[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

[fairsimple]

UPDATE:
I downloaded some xxxx.HEX files and tried flashing them. Only two of them flashed.
After flashing the first one, windows detected the phone as Fastboot XT626 NS
Picture 1

Second one was detected as USB STORAGE but it was also showing as an Unknown device under the mass storage devices
Picture 2

1. Can you confirm you used the emmcswdownload (from QPST) to flash the HEX file.
2. Did you use any MBN file, if yes, which
3. Which HEX/MBN combination resulted in the fastboot xt626 mode
4. which hex/mbn combination resulted in the storage mode
5. if you take the battery out and re-install it then plugin your phone to the pc again, what is its current mode? QHSUSB_DLOAD, fastboot xt626 or storage?

 

[mickeyasamoah]

1. Can you confirm you used the emmcswdownload (from QPST) to flash the HEX file.
2. Did you use any MBN file, if yes, which
3. Which HEX/MBN combination resulted in the fastboot xt626 mode
4. which hex/mbn combination resulted in the storage mode
5. if you take the battery out and re-install it then plugin your phone to the pc again, what is its current mode? QHSUSB_DLOAD, fastboot xt626 or storage?

1. I used software download.
2.I used the 7x30_msimage.mbn
3. I Used the 7x30prg.hex for fastboot ....
4.The ARMPRG.HEX
5.Everything resets to QHSUSB_DLOAD when you take out the battery.

So how is it going with the qd.pl file?
Were u able to load the .HEX file with it?

 

[fairsimple]

So far I can load the MPRG7x30.bin (original file MPRG7x30.hex) to phone, but failed to load the MBN file after that.

Before loading hex file:

: new high speed USB device using ehci_hcd and address 2
: New USB device found, idVendor=05c6, idProduct=9008
: New USB device strings: Mfr=1, Product=2, SerialNumber=0
: Product: QHSUSB_DLOAD
: Manufacturer: Qualcomm CDMA Technologies MSM

After loading hex file:

: new high speed USB device using ehci_hcd and address 9
: New USB device found, idVendor=22b8, idProduct=2df1
: New USB device strings: Mfr=4, Product=3, SerialNumber=5
: Product: Fastboot XT626 NS
: Manufacturer: Motorola Inc.
: SerialNumber: 0000000000000000

So it becomes a Motorola device. 'fastboot devices' gives all zeros sn device. 'adb devices' gives nothing.

I will try other HEX file next. Thanks.

 

[fairsimple]

I got the following error after loading ARMPRG.hex:

$ perl ./fixdhd.pl --fixdhd
fixdhd.pl version 20140212.
This function is for HTC Desire HD which is in QDLoader mode only. 
!! You are running it on your own risk!!
Please plugin your DHD and press enter...
Qualcomm device is (05c6:9008/9025): Bus 001 Device 026: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

Please input lower case 'y' if you confirm to move forward.
Device found, load ARMPRG.bin? y
Opening ttyUSB port...
Loading ARMPRG.bin at 2147483648...
....................................................................................................................................................................................................................................................................................................Executing file...
..So far so good, load 7x30_msimage.mbn? y
Opening ttyUSB port...
Sending MAGIC...
..Good magic response from DHD
Sending secureMode...
SENDING: 7e 17 01 57 c6 7e
RECEIVED: 18 b1 6c
Sending openMulti ...
SENDING: 7e 1b 21 f5 4e 7e
RECEIVED: 0e 4e 6f 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 20 72 65 63 65 69 76 65 64 20 62 65 66 6f 72 65 20 6f 70 65 6e 20 6d 75 6c 74 69 0a f5 8f
MSG: No partition table received before open multi 
RECEIVED: 0d 0f 00 00 00 4e 6f 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 20 72 65 63 65 69 76 65 64 20 62 65 66 6f 72 65 20 6f 70 65 6e 20 6d 75 6c 74 69 a4 c3
ERROR: No partition table received before open multi
Invalid openMulti response.

In the protocol doc I have for now, there is no secureMode, openMulti, or Magic command, but the code runs well with both magic and secureMode, but fails at openMulti.

