial Port under Ports (COM & LPT), then press VOLUME_UP+VOLUME_DOWN+POWER keys until you see QHSUSB_BULK under Other devices or Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT).
z_www.kepfeltoltes.hu_.png

1: If you see QHSUSB_BULK under Other devices, then you have to install drivers. Just click on Next, Next... and Finish.
You have to turn off driver signature enforcement if you are using Windows 8 or Windows 8.1 to make the drivers work.

  • Extract the downloaded firmware .zip to get the .tot file
  • Start BoardDiag
5758278061_www.kepfeltoltes.hu_.png

1: Select .tot file.
2: Select a directory where to extract .tot file.
3: Click on Extract.
It may hangs on extracting system and cache. Just let it finish.
7830578452_www.kepfeltoltes.hu_.png

1: Click OK.
3_www.kepfeltoltes.hu_.png

1: Select Nexus5 (MSM8974_HammerHead).
2: Select the Com Port you see in Device manager (in my case it is COM3).
3: Select the directory where you extracted the .tot file.
4: Select AP check.
5: Select RESTORE BOOT IMG.
5221504014_www.kepfeltoltes.hu_.png

1: Click on START.
5_www.kepfeltoltes.hu_.png

If you were successful you should see Boot images download completed.
Your phone should turn on, but it may stuck at Google logo. If it is stucked at Google logo you have to reflash a stock rom. You can use either LG FlashTool or fastboot method. You can also flash custom rom from custom recovery if it didn't get replaced by the stock recovery, otherwise flash custom recovery from fastboot.


Thanks @jd1639 once again for the GPT partition table of the 32GB variant.
 
Last edited:

bitdomo

Senior Member
Nov 3, 2011
1,542
1,240
29
Göd
@bitdomo Nice, once again.

Added this thread to the Sticky Roll-Up thread. :)

59749915.jpg


---------------------------------------------------------------------------

The tool is working. I tested on my nexus 5. I dd zeroed out the sbl1 partition. The phone refused to turn on no matter what I do. I did that what is shown in my first post and now the phone is working again. I also tried to help a guy, but it turned out the emmc of his phone has an I/O error. I used the EMMC TEST option to check the emmc for bad sectors.

I am also summoning @rootSU to let him know what a cool stuff nexus 5 has.
 

bitdomo

Senior Member
Nov 3, 2011
1,542
1,240
29
Göd
Maybe this could work or be adapted for Nexus 4? I ask for personal curiosity :)

Inviato dal mio Nexus 4 con Tapatalk 2
It could be if we would have the flash programmer hex for nexus 4. I have some for some LG phone, but I have no idea are they working or they are for which phone. If you have a bricked nexus 4 or you know somebody who has I could try check the remaining flash programmers. Maybe 1 works for nexus 4.
 
  • Like
Reactions: jacomail95

RussianBear

Recognized Contributor
Nov 10, 2008
2,016
328
Not to rain on your parade, but are you sure you didn't use this thread in any way? (posted one day before you expressed interest in unbricking n5)

http://forum.xda-developers.com/lg-g2/general/fix-unbrick-lg-g2-stuck-qualcomm-hs-usb-t2933830

This brings back memories, though. 3 years ago we were trying to unbrick Sensations/Evos and succeeded: http://forum.xda-developers.com/showthread.php?t=1522351 The really smart guys went as far as being able to unlock bootloaders on various Qualcomm-based phones after that... Those were the days.
 

bitdomo

Senior Member
Nov 3, 2011
1,542
1,240
29
Göd
Not to rain on your parade, but are you sure you didn't use this thread in any way? (posted one day before you expressed interest in unbricking n5)

http://forum.xda-developers.com/lg-g2/general/fix-unbrick-lg-g2-stuck-qualcomm-hs-usb-t2933830

This brings back memories, though. 3 years ago we were trying to unbrick Sensations/Evos and succeeded: http://forum.xda-developers.com/showthread.php?t=1522351 The really smart guys went as far as being able to unlock bootloaders on various Qualcomm-based phones after that... Those were the days.

