FORUMS
Remove All Ads from XDA

Finally... unbrick your Lumia device QHSUSB_DLOAD without JTAG

40 posts
Thanks Meter: 58
 
By johntheredimid, Member on 14th April 2015, 10:00 PM
Post Reply Email Thread
04/30/2015

And THE WAIT IS OVER ... after almost two months without telephone, as this has happened to me in February, with the help of you... have achieved UNBRICK LUMIA DEVICES WITHOUT JTAG ONLY WITH USB. Thank you, thank infinitely.

Warning: use this tutorial at your own risk, I do not responsible of anything. To me it worked.


05/25/2015
Simple method:

Yesterday update to WPRT 2.10 was released, which is able to fix DLOAD scenarios for lumias.
Here is the link.


--------------------------------------
If this does not work, try the advanced method:

Let's to the steps:
Attachment files in the same thread.

1) Install Thor2 (incluiding on WPRT): http://go.microsoft.com/fwlink/?LinkID=525569
2) Download your firmware lumia with NaviFirm
3) Install Drivers
4) Go to the folder where it is thor 2 from cmd (run administrator)
cd C:...

Use this command line to extract gtp0.bin from ffu image

Code:
thor2 -mode ffureader -ffufile "C:\rm-914\XXX.ffu" -dump_gpt -filedir C:\dump
this command will create gpt0.bin and rename it as msimage.mbn

mine was F771E62AF89994064F77CD3BC16829503BDF9A3D506D3FACEC AEF3F808C868FD so my hex file in binary format was F771E62AF89994064F77CD3BC16829503BDF9A3D.bin

convert this binary file to hex using bin2hex.exe

Code:
bin2hex F771E62AF89994064F77CD3BC16829503BDF9A3D.bin HEX.hex
open .hex file in notepad
insert :020000042A00D0 in first line
and :040000052A000000CD before the last line

or
Hex files already created starting in the bin, use RESPONSIBLY depending on your Lumia device


Now you have HEX.hex and msimage.mbn

the use this command line

Code:
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
Ready, disconnect the battery and reconnect. Now connect your phone to the PC
Yeah, his phone started life with red screen!
Charge the battery

5) Flash rom: Now, in the case of Lumia 520/521

Code:
thor2.exe -mode vpl -maxtransfersizekb 1 -vplfile C:\ProgramData\Nokia\Packages\Products\rm-915\XXX.vpl
.VPL remember it is not ffu. After the process 100%, your device turn with green screen, and:

Code:
thor2 -mode rnd -bootnormalmode



Some versions of Lumia, especially Lumia 820, 920, 920T, 925, 1020 (several models) have different .HEX, attached in the correct thread files ''CorrectedHexFiles.zip''
thanks @Heathcliff74


thanks @zapirkon and others users participated
thanks @ TheBITLINK aka BIT of Windows Insider.

Special thanks to Rathina Balan and AnnanZubair of Windows Insider Program
Thanks all... they are the best
Attached Files
File Type: zip Lumia.zip - [Click for QR Code] (785.4 KB, 25228 views)
File Type: zip MPRG_HEX.zip - [Click for QR Code] (1.18 MB, 61322 views)
File Type: zip bin2hexQ_src.zip - [Click for QR Code] (831 Bytes, 13258 views)
File Type: zip bin2hexQ.zip - [Click for QR Code] (2.6 KB, 18312 views)
File Type: zip CorrectedHexFiles.zip - [Click for QR Code] (442.2 KB, 26664 views)
The Following 51 Users Say Thank You to johntheredimid For This Useful Post: [ View ] Gift johntheredimid Ad-Free
 
 
15th April 2015, 10:54 AM |#2  
Member
Thanks Meter: 15
 
More
there is mbn file in the ffu
Quote:

issw_ape_MSM_v1.mbn

but I don't know if it is the same
15th April 2015, 11:24 AM |#3  
Senior Member
Flag Mashad
Thanks Meter: 377
 
More
Quote:
Originally Posted by zapirkon

there is mbn file in the ffu

but I don't know if it is the same

you have extracted ffu using 7-Zip ? is that right ?
15th April 2015, 01:05 PM |#4  
Member
Thanks Meter: 15
 
More
Quote:
Originally Posted by ngame

you have extracted ffu using 7-Zip ? is that right ?

either with thor2 or with imgmount

---------- Post added at 02:05 PM ---------- Previous post was at 01:44 PM ----------

from thor2 manual I see that it can flash the bin or mbn files
I tried that once, but later today I will try it again and post here

as for the mbn file i mentioned, I think it is too small to be the one.
16th April 2015, 09:55 AM |#5  
Member
Thanks Meter: 15
 