 

[fairsimple]

The phone will reply 'Write unsuccessful' (hex 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c) error if I skip the multiOpen.

If skip both securemode and multiopen:

Sending MAGIC...
..Good magic response from DHD
Loading 7x30_msimage.mbn ...
Writing 1024 bytes to 0x00000000; 1981480 bytes left.
SENDING: 7e 07 00 00 00 00 0a 00 00 ...
...
RECEIVED: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a 65 ac
Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a

If skip the multiopen only:

Sending MAGIC...
..Good magic response from DHD
Sending secureMode...
SENDING: 7e 17 01 57 c6 7e
RECEIVED: 18 b1 6c
Loading 7x30_msimage.mbn ...
Writing 1024 bytes to 0x00000000; 1981480 bytes left.
SENDING: 7e 07 00 00 00 00 0a 00...
...
RECEIVED: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a 65 ac
Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a

 

[fairsimple]

As my understanding, the MBN file for the first stage should have partition table in the beginning at offset 0x1fe, so the two bytes should be '55AA' (as the attached file from http://forum.xda-developers.com/showthread.php?t=2136738). None of our current MBN files has that so we need go ahead and find the right mbn file. Don't know if this is the reason you got the 'cookie error' with QPST.

 

[mickeyasamoah]

With QPST, after selecting Program Download, and selecting the Multi-Image Tab, i select Sec Boot 2.0, and select start, it loads and then ask for the partition table.mbn.
So i am thinking, We need partition.mbn file.
I think thats our only chance.

I am thinking if we put up a thread on the DHD forum for people to upload thier partition table through this procedure,We can ask the author of this thread so that he can create a partition.mbn for us.
What do you think??

 

[mickeyasamoah]

@fairsimple I have found these partition.mbn and a HEX editor which is used for editing such files.

I havent tried them yet.

 

[fairsimple]

@fairsimple I have found these partition.mbn and a HEX editor which is used for editing such files.

I havent tried them yet.

As my understanding, the first step should be loading the HEX file (which I think we found) and the MBN file (which I think we still miss). After that the phone will become SD device. The 2nd step is to load partition table and SBL1/2/3, TZ, RPM, etc.

Anyway, I will check those files to see if you can load. Thanks.

 

[tjnapster555]

my DHD problem is exactly as yoyrs

i install a app in stock ROM didn't root my device and it was installing then did installing for long
then i pulled the battery then on it show htc logo then off then never on
its not charging but when connect to PC show as QHSUSB_DLOAD)

 

[mickeyasamoah]

i install a app in stock ROM didn't root my device and it was installing then did installing for long
then i pulled the battery then on it show htc logo then off then never on
its not charging but when connect to PC show as QHSUSB_DLOAD)

You are welcome brother. We still working on a fix. You are welcome to help.

---------- Post added at 09:01 PM ---------- Previous post was at 08:49 PM ----------

As my understanding, the first step should be loading the HEX file (which I think we found) and the MBN file (which I think we still miss). After that the phone will become SD device. The 2nd step is to load partition table and SBL1/2/3, TZ, RPM, etc.

Anyway, I will check those files to see if you can load. Thanks.

I taught we the SD device part done, reason is because when i open software programmer (QPST),and select Multi-Image Tab, i select Sec Boot 2.0, and select advanced,it shows the files needed to get the device into hboot or bootloader mode. You can check it out if am wrong.

So as i was saying, when i click start after selecting Multi-Image tab and Sec Boot2.0, it loads the HEX file and then gets stuck at partition.
But after adding the partition file i uploaded, it now gets stuck on the file next to partition advance.

Maybe the SBL1/2/3,tz,RPM is for the samsung devices as i saw those files in the brixfix files.
Fromthe advanced option in Multi-Image tab, we need partition,fsbl,amss,osbl(which i think is the bootloader{or hboot}).

Or i could be wrong.

 

[fairsimple]

You are welcome brother. We still working on a fix. You are welcome to help.

Welcome on board @tjnapster555. If you have Linux experience, can you try to run the Perl script as post #19 and check if you get same result. http://forum.xda-developers.com/showpost.php?p=49675637&postcount=19

I taught we the SD device part done, reason is because when i open software programmer (QPST),and select Multi-Image Tab, i select Sec Boot 2.0, and select advanced,it shows the files needed to get the device into hboot or bootloader mode. You can check it out if am wrong.

