[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

[fairsimple]

Hi Everyone. By opening this thread, I hope I can 1) log my work, 2) get input from the wonderful people here, 3) benefit others who has the same type of brick. I have been reading/following/searching stuffs here for a while, and this is my first dirty-work-to-do. Please help me as much as you can. Thank you all!

How I bricked my Telus HTC Desire HD:

1. Phone has stock Android 2.3 and one day it keeps rebooting
2. Unlock bootloader by HTCDev
3. Didn't turn S-OFF
4. Flash _TOUCHRECOVERY__CWM_5.8.0.0_Touch_Recovery_for_DesireHD successfully
5. Flash cm-11-20131203-UNOFFICIAL-ace.zip successfully (after one failure) but phone is in boot loop
6. Unzip boot.img from the CM11 zip and 'fastboot flash boot boot.img' (as in [1]). The command didn't return anything, and I disconnect the cable after about 1m

Now the phone bricks, it doesn't boot to fastboot/hboot, charging LED never on. Connecting to PC shows a QHSUSB_DLOAD device.

The first thing I'd like to know is the root cause of my brick. Is it because the phone has S-ON, or because I disconnected the USB cable before getting the fastboot fully done. As [2] (which is for One X), the S-ON may not be an issue, then why the fastboot command didn't return anything?

What I got to work so far:

1. Install driver to my PC (QHSUSB_Drivers_(x64).zip from [4], thanks JSLEnterprises)
2. Enable the driver as test driver since it doesn't have signature (as [6])
3. Install QPST (QPST_2.7_378.zip, from [5], thanks darkspr1te)
4. QPST connects to phone and lists as type 'Q/QCP-XXX' which is in '*Download*' mode

As there is an 'HTC Unbricking Project' which doesn't have DHD in its supported phones list [3], I see the hope to unbrick my DHD without JTAG. I am not expecting to have a one-click solution like the unbrick project, and I am open to do some coding if needed, but I think I should be able to restore my boot partition (or multiple partitions) with QPST. And here I need your help:

1. What cause the brick? S-ON of the phone, or failure of fastboot
2. Do you think I can unbrick it just with QPST
3. If someone has a working Desire HD and uses QPST to backup its partitions to files, will I have its IMEI/CID/etc after download those files to my phone
4. Do you think I can manully build the QPST QCN download file from a stock ROM/RUU

Thank you!

[1] http://forum.xda-developers.com/showthread.php?t=2533007 (HTC Desire HD > Desire HD Android Development > [ROM][UNOFFICIAL] CyanogenMod 11 Nightlies)
[2] http://forum.xda-developers.com/showthread.php?t=1603791 (HTC One X > One X Android Development > [WARNING] Flashing boot.img on S-ON devices)
[3] http://forum.xda-developers.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
[4] http://forum.xda-developers.com/showthread.php?t=1041153&page=2 ( HTC Desire HD > Desire HD Q&A, Help & Troubleshooting > [Q]HTC Desire HD QHSUSB_DLOAD driver[brick caused by rom manager sdcard repartition])
[5] http://forum.xda-developers.com/showpost.php?p=33545892 (AT&T Samsung Galaxy Note I717 > AT&T Galaxy Note I717 General > [SOLVED]-[BRICKED]SHV-E160L Korean model)
How to calculate partition info in post #13, 15, 16 thanks darkspr1te
[6] http://windows7themes.net/windows-requires-a-digitally-signed-driver-windows-7.html
[7] http://forum.xda-developers.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)
[8] http://forum.xda-developers.com/showthread.php?t=905003
(HTC Desire HD > Desire HD Android Development > [GUIDE] How to downgrade 1.7x/1.8x/2.x to 1.32.405.6, with download of stock PD98IMG.ZIP)
[9] 7x30 HEX and MBN files in post#39 and partition.mbn and HxD HEX editor in post #48 (thanks mickeyasamoah)
[10] Qualcomm docs in post #87 and post #88 on page 9 (thanks darkspr1te)
[11] QFIT (flash image creation tool) in post #90 (thank darkspr1te)
[12] fixdhd.pl v20140228 in post #98 (based on qdloader.pl thanks JCSullins(Rootz Wiki)) v20140410 in post #161 on page 17
[13] MBN files from HP Pre 3 device in post #126 (thanks mickeyasamoah)
[14] Qualcomm development doc in Chinese and English. Need download file from https://support.cdmatech.com/login/, https://silver.arm.com/browse or https://developer.qualcomm.com/.
[15] Related post: Request for DHD backup and Qualcomm docs
[16] (thanks Gussta) Qualcomm processors and Snapdragon SoCs (post #139 on page 14), and Dual boot DHD with SD

 

[Conrail16]

To answer #1: I'm thinking it's the recovery. Jelly Bean and above roms usually require CWM 6.x (or the equivalent 4EXT or TWRP versions).

