[GUIDE][K920] Unlock bootloader on Lenovo VIBE Z2 Pro

U

user700512

Senior Member
Sep 24, 2013
106
21
38
Sofia
www.twe.bg
Dec 28, 2016 at 11:34 PM
It may be better if steps 6 and 7 are removed from the instructions.
The device and its port are shown in the main QFIL dialog in place of "No Port Available".

Another important instruction would be appropriate to add - it is to switch to "Flat Build" in "Select Build Type".
With "Meta Build" selected by default, "Select Programmer" is inactive (greyed out).

I have K920_S288_160224_ROW on my piece of crap, and I have a Windows 10 x64 Home on the other side.
And I could not get QFIL to flash the boot loader unlocked.
After following the instructions here, I had QFIL start with:
Code: 
Validating Application Configuration
Load APP Configuration
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\
Process Index:0
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Image Search Path: C:\UnlockBootloader_LP_ROW
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
After hitting <Download> while I was seeing my device and its port in QFIL, I either got:
Code: 
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Download Fail:Sahara Fail:QSaharaServer Fail:The directory name is invalid
Finish Download
or:
Code: 
Start Download
Download Fail:Invalid physical address number
Finish Download
or:
Code: 
Start Download
Download Fail:Value was either too large or too small for a UInt32.
Finish Download
I did have QFIL complete successfully, though, but…
After step 4:
4a. QFIL must be closed;
4b. QFIL must be started again;
4c. "Select Build Type" must be set to "Flat Build" again;
Then in step 5, holding all the time until the end <Vol. Up>, I got the following output.
But, I didn't get the phone auto-reboot (just powered off).
How do I check if it is unlocked?

Code: 
Validating Application Configuration
Load APP Configuration
COM:-1
SAHARA:True
SAHARA:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
SEARCHPATH:C:\UnlockBootloader_LP_ROW
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Process Index:0
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM3 -s 13:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn 'Current working dir: C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
00:54:41: Requested ID 13, file: "C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn"
00:54:41: 84192 bytes transferred in 0.015000 seconds (5.3528MBps)
00:54:41: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
00:54:41: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:45: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=rawprogram0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:45: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:45: INFO: Showing network mappings to allow debugging
00:54:46: INFO: 
00:54:46: INFO: Trying to store 'rawprogram0.xml' in string table
00:54:46: INFO: Looking for file 'rawprogram0.xml'
00:54:46: INFO: User wants to talk to port '\\.\COM3'
00:54:46: INFO: Took       0.00000000 seconds to open port
00:54:46: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:46: INFO: If  you don't want this, use --dontsorttags
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: Looking for file 'gpt_main0.bin'
00:54:46: INFO: Looking for file 'gpt_backup0.bin'
00:54:46: INFO: 
Total to be tansferd with <program> or <read> is 711.05 KB
00:54:46: INFO: Sending <configure>
00:54:46: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:46: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:46: INFO: In handleProgram('emmc_appsboot.mbn')
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: =======================================================
00:54:46: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'}
00:54:46: INFO: {<program> (677.55 KB) 1356 sectors needed at location 264232 on LUN 0}
00:54:46: INFO: =======================================================
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: TARGET SAID: 'start 264232, num 1356'
00:54:47: INFO: FILE ACCESS SLOW!!  678.00 KB in  0.015 seconds (  44.14 MBps) --- Overall to target  0.125 seconds (5.30 MBps)
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 265588'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: In handleProgram('gpt_main0.bin')
00:54:47: INFO: Looking for file 'gpt_main0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'}
00:54:47: INFO: {<program> (17.00 KB) 34 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 0, num 34'
00:54:47: INFO: FILE ACCESS SLOW!!   17.00 KB in  0.015 seconds (   1.11 MBps) --- Overall to target  0.010 seconds (1.66 MBps)
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 34'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: In handleProgram('gpt_backup0.bin')
00:54:47: INFO: Looking for file 'gpt_backup0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'}
00:54:47: INFO: {<program> (16.50 KB) 33 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 61071327, num 33'
00:54:47: INFO: FILE ACCESS SLOW!!   16.50 KB in  0.015 seconds (   1.07 MBps) --- Overall to target  0.010 seconds (1.61 MBps)
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 61071360'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: ==============================================================
00:54:47: INFO: Files used and their paths
00:54:47: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:47: INFO:   2 'C:\UnlockBootloader_LP_ROW\rawprogram0.xml'
00:54:47: INFO:   3 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'
00:54:47: INFO:   4 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'
00:54:47: INFO:   5 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'
00:54:47: INFO:      _             (done)
00:54:47: INFO:     | |                 
00:54:47: INFO:   __| | ___  _ __   ___ 
00:54:47: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:47: INFO: | (_| | (_) | | | |  __/
00:54:47: INFO:  \__,_|\___/|_| |_|\___|
00:54:47: INFO: {All Finished Successfully}
00:54:47: INFO: FILE ACCESS SLOW!!  711.05 KB in  0.015 seconds (  46.29 MBps) --- Overall to target  0.953 seconds (746.12 KBps)
00:54:47: INFO: {percent files transferred 100.00%}
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:48: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=patch0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:48: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:48: INFO: Showing network mappings to allow debugging
00:54:48: INFO: 
00:54:48: INFO: Trying to store 'patch0.xml' in string table
00:54:48: INFO: Looking for file 'patch0.xml'
00:54:48: INFO: User wants to talk to port '\\.\COM3'
00:54:48: INFO: Took       0.01600000 seconds to open port
00:54:48: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:48: INFO: If  you don't want this, use --dontsorttags
00:54:48: INFO: Sending <configure>
00:54:48: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:48: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:48: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:49: INFO: TARGET SAID: 'Patched sector 7 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071332 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDF'
00:54:49: INFO: TARGET SAID: 'crc start sector 2, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'crc start sector 61071327, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 1, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 1 with 1125B526'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 61071359, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with AD0AE52E'
00:54:50: INFO: ==============================================================
00:54:50: INFO: Files used and their paths
00:54:50: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:50: INFO:   2 'C:\UnlockBootloader_LP_ROW\patch0.xml'
00:54:50: INFO:      _             (done)
00:54:50: INFO:     | |                 
00:54:50: INFO:   __| | ___  _ __   ___ 
00:54:50: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:50: INFO: | (_| | (_) | | | |  __/
00:54:50: INFO:  \__,_|\___/|_| |_|\___|
00:54:50: INFO: {All Finished Successfully}
00:54:50: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  1.438 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:51: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC --setactivepartition=0 
************************************************
00:54:51: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:51: INFO: Showing network mappings to allow debugging
00:54:51: INFO: User wants to talk to port '\\.\COM3'
00:54:51: INFO: Took       0.00000000 seconds to open port
00:54:51: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:51: INFO: If  you don't want this, use --dontsorttags
00:54:51: INFO: Sending <configure>
00:54:51: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:51: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:51: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:51: INFO: Sending <setbootablestoragedrive>
00:54:51: INFO: TARGET SAID: 'Set bootable drive to 0.'
00:54:51: INFO: ==============================================================
00:54:51: INFO: Files used and their paths
00:54:51: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:51: INFO:      _             (done)
00:54:51: INFO:     | |                 
00:54:51: INFO:   __| | ___  _ __   ___ 
00:54:51: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:51: INFO: | (_| | (_) | | | |  __/
00:54:51: INFO:  \__,_|\___/|_| |_|\___|
00:54:51: INFO: {All Finished Successfully}
00:54:51: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  0.203 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Succeed
Finish Download
 