More
still no luck... now looking at

http://forum.xda-developers.com/show....php?t=1705324
16th April 2015, 01:27 PM |#6  
OP Member
Thanks Meter: 58
 
More
Quote:
Originally Posted by zapirkon

still no luck... now looking at

http://forum.xda-developers.com/show....php?t=1705324

this is for windows phone7 lumia devices... work on lumia X20 ?? wp8...

need the files partition.xml etc, to blink
16th April 2015, 01:47 PM |#7  
Member
Thanks Meter: 15
 
More
Quote:
Originally Posted by johntheredimid

this is for windows phone7 lumia devices... work on lumia X20 ?? wp8...

need the files partition.xml etc, to blink

I can see that also, but the hope to find something is still present
18th April 2015, 09:58 AM |#8  
Member
Thanks Meter: 15
 
More
in the ffu there is MMOS.WIM file
inside it i found xml file with some partitioning info


Code:
<?xml version="1.0" encoding="utf-8"?>
<DeviceLayout xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/embedded/2004/10/ImageUpdate">
  <Partitions>
    <!-- READ-ONLY SECTION START -->

    <!-- Device Provisioning Partition (FIRST READ-ONLY) -->
    <Partition>
      <Name>DPP</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <TotalSectors>16384</TotalSectors>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- QUALCOMM 8960 SPECIFIC READ-ONLY PARTITIONS -->

    <!-- Modem golden file system - MUST FOLLOW DPP -->
    <Partition>
      <Name>MODEM_FSG</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{638FF8E2-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Secure Software Download -->
    <Partition>
      <Name>SSD</Name>
      <TotalSectors>16</TotalSectors>
      <Type>{2C86E742-745E-4FDD-BFD8-B6A7AC638772}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Bootloaders -->
    <Partition>
      <Name>SBL1</Name>
      <TotalSectors>3000</TotalSectors>
      <!-- Qualcomm defined for SBL1 -->
      <Type>{DEA0BA2C-CBDD-4805-B4F9-F428251C3E98}</Type>
      <Bootable>true</Bootable>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>SBL2</Name>
      <TotalSectors>3000</TotalSectors>
      <Type>{8C6B52AD-8A9E-4398-AD09-AE916E53AE2D}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>SBL3</Name>
      <TotalSectors>4096</TotalSectors>
      <Type>{05E044DF-92F1-4325-B69E-374A82E97D6E}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI</Name>
      <TotalSectors>5000</TotalSectors>
      <Type>{400FFDCD-22E0-47E7-9A23-F16ED9382388}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
    <Name>RPM</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{098DF793-D712-413D-9D4E-89D711772228}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>TZ</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- fTPM Application -->
    <Partition>
      <Name>WINSECAPP</Name>
      <TotalSectors>1024</TotalSectors>
      <Type>{69B4201F-A5AD-45EB-9F49-45B38CCDAEF5}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- Bootloaders Backup Section (Sizes must match) -->
    <Partition>
      <Name>BACKUP_SBL1</Name>
      <TotalSectors>3000</TotalSectors>
      <!-- Qualcomm defined for SBL1 -->
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <Bootable>true</Bootable>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_SBL2</Name>
      <TotalSectors>3000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_SBL3</Name>
      <TotalSectors>4096</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_UEFI</Name>
      <TotalSectors>5000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
   <Name>BACKUP_RPM</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>BACKUP_TZ</Name>
      <TotalSectors>1000</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- fTPM Application Backup Section (Sizes must match) -->
    <Partition>
      <Name>BACKUP_WINSECAPP</Name>
      <TotalSectors>1024</TotalSectors>
      <Type>{A3381699-350C-465E-BD5D-FA3AB901A39A}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>


    <!-- UEFI Variable Services Partitions - Read-Only -->
    <Partition>
      <Name>UEFI_BS_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{F0B4F48B-AEBA-4ECF-9142-5DC30CDC3E77}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{74DA3EE7-D422-487C-A573-CE03C261362F}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
  
    <!-- ACPI table storage -->
    <Partition>
      <Name>PLAT</Name>
      <TotalSectors>16384</TotalSectors>
      <FileSystem>FAT</FileSystem>
      <Type>{543C031A-4CB6-4897-BFFE-4B485768A8AD}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- EFI System Partition (LAST READ-ONLY) --> 
    <Partition>
      <Name>EFIESP</Name>
      <FileSystem>FAT</FileSystem>
      <TotalSectors>131072</TotalSectors>
      <ByteAlignment>0x4000000</ByteAlignment>
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- READ-ONLY SECTION END -->

