[Q] Unbrick Telus Desire HD (QHSUSB_DLOAD after flash boot.img to S-ON DHD)

[fairsimple]

I changed the fixdhd.pl tool as:
1. skip sending OpenMulti and other commands before writing MBN (using 0x07 command)
2. retry 10 times to load same MNB file
3. try to download multiple MBN file

My first test shows that the first 1K chunk is loaded to phone successfully, but retry the same file or other files are all failed. This looks like the emmc is bad since the first writing is good, but later writing to the same address with same chunk of data fails.

First attempt:

# ./fixdhd.pl -fixdhd
fixdhd.pl version 20140410.
...
..Good magic response from DHD
Load file 7x30_msimage_1.mbn? y
Loading 7x30_msimage_1.mbn ...
Writing 1024 bytes to 0x00000000; 2305064 bytes left.   <----- no error with first chunk
.Writing 1024 bytes to 0x00000400; 2304040 bytes left.  <---- 2nd chunk
..Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a  <--- failed with 2nd chunk
Write unsuccessful

Writing 1024 bytes to 0x00000000; 2305064 bytes left.
..Invalid Response: 0d 07 00 00 00 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c
Write unsuccessful
...

Re-run the tool:

# ./fixdhd.pl -fixdhd
fixdhd.pl version 20140410.
...
..Good magic response from DHD
Load file 7x30_msimage_1.mbn? y
Loading 7x30_msimage_1.mbn ...
Writing 1024 bytes to 0x00000000; 2305064 bytes left.
..Invalid Response: 0e 57 72 69 74 65 20 75 6e 73 75 63 63 65 73 73 66 75 6c 0a  <------ failed with first chunk
Write unsuccessful

 

[Gussta]

Did you try again after pulling out battery and connecting phone again?

 

[fairsimple]

Did you try again after pulling out battery and connecting phone again?

My DHD has battery in and USB off for several days, then I got first writing block successfully as I posted. After a failure, I have to pull the battery to make the phone reset, otherwise it doesn't talk to the tool.

 

[mickeyasamoah]

My DHD has battery in and USB off for several days, then I got first writing block successfully as I posted. After a failure, I have to pull the battery to make the phone reset, otherwise it doesn't talk to the tool.

Sorry for not reply in long while. As you said, its the emmc fault.
I sent it for JTAG and the guy said he couldnt flash it because the device kept getting stuck in the process.
He suggested the device is dead.
So i got a DHD motherboard from a friend and installed it and it works now.

I think maybe you should do the same.
If you would remember, in one of the posts i said i suspected the emmc.
Reason being when i try to flash the mbn file using qpst software download, it successfully sends the HEX file and gets stuck at sending the mbn saying

setting up emmc device

It always got stuck there. Thats when i started giving up.
Maybe i might be wrong.

 

[Gussta]

Sorry for not reply in long while. As you said, its the emmc fault.
I sent it for JTAG and the guy said he couldnt flash it because the device kept getting stuck in the process.
He suggested the device is dead.
So i got a DHD motherboard from a friend and installed it and it works now.

I think maybe you should do the same.
If you would remember, in one of the posts i said i suspected the emmc.
Reason being when i try to flash the mbn file using qpst software download, it successfully sends the HEX file and gets stuck at sending the mbn saying

setting up emmc device

It always got stuck there. Thats when i started giving up.
Maybe i might be wrong.

What did you do with your old MB? Throw it in the garbage or?

 

[mickeyasamoah]

What did you do with your old MB? Throw it in the garbage or?

Its lying around.
Allmost threw it away but i decided to keep it and what do u know... The SDCARD holder begun to unmount the SDCARD by itself so i swapped the old SDCARD and SIM holder in and boom,problem solved.

 

[fairsimple]

...
I sent it for JTAG and the guy said he couldnt flash it because the device kept getting stuck in the process.
...

So JTAG confirms that your DHD is emmc issue. Glad you can get another MB to fix it. Do a full backup if you can .

 

[fairsimple]

Its lying around.
Allmost threw it away but i decided to keep it and what do u know... The SDCARD holder begun to unmount the SDCARD by itself so i swapped the old SDCARD and SIM holder in and boom,problem solved.

For a over 3 years old phone, looks there are more hw issue than sw.

 

[mickeyasamoah]

For a over 3 years old phone, looks there are more hw issue than sw.

Guess you are right.
From what i heard, The DHD has the same Good Emmc and Bad Emmc just like the MYTOUCH 4G.
It also has the good and bad screen.
The MYTOUCH 4G which has the bad emmc normally give up after a number of flashes. You could check the MYTOUCH 4G forums and see.
But one thing with the MYTOUCH 4G is that, when the emmc gets f*cked up, it doesnt go into QHSUSB-DLOAD, its data,cache and other partitions gets curropted.
When this happens, the rom wont boot neither can you flash any from recovery.
When you try flashing something from recovery, you get an error like..