 

[fairsimple]

To answer #1: I'm thinking it's the recovery. Jelly Bean and above roms usually require CWM 6.x (or the equivalent 4EXT or TWRP versions).

This may be the cause of boot loop with CM11, but I don't understand why I can't reboot to the bootloader. Thanks.

 

[droid_ilari]

Have you tried to see if you have fastboot or adb connection? Have you tried pulling the battery for a minute and then doing pwr + volume (-)? Afaik, what you have done could not have damaged your Hboot doing what you did. With it responding as if it is in download mode it sounds as though it is in oem RUU mode. If so, you should be able to flash the PD98 zip of the same version of android/sense you were on by using fastboot flash zip Name-of-your.zip. With S-on it has to be the same version or higher. You can extract the PD98IMG.zip from the latest RUU for your device.

 

[fairsimple]

Have you tried to see if you have fastboot or adb connection? Have you tried pulling the battery for a minute and then doing pwr + volume (-)? Afaik, what you have done could not have damaged your Hboot doing what you did. With it responding as if it is in download mode it sounds as though it is in oem RUU mode. If so, you should be able to flash the PD98 zip of the same version of android/sense you were on by using fastboot flash zip Name-of-your.zip. With S-on it has to be the same version or higher. You can extract the PD98IMG.zip from the latest RUU for your device.

I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.

 

[droid_ilari]

Download mode

I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.

I may be mistaken but, I believe that download mode is mode the phone goes into when running an RUU. If that is the case then it uses a different set of fastboot commands. I am not that tech savy but, if you are in the mode I believe you are then you would need to:
1) Put the PD98IMG.zip file in the folder where your adb/fastboot stuff is.
2) Plug your DHD into your computer
3) Issue exactly this command minus the quotes "fastboot flash zip PD98IMG.zip

If I am right, the htc logo will appear on the black screen and it will flash the stock rom, Hboot and all. I hope this helps you.

 

[fairsimple]

... then it uses a different set of fastboot commands. ...

As my understanding, QPST/QHSUSB_DLOAD may use a QUALCOMM DMSS protocol. Do you know what portocol fastboot or ADB use?

...3) Issue exactly this command minus the quotes "fastboot flash zip PD98IMG.zip ...

I will try this. Thanks.

 

[droid_ilari]

fastboot protocol

no, fairsimple, that is higher than my knowledge level, sorry.
I connected my inspire to the pc and ran fastboot oem rebootRUU to double check what I was telling you. In the device manager, it still shows as an android phone. So, it appears I have been no help at all, sorry.

 

[fairsimple]

no, fairsimple, that is higher than my knowledge level, sorry.
I connected my inspire to the pc and ran fastboot oem rebootRUU to double check what I was telling you. In the device manager, it still shows as an android phone. So, it appears I have been no help at all, sorry.

Thanks for your help anyway I add a new link in the top post which I found today. I think I will spend some time to do my homework with it.

[7] http://forum.xda-developers.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)

 

[droid_ilari]

I did read in one of your links that the problem you experienced is supposedly a confirmed bug in CWM recovery. The person posting said it was confirmed by koush him/herself. It apparently messes up your internal partitions so you were probably doomed as soon as you flashed CyanogenMod. At least that may explain why you got bricked. The fastboot flashing of the boot.img is a common method of flashing custom roms on dev unlocked HTC's with S-On. That is the way it is on the One X and the Vivid. So, at least now you know why your phone is bricked. Sorry I wasn't more help in fixing it.
Edit: I wanted to clarify so there is no confusion. This was actually a bug with older versions of ROM manager that have been fixed.

 

[fairsimple]

I did read in one of your links that the problem you experienced is supposedly a confirmed bug in CWM recovery. The person posting said it was confirmed by koush him/herself. It apparently messes up your internal partitions so you were probably doomed as soon as you flashed CyanogenMod. At least that may explain why you got bricked. The fastboot flashing of the boot.img is a common method of flashing custom roms on dev unlocked HTC's with S-On. That is the way it is on the One X and the Vivid. So, at least now you know why your phone is bricked. Sorry I wasn't more help in fixing it.

