• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Question MSM and EDL , UI Recovery flash

Search This thread

StratOS_HTC

Senior Member
Sep 25, 2007
590
360
Celje
Realme 8 Pro
Guess you must be using special version of QC Qfil to flash the device or typical MSM.

In EDL mode I was in current SaharaMode been able to get infos from the firehose :

sahara-mode-chg-png.5451261


We have SN, MSM HWID and two OEM Hash

Don't forget that OEM SecondBootLoader have it's version also.

From normal QFil :

Code:
16:45:48: INFO: Sending <configure>
16:45:48: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50'
16:45:48: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50
'
16:45:48: INFO: TARGET SAID: 'INFO: Chip serial num: Not shown (0xNot Shown)'
16:45:48: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
16:45:48: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'

Code:
16:45:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 49152
16:45:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
16:45:48: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information
 

Attachments

  • Sahara Mode-chg.png
    Sahara Mode-chg.png
    12.7 KB · Views: 406

StratOS_HTC

Senior Member
Sep 25, 2007
590
360
Celje
Realme 8 Pro
Ok. Here is the deal new start from the MSM :

It creates files in C:\temp\MsmDownloadTool\
(Further analysis : https://www.joesandbox.com/analysis/372003/0/pdf)

What is interesting is autoedl.exe (It's an agent to send the phone with connected adb to EDL).
Secondary secrecy auto unlocker (SecrecyAutoUnlocker.exe 1.1) Don't know why this is integrated here (OK, for OPPO like https://www.allaboutflashing.com/oppo-a3s-network-unlock/ ), but guess no command lines are available ... (Guess). But will come back if needed that ...

DramScreenTool.exe is interesting ... No feedback ....

Available ERROR strings :

ERROR(Please enter for example. DramScreenTool.exe DRAM/EMMC/UFS CID1 CID2 ... )
DRAM.ERROR(CID size)
FAIL.EMMC.UFS.PASS
Mingw runtime failure
VirtualQuery failed for %d bytes at address %p
Unknown pseudo relocation protocol version %d
Unknown pseudo relocation bit size %d
glob-1.0-mingw32

So this is guess the utility to set the writting position for DRAM or EMMMC or UFS, need CID 1 and or CID 2

CID 1 or DID 2 could be - noticable like handshake in Sahara mode when using correct programmer :
Also HWID for QLM MSM is also noticable !

sahara-mode-png.5449575


For now the SaharaMode is still not documented enought to post quick answers :

Some of the logs with implemented QFIL :

Code:
17:40:40: DEBUG: The command completed successfully.
17:40:40: DEBUG:
17:40:40: DEBUG: User set MaxPayloadSizeToTargetInBytes to 49152
17:40:40: DEBUG: User wants FIREHOSE VERBOSE - Target will log much of what it is doing
17:40:40: DEBUG: User set ZLPAWAREHOST to 1
17:40:40: DEBUG: User wants verify_programming
17:40:40: INFO: User wants to talk to port '\\.\COM3'
17:40:40: DEBUG: port_fd=0xC4
17:40:40: INFO: Took       0.00000000 seconds to open port
17:40:40: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
17:40:40: INFO: Sending <configure>
17:40:40: DEBUG: CHANNEL DATA (P0000) (H00202) (    225 bytes) - HOST TO TARGET -->
===========================================================================================================
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<configure MemoryName="ufs" Verbose="1" AlwaysValidate="0" MaxDigestTableSizeInBytes="8192" MaxPayloadSizeToTargetInBytes="49152" ZlpAwareHost="1" SkipStorageInit="0" />
</data>
============================================================================================================
17:40:40: DEBUG: CharsInBuffer=0 Trying to read from USB 8192 bytes
17:40:40: DEBUG: CHANNEL DATA (775 bytes) <-- TARGET to HOST
17:40:40: DEBUG: CharsInBuffer = 775
17:40:40: DEBUG: printBuffer:6017 PRETTYPRINT Buffer is 775 bytes

17:40:40: DEBUG: printBuffer:6094 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 <?xml version="1
17:40:40: DEBUG: printBuffer:6094 2E 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 .0" encoding="UT
17:40:40: DEBUG: printBuffer:6094 46 2D 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C F-8" ?>.<data>.<
17:40:40: DEBUG: printBuffer:6094 6C 6F 67 20 76 61 6C 75 65 3D 22 49 4E 46 4F 3A log value="INFO:
17:40:40: DEBUG: printBuffer:6094 20 42 69 6E 61 72 79 20 62 75 69 6C 64 20 64 61  Binary build da
17:40:40: DEBUG: printBuffer:6094 74 65 3A 20 44 65 63 20 31 39 20 32 30 31 39 20 te: Dec 19 2019
17:40:40: DEBUG: printBuffer:6094 40 20 32 30 3A 35 33 3A 35 30 22 20 2F 3E 3C 2F @ 20:53:50" /></
17:40:40: DEBUG: printBuffer:6094 64 61 74 61 3E 3C 3F 78 6D 6C 20 76 65 72 73 69 data><?xml versi
17:40:40: DEBUG: printBuffer:6094 6F 6E 3D 22 31 2E 30 22 20 65 6E 63 6F 64 69 6E on="1.0" encodin
17:40:40: DEBUG: printBuffer:6094 67 3D 22 55 54 46 2D 38 22 20 3F 3E 0A 3C 64 61 g="UTF-8" ?>.<da
17:40:40: DEBUG: printBuffer:6094 74 61 3E 0A 3C 6C 6F 67 20 76 61 6C 75 65 3D 22 ta>.<log value="
17:40:40: DEBUG: printBuffer:6094 49 4E 46 4F 3A 20 42 69 6E 61 72 79 20 62 75 69 INFO: Binary bui
17:40:40: DEBUG: printBuffer:6094 6C 64 20 64 61 74 65 3A 20 44 65 63 20 31 39 20 ld date: Dec 19
17:40:40: DEBUG: printBuffer:6094 32 30 31 39 20 40 20 32 30 3A 35 33 3A 35 30 0A 2019 @ 20:53:50.
17:40:40: DEBUG: printBuffer:6094 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 6D 6C " /></data><?xml
17:40:40: DEBUG: printBuffer:6094 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 65  version="1.0" e
17:40:40: DEBUG: printBuffer:6094 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38 22 20 ncoding="UTF-8"
17:40:40: DEBUG: printBuffer:6094 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 20 76 ?>.<data>.<log v
17:40:40: DEBUG: printBuffer:6094 61 6C 75 65 3D 22 49 4E 46 4F 3A 20 43 68 69 70 alue="INFO: Chip
17:40:40: DEBUG: printBuffer:6094 20 73 65 72 69 61 6C 20 6E 75 6D 3A 20 39 38 31  serial num: 000
17:40:40: DEBUG: printBuffer:6094 38 38 32 32 35 37 20 28 30 78 33 61 38 36 35 35 882000 (0x3xxxxx
17:40:40: DEBUG: printBuffer:6094 39 31 29 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 91)" /></data><?
17:40:40: DEBUG: printBuffer:6094 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 xml version="1.0
17:40:40: DEBUG: printBuffer:6094 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D " encoding="UTF-
17:40:40: DEBUG: printBuffer:6094 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 8" ?>.<data>.<lo
17:40:40: DEBUG: printBuffer:6094 67 20 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 g value="ERROR:
17:40:40: DEBUG: printBuffer:6094 56 65 72 69 66 79 69 6E 67 20 73 69 67 6E 61 74 Verifying signat
17:40:40: DEBUG: printBuffer:6094 75 72 65 20 66 61 69 6C 65 64 20 77 69 74 68 20 ure failed with
17:40:40: DEBUG: printBuffer:6094 33 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 6D 3" /></data><?xm
17:40:40: DEBUG: printBuffer:6094 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 l version="1.0"
17:40:40: DEBUG: printBuffer:6094 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38 22 encoding="UTF-8"
17:40:40: DEBUG: printBuffer:6094 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 20  ?>.<data>.<log
17:40:40: DEBUG: printBuffer:6094 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 41 75 value="ERROR: Au
17:40:40: DEBUG: printBuffer:6094 74 68 65 6E 74 69 63 61 74 69 6F 6E 20 6F 66 20 thentication of
17:40:40: DEBUG: printBuffer:6094 73 69 67 6E 65 64 20 68 61 73 68 20 66 61 69 6C signed hash fail
17:40:40: DEBUG: printBuffer:6094 65 64 20 30 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C ed 0" /></data><
17:40:40: DEBUG: printBuffer:6094 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E ?xml version="1.
17:40:40: DEBUG: printBuffer:6094 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 0" encoding="UTF
17:40:40: DEBUG: printBuffer:6094 2D 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 72 -8" ?>.<data>.<r
17:40:40: DEBUG: printBuffer:6094 65 73 70 6F 6E 73 65 20 76 61 6C 75 65 3D 22 4E esponse value="N
17:40:40: DEBUG: printBuffer:6094 41 4B 22 20 72 61 77 6D 6F 64 65 3D 22 66 61 6C AK" rawmode="fal
17:40:40: DEBUG: printBuffer:6094 73 65 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 se" /></data><?x
17:40:40: DEBUG: printBuffer:6094 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 ml version="1.0"
17:40:40: DEBUG: printBuffer:6094 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38  encoding="UTF-8
17:40:40: DEBUG: printBuffer:6094 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 " ?>.<data>.<log
17:40:40: DEBUG: printBuffer:6094 20 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 46  value="ERROR: F
17:40:40: DEBUG: printBuffer:6094 61 69 6C 65 64 20 74 6F 20 72 65 61 64 20 58 4D ailed to read XM
17:40:40: DEBUG: printBuffer:6094 4C 20 63 6F 6D 6D 61 6E 64 20 2D 31 22 20 2F 3E L command -1" />
17:40:40: DEBUG: printBuffer:6094 3C 2F 64 61 74 61 3E                            </data>
17:40:40: DEBUG: printBuffer:6107


17:40:40: DEBUG: XML FILE (117 bytes): CharsInBuffer=775-117=658
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50'
17:40:40: DEBUG: XML FILE (118 bytes): CharsInBuffer=658-118=540
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50
" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50
17:40:40: DEBUG: XML FILE (115 bytes): CharsInBuffer=540-115=425
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Chip serial num: 9xxxxxx (0xxxxxxxx)" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: TARGET SAID: 'INFO: Chip serial num: 9srgrg7 (0xrhrhrh)'
17:40:40: DEBUG: XML FILE (110 bytes): CharsInBuffer=425-110=315
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
17:40:40: DEBUG: XML FILE (115 bytes): CharsInBuffer=315-115=200
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
17:40:40: DEBUG: XML FILE (94 bytes): CharsInBuffer=200-94=106
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" /></data>
-------------------------------------------------------------------------------------------
17:40:40: INFO: IGNORING UNRECOGNIZED Attribute 'rawmode' with value 'false'
17:40:40: DEBUG: Response was 'NAK'
17:40:40: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 49152
17:40:40: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
17:40:40: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information

For now reading the Chinese pdf also in MSM temp : MSMDownloadToolSpecificationCHS.pdf
Because have seen the Qualcomm HS-USB Diagnostics 9006 driver and this could be the key for the correct Sahara/Firehose implementation and handshake protocol.


Qualcomm download device (Qualcomm HS-USB QDLoader 9008,
Qualcomm HS-USB Diagnostics 9006) corresponding serial port numbers are increasing
Open the hidden device in the device manager as follows:
① Create a new environment variable, the name is devmgr_show_nonpresent_devices, the value is 1, and then open the device manager;
② Device Manager—View—Display hidden devices;
③ Manually delete one by one or use USBDeview.exe to delete selected device drivers in batches.


Till then ...
 
Last edited:

StratOS_HTC

Senior Member
Sep 25, 2007
590
360
Celje
Realme 8 Pro
For now the only thing to bother is usage of the MSM (pure official) as only flashable program without any dongle.
As seen on the test executables the problem is in the executable program in MSM the DRAM_Screen_Tool_v2.0 or emmcdl.
The second thing is flash boot programmer end provisioning options.
Also the Sahara Download mode.

Been able to do some magic with emmcdl, but cannot get the correct loader and Sahara mode Configuration from phone like SN but vere unable to get HASHES and HWID's.

But after the boot of the flash programmer the device goes into non recognisable mode.

For now the problems are with ERRORS :

Verifying signature failed with 3 and Authentication of signed hash failed 0.

With Qfil and QsaharaServer I'm out of possibilities, when It would be able to prepare the stuff with one all other could be possible.

