Hardbricked Mi4C, no fastboot or recovery + trouble with QFIL

[feek.404]

I've managed to accidentally brick my MI4C while flashing recovery. There is no way to boot now, no fastboot either.

Phone doesn't respond to charging cable, but I'm able to connect it to the PC in the EDL mode (shows up as Qualcomm HS-USB QDLoader 9008).

I've downloaded the QPST package and used the QFIL emergency flashing utility following a guide from xiaomifirmware.com.

QFIL always finishes without any error (tried waiting for >45 mins), however the ROM doesn't seem to be installed - and the phone is still completely dead.

Is there any hope left? Here is the output log from QFIL:

Validating Application Configuration
Load APP Configuration
COM:5
PBLDOWNLOADPROTOCOL:0
PROGRAMMER:True
PROGRAMMER:C:\Program Files (x86)\Qualcomm\QPST\bin\prog_emmc_firehose_8992_ddr.mbn
RESETSAHARASTATEEMACHINE:False
SEARCHPATH:C:\
RAWPROGRAM:
rawprogram0.xml
PATCH:
patch0.xml
ACKRAWDATAEVERYNUMPACKETS:False
ACKRAWDATAEVERYNUMPACKETS:100
MAXPAYLOADSIZETOTARGETINBYTES:False
MAXPAYLOADSIZETOTARGETINBYTES:49152
DEVICETYPE:eMMC
PLATFORM:8x26
VALIDATIONMODE:0
RESETAFTERDOWNLOAD:False
MAXDIGESTTABLESIZE:8192
SWITCHTOFIREHOSETIMEOUT:30
RESETTIMEOUT:200
RESETDELAYTIME:2
FLATBUILDPATH:C:\
FLATBUILDFORCEOVERRIDE:True
QCNPATH:C:\Temp\00000000.qcn
QCNAUTOBACKUPRESTORE:False
SPCCODE:000000
ENABLEMULTISIM:False
AUTOPRESERVEPARTITIONS:False
PARTITIONPRESERVEMODE:0
PRESERVEDPARTITIONS:0
PRESERVEDPARTITIONS:
ERASEALL:False
Load ARG Configuration
Validating Download Configuration
Image Search Path: C:\
RAWPROGRAM file path: C:\rawprogram0.xml
PATCH file path:C:\patch0.xml
Programmer Path:C:\Program Files (x86)\Qualcomm\QPST\bin\prog_emmc_firehose_8992_ddr.mbn
Process Index:0
Start Download
Program Path:C:\Program Files (x86)\Qualcomm\QPST\bin\prog_emmc_firehose_8992_ddr.mbn
***** Working Folder:C:\Users\______\AppData\Roaming\Qualcomm\QFIL\COMPORT_5
Binary build date: Oct 31 2016 @ 22:51:05
QSAHARASERVER CALLED LIKE THIS: 'C:\Program Files (x86)\Qualcomm\QPST\bin\QSaharaServer.ex'Current working dir: C:\Users\______\AppData\Roaming\Qualcomm\QFIL\COMPORT_5
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Program Files (x86)\Qualcomm\QPST\bin\prog_emmc_firehose_8992_ddr.mbn
15:57:02: Requested ID 13, file: "C:\Program Files (x86)\Qualcomm\QPST\bin\prog_emmc_firehose_8992_ddr.mbn"
15:57:02: 404664 bytes transferred in 0.094000 seconds (4.1055MBps)
15:57:02: File transferred successfully
NOTE: Target requested image 13 which is DeviceProgrammer. Forcing QUIT. This is by design, ** All is well ** SUCCESS!!
15:57:02: Sahara protocol completed
Sending Programmer Finished
Switch To FireHose
Wait for 3 seconds...
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Skip Write:False
Always Validate:False
Use Verbose:False
***** Working Folder:C:\Users\______\AppData\Roaming\Qualcomm\QFIL\COMPORT_5

The phones gets recognized by MiFlash, however any action results in ERROR 0x8000ffff: Receiving hello packet...

Any insight appreciated!