I expressed my interest there 2 month before.
I have to admit that thread inspired me, but that tools shared on that thread never worked because the 2nd_loader.hex files were incomplete or for wrong device. That is why I dont want to give credits., and also the version of this tool is different than the two posted there. The version I use was never posted here on xda. I was searching for the correct 2nd_loader.hex for nexus 5 for 2 months until I found a way to get them. The only things which are similar is the title of thread and we are talking about the same tool.

It is like somebody made a guide to flash stock rom for nexus 4 in fastboot mode and you make a guide to do the same for nexus 5. It is impossible to write not the same instructions. You will find similarities.
 

RussianBear

Recognized Contributor
Nov 10, 2008
2,016
328
I expressed my interest there 2 month before.
I have to admit that thread inspired me, but that tools shared on that thread never worked because the 2nd_loader.hex files were incomplete or for wrong device. That is why I dont want to give credits., and also the version of this tool is different than the two posted there. The version I use was never posted here on xda. I was searching for the correct 2nd_loader.hex for nexus 5 for 2 months until I found a way to get them. The only things which are similar is the title of thread and we are talking about the same tool.

It is like somebody made a guide to flash stock rom for nexus 4 in fastboot mode and you make a guide to do the same for nexus 5. It is impossible to write not the same instructions. You will find similarities.

Gotcha. Just looking out, man. Good stuff!
 

Weynz_Dc

Member
Feb 28, 2015
5
0
Please I'm stuck with my NEXUS 5 I've done everything and I'm stuck at the end when i have to start the boot flash it says . serial port open FAILED..
I'm using windows 8.1 under parallels desktop on my mac and i have x64 bit qhsusb_bulk drivers PLEASE HELP !!!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 90
    Requirements:

    • Bricked Nexus 5
    • EMMC should not be fried
    • Image files: 16GB (mirror) and 32GB (mirror)
    • BoardDiag (mirror) tool for Nexus 5
    • Windows XP - 7 - 8 - 8.1 (Virutal Box or VMware good too)
    Let's start!
    • Connect the phone to your PC
    • Open Device Manager
    x_www.kepfeltoltes.hu_.png

    1: Find Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT) and note the COMxy port (in my case it is COM3).
    If you dont see Qualcomm HS-USB QDLoader 9008 click on the CLICK TO SHOW CONTENT button bellow, otherwise don't and follow the guide.
    zs_www.kepfeltoltes.hu_.png

    y_www.kepfeltoltes.hu_.png

    1: If you see LG Android USB Device under Other devices or LGE AndroidNet USB Serial Port under Ports (COM & LPT), then press VOLUME_UP+VOLUME_DOWN+POWER keys until you see QHSUSB_BULK under Other devices or Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT).
    z_www.kepfeltoltes.hu_.png

    1: If you see QHSUSB_BULK under Other devices, then you have to install drivers (mirror). Just click on Next, Next... and Finish.
    You have to turn off driver signature enforcement if you are using Windows 8 or Windows 8.1 to make the drivers work.

    • Extract the downloaded images 16GB.rar or 32GB.rar to get the image files
    • Start BoardDiag
    3_www.kepfeltoltes.hu__www.kepfeltoltes.hu_.png

    1: Select Nexus5 (MSM8974_HammerHead).
    2: Select the Com Port you see in Device manager (in my case it is COM3).
    3: Select the 16GB or 32GB folder.
    4: Select AP check.
    5: Select RESTORE BOOT IMG.
    6151548745221504014_www.kepfeltoltes.hu__www.kepfeltoltes.hu_.png

    1: Click on START.
    5_www.kepfeltoltes.hu_.png

    If you were successful you should see Boot images download completed.
    Your phone should turn on, but it may stuck at Google logo. If it is stucked at Google logo you have to reflash a stock rom. You can use either LG FlashTool or fastboot method. You can also flash custom rom from custom recovery if it didn't get replaced by the stock recovery, otherwise flash custom recovery from fastboot.

    Extra fun

    OP updated.

    I want to make a little comment about this boarddiag tool, and how it works.