Some feedback to share :

Code:
emmcdl -p COM4 -f prog_firehose_ddr.elf -info
Version 2.15
Downloading flash programmer: prog_firehose_ddr.elf
Successfully open flash programmer to write: prog_firehose_ddr.elf
Waiting for flash programmer to boot
Failed to write hello response back to device
Did not receive Sahara hello packet from device
Status: 6 The handle is invalid.

Code:
emmcdl -p COM4 -SkipWrite -SkipStorageInit -f prog_firehose_ddr.elf -x memory_configure.xml
Version 2.15
Downloading flash programmer: prog_firehose_ddr.elf
Successfully open flash programmer to write: prog_firehose_ddr.elf
Waiting for flash programmer to boot
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50" /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50
" /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Chip serial num: not shown (0xnot shown)" /></data>
Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="1" SkipWrite="1" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" /></data>

---Target returned NAK---

<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to read XML command -1" /></data>
ERROR: No response to configure packet

Status: 21 The device is not ready.

So the configuration is needed and preservation of QSahara mode for the successfull flash/diagnostics.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Ok. Here is the deal new start from the MSM :

    It creates files in C:\temp\MsmDownloadTool\
    (Further analysis : https://www.joesandbox.com/analysis/372003/0/pdf)

    What is interesting is autoedl.exe (It's an agent to send the phone with connected adb to EDL).
    Secondary secrecy auto unlocker (SecrecyAutoUnlocker.exe 1.1) Don't know why this is integrated here (OK, for OPPO like https://www.allaboutflashing.com/oppo-a3s-network-unlock/ ), but guess no command lines are available ... (Guess). But will come back if needed that ...

    DramScreenTool.exe is interesting ... No feedback ....

    Available ERROR strings :

    ERROR(Please enter for example. DramScreenTool.exe DRAM/EMMC/UFS CID1 CID2 ... )
    DRAM.ERROR(CID size)
    FAIL.EMMC.UFS.PASS
    Mingw runtime failure
    VirtualQuery failed for %d bytes at address %p
    Unknown pseudo relocation protocol version %d
    Unknown pseudo relocation bit size %d
    glob-1.0-mingw32

    So this is guess the utility to set the writting position for DRAM or EMMMC or UFS, need CID 1 and or CID 2

    CID 1 or DID 2 could be - noticable like handshake in Sahara mode when using correct programmer :
    Also HWID for QLM MSM is also noticable !

    sahara-mode-png.5449575


    For now the SaharaMode is still not documented enought to post quick answers :

    Some of the logs with implemented QFIL :

    Code:
    17:40:40: DEBUG: The command completed successfully.
    17:40:40: DEBUG:
    17:40:40: DEBUG: User set MaxPayloadSizeToTargetInBytes to 49152
    17:40:40: DEBUG: User wants FIREHOSE VERBOSE - Target will log much of what it is doing
    17:40:40: DEBUG: User set ZLPAWAREHOST to 1
    17:40:40: DEBUG: User wants verify_programming
    17:40:40: INFO: User wants to talk to port '\\.\COM3'
    17:40:40: DEBUG: port_fd=0xC4
    17:40:40: INFO: Took       0.00000000 seconds to open port
    17:40:40: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
    17:40:40: INFO: Sending <configure>
    17:40:40: DEBUG: CHANNEL DATA (P0000) (H00202) (    225 bytes) - HOST TO TARGET -->
    ===========================================================================================================
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <configure MemoryName="ufs" Verbose="1" AlwaysValidate="0" MaxDigestTableSizeInBytes="8192" MaxPayloadSizeToTargetInBytes="49152" ZlpAwareHost="1" SkipStorageInit="0" />
    </data>
    ============================================================================================================
    17:40:40: DEBUG: CharsInBuffer=0 Trying to read from USB 8192 bytes
    17:40:40: DEBUG: CHANNEL DATA (775 bytes) <-- TARGET to HOST
    17:40:40: DEBUG: CharsInBuffer = 775
    17:40:40: DEBUG: printBuffer:6017 PRETTYPRINT Buffer is 775 bytes
    