    <!-- START QUALCOMM 8960 SPECIFIC READ-WRITE PARTITIONS -->

    <!-- Modem live file systems -->
    <Partition>
      <Name>MODEM_FS1</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{EBBEADAF-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
      <ByteAlignment>0x4000000</ByteAlignment>
    </Partition>
    <Partition>
      <Name>MODEM_FS2</Name>
      <TotalSectors>6144</TotalSectors>
      <Type>{0A288B1F-22C9-E33B-8F5D-0E81686A68CB}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

    <!-- UEFI Variable Services Partitions - Read-Write -->
    <Partition>
      <Name>UEFI_RT_NV</Name>
      <TotalSectors>512</TotalSectors>
      <Type>{6BB94537-7D1C-44D0-9DFE-6D77C011DBFC}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>
    <Partition>
      <Name>UEFI_RT_NV_RPMB</Name>
      <TotalSectors>256</TotalSectors>
      <Type>{E35F99CF-0025-4252-A608-CAAA1289CAF4}</Type>
      <RequiredToFlash>true</RequiredToFlash>
    </Partition>

   <!-- END QUALCOMM 8960 SPECIFIC READ-WRITE PARTITIONS -->

   <!-- START MICROSOFT READ-WRITE PARTITIONS -->
    <Partition>
      <Name>MMOS</Name>
      <FileSystem>FAT</FileSystem>
      <MinFreeSectors>8192</MinFreeSectors>
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
    </Partition>

   <Partition>
      <Name>MainOS</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <!-- Accounts for 400MB free sectors and 256MB page file as defined in registry by package src\baseos\prod\packages\arm\armmemory -->
      <MinFreeSectors>1343488</MinFreeSectors>
      <ByteAlignment>0x800000</ByteAlignment>
      <ClusterSize>0x4000</ClusterSize>
      <FileSystem>NTFS</FileSystem>
      <AttachDriveLetter>false</AttachDriveLetter>
    </Partition>
    <Partition>
      <Name>Data</Name>
      <!-- PARTITION_BASIC_DATA_GUID -->
      <Type>{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}</Type>
      <UseAllSpace>true</UseAllSpace>
      <ByteAlignment>0x800000</ByteAlignment>
      <ClusterSize>0x4000</ClusterSize>
      <FileSystem>NTFS</FileSystem>
    </Partition>
  </Partitions>
  <!-- END MICROSOFT READ-WRITE PARTITIONS -->

  <SectorSize>512</SectorSize>
  <ChunkSize>128</ChunkSize>
  <DefaultPartitionByteAlignment>0x200000</DefaultPartitionByteAlignment>
</DeviceLayout>
also, i found

qcadsp8930.mbn
qcdsp1v18930.mbn
qcdsp1v28930.mbn
qcdsp28930.mbn
qcwcnss8930.mbn

but, I notice that when thor2 is started in emergency mode, and I provide any mbn file, the error is

Code:
QUATTRO EMERGENCY FLASH START
Quattro Emergency Programmer version 2014.11.25.001
ED download selected
Failed to load XML configuration file
Quattro emergency flash exited with error code 85000
QUATTRO EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 6.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_XML_PARSING_FAILED

THOR2 1.8.2.15 exited with error code 85000 (0x14C08)
also from the WMI file I see buld info:
Code:
collins_engine_8227/PRx_engine_integration
which indicates to me that emergency programming should be done with
Code:
 -protocol streaming
but I always get error THOR2_ERROR_NO_SAHARA_HANDSHAKE
how to change the emergency protocol?
18th April 2015, 10:21 AM |#9  
Senior Member
Flag PERPIGNAN
Thanks Meter: 344
 
More
Read This
http://answers.microsoft.com/en-us/i...d-fde2ca5e34c7
18th April 2015, 11:00 AM |#10  
Member
Thanks Meter: 15
 
More
did you read it?

Quote:

Please do try to recover and share your results.



---------- Post added at 12:00 PM ---------- Previous post was at 11:43 AM ----------

comparing
8960_msimage.mbn
to
GPT.bin
(extracted with thor2 -mode ffureader -ffufile "...ffu" -dump_partitions -filedir c:\temp)

they seem similar in contents

is this the mbn file? I still can't find hex file
18th April 2015, 02:51 PM |#11  
Nokia uses own Sahara implementation, called "FireHose" , which will NOT work with QPST. And not open mass storage mode. And MSM image is also not usable for repair. Funny, isn't it?
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes