[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

Gussta

Senior Member
Feb 11, 2014
140
25
0
33
Zagreb
Yes, HTC DHD has 8255 SoC. However, there are some internet posts/docs mention that the code name of 8255 is 7x30.

Also as the diagram in the page you posted, the S2 has 7230, 7630, 8255, 8655 so assuming the 8xxx is backward compatible with older one like 7230, it makes sense that the 7x30 file will work on both 7x30 and 8x55.

Anyway those folder name/SVN path I posted are just samples (which are mentioned in the dev doc), if we can find a path as ' AMSS/products/8255', or ' AMSS/products/825x/' then it will be better than the ' AMSS/products/7x30'.

I found this thread:

http://forum.xda-developers.com/showthread.php?t=2197265

Maybe @onejay09 wish to help?

In his thread I found this:

http://faq.riffbox.org/index.php?action=artikel&cat=10&id=53&artlang=en

It wouldn't help with easy solve but maybe can explain some thing because they explaining how it works on DHD.
Principles perhaps can be similar (?????).
 

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
I found this thread:

http://forum.xda-developers.com/showthread.php?t=2197265

Maybe @onejay09 wish to help?

In his thread I found this:

http://faq.riffbox.org/index.php?action=artikel&cat=10&id=53&artlang=en

It wouldn't help with easy solve but maybe can explain some thing because they explaining how it works on DHD.
Principles perhaps can be similar (?????).
Thanks for the links.

As I posted in post#31 on page 4, Fuses (who was part of the HTC unbrick project) mentioned that riffbox can unbrick DHD by USB only (no need of jtag). This is confirmed by the link you posted. That link is also looking forward a pure software unbrick way, which the fixdhd.pl is our implement/attempt to do so with DHD.

Riffbox must have the file for DHD, but I guess they are in the box. Reason: I don't have a riffbox but have the riffbox sw installed on my PC, there is no file under the installation directory. It make sense the files are in the box since it is a commercial production.

Another point in the link is that if the emmc or other hardware is broken, nothing (even riffbox) can help. As the post#3 mention, 'the bad side is 98% of emmc fault is due to Hardware'. That is why I hope we know a sure way to check emmc hw as I was ask in post #107 on page 11. For a 3/4 years old phone like DHD, it won't worth to find and replace any part I think. However, by contributing our free time, searching the free internet, hopefully we can find the files and test as much sw fix as we can, till either recovery our phone or hit the wall (confirm the hw is broken).
 
  • Like
Reactions: tjnapster555

Gussta

Senior Member
Feb 11, 2014
140
25
0
33
Zagreb
Thanks for the links.

As I posted in post#31 on page 4, Fuses (who was part of the HTC unbrick project) mentioned that riffbox can unbrick DHD by USB only (no need of jtag). This is confirmed by the link you posted. That link is also looking forward a pure software unbrick way, which the fixdhd.pl is our implement/attempt to do so with DHD.

Riffbox must have the file for DHD, but I guess they are in the box. Reason: I don't have a riffbox but have the riffbox sw installed on my PC, there is no file under the installation directory. It make sense the files are in the box since it is a commercial production.

Another point in the link is that if the emmc or other hardware is broken, nothing (even riffbox) can help. As the post#3 mention, 'the bad side is 98% of emmc fault is due to Hardware'. That is why I hope we know a sure way to check emmc hw as I was ask in post #107 on page 11. For a 3/4 years old phone like DHD, it won't worth to find and replace any part I think. However, by contributing our free time, searching the free internet, hopefully we can find the files and test as much sw fix as we can, till either recovery our phone or hit the wall (confirm the hw is broken).
Sorry, I forgot about your post on page 4.
If it's a problem with eMMC, you can try changing smd cunductors around eMMC especially the one on Vdd, because if you short circuit Vdd conductor the phone go automaticaly in Qdload_mode.
But if eMMC not working at all, you can buy it for 20$ (bigger, your's are 4 gb, for 20$ is 8 Gb), but replacing it?
It's a big question. I have Infrared rework station and I'm not sure if I have that much skills to do it.
 
  • Like
Reactions: tjnapster555

Gussta

Senior Member
Feb 11, 2014
140
25
0
33
Zagreb
I don't now if someone mentioned this thread or not.
I now that this thread wouldn't help you (for now).
But it's a good thread with lot of work from @E:V:A and others. It's worth reading. It's about partition and eMMC card.
Unfortunately all posts from E:V:A is for Samsung. Why are all good post's for Samsung, and not for HTC?

http://forum.xda-developers.com/showthread.php?t=1959445
 

mickeyasamoah

Senior Member
Jan 11, 2013
979
229
0
Accra

Attachments

Last edited:

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
I have being able to sign up at https://silver.arm.com/browse.
Whats next?
Can you find something like RVCT or RVDS. Below is from section of 1.2.4 of http://www.phonesdevelopers.com/1705937/. I am still not fully understand those but looks like RVDS v2.2 (from ARM) and patch 349 (from Qualcomm) is the complier.