Last edited:
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Jan 2, 2017 at 4:07 AM
hi, my last attempt i refreshed my CN phone with ROW (with CN modem files)
any idea which file should I use now? ROW or CN?

how to tell if unlocked successfully?
if after adb reboot bootloader, i failed to fastboot flash recovery.img, means not unlocked ( stuck as "Waiting Any device" ), right?
 
Last edited:
N

nikods

Member
Aug 19, 2009
28
1
0
Jan 22, 2017 at 10:51 AM
HI I have same build as you (K920_S288_160224_ROW), did you manage to do it? Also I do not understand, I presume I have to root it at first? How do I do it on this build, there are some how to's but none has our build in supported list :(
Thanks Niko

ps Kako je u Bugarskoj komsija :) pozdrav iz Beograda

user700512 said:
It may be better if steps 6 and 7 are removed from the instructions.
The device and its port are shown in the main QFIL dialog in place of "No Port Available".

Another important instruction would be appropriate to add - it is to switch to "Flat Build" in "Select Build Type".
With "Meta Build" selected by default, "Select Programmer" is inactive (greyed out).

I have K920_S288_160224_ROW on my piece of crap, and I have a Windows 10 x64 Home on the other side.
And I could not get QFIL to flash the boot loader unlocked.
After following the instructions here, I had QFIL start with:
Code: 
Validating Application Configuration
Load APP Configuration
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\
Process Index:0
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Image Search Path: C:\UnlockBootloader_LP_ROW
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
After hitting <Download> while I was seeing my device and its port in QFIL, I either got:
Code: 
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Download Fail:Sahara Fail:QSaharaServer Fail:The directory name is invalid
Finish Download
or:
Code: 
Start Download
Download Fail:Invalid physical address number
Finish Download
or:
Code: 
Start Download
Download Fail:Value was either too large or too small for a UInt32.
Finish Download
I did have QFIL complete successfully, though, but…
After step 4:
4a. QFIL must be closed;
4b. QFIL must be started again;
4c. "Select Build Type" must be set to "Flat Build" again;
Then in step 5, holding all the time until the end <Vol. Up>, I got the following output.
But, I didn't get the phone auto-reboot (just powered off).
How do I check if it is unlocked?

Code: 
Validating Application Configuration
Load APP Configuration
COM:-1
SAHARA:True
SAHARA:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
SEARCHPATH:C:\UnlockBootloader_LP_ROW
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Process Index:0
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM3 -s 13:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn 'Current working dir: C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
00:54:41: Requested ID 13, file: "C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn"
00:54:41: 84192 bytes transferred in 0.015000 seconds (5.3528MBps)
00:54:41: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
00:54:41: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:45: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=rawprogram0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:45: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:45: INFO: Showing network mappings to allow debugging
00:54:46: INFO: 
00:54:46: INFO: Trying to store 'rawprogram0.xml' in string table
00:54:46: INFO: Looking for file 'rawprogram0.xml'
00:54:46: INFO: User wants to talk to port '\\.\COM3'
00:54:46: INFO: Took       0.00000000 seconds to open port
00:54:46: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:46: INFO: If  you don't want this, use --dontsorttags
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: Looking for file 'gpt_main0.bin'
00:54:46: INFO: Looking for file 'gpt_backup0.bin'
00:54:46: INFO: 
Total to be tansferd with <program> or <read> is 711.05 KB
00:54:46: INFO: Sending <configure>
00:54:46: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:46: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:46: INFO: In handleProgram('emmc_appsboot.mbn')
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: =======================================================
00:54:46: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'}
00:54:46: INFO: {<program> (677.55 KB) 1356 sectors needed at location 264232 on LUN 0}
00:54:46: INFO: =======================================================
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: TARGET SAID: 'start 264232, num 1356'
00:54:47: INFO: FILE ACCESS SLOW!!  678.00 KB in  0.015 seconds (  44.14 MBps) --- Overall to target  0.125 seconds (5.30 MBps)
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 265588'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: In handleProgram('gpt_main0.bin')
00:54:47: INFO: Looking for file 'gpt_main0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'}
00:54:47: INFO: {<program> (17.00 KB) 34 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 0, num 34'
00:54:47: INFO: FILE ACCESS SLOW!!   17.00 KB in  0.015 seconds (   1.11 MBps) --- Overall to target  0.010 seconds (1.66 MBps)
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 34'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: In handleProgram('gpt_backup0.bin')
00:54:47: INFO: Looking for file 'gpt_backup0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'}
00:54:47: INFO: {<program> (16.50 KB) 33 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 61071327, num 33'
00:54:47: INFO: FILE ACCESS SLOW!!   16.50 KB in  0.015 seconds (   1.07 MBps) --- Overall to target  0.010 seconds (1.61 MBps)
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 61071360'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: ==============================================================
00:54:47: INFO: Files used and their paths
00:54:47: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:47: INFO:   2 'C:\UnlockBootloader_LP_ROW\rawprogram0.xml'
00:54:47: INFO:   3 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'
00:54:47: INFO:   4 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'
00:54:47: INFO:   5 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'
00:54:47: INFO:      _             (done)
00:54:47: INFO:     | |                 
00:54:47: INFO:   __| | ___  _ __   ___ 
00:54:47: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:47: INFO: | (_| | (_) | | | |  __/
00:54:47: INFO:  \__,_|\___/|_| |_|\___|
00:54:47: INFO: {All Finished Successfully}
00:54:47: INFO: FILE ACCESS SLOW!!  711.05 KB in  0.015 seconds (  46.29 MBps) --- Overall to target  0.953 seconds (746.12 KBps)
00:54:47: INFO: {percent files transferred 100.00%}
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:48: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=patch0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:48: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:48: INFO: Showing network mappings to allow debugging
00:54:48: INFO: 
00:54:48: INFO: Trying to store 'patch0.xml' in string table
00:54:48: INFO: Looking for file 'patch0.xml'
00:54:48: INFO: User wants to talk to port '\\.\COM3'
00:54:48: INFO: Took       0.01600000 seconds to open port
00:54:48: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:48: INFO: If  you don't want this, use --dontsorttags
00:54:48: INFO: Sending <configure>
00:54:48: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:48: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:48: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:49: INFO: TARGET SAID: 'Patched sector 7 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071332 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDF'
00:54:49: INFO: TARGET SAID: 'crc start sector 2, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'crc start sector 61071327, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 1, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 1 with 1125B526'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 61071359, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with AD0AE52E'
00:54:50: INFO: ==============================================================
00:54:50: INFO: Files used and their paths
00:54:50: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:50: INFO:   2 'C:\UnlockBootloader_LP_ROW\patch0.xml'
00:54:50: INFO:      _             (done)
00:54:50: INFO:     | |                 
00:54:50: INFO:   __| | ___  _ __   ___ 
00:54:50: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:50: INFO: | (_| | (_) | | | |  __/
00:54:50: INFO:  \__,_|\___/|_| |_|\___|
00:54:50: INFO: {All Finished Successfully}
00:54:50: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  1.438 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:51: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC --setactivepartition=0 
************************************************
00:54:51: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:51: INFO: Showing network mappings to allow debugging
00:54:51: INFO: User wants to talk to port '\\.\COM3'
00:54:51: INFO: Took       0.00000000 seconds to open port
00:54:51: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:51: INFO: If  you don't want this, use --dontsorttags
00:54:51: INFO: Sending <configure>
00:54:51: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:51: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:51: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:51: INFO: Sending <setbootablestoragedrive>
00:54:51: INFO: TARGET SAID: 'Set bootable drive to 0.'
00:54:51: INFO: ==============================================================
00:54:51: INFO: Files used and their paths
00:54:51: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:51: INFO:      _             (done)
00:54:51: INFO:     | |                 
00:54:51: INFO:   __| | ___  _ __   ___ 
00:54:51: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:51: INFO: | (_| | (_) | | | |  __/
00:54:51: INFO:  \__,_|\___/|_| |_|\___|
00:54:51: INFO: {All Finished Successfully}
00:54:51: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  0.203 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Succeed
Finish Download
Click to expand...
 