    Emmc test:
    Erase: erase the whole emmc. Even if you select a partition from the dropdown menu,
    Read only: Only reads random blocks from the emmc. If you check DUMP it will read back the amount of blocks of a the chosen partition given in the partition.txt
    Write only: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition).
    Read/Write: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition) and then verify them by reading it back​

    SDRAM test:
    I think this test the memory. There is a Level option for it. I dont know what is the differance between the two.​

    PIMC ON:
    No idea, but in some LG documentations it is for only APQ8064 chipset.​

    Restore boot img:
    Restores the images.​

    How it know which partitions have to be restored?
    There is a rawprogram0.xml in model\Nexus5 (MSM8974_HammerHead)\boot_partition_info folder.
    The partitions declared here will be flashed to the device if you select nothing in the partititon dropdown menu or in the restore boot img dropdown menu
    Boarddiag only cares about the "label" value (have to be tha same as in partition.txt) from rawprogram0.xml. The rest info like startblock, files size and file name will be acquired from the partition.txt.
    Partition.txt is a binary file:
    0x00-0x03: start block
    0x04-0x07: file size in block numbers ( 1 block = 512 byte)
    0x08-0x0F: always zero
    0x10-0x2F: partition name (must be the same as the label value in rawprogram0.xml)
    0x30-0x4F: file name
    and the pattern goes on.​
    I wrote a little program which converts this binary partition.txt to an actual txt. You can get it from here
    Copy the partition.txt to the same folder where the bin2txt and txt2bin exes are. Run bin2txt then it will create a readable_partition.txt file. Edit it with notepad++. The start block is in HEX and the file size is in bytes (must be multiple of 512). Partition entries is the number of partition declared in the partition.txt. If you done with the editing then run txt2bin and it will create a new_partition.txt file.​


    Old OP
    Requirements:

    • Bricked Nexus 5
    • EMMC should not be fried
    • Firmware file: D820 and D821
    • BoardDiag tool for Nexus 5
    • Windows XP - 7 - 8 - 8.1 (Virutal Box or VMware good too)
    Let's start!
    • Connect the phone to your PC
    • Open Device Manager
    x_www.kepfeltoltes.hu_.png

    1: Find Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT) and note the COMxy port (in my case it is COM3).
    If you dont see Qualcomm HS-USB QDLoader 9008 click on the CLICK TO SHOW CONTENT button bellow, otherwise don't and follow the guide.
    zs_www.kepfeltoltes.hu_.png

    y_www.kepfeltoltes.hu_.png

    1: If you see LG Android USB Device under Other devices or LGE AndroidNet USB Serial Port under Ports (COM & LPT), then press VOLUME_UP+VOLUME_DOWN+POWER keys until you see QHSUSB_BULK under Other devices or Qualcomm HS-USB QDLoader 9008 device under Ports (COM & LPT).
    z_www.kepfeltoltes.hu_.png

    1: If you see QHSUSB_BULK under Other devices, then you have to install drivers. Just click on Next, Next... and Finish.
    You have to turn off driver signature enforcement if you are using Windows 8 or Windows 8.1 to make the drivers work.

    • Extract the downloaded firmware .zip to get the .tot file
    • Start BoardDiag
    5758278061_www.kepfeltoltes.hu_.png

    1: Select .tot file.
    2: Select a directory where to extract .tot file.
    3: Click on Extract.
    It may hangs on extracting system and cache. Just let it finish.
    7830578452_www.kepfeltoltes.hu_.png

    1: Click OK.
    3_www.kepfeltoltes.hu_.png

    1: Select Nexus5 (MSM8974_HammerHead).
    2: Select the Com Port you see in Device manager (in my case it is COM3).
    3: Select the directory where you extracted the .tot file.
    4: Select AP check.
    5: Select RESTORE BOOT IMG.
    5221504014_www.kepfeltoltes.hu_.png

    1: Click on START.
    5_www.kepfeltoltes.hu_.png

    If you were successful you should see Boot images download completed.
    Your phone should turn on, but it may stuck at Google logo. If it is stucked at Google logo you have to reflash a stock rom. You can use either LG FlashTool or fastboot method. You can also flash custom rom from custom recovery if it didn't get replaced by the stock recovery, otherwise flash custom recovery from fastboot.