Find all the source file and the tools are very difficult way to go, there are many posts complain not able to find them. I think the easier ways are:

- find the right MBN for our phone to put it in SD mode (I think the HEX we have is good)
- get partition info and a full emmc back to load (after phone goes to SD mode)


1.2.4 set up a modem development environment

Unlike the android source code modem compiler tool is RVDS actually uses only one of the RVCT Compiler, Qualcomm does not provide the tools, we must obtain the appropriate license from ARM RVDS is the upgrade version of ADS, ADS 1.2 RVDS 3.1 Our company has its mandate in accordance with the requirements of the high-pass we must now use the RVDS 2.2 and use the 349 patch.
 
  • Like
Reactions: tjnapster555

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
I don't now if someone mentioned this thread or not.
I now that this thread wouldn't help you (for now).
But it's a good thread with lot of work from @E:V:A and others. It's worth reading. It's about partition and eMMC card.
Unfortunately all posts from E:V:A is for Samsung. Why are all good post's for Samsung, and not for HTC?

http://forum.xda-developers.com/showthread.php?t=1959445
Yes we hope HTC DHD info is there, and FYI we opened a thread to look for partition info and emmc backup at http://forum.xda-developers.com/showthread.php?p=50631137, no input yet :(
 
  • Like
Reactions: tjnapster555

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
Sorry for taking a long while to reply but i cant find the downloads on that site.
Do you have a URL to thier downloads?
Links from http://blog.csdn.net/zhudongya/article/details/6899070

Getting RVDS

https://silver.arm.com/browse

http://www.arm.com/products/tools/software-development-tools.php

https://silver.arm.com/download/eval_download.tm

https://silver.arm.com/userguides/Web_Licensing_Portal_User_Guide.pdf (Licensing by 'host id' register)

―――――――

1.2.4.1.1 getting RVDS licenses

https://silver.arm.com/licensing/

https://silver.arm.com/licensing/generate.tm

http://www.keil.com/support/man/docs/license/license_sul_install.htm



URL: https://silver.arm.com/licensing/ log in:

user: [email protected] password: Mohuifu7737

URL https://silver.arm.com/licensing/generate.tm input product SN

the follow the steps on web page

Server Host Id Type type: ETHERNET

Server Host Id MAC: 00:1a:64:0a:ba:70

Save the license.dat file in text format
Please note even we can get RVDS, we still need the patch of it from Qualcomm. And looks like the Qualcomm files are only available for paid vendors. FYI: I am still out of my office for now, I may try more on our current HEX and MBN files. We still need to do our best to get a rooted working DHD.
 
  • Like
Reactions: tjnapster555

mickeyasamoah

Senior Member
Jan 11, 2013
979
229
0
Accra
Links from http://blog.csdn.net/zhudongya/article/details/6899070



Please note even we can get RVDS, we still need the patch of it from Qualcomm. And looks like the Qualcomm files are only available for paid vendors. FYI: I am still out of my office for now, I may try more on our current HEX and MBN files. We still need to do our best to get a rooted working DHD.
I could get a rooted DHD but the problem would be how to upload almost 2gig of data.
 
  • Like
Reactions: fairsimple

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
I could get a rooted DHD but the problem would be how to upload almost 2gig of data.
Can you retrieve the partition table info and post that first as http://forum.xda-developers.com/showthread.php?p=50631137. I'd like to verify our partition.mbn is same as the good DHD. Also, if we can getting the partition info correctly, we may backup the good DHD by each partition (instead of the whole emmc).

7zip can be used to split to multiple compressed files. Thanks!
 

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
mkappsboot.py (create appsboot.mbn, from Chromium OS):

https://chromium.googlesource.com/chromiumos/third_party/u-boot-next/+/0.11.257.B/tools/qualcomm/mkappsboot.py

Create the appsboot.mbn file using the new qualcomm tool. (issue1520018)

Code:
chromium / chromiumos/third_party/u-boot-next / 0.11.257.B / . / tools / qualcomm / mkappsboot.py
blob: 8f10ea4bce1186940cba2324eda3f58e1571f8d2 [file history] [blame]
#!/usr/bin/python

#Copyright (c) 2010, Code Aurora Forum. All rights reserved.

#This program is free software; you can redistribute it and/or modify
#it under the terms of the GNU General Public License version 2 and
#only version 2 as published by the Free Software Foundation.