U

user700512

Senior Member
Sep 24, 2013
106
21
38
Sofia
www.twe.bg
Jan 23, 2017 at 9:50 AM
nikods said:
HI I have same build as you (K920_S288_160224_ROW), did you manage to do it? Also I do not understand, I presume I have to root it at first? How do I do it on this build, there are some how to's but none has our build in supported list :(
Thanks Niko

ps Kako je u Bugarskoj komsija :) pozdrav iz Beograda
Click to expand...
Zdravo, nikods!

Yes, the unlock procedure was successful.
I had SuperSU installed on the stock K920_S288_160224_ROW before that. But, I don't think root is needed when you unlock the bootloader.
When you flash a CM/LA-based ROM later on, you will have root in it.

I used QPST 2.7.437 (because I had it already installed for the root procedure) instead of the suggested here QPST 2.7.422.
Be sure to follow exactly the unlock guide. And also, do as I did - when you choose the necessary files, exit QPST, then start it again, check the paths in QPST and then do the unlock.
Far as I remember, it required a bit of speed with 3 hands altogether to start flashing while port open, but it was successful after all.

Pozdrav and ziveli! ;)
 
  • Like
Reactions: nikods
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Feb 2, 2017 at 2:24 AM
from the computer Device Manager at Port there, I can see those hidden devices with Lenovo HS-USB xxx and also QualComm but somehow only QualComm get activated and not Lenovo HS-USB.

I can read phone content and copy / delete from it..but during FASTBOOT FLASH recovery recovery.img, I always get <Waiting for device>

Google it and told wrong driver which i suspect should have Lenovo HS-USB displayed but not QualComm...i uninstalled all Lenovo driver and re-install and i uninstall Qualcomm driver..i still see QualComm display there..

when I checked to view all Hidden Devices, I see list of Lenovo drivers (Port 6,7,8,9)and QualComm (Port 5). I even changed the Port 5 to Port 10 just incase display according to sequential manner but still "Waiting for Device" during Fastboot reflash recovery recovery.img..

any clue?
 
Last edited:
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Feb 13, 2017 at 3:08 AM
user700512 said:
It may be better if steps 6 and 7 are removed from the instructions.
The device and its port are shown in the main QFIL dialog in place of "No Port Available".

Another important instruction would be appropriate to add - it is to switch to "Flat Build" in "Select Build Type".
With "Meta Build" selected by default, "Select Programmer" is inactive (greyed out).

I have K920_S288_160224_ROW on my piece of crap, and I have a Windows 10 x64 Home on the other side.
And I could not get QFIL to flash the boot loader unlocked.
After following the instructions here, I had QFIL start with:
Code: 
Validating Application Configuration
Load APP Configuration
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\
Process Index:0
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Image Search Path: C:\UnlockBootloader_LP_ROW
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
After hitting <Download> while I was seeing my device and its port in QFIL, I either got:
Code: 
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Download Fail:Sahara Fail:QSaharaServer Fail:The directory name is invalid
Finish Download
or:
Code: 
Start Download
Download Fail:Invalid physical address number
Finish Download
or:
Code: 
Start Download
Download Fail:Value was either too large or too small for a UInt32.
Finish Download
I did have QFIL complete successfully, though, but…
After step 4:
4a. QFIL must be closed;
4b. QFIL must be started again;
4c. "Select Build Type" must be set to "Flat Build" again;
Then in step 5, holding all the time until the end <Vol. Up>, I got the following output.
But, I didn't get the phone auto-reboot (just powered off).
How do I check if it is unlocked?