Recovery failed to mount system or data or cache.

Hope you get me.

 

[Gussta]

This weekend my friend will bring me a dhd with bad eMMC.
I will try to bypass it and install ROM to SD card.

 

[fairsimple]

This weekend my friend will bring me a dhd with bad eMMC.
I will try to bypass it and install ROM to SD card.

Are you going to touch the hw to make the phoen boot from SD. I think you at least need the SBL, TZ, HBOOT and recovery on eMMC.

 

[Gussta]

Are you going to touch the hw to make the phoen boot from SD. I think you at least need the SBL, TZ, HBOOT and recovery on eMMC.

This is phone what i was talking about in post #80 and explain a litle bit more of his problem in post #101.
This phone isn't in QHSUSB_DLOAD mode and you can turn it on, but it's in the same position.
You can't use it.
Yes i will try to touch the hw to make the phoen boot from SD.
I was reading somewhere that Qualcomm SoC first try to find next "boot" from eMMC.
If they can't find it than try it from sd card.
And if neithere there can find it, than goes to QHSUSB_DLOAD mode.
Maybe I can't do it like I would like to, but, what a hell.
I can't lose anything.

 

[fairsimple]

This is phone what i was talking about in post #80 and explain a litle bit more of his problem in post #101.
This phone isn't in QHSUSB_DLOAD mode and you can turn it on, but it's in the same position.
You can't use it.
Yes i will try to touch the hw to make the phoen boot from SD.
I was reading somewhere that Qualcomm SoC first try to find next "boot" from eMMC.
If they can't find it than try it from sd card.
And if neithere there can find it, than goes to QHSUSB_DLOAD mode.
Maybe I can't do it like I would like to, but, what a hell.
I can't lose anything.

Do you mean the PBL(ROM) will try to read SBL from SD? If this is true then how about other partition like TZ.

I don't know if it is possible that physically switch memory address of the emmc and sd. If this is doable, then you are replacing emmc by the SD and everyone should be happy then.

As you mentioned in post #101 on page 11, I think the PBL still needs the SBL and some other partitions on emmc, and if it can run to either hboot or recovery then other parts can be on SD.

 

[Gussta]

Do you mean the PBL(ROM) will try to read SBL from SD? If this is true then how about other partition like TZ.

I don't know if it is possible that physically switch memory address of the emmc and sd. If this is doable, then you are replacing emmc by the SD and everyone should be happy then.

As you mentioned in post #101 on page 11, I think the PBL still needs the SBL and some other partitions on emmc, and if it can run to either hboot or recovery then other parts can be on SD.

I'm hoping that PBL will try to read SBL from SD card.
What do you mean: "How about other partition like TZ"?
Why and where do you need physically switch memory address of the emmc and sd?


This is my perception if I read it right about Qualcomm SoC and what was I talking about reading eMMC or SD:
When you press power button qualcomm first read internal PBL, PBL looking for SBL on emmc, if he find it than he load it, SBL load OSBL (hboot), than hboot loading rest.... bla,bla,bla...... (I was fast forwarding and skip some thing like, every boot loader first check if he can find next boot loader, than he check if this next boot is correct and if it is, than he load it, and so on).
If PBL can't find SBL on eMMC (can't find eMMC?), than he try to find SBL on SD, if he find it than he load it, SBL load hboot and so on.
When phone goes in the direction that he start to load ROM from SD, he load it to the end.




If you have in recovery installed dual boot, hboot load rest of the ROM either from eMMC or SD.
Because this phone don't have it, and I can't install it, I have to skip loading partitions from eMMC in the first place.



What MBN and HEX files did you try to push on mobile phone and where can I find it?
I forgot, can I find all files that I will maybe need for doing this, in this therad or?

 

[Gussta]

DHD arrived.
Now I have to figure out how to bypass eMMC
And somehow obtain micro SD card.

One other thing. I was reading article: http://android-revolution-hd.blogspot.com/2013/06/do-we-really-need-s-off.html
And below picture of HTC connected to laptop i found something that change a little my perspective about boot process.
If this is true amd you have blank eMMC or SD, it's not enough just to flash partition table and boot loaders, that you can go in hboot and flash rest. Obviously it's also necessary to flash radio partition (image) to.

And just two things:
First from: 80-N2967-1_C_eMMC_Software_Download_Tool.pdf
page 22 (23)
"
Question
[FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]What is the purpose of emmcbld7x30_SD_SDC4.hex? Do I require it for loading an image? [/FONT][/FONT]
Answer
[FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]The emmcbld7x30_SD_SDC4.hex, emmcbld7x30_eMMC_SDC2.hex, and 7x30_msimage.mbn files are required only when you program a blank card. These are emergency download programmers. [/FONT][/FONT]
"

Second:
I found that when DHD is turned off and connected to pc, when I just press volume down on DHD, pc recognize it like android portable device with dedicated drive letter in device manager. In computer explorer I can see drive letter but I can't open it. It get error like device is not connected.