#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#GNU General Public License for more details.

#You should have received a copy of the GNU General Public License
#along with this program; if not, write to the Free Software
#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
#02110-1301, USA.


#usage: ./mkappsboot.py u-boot.bin appsboot.mbn

import sys
import struct

# read the bin file
bin = open(sys.argv[1], "rb")
loader = bin.read()
bin.close()

# construct the mbn header
size = len(loader)
base = int(sys.argv[3],16)
header = struct.pack("10I",
    0x00000005, # appsbl
    0x00000003, # part version
    0x00000000,
    base,
    size,
    size,
    base + size,
    0x00000000,
    base + size,
    0x00000000,
)

# write the mbn file with the header and code
mbn = open(sys.argv[2], "wb+")
mbn.seek(0)
mbn.truncate()
mbn.write(header)
mbn.write(loader)
mbn.close()
 
Last edited:
  • Like
Reactions: tjnapster555

mickeyasamoah

Senior Member
Jan 11, 2013
979
229
0
Accra
mkappsboot.py (create appsboot.mbn, from Chromium OS):

https://chromium.googlesource.com/chromiumos/third_party/u-boot-next/+/0.11.257.B/tools/qualcomm/mkappsboot.py

Create the appsboot.mbn file using the new qualcomm tool. (issue1520018)

Code:
chromium / chromiumos/third_party/u-boot-next / 0.11.257.B / . / tools / qualcomm / mkappsboot.py
blob: 8f10ea4bce1186940cba2324eda3f58e1571f8d2 [file history] [blame]
#!/usr/bin/python

#Copyright (c) 2010, Code Aurora Forum. All rights reserved.

#This program is free software; you can redistribute it and/or modify
#it under the terms of the GNU General Public License version 2 and
#only version 2 as published by the Free Software Foundation.

#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#GNU General Public License for more details.

#You should have received a copy of the GNU General Public License
#along with this program; if not, write to the Free Software
#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
#02110-1301, USA.


#usage: ./mkappsboot.py u-boot.bin appsboot.mbn

import sys
import struct

# read the bin file
bin = open(sys.argv[1], "rb")
loader = bin.read()
bin.close()

# construct the mbn header
size = len(loader)
base = int(sys.argv[3],16)
header = struct.pack("10I",
    0x00000005, # appsbl
    0x00000003, # part version
    0x00000000,
    base,
    size,
    size,
    base + size,
    0x00000000,
    base + size,
    0x00000000,
)

# write the mbn file with the header and code
mbn = open(sys.argv[2], "wb+")
mbn.seek(0)
mbn.truncate()
mbn.write(header)
mbn.write(loader)
mbn.close()
does it work????
 
  • Like
Reactions: tjnapster555

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
does it work????
Don't know since it is to add a header to BIN file (e.g. backup file by dd command for one partition) to generate MBN file. The header looks small and simple as from the code, but I didn't find any doc or spec regarding it (the MBN header). That post is just for our info/ref, and I will double check the MBN files we found with that header info.
 
  • Like
Reactions: tjnapster555

fairsimple

Senior Member
Aug 23, 2013
83
35
0
Toronto
Files for 8x25(karbonn a9+) from this post: http://forum.gsmhosting.com/vbb/f824/karbonn-a9-dead-qualcomm-hs-usb-qdloader-9008-how-fix-1740061/#post9962431

Code:
12-19-2013, 10:00	   #12 (permalink)
umesh gaba
Product Manager

 

 
Join Date: Aug 2012
Location: jalandhar,india
Posts: 4,034 
Member: 1792140 
Status: Online
Sonork: 100.1618782;gaba
Thanks Meter: 4,644
QPST 2.7 build 399QPST-2.7.399


BP Firmware BP_JB_Firmware

drivers ICS_pcdrivers

drivers JB_pcdrivers



Install QPST
1. Extract QPST-2.7.399.rar. Run SETUP.EXE
2. Run SETUP.EXE, press INSTALL when it prmpt to insall additional Visual C++ runtime libraries. Follow the defaults, press NEXT until it is finished with the install.

Install drivers
1. Connect deadboot flare to PC / Laptop.
2. Go to device manager, expand PORTS (COM & LPT). Check if there is an item called Qualcomm HSUSB QDLOADER 9008. If the item is there, you are done with driver install. If it does not exist, proceed to step3.
3. If there is no item under PORTS (COM & LPT), check device manager under OTHER DEVICES > Unknown Device
4. Double click UNKNOWN DEVICE > UPDATE DRIVER > BROWSE MY COMPUTER > browse to the folder where you saved extracted the ICS / JB drivers. It will install the driver, if it prompts for unsigned drivers, press INSTALL ANYWAY.
5. It should now be listed under COM PORTS > Qualcomm HSUSB QDLOADER 9008.