    17:40:40: DEBUG: printBuffer:6094 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 <?xml version="1
    17:40:40: DEBUG: printBuffer:6094 2E 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 .0" encoding="UT
    17:40:40: DEBUG: printBuffer:6094 46 2D 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C F-8" ?>.<data>.<
    17:40:40: DEBUG: printBuffer:6094 6C 6F 67 20 76 61 6C 75 65 3D 22 49 4E 46 4F 3A log value="INFO:
    17:40:40: DEBUG: printBuffer:6094 20 42 69 6E 61 72 79 20 62 75 69 6C 64 20 64 61  Binary build da
    17:40:40: DEBUG: printBuffer:6094 74 65 3A 20 44 65 63 20 31 39 20 32 30 31 39 20 te: Dec 19 2019
    17:40:40: DEBUG: printBuffer:6094 40 20 32 30 3A 35 33 3A 35 30 22 20 2F 3E 3C 2F @ 20:53:50" /></
    17:40:40: DEBUG: printBuffer:6094 64 61 74 61 3E 3C 3F 78 6D 6C 20 76 65 72 73 69 data><?xml versi
    17:40:40: DEBUG: printBuffer:6094 6F 6E 3D 22 31 2E 30 22 20 65 6E 63 6F 64 69 6E on="1.0" encodin
    17:40:40: DEBUG: printBuffer:6094 67 3D 22 55 54 46 2D 38 22 20 3F 3E 0A 3C 64 61 g="UTF-8" ?>.<da
    17:40:40: DEBUG: printBuffer:6094 74 61 3E 0A 3C 6C 6F 67 20 76 61 6C 75 65 3D 22 ta>.<log value="
    17:40:40: DEBUG: printBuffer:6094 49 4E 46 4F 3A 20 42 69 6E 61 72 79 20 62 75 69 INFO: Binary bui
    17:40:40: DEBUG: printBuffer:6094 6C 64 20 64 61 74 65 3A 20 44 65 63 20 31 39 20 ld date: Dec 19
    17:40:40: DEBUG: printBuffer:6094 32 30 31 39 20 40 20 32 30 3A 35 33 3A 35 30 0A 2019 @ 20:53:50.
    17:40:40: DEBUG: printBuffer:6094 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 6D 6C " /></data><?xml
    17:40:40: DEBUG: printBuffer:6094 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 65  version="1.0" e
    17:40:40: DEBUG: printBuffer:6094 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38 22 20 ncoding="UTF-8"
    17:40:40: DEBUG: printBuffer:6094 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 20 76 ?>.<data>.<log v
    17:40:40: DEBUG: printBuffer:6094 61 6C 75 65 3D 22 49 4E 46 4F 3A 20 43 68 69 70 alue="INFO: Chip
    17:40:40: DEBUG: printBuffer:6094 20 73 65 72 69 61 6C 20 6E 75 6D 3A 20 39 38 31  serial num: 000
    17:40:40: DEBUG: printBuffer:6094 38 38 32 32 35 37 20 28 30 78 33 61 38 36 35 35 882000 (0x3xxxxx
    17:40:40: DEBUG: printBuffer:6094 39 31 29 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 91)" /></data><?
    17:40:40: DEBUG: printBuffer:6094 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 xml version="1.0
    17:40:40: DEBUG: printBuffer:6094 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D " encoding="UTF-
    17:40:40: DEBUG: printBuffer:6094 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 8" ?>.<data>.<lo
    17:40:40: DEBUG: printBuffer:6094 67 20 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 g value="ERROR:
    17:40:40: DEBUG: printBuffer:6094 56 65 72 69 66 79 69 6E 67 20 73 69 67 6E 61 74 Verifying signat
    17:40:40: DEBUG: printBuffer:6094 75 72 65 20 66 61 69 6C 65 64 20 77 69 74 68 20 ure failed with
    17:40:40: DEBUG: printBuffer:6094 33 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 6D 3" /></data><?xm
    17:40:40: DEBUG: printBuffer:6094 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 l version="1.0"
    17:40:40: DEBUG: printBuffer:6094 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38 22 encoding="UTF-8"
    17:40:40: DEBUG: printBuffer:6094 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 20  ?>.<data>.<log
    17:40:40: DEBUG: printBuffer:6094 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 41 75 value="ERROR: Au
    17:40:40: DEBUG: printBuffer:6094 74 68 65 6E 74 69 63 61 74 69 6F 6E 20 6F 66 20 thentication of
    17:40:40: DEBUG: printBuffer:6094 73 69 67 6E 65 64 20 68 61 73 68 20 66 61 69 6C signed hash fail
    17:40:40: DEBUG: printBuffer:6094 65 64 20 30 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C ed 0" /></data><
    17:40:40: DEBUG: printBuffer:6094 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E ?xml version="1.
    17:40:40: DEBUG: printBuffer:6094 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 0" encoding="UTF
    17:40:40: DEBUG: printBuffer:6094 2D 38 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 72 -8" ?>.<data>.<r
    17:40:40: DEBUG: printBuffer:6094 65 73 70 6F 6E 73 65 20 76 61 6C 75 65 3D 22 4E esponse value="N
    17:40:40: DEBUG: printBuffer:6094 41 4B 22 20 72 61 77 6D 6F 64 65 3D 22 66 61 6C AK" rawmode="fal
    17:40:40: DEBUG: printBuffer:6094 73 65 22 20 2F 3E 3C 2F 64 61 74 61 3E 3C 3F 78 se" /></data><?x
    17:40:40: DEBUG: printBuffer:6094 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 ml version="1.0"
    17:40:40: DEBUG: printBuffer:6094 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 2D 38  encoding="UTF-8
    17:40:40: DEBUG: printBuffer:6094 22 20 3F 3E 0A 3C 64 61 74 61 3E 0A 3C 6C 6F 67 " ?>.<data>.<log
    17:40:40: DEBUG: printBuffer:6094 20 76 61 6C 75 65 3D 22 45 52 52 4F 52 3A 20 46  value="ERROR: F
    17:40:40: DEBUG: printBuffer:6094 61 69 6C 65 64 20 74 6F 20 72 65 61 64 20 58 4D ailed to read XM
    17:40:40: DEBUG: printBuffer:6094 4C 20 63 6F 6D 6D 61 6E 64 20 2D 31 22 20 2F 3E L command -1" />
    17:40:40: DEBUG: printBuffer:6094 3C 2F 64 61 74 61 3E                            </data>
    17:40:40: DEBUG: printBuffer:6107
    