Code: 
Validating Application Configuration
Load APP Configuration
COM:-1
SAHARA:True
SAHARA:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
SEARCHPATH:C:\UnlockBootloader_LP_ROW
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\UnlockBootloader_LP_ROW
RAWPROGRAM file path: C:\UnlockBootloader_LP_ROW\rawprogram0.xml
PATCH file path:C:\UnlockBootloader_LP_ROW\patch0.xml
Programmer Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Process Index:0
Start Download
Program Path:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
Binary build date: May 13 2015 @ 14:41:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.exe -p \\.\COM3 -s 13:C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn 'Current working dir: C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn
00:54:41: Requested ID 13, file: "C:\UnlockBootloader_LP_ROW\prog_emmc_firehose_8974.mbn"
00:54:41: 84192 bytes transferred in 0.015000 seconds (5.3528MBps)
00:54:41: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
00:54:41: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:45: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=rawprogram0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:45: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:45: INFO: Showing network mappings to allow debugging
00:54:46: INFO: 
00:54:46: INFO: Trying to store 'rawprogram0.xml' in string table
00:54:46: INFO: Looking for file 'rawprogram0.xml'
00:54:46: INFO: User wants to talk to port '\\.\COM3'
00:54:46: INFO: Took       0.00000000 seconds to open port
00:54:46: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:46: INFO: If  you don't want this, use --dontsorttags
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: Looking for file 'gpt_main0.bin'
00:54:46: INFO: Looking for file 'gpt_backup0.bin'
00:54:46: INFO: 
Total to be tansferd with <program> or <read> is 711.05 KB
00:54:46: INFO: Sending <configure>
00:54:46: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:46: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:46: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:46: INFO: In handleProgram('emmc_appsboot.mbn')
00:54:46: INFO: Looking for file 'emmc_appsboot.mbn'
00:54:46: INFO: =======================================================
00:54:46: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'}
00:54:46: INFO: {<program> (677.55 KB) 1356 sectors needed at location 264232 on LUN 0}
00:54:46: INFO: =======================================================
00:54:46: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:46: INFO: TARGET SAID: 'start 264232, num 1356'
00:54:47: INFO: FILE ACCESS SLOW!!  678.00 KB in  0.015 seconds (  44.14 MBps) --- Overall to target  0.125 seconds (5.30 MBps)
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 265588'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  95.29%}
00:54:47: INFO: In handleProgram('gpt_main0.bin')
00:54:47: INFO: Looking for file 'gpt_main0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'}
00:54:47: INFO: {<program> (17.00 KB) 34 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 0, num 34'
00:54:47: INFO: FILE ACCESS SLOW!!   17.00 KB in  0.015 seconds (   1.11 MBps) --- Overall to target  0.010 seconds (1.66 MBps)
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 34'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred  97.68%}
00:54:47: INFO: In handleProgram('gpt_backup0.bin')
00:54:47: INFO: Looking for file 'gpt_backup0.bin'
00:54:47: INFO: =======================================================
00:54:47: INFO: {<program> FILE: 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'}
00:54:47: INFO: {<program> (16.50 KB) 33 sectors needed at location 0 on LUN 0}
00:54:47: INFO: =======================================================
00:54:47: INFO: TARGET SAID: 'start 61071327, num 33'
00:54:47: INFO: FILE ACCESS SLOW!!   16.50 KB in  0.015 seconds (   1.07 MBps) --- Overall to target  0.010 seconds (1.61 MBps)
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: TARGET SAID: 'Finished sector address 61071360'
00:54:47: INFO: 
00:54:47: INFO: =======================================================
00:54:47: INFO: ==================== {SUCCESS} ========================
00:54:47: INFO: =======================================================
00:54:47: INFO: {percent files transferred 100.00%}
00:54:47: INFO: ==============================================================
00:54:47: INFO: Files used and their paths
00:54:47: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:47: INFO:   2 'C:\UnlockBootloader_LP_ROW\rawprogram0.xml'
00:54:47: INFO:   3 'C:\UnlockBootloader_LP_ROW\emmc_appsboot.mbn'
00:54:47: INFO:   4 'C:\UnlockBootloader_LP_ROW\gpt_main0.bin'
00:54:47: INFO:   5 'C:\UnlockBootloader_LP_ROW\gpt_backup0.bin'
00:54:47: INFO:      _             (done)
00:54:47: INFO:     | |                 
00:54:47: INFO:   __| | ___  _ __   ___ 