So as i was saying, when i click start after selecting Multi-Image tab and Sec Boot2.0, it loads the HEX file and then gets stuck at partition.
But after adding the partition file i uploaded, it now gets stuck on the file next to partition advance.

Maybe the SBL1/2/3,tz,RPM is for the samsung devices as i saw those files in the brixfix files.
Fromthe advanced option in Multi-Image tab, we need partition,fsbl,amss,osbl(which i think is the bootloader{or hboot}).

Or i could be wrong.

FYI: as @darkspr1te post here (http://forum.xda-developers.com/showpost.php?p=33082185&postcount=29), the HEX and first step MBN files should be loaded by EMMCSWDOWNLOAD. However, I keep getting 'cookie error' with that (screen attached).

When I try the 'multi-image' tab as you did, I got error too.

I agree with you regarding that DHD has different partitions than samsung, and the osbl should be the bootloader/hboot, but I still don't think we have move the phone to SD mode. If the DHD is in SD mode, after you plugin the cable, the pc should have some new drives (like you plugin a usb drive or sd to the memory slot).

 

[mickeyasamoah]

Welcome on board @tjnapster555. If you have Linux experience, can you try to run the Perl script as post #19 and check if you get same result. http://forum.xda-developers.com/showpost.php?p=49675637&postcount=19


FYI: as @darkspr1te post here (http://forum.xda-developers.com/showpost.php?p=33082185&postcount=29), the HEX and first step MBN files should be loaded by EMMCSWDOWNLOAD. However, I keep getting 'cookie error' with that (screen attached).

When I try the 'multi-image' tab as you did, I got error too.

I agree with you regarding that DHD has different partitions than samsung, and the osbl should be the bootloader/hboot, but I still don't think we have move the phone to SD mode. If the DHD is in SD mode, after you plugin the cable, the pc should have some new drives (like you plugin a usb drive or sd to the memory slot).

For the multi-image tab, select multi-sec.2.0, that's why you keep getting that error.
So try that and see.

Sent from my GT-I9100 using xda app-developers app

 

[fairsimple]

For the multi-image tab, select multi-sec.2.0, that's why you keep getting that error.
So try that and see.

I can't find the 'multi-sec 2.0'. I have QPST v2.7 b378.

Also if you have access to a working DHD (I think we need it as rooted), we need backup the whole internal memory as #2 of this post, then we may can get the partition table from the backup file.

http://forum.xda-developers.com/showthread.php?t=1188510

 

[tjnapster555]

Welcome on board @tjnapster555. If you have Linux experience, can you try to run the Perl script as post #19 and check if you get same result. http://forum.xda-developers.com/showpost.php?p=49675637&postcount=19


FYI: as @darkspr1te post here (http://forum.xda-developers.com/showpost.php?p=33082185&postcount=29), the HEX and first step MBN files should be loaded by EMMCSWDOWNLOAD. However, I keep getting 'cookie error' with that (screen attached).

When I try the 'multi-image' tab as you did, I got error too.

I agree with you regarding that DHD has different partitions than samsung, and the osbl should be the bootloader/hboot, but I still don't think we have move the phone to SD mode. If the DHD is in SD mode, after you plugin the cable, the pc should have some new drives (like you plugin a usb drive or sd to the memory slot).

sorry never use linux

 

[fairsimple]

sorry never use linux

If you have access to a Riffbox and want unbrick your phone now then you can use that to fix the phone. If you can wait then just subscribe to this thread and stay tuned. Hopefully we can find our way soon

 

[tjnapster555]

If you have access to a Riffbox and want unbrick your phone now then you can use that to fix the phone. If you can wait then just subscribe to this thread and stay tuned. Hopefully we can find our way soon

i will wait for you guys and hoping someone will unbrirk his device

 

[mickeyasamoah]

I can't find the 'multi-sec 2.0'. I have QPST v2.7 b378.

Also if you have access to a working DHD (I think we need it as rooted), we need backup the whole internal memory as #2 of this post, then we may can get the partition table from the backup file.

http://forum.xda-developers.com/showthread.php?t=1188510

Its there check the image below.

And i was thinking of backing up another DHD so that we can get all the files for unbricking the device.
But i dont have another DHD. So then, how about we put up a thread in the DHD forum giving the guidelines on how to backup the DHD for unbricking purpose.
What do you think?

Also do you have any idea on how to backup the DHDs mbn files?

 

[fairsimple]

i will wait for you guys and hoping someone will unbrirk his device

Thanks to be patient

Its there check the image below.

And i was thinking of backing up another DHD so that we can get all the files for unbricking the device.
But i dont have another DHD. So then, how about we put up a thread in the DHD forum giving the guidelines on how to backup the DHD for unbricking purpose.
What do you think?

Also do you have any idea on how to backup the DHDs mbn files?

Agree. We should discover lots of info from the working DHD.

As my understanding, to get a full emmc backup, the phone has to be rooted, and has a SD inserted with at lease 2G free space (since DHD has 1.5G internal flash), asthis post (by TrevE) , user can use command 'dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0.img' to copy whole internal emmc to a file on microSD. I think the command can either run from a terminal app on the phone or use 'adb shell ..' command from a PC when phone has usb development on. Please note the generated file should not be posted publicly since the backup file has the phone's IMEI number and other phone data.

This post(by E:V:A) shows how to get the partition info from a working phone. I also find a tools folder which has the fdisk/gdisk/ect apps from the zip of Brixfix V2 (by darkspr1te) but don't know if them work on DHD or not.

However I don't think either of above method will provide us with MBN file directly, even we may can build MBN from the whole emmc backup.

Also I still don't think we have put the phone to SD mode for loading partition table and other xbl partitions. As the 2nd picture from this post, we need the right MBN file (which is a mini file system to run the phone as SD).

FYI: with QPST software download app - multi-image tab, if I only select partition.mbn and uncheck all others, I got 'Could not Communicate in Diagnostic Mode' error.

 

[mickeyasamoah]

Thanks to be patient



Agree. We should discover lots of info from the working DHD.

As my understanding, to get a full emmc backup, the phone has to be rooted, and has a SD inserted with at lease 2G free space (since DHD has 1.5G internal flash), asthis post (by TrevE) , user can use command 'dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0.img' to copy whole internal emmc to a file on microSD. I think the command can either run from a terminal app on the phone or use 'adb shell ..' command from a PC when phone has usb development on. Please note the generated file should not be posted publicly since the backup file has the phone's IMEI number and other phone data.

This post(by E:V:A) shows how to get the partition info from a working phone. I also find a tools folder which has the fdisk/gdisk/ect apps from the zip of Brixfix V2 (by darkspr1te) but don't know if them work on DHD or not.

However I don't think either of above method will provide us with MBN file directly, even we may can build MBN from the whole emmc backup.

Also I still don't think we have put the phone to SD mode for loading partition table and other xbl partitions. As the 2nd picture from this post, we need the right MBN file (which is a mini file system to run the phone as SD).

FYI: with QPST software download app - multi-image tab, if I only select partition.mbn and uncheck all others, I got 'Could not Communicate in Diagnostic Mode' error.

Wow!!! We have to ask @darkspr1te how he got/made his mbn files. Also, If we get a volunteer to backup his device, it would be saved into a .img file. Then the person could delete his/her personal info from the backup by opening it with a .img software like Power Iso or something.

FYI: with QPST software download app - multi-image tab, if I only select partition.mbn and uncheck all others, I got 'Could not Communicate in Diagnostic Mode' error.

I dont know why you get that error but with mine, it flashes the partition file and gets stuck since i dont have the next file. But when i leave all the mbn files selected, it flashes the partition file then stops the flash due to the next file being incorrect.

Anyway did you try removing the battery and re-inserting it?
Maybe you flashed a HEX file and its kind of blocking the communication.

---------- Post added at 07:33 PM ---------- Previous post was at 06:34 PM ----------

I just found these. It appears to be able to do a full emmc backup.

This(Documentation on the software) and That(download link to the file)