    
    17:40:40: DEBUG: XML FILE (117 bytes): CharsInBuffer=775-117=658
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50" /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50'
    17:40:40: DEBUG: XML FILE (118 bytes): CharsInBuffer=658-118=540
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50
    " /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50
    17:40:40: DEBUG: XML FILE (115 bytes): CharsInBuffer=540-115=425
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <log value="INFO: Chip serial num: 9xxxxxx (0xxxxxxxx)" /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: TARGET SAID: 'INFO: Chip serial num: 9srgrg7 (0xrhrhrh)'
    17:40:40: DEBUG: XML FILE (110 bytes): CharsInBuffer=425-110=315
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <log value="ERROR: Verifying signature failed with 3" /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
    17:40:40: DEBUG: XML FILE (115 bytes): CharsInBuffer=315-115=200
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <log value="ERROR: Authentication of signed hash failed 0" /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
    17:40:40: DEBUG: XML FILE (94 bytes): CharsInBuffer=200-94=106
    -------------------------------------------------------------------------------------------
    <?xml version="1.0" encoding="UTF-8" ?>
    <data>
    <response value="NAK" rawmode="false" /></data>
    -------------------------------------------------------------------------------------------
    17:40:40: INFO: IGNORING UNRECOGNIZED Attribute 'rawmode' with value 'false'
    17:40:40: DEBUG: Response was 'NAK'
    17:40:40: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 49152
    17:40:40: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
    17:40:40: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information

    For now reading the Chinese pdf also in MSM temp : MSMDownloadToolSpecificationCHS.pdf
    Because have seen the Qualcomm HS-USB Diagnostics 9006 driver and this could be the key for the correct Sahara/Firehose implementation and handshake protocol.


    Qualcomm download device (Qualcomm HS-USB QDLoader 9008,
    Qualcomm HS-USB Diagnostics 9006) corresponding serial port numbers are increasing
    Open the hidden device in the device manager as follows:
    ① Create a new environment variable, the name is devmgr_show_nonpresent_devices, the value is 1, and then open the device manager;
    ② Device Manager—View—Display hidden devices;
    ③ Manually delete one by one or use USBDeview.exe to delete selected device drivers in batches.


    Till then ...