    Thanks @jd1639 once again for the GPT partition table of the 32GB variant.
    8
    @bitdomo Nice, once again.

    Added this thread to the Sticky Roll-Up thread. :)

    59749915.jpg


    ---------------------------------------------------------------------------

    The tool is working. I tested on my nexus 5. I dd zeroed out the sbl1 partition. The phone refused to turn on no matter what I do. I did that what is shown in my first post and now the phone is working again. I also tried to help a guy, but it turned out the emmc of his phone has an I/O error. I used the EMMC TEST option to check the emmc for bad sectors.

    I am also summoning @rootSU to let him know what a cool stuff nexus 5 has.
    6
    OP updated.

    I want to make a little comment about this boarddiag tool, and how it works.

    Emmc test:
    Erase: erase the whole emmc. Even if you select a partition from the dropdown menu,
    Read only: Only reads random blocks from the emmc. If you check DUMP it will read back the amount of blocks of a the chosen partition given in the partition.txt
    Write only: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition).
    Read/Write: writes dummy data to the emmc (55AA hex values and some other other random writes on the actual partition) and then verify them by reading it back​

    SDRAM test:
    I think this test the memory. There is a Level option for it. I dont know what is the differance between the two.​

    PIMC ON:
    No idea, but in some LG documentations it is for only APQ8064 chipset.​

    Restore boot img:
    Restores the images.​

    How it know which partitions have to be restored?
    There is a rawprogram0.xml in model\Nexus5 (MSM8974_HammerHead)\boot_partition_info folder.
    The partitions declared here will be flashed to the device if you select nothing in the partititon dropdown menu or in the restore boot img dropdown menu
    Boarddiag only cares about the "label" value (have to be tha same as in partition.txt) from rawprogram0.xml. The rest info like startblock, files size and file name will be acquired from the partition.txt.
    Partition.txt is a binary file:
    0x00-0x03: start block
    0x04-0x07: file size in block numbers ( 1 block = 512 byte)
    0x08-0x0F: always zero
    0x10-0x2F: partition name (must be the same as the label value in rawprogram0.xml)
    0x30-0x4F: file name
    and the pattern goes on.​
    I wrote a little program which converts this binary partition.txt to an actual txt. You can get it from here
    Copy the partition.txt to the same folder where the bin2txt and txt2bin exes are. Run bin2txt then it will create a readable_partition.txt file. Edit it with notepad++. The start block is in HEX and the file size is in bytes (must be multiple of 512). Partition entries is the number of partition declared in the partition.txt. If you done with the editing then run txt2bin and it will create a new_partition.txt file.​
    3
    one more quick question...i want to test my emmc to see if its fried...would selecting read only work for that?

    It is fine to do the r/w test. Better to check the SDRAM test too because after a successfull emmc test the bootloader will be not restored then you have to hold the powerkey until you see the qualcomm qdloader 9008 device disappearing and reappearing again or removing the battery connectors if that not works. So if you check the SDRAM test too then it will restore bootloader. Keep in mind that SDRAM test takes about 5 minutes and also during this time your phone will not show up in the device manager. Just be patient the phone will reconnect when the test is done.
    3
    Can we adapt these procedures for other devices. If we can how to go about it ? What files are needed and how to get them from a similar device?
    Thanks.

    Maybe. What you will need:

    Flash programmer
    Essential images to make the phone boot. These are the generic: aboot, sbl1, (sbl2, sbl3), tz, rpm, boot, and there are some other necessary partitions which depends on the device for LG phones it is the laf. You will need the primary and backup GPT too if you want to fix them too.
    Edit rawprogramm.xml
    Make a partition.txt

    The choke pont is to find a working flash programmer for you device.

    But you can try an SDcard method. Some LG (like LG F460/LG G3 Prime,/LG G3 Cat.6) and Samsung (Note 3 ???) boots to download/odin mode if you make an emmc dump of a working phone and raw write that image to an sdcard. The dump size is determined by the start block of the system partition.