00:54:47: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:47: INFO: | (_| | (_) | | | |  __/
00:54:47: INFO:  \__,_|\___/|_| |_|\___|
00:54:47: INFO: {All Finished Successfully}
00:54:47: INFO: FILE ACCESS SLOW!!  711.05 KB in  0.015 seconds (  46.29 MBps) --- Overall to target  0.953 seconds (746.12 KBps)
00:54:47: INFO: {percent files transferred 100.00%}
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:48: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --sendxml=patch0.xml --search_path=C:\UnlockBootloader_LP_ROW --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC 
************************************************
00:54:48: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:48: INFO: Showing network mappings to allow debugging
00:54:48: INFO: 
00:54:48: INFO: Trying to store 'patch0.xml' in string table
00:54:48: INFO: Looking for file 'patch0.xml'
00:54:48: INFO: User wants to talk to port '\\.\COM3'
00:54:48: INFO: Took       0.01600000 seconds to open port
00:54:48: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:48: INFO: If  you don't want this, use --dontsorttags
00:54:48: INFO: Sending <configure>
00:54:48: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:48: INFO: TARGET SAID: '[email protected]23A78 [email protected]'
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:48: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:49: INFO: TARGET SAID: 'Patched sector 7 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071332 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDE'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFFF'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with 03A3DFDF'
00:54:49: INFO: TARGET SAID: 'crc start sector 2, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'crc start sector 61071327, over bytes 3072'
00:54:49: INFO: TARGET SAID: 'Patched sector 61071359 with B5BEDE61'
00:54:49: INFO: TARGET SAID: 'Patched sector 1 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 1, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 1 with 1125B526'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with 00000000'
00:54:50: INFO: TARGET SAID: 'crc start sector 61071359, over bytes 92'
00:54:50: INFO: TARGET SAID: 'Patched sector 61071359 with AD0AE52E'
00:54:50: INFO: ==============================================================
00:54:50: INFO: Files used and their paths
00:54:50: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:50: INFO:   2 'C:\UnlockBootloader_LP_ROW\patch0.xml'
00:54:50: INFO:      _             (done)
00:54:50: INFO:     | |                 
00:54:50: INFO:   __| | ___  _ __   ___ 
00:54:50: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:50: INFO: | (_| | (_) | | | |  __/
00:54:50: INFO:  \__,_|\___/|_| |_|\___|
00:54:50: INFO: {All Finished Successfully}
00:54:50: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  1.438 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Binary build date: Jun  3 2015 @ 17:12:06
Build version: 15.06. 3.17.12.06
00:54:51: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe --port=\\.\COM3 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=eMMC --setactivepartition=0 
************************************************
00:54:51: INFO: Current working dir (cwd): C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\
00:54:51: INFO: Showing network mappings to allow debugging
00:54:51: INFO: User wants to talk to port '\\.\COM3'
00:54:51: INFO: Took       0.00000000 seconds to open port
00:54:51: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
00:54:51: INFO: If  you don't want this, use --dontsorttags
00:54:51: INFO: Sending <configure>
00:54:51: INFO: TARGET SAID: 'Host's payload to target size is too large'
00:54:51: INFO: TARGET SAID: '[email protected] [email protected]'
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 131072
00:54:51: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 131072
00:54:51: INFO: Target returned NAK for your <configure> but it does not seem to be an error. This is ok, fh_loader.exe attributes updated
00:54:51: INFO: Sending <setbootablestoragedrive>
00:54:51: INFO: TARGET SAID: 'Set bootable drive to 0.'
00:54:51: INFO: ==============================================================
00:54:51: INFO: Files used and their paths
00:54:51: INFO:   1 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
00:54:51: INFO:      _             (done)
00:54:51: INFO:     | |                 
00:54:51: INFO:   __| | ___  _ __   ___ 
00:54:51: INFO:  / _` |/ _ \| '_ \ / _ \
00:54:51: INFO: | (_| | (_) | | | |  __/
00:54:51: INFO:  \__,_|\___/|_| |_|\___|
00:54:51: INFO: {All Finished Successfully}
00:54:51: INFO: FILE ACCESS SLOW!!     0.00 B in  0.015 seconds (    0.00 Bps) --- Overall to target  0.203 seconds (0.00 Bps)
Writing log to 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt', might take a minute
Log is 'C:\Users\User Account\AppData\Roaming\Qualcomm\QFIL\port_trace.txt'
Download Succeed
Finish Download
Click to expand...
Hi,