Sorry if I wrote something that you already now.

 

[mickeyasamoah]

DHD arrived.
Now I have to figure out how to bypass eMMC
And somehow obtain micro SD card.

One other thing. I was reading article: http://android-revolution-hd.blogspot.com/2013/06/do-we-really-need-s-off.html
And below picture of HTC connected to laptop i found something that change a little my perspective about boot process.
If this is true amd you have blank eMMC or SD, it's not enough just to flash partition table and boot loaders, that you can go in hboot and flash rest. Obviously it's also necessary to flash recovery partition (image) to.

And just two things:
First from: 80-N2967-1_C_eMMC_Software_Download_Tool.pdf
page 22 (23)
"
Question
[FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]What is the purpose of emmcbld7x30_SD_SDC4.hex? Do I require it for loading an image? [/FONT][/FONT]
Answer
[FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]The emmcbld7x30_SD_SDC4.hex, emmcbld7x30_eMMC_SDC2.hex, and 7x30_msimage.mbn files are required only when you program a blank card. These are emergency download programmers. [/FONT][/FONT]
"

Second:
I found that when DHD is turned off and connected to pc, when I just press volume down on DHD, pc recognize it like android portable device with dedicated drive letter in device manager. In computer explorer I can see drive letter but I can't open it. It get error like device is not connected.

Sorry if I wrote something that you already now.

i found someone with the problem i had with my DHD, but he is still able to access bootloader but all other partitions are not accessible.
I directed him here.

 

[tjnapster555]

everyone stop replying here is this thread is dead

mean my htc desire HD not going to see the light again :crying::crying:

 

[Gussta]

everyone stop replying here is this thread is dead

mean my htc desire HD not going to see the light again :crying::crying:

I think not yet.
Yestrday I found power supply test points for eMMC (Vcc and VccQ).
Vcc is the power supply line for internal flash memory (NAND).
VccQ is the power supply line for host interface (controler).

Standard voltage range:
Core voltage (Vcc): 2.7-3.6V
Host voltage (VccQ), either: 1.7-1.95V or 2.7-3.6V

Desire HD use the same line to power supply SoC (CPU), RAM, eMMC host interface + some other chips.
Qualcomm SoC power supply is 1.8V = VccQ is also 1.8V.

My DHD test voltages:
Vcc: 1.8V Good
VccQ: 2.8V Good

I was thinking that maybe some power supply line (Vcc or VccQ) is not good (wrong voltages) and maybe because of that emmc not working. But now I eliminate that.

I'm still trying to find out how to bypass eMMC and install ROM on microSD card.
I can replace eMMC because I have equipment, but that will not help other people.

 

[Gussta]

I manage to deactivate eMMC card. I schortcut Vdd capacitor.
Now phone is in "Qualcomm HS-USB QDLoader 9008" mode (that is said in control panel after driver installation).
Because i'm more familiar with Hardware than software I need Your's help guys.
What formation of microSD?
What files for QPST emmc downolad software?
Can I maybe do something directly to microSD (format it, push files, image) from PC (Windows or Linux)?
I appreciate any help.

 

[fairsimple]

Sorry guys for missing all the discussions for almost a month. Gmail put one of the notification email to spam folder and xda didn't send more notification after that since I didn't check the new post

If PBL can't find SBL on eMMC (can't find eMMC?), than he try to find SBL on SD, if he find it than he load it, ...

I don't think this true. The PBL in ROM is very small so without loading one or multiple SBL I don't think it can amount SD. That is why I think if you can switch memory addresses of emmc and sd, then the PBL can just loading sd as emmc (if sd has emmc memory address).

everyone stop replying here is this thread is dead

mean my htc desire HD not going to see the light again :crying::crying:

Don't give up before you confirm that your emmc is broken. I suggest you find a friend which has a linux box (or you may learn it), try the script in post post 161 and let us know what is your output.

What formation of microSD?
What files for QPST emmc downolad software?
Can I maybe do something directly to microSD (format it, push files, image) from PC (Windows or Linux)?
I appreciate any help.

As my understanding DHD emmc is formatted as FAT32, but I am not sure about the sizes of each partition. We requested partition info in this post. You may following the links there if you can find a working DHD (rooted?).

If PBL really can load SBL and others from SD then I think you can partition/format/copy on a PC. If you can find a rooted DHD, you may just clone the emmc from working DHD to it (which will copy the IMEI number and other user data if the user doesn't mind).