Run QPST and reprogram EMMC (this is where the magic begins)
If you are on Win7, make sure you run it under compatibility XP Sp3 and RUN AS ADMINISTRATOR

1. Run EMMC SOFTWARE DOWNLOAD.
2. Press BROWSE, it will detect your phone. Look for the PHONE TAB that says DOWNLOAD. Press OK.
3. Put check mark on PROGRAM BOOTLOADERS, PROGRAM MMC DEVICE, TRUSTED.
4. Under FLASH PROGRAMMER FILENAME, enter MPRG8X25.hex
5. Under BOOT IMAGE, enter 8X25_msimage.mbn
6. Press LOAD XML DEF > navigate to your extracted JB firmware > select rawprogram0 > press OPEN.
7. Press LOAD PATCH DEF > navigate to your extracted JB firmware > select patch0 > press OPEN
8. PRESS DOWNLOAD
9. An warning message may appear, TIME OUT WAITING etc etc or COOKIE NOT RECEIVED. If the error is TIME OUT WAITING, press OK and then press SWITCH DEVICE TO DLOAD. Check the flare, it will show RESET FOR ENTRY QPST.
10. Exit EMMC SOFTWARE DOWNLOAD. Proceed to flash Jelly Bean BP Firmware and then flash Jelly Bean img dump.
11. IF ERROR IS COOKIE NOT RECEIVED, sorry it is still bricked.
 
Last edited:

mickeyasamoah

Senior Member
Jan 11, 2013
979
229
0
Accra
Files for 8x25(karbonn a9+) from this post: http://forum.gsmhosting.com/vbb/f824/karbonn-a9-dead-qualcomm-hs-usb-qdloader-9008-how-fix-1740061/#post9962431

Code:
12-19-2013, 10:00	   #12 (permalink)
umesh gaba
Product Manager

 

 
Join Date: Aug 2012
Location: jalandhar,india
Posts: 4,034 
Member: 1792140 
Status: Online
Sonork: 100.1618782;gaba
Thanks Meter: 4,644
QPST 2.7 build 399QPST-2.7.399


BP Firmware BP_JB_Firmware

drivers ICS_pcdrivers

drivers JB_pcdrivers



Install QPST
1. Extract QPST-2.7.399.rar. Run SETUP.EXE
2. Run SETUP.EXE, press INSTALL when it prmpt to insall additional Visual C++ runtime libraries. Follow the defaults, press NEXT until it is finished with the install.

Install drivers
1. Connect deadboot flare to PC / Laptop.
2. Go to device manager, expand PORTS (COM & LPT). Check if there is an item called Qualcomm HSUSB QDLOADER 9008. If the item is there, you are done with driver install. If it does not exist, proceed to step3.
3. If there is no item under PORTS (COM & LPT), check device manager under OTHER DEVICES > Unknown Device
4. Double click UNKNOWN DEVICE > UPDATE DRIVER > BROWSE MY COMPUTER > browse to the folder where you saved extracted the ICS / JB drivers. It will install the driver, if it prompts for unsigned drivers, press INSTALL ANYWAY.
5. It should now be listed under COM PORTS > Qualcomm HSUSB QDLOADER 9008.

Run QPST and reprogram EMMC (this is where the magic begins)
If you are on Win7, make sure you run it under compatibility XP Sp3 and RUN AS ADMINISTRATOR

1. Run EMMC SOFTWARE DOWNLOAD.
2. Press BROWSE, it will detect your phone. Look for the PHONE TAB that says DOWNLOAD. Press OK.
3. Put check mark on PROGRAM BOOTLOADERS, PROGRAM MMC DEVICE, TRUSTED.
4. Under FLASH PROGRAMMER FILENAME, enter MPRG8X25.hex
5. Under BOOT IMAGE, enter 8X25_msimage.mbn
6. Press LOAD XML DEF > navigate to your extracted JB firmware > select rawprogram0 > press OPEN.
7. Press LOAD PATCH DEF > navigate to your extracted JB firmware > select patch0 > press OPEN
8. PRESS DOWNLOAD
9. An warning message may appear, TIME OUT WAITING etc etc or COOKIE NOT RECEIVED. If the error is TIME OUT WAITING, press OK and then press SWITCH DEVICE TO DLOAD. Check the flare, it will show RESET FOR ENTRY QPST.
10. Exit EMMC SOFTWARE DOWNLOAD. Proceed to flash Jelly Bean BP Firmware and then flash Jelly Bean img dump.
11. IF ERROR IS COOKIE NOT RECEIVED, sorry it is still bricked.
So did it work on our DHD?