at Step 5, in your Device Manager, did you see
QualComm HS-USB xxx Or Lenovo HS-USB xxx appeared?

I always see QualComm eventhough i have Lenovo driver installed and i can manage the phone content via the computer/notebook.

I am still stuck at Fastboot flash recover recover.img with response <Waiting for devices>
 
U

user700512

Senior Member
Sep 24, 2013
106
21
38
Sofia
www.twe.bg
Feb 13, 2017 at 9:03 AM
leecs said:
Hi,

at Step 5, in your Device Manager, did you see
QualComm HS-USB xxx Or Lenovo HS-USB xxx appeared?

I always see QualComm eventhough i have Lenovo driver installed and i can manage the phone content via the computer/notebook.

I am still stuck at Fastboot flash recover recover.img with response <Waiting for devices>
Click to expand...
I hope somebody with more experience could help you.

For me it was easier to get all done within QFIL, rather than check device/port in Device Manager and repeat. Anyway, yes, it appeared for a few seconds in Device Manager.

To my opinion, if you are in a fastboot screen on your phone (a small green android in the center of a black screen) and you cannot execute a fastboot command from cmd, it may be because of a faulty USB cable. Try "fastboot devices" first.
 
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Feb 15, 2017 at 6:16 AM
user700512 said:
I hope somebody with more experience could help you.

For me it was easier to get all done within QFIL, rather than check device/port in Device Manager and repeat. Anyway, yes, it appeared for a few seconds in Device Manager.

To my opinion, if you are in a fastboot screen on your phone (a small green android in the center of a black screen) and you cannot execute a fastboot command from cmd, it may be because of a faulty USB cable. Try "fastboot devices" first.
Click to expand...
Yes, I do get a small green android in the middle of screen after i entered "adb reboot bootloader"

when with green android in the middle "fastboot flash recovery recovery.img" just give me <Waiting for device> and stopped there till I reboot the phone manually 15mins later.

---------- Post added at 02:16 PM ---------- Previous post was at 02:10 PM ----------
user700512 said:
I hope somebody with more experience could help you.

For me it was easier to get all done within QFIL, rather than check device/port in Device Manager and repeat. Anyway, yes, it appeared for a few seconds in Device Manager.

To my opinion, if you are in a fastboot screen on your phone (a small green android in the center of a black screen) and you cannot execute a fastboot command from cmd, it may be because of a faulty USB cable. Try "fastboot devices" first.
Click to expand...
Yes, just that when not proceeding and stuck with "waiting for device" after many weeks, i have to read for other possibilities of the cause.

I still have Qualcomm HS-USB QLoader xxxx instead of Lenovo HS-USB QLoader xxx
 
U

user700512

Senior Member
Sep 24, 2013
106
21
38
Sofia
www.twe.bg
Feb 15, 2017 at 7:38 PM
leecs said:
hi, my last attempt i refreshed my CN phone with ROW (with CN modem files)
any idea which file should I use now? ROW or CN?

how to tell if unlocked successfully?
if after adb reboot bootloader, i failed to fastboot flash recovery.img, means not unlocked ( stuck as "Waiting Any device" ), right?
Click to expand...
Start over and unlock your bootloader with the correct files. Since you have communication with the phone (copy files/execute adb commands), it means that you have the necessary drivers and a good USB cable.
 
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Feb 16, 2017 at 7:12 AM
user700512 said:
Start over and unlock your bootloader with the correct files. Since you have communication with the phone (copy files/execute adb commands), it means that you have the necessary drivers and a good USB cable.
Click to expand...
I thought the same too.
I retried many times with unlock bootloader d...but still <waiting for devices> at fastboot flash recovery recovery.img
 
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Feb 26, 2017 at 1:39 PM
Just now another attempt.
BUT this round with another USB cable (I tried 2 other good USB cables earlier on)
and I managed to flash TWRP :)

But now I hit Error 7 when trying to flash ROM
 
U

user700512

Senior Member
Sep 24, 2013
106
21
38
Sofia
www.twe.bg
Feb 27, 2017 at 9:36 PM
I think that's more a ROM topic than TWRP.
(Although off-topic, I remember having to re-download a ROM, re-wipe partitions, then format /cache and /data (posted here).

Edit: I saw you've managed it (here) - great! :) It might still be a good idea to share your experience. ;)
 
Last edited:
L

leecs

Senior Member
Jan 6, 2007
109
10
0
Mar 1, 2017 at 3:06 AM
leecs said:
Just now another attempt.
BUT this round with another USB cable (I tried 2 other good USB cables earlier on)
and I managed to flash TWRP :)

But now I hit Error 7 when trying to flash ROM
Click to expand...
I did few things on that to get it resolved.
1. I flashed SU root.
2. I format the system/data on the phone too.

Now another happy user on LineageOS 14.1 :)
I just sent out little donation as token of appreciation. Will continue doing so with the subsequent update and effort put in. Good job, guys!
 
D

doomon

New member
Mar 29, 2017
2
0
0
Ceske Budejovice
Mar 29, 2017 at 12:57 PM
Hello guys,

I am trying unlock all day but no luck. I am using Windows 10 pro x64 (but also tried Win 7). I have international version of Lenovo Z2 Pro (K920) with Android 5.0.2 (last OTA update), K920_S288_160224_ROW.

When i switched to newer version of QPST 2.7.437, it looks like i succeded, but still doesnt have TWRP after flashing it. My goal is to flash Lineage OS 7.1 ROM since Lenovo is obviously not going to provide even Android 6 for Lenovo K920.