 

[k23m]

I've downloaded the QPST package and used the QFIL emergency flashing utility following a guide from xiaomifirmware.com. QFIL always finishes without any error (tried waiting for >45 mins), however the ROM doesn't seem to be installed - and the phone is still completely dead.
The phones gets recognized by MiFlash, however any action results in ERROR 0x8000ffff: Receiving hello packet...
Any insight appreciated!

With Xiaomi we generally use MiFlash rather than QPST/QFIL. I suppose you had tried the latest version of MiFlash but this device is old and an old version of MiFlash/MiPhone has to be used. Please get this 2015 version, it works for sure. Also for soft-brick recovery we use this old ROM "libra_images_6.1.7_20151221.0000.11_5.1_cn_b09dac70a0.tgz" and then flash new stuff.

So, enter the EDL/9008 mode again and flash the old ROM with the old MiFlash.

Relax, it will be fixed :highfive:

 

[feek.404]

With Xiaomi we generally use MiFlash rather than QPST/QFIL. I suppose you had tried the latest version of MiFlash but this device is old and an old version of MiFlash/MiPhone has to be used. Please get ..., it works for sure. Also for soft-brick recovery we use this old ROM "libra_images_6.1.7_20151221.0000.11_5.1_cn_b09dac70a0.tgz" and then flash new stuff.

So, enter the EDL/9008 mode again and flash the old ROM with the old MiFlash.

Relax, it will be fixed :highfive:

Thank you, this version of MiFlash worked! :good:

I flashed the old 5.1 ROM with MiFlash, then the older TWRP version, then flashed the official 7.0 ROM, then unlocked bootloader, then the new TWRP, then my desired ROM and now I'm good to go again.

QFIL is such a finicky tool, I don't want to ever see that again haha

 

[Nekronik]

I got into a similar situation.
The device is bootlooping and does not have recovery or atleast it is not accessible. I can boot in fastboot mode. The bootloader is locked and it does not let me flash recovery or rom.
I have requested and got permision to unlock the phone but the unlocking fails at the second step (don't remember the mesaage right now, I'll try to update this response later).
I have tried flashing what is stated in this post but it did not work. If anyone could list the specific details required for each step I could give it a second try.
Anyone willing to help? Thanks

 

[Nekronik]

I got into a similar situation.
The device is bootlooping and does not have recovery or atleast it is not accessible. I can boot in fastboot mode. The bootloader is locked and it does not let me flash recovery or rom.
I have requested and got permision to unlock the phone but the unlocking fails at the second step (don't remember the mesaage right now, I'll try to update this response later).
I have tried flashing what is stated in this post but it did not work. If anyone could list the specific details required for each step I could give it a second try.
Anyone willing to help? Thanks

This is the output for the following commands:

$ fastboot getvar product:
product: MSM8992
finished. total time: 0.016s

$ fastboot oem unlock
...
FAILED (remote: Token verification failed, reboot the device)
finished. total time: -0.000s

$ fastboot oem edl
< waiting for any device >
...
OKAY [ 0.000s]
finished. total time: 0.000s


The last command took some time to return even though it says 0.000.
I do see a 9008 in the devices admin.

 

[Nekronik]

This is the output for the following commands:

$ fastboot getvar product:
product: MSM8992
finished. total time: 0.016s

$ fastboot oem unlock
...
FAILED (remote: Token verification failed, reboot the device)
finished. total time: -0.000s

$ fastboot oem edl
< waiting for any device >
...
OKAY [ 0.000s]
finished. total time: 0.000s


The last command took some time to return even though it says 0.000.
I do see a 9008 in the devices admin.

My problem was that MiFlash2015 did not let me communicate with the phone under edl mode. It simply refused to connect.
I have managed to recover it by attempting the recover method described above after disabling "Driver Signature Verification".
To disable it under windows 10, the easiest way I have found is to restart with driver signature verification turned off.

To do so: Configuration > Updates and Security > Recover > Reset now
Once the blue menu appears: Solve problems > Advanced options > Configure start > Reset
Then you will be prompted to select an option. It is probably to "F7" to disable signature verification.


Big thanks to @k23m for helping me recover the phone.