I didn't find the post but as I remember, the CWM bug is when you use it to format or partition external SD, and it was in CWM v3.xx or something. Thanks.

 

[droid_ilari]

Yeah, reread the post, it is when formatting SD card.

Sent from my Nexus 5 using xda app-developers app

 

[fairsimple]

I did pull the battery (and charge it with an external charger) overnight but I still can't boot and go to bootloader. I also did try fastboot which can't talk to the phone. I didn't try the PD93IMG.zip update since I can't go to HBOOT (as my understanding, this is a HBOOT function to find and use that file). I will try use ADB to talk to the phone this weekend. Thanks.

Update: disconnect the battery for two days, then reboot with USB connected. Nothing changed, and none of the following command worked:

adb shell
fastboot devices
fastboot reboot

This confirms my understanding: adb works when phone is in developer mode, and fastboot works with bootloader/fastboot.

 

[fairsimple]

As my understanding, QPST/QHSUSB_DLOAD may use a QUALCOMM DMSS protocol...

Now I confirm that the phone is using DMSS protocol since I can get version info with command 0C.

Device opened
MSG trx[5]: 7E 0C 14 3A 7E 
Device wrote 5/5 bytes
MSG rcv[24]: 7E 0D 14 50 42 4C 5F 44 6F 77 6E 6C 6F 61 64 65 72 56 45 52 31 2E 30 7E 
Close device 0
Version [PBL_DownloaderVER1.0]

[3] http://forum.xda-developers.com/showthread.php?t=1522351 ( HTC Sensation > Sensation Android Development > [UNBRICK] HTC Unbricking Project)
[7] http://forum.xda-developers.com/showthread.php?t=2086142 (Hardware Hacking > Hardware Hacking General > [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features)

 

[NikolayIII]

Hi. My phone dead. Model - Desire HD. PC define his QHSUSB_DLOAD. Can you help me restore Phone?
Do you restore phone?
Sorry for my English. I am vary bad speak English.

 

[fairsimple]

Hi. My phone dead. Model - Desire HD. PC define his QHSUSB_DLOAD. Can you help me restore Phone?
Do you restore phone?
Sorry for my English. I am vary bad speak English.

How did you brick it?

 

[NikolayIII]

How did you brick it?

I don't know. This is HDH my nephew. He installed games. Battery is discharged and phone is dead. So he said. He just has not updated HDH.

I noticed the phone is determined by ODIN. Possible through ODIN to flash bootloader?

 

[fairsimple]

I don't know. This is HDH my nephew. He installed games. Battery is discharged and phone is dead. So he said. He just has not updated HDH.

I noticed the phone is determined by ODIN. Possible through ODIN to flash bootloader?

As my understanding, ODIN is for Samsung phone and not work with HTC devices. Does the screen on, or charging light on when you plugin the USB cable or charger, and press the power on button.

 

[fairsimple]

More info (thanks qdload.pl):

 ./qd.pl --check
Requesting SoftwareVersion...
SENDING: 7e 0c 14 3a 7e
RECEIVED: 0d 14 50 42 4c 5f 44 6f 77 6e 6c 6f 61 64 65 72 56 45 52 31 2e 30
Version: PBL_DownloaderVER1
Requesting Params...
SENDING: 7e 07 c7 84 7e
RECEIVED: 08 06 01 01 00 90 00 00 14 70
Params: 06 01 01 00 90 00 00
Unlocking...
SENDING: 7e 0b 00 00 00 00 00 00 00 00 2a 18 7e
RECEIVED: 03 00 06 9e 4c
Invalid Response: 03 00 06
Dumping chunk...
SENDING: 7e 09 2a 00 00 00 00 80 2f e5 7e
RECEIVED: 03 00 06 9e 4c
Response: 03 00 06
Requesting Reboot...
SENDING: 7e 0a 22 5f 7e
requestReboot send ok
RECEIVED: 02 6a d3
Param: 02

Parameter response has flash size as zero. Don't know if this indicates an EMMC failure.

 

[NikolayIII]

As my understanding, ODIN is for Samsung phone and not work with HTC devices. Does the screen on, or charging light on when you plugin the USB cable or charger, and press the power on button.

No. Phone is not charging. Screen does not turn. Pressing the button on the PC sees HDH - QHSUSB_DLOAD.