What i do so far:
- run QFIL and set as in attached qfil.png (close and open after orig. step 4)
- holding vol+ until the phone turns of (yes, not reboot but turn of like user700512 said, in older QFIL it rebooted but failed with: "Download Fail:FireHose Fail Fail to find QDLoader port after switch")
- when QFIL end it looks like it should be unlocked (qfil.log attached) but when i use "fastboot oem device-info" it says Device unlocked: false
- however flashing recovery ends with OKAY (recovery.img is TWRP 3.1.0 from https://forum.xda-developers.com/k920/development/recovery-team-win-recovery-project-3-0-t3454739)
- but when i boot my phone to recovery (using "abd reboot recovery" or by holding Vol+ and Vol- and Power -> holding just Vol+ and Power is not working for me) I am stil in Lenovo-Recovery instead of TWRP!!! WTF?! :mad:

Thx for eny help.

* Cannot add attachments for some reason, so here is links:
qfil.png https://www.dropbox.com/s/4yqp259a5wdjalm/qfil.png?dl=0
qfil.log https://www.dropbox.com/s/qeb75cmutu8pu3f/qfil.log?dl=0
flash_recovery.img https://www.dropbox.com/s/um98nxb7sy33r7x/flash_recovery.png?dl=0
 
E

Electry

Senior Member
Apr 19, 2015
251
603
0
Slovakia
Mar 29, 2017 at 1:36 PM
doomon said:
Hello guys,

I am trying unlock all day but no luck. I am using Windows 10 pro x64 (but also tried Win 7). I have international version of Lenovo Z2 Pro (K920) with Android 5.0.2 (last OTA update), K920_S288_160224_ROW.
Click to expand...
If 'fastboot flash' doesn't throw error the bootloader is unlocked.
The twrp might get overwritten with stock recovery on boot. I would try to boot straight into recovery.img (fastboot boot xxx.img) right after flashing the twrp and then, in twrp mount 'System' partition, open file manager (it's under Advanced menu AFAIK), look for something like 'install-recovery.sh' or 'recovery-from-boot.sh' (should be somewhere in /system/etc/) and remove/rename that file...
Or just wipe system partition or flash Lineage zip.

I'd give better instructions, but I'm not at home ATM.
 
Last edited:
D

doomon

New member
Mar 29, 2017
2
0
0
Ceske Budejovice
Mar 29, 2017 at 2:40 PM
Electry said:
If 'fastboot flash' doesn't throw error the bootloader is unlocked.
The twrp might get overwritten by stock recovery on boot. I would try to boot straight into recovery.img (fastboot boot xxx.img) right after flashing the twrp and then, in twrp mount 'System' partition, open file manager (it's under Advanced menu AFAIK), look for something like 'install-recovery.sh' or 'recovery-from-boot.sh' (should be somewhere in /system/etc/) and remove/rename that file...
Or just wipe system partition or flash Lineage zip.

I'd give better instructions, but I'm not at home ATM.
Click to expand...
Thank you very much for perfect and fast answer. Booting straight to TWRP really works! Didnt really expect stock ROM overwritting recovery on every boot. Thank you!

P.S.: Vlastně si nemusíme psát anglicky, ale nevadí. :) Ať žijí češi a slováci!



---------- Post added at 03:40 PM ---------- Previous post was at 03:37 PM ----------
Electry said:
If 'fastboot flash' doesn't throw error the bootloader is unlocked.
The twrp might get overwritten by stock recovery on boot. I would try to boot straight into recovery.img (fastboot boot xxx.img) right after flashing the twrp and then, in twrp mount 'System' partition, open file manager (it's under Advanced menu AFAIK), look for something like 'install-recovery.sh' or 'recovery-from-boot.sh' (should be somewhere in /system/etc/) and remove/rename that file...
Or just wipe system partition or flash Lineage zip.

I'd give better instructions, but I'm not at home ATM.
Click to expand...
Also, for people who are getting the "Download Fail:FireHose Fail Fail to find QDLoader port after switch", just try newer version of QPST. Version 2.7.437 worked for me even on Win 10 pro x64 (even without using Qualcomm driver from main post). For some reason, i couldnt instal latest QPST 2.7.441, so for now i would recommend 2.7.437. The only difference is that you have to select "Flat Build" when start QFIL and that the phone turns off after unlock (instead of reboot).
 
R

r_m_f_f

Member
Mar 22, 2011
13
1
0
Apr 21, 2017 at 10:12 AM
This procedure work on Lenovo VIBE X3 K51c78 with android 5.1 ROM VIBEUI_V2.9_1616_5.1340.1_ST_K51c78?
I have several problems with this device and I try update de ROM throught recovery mode but is not allowed, when it will start install (appear 0%), appear a X symbol in red.

So I need update the ROM but the device don't allow, anyone can help me?
 
You must log in or register to reply here.

New posts

Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone