[Q&A] [Help] programmer? unbrick possible without JTAG

Search This thread

ElectroSix

Member
Dec 8, 2010
9
0
Hello i have a problem with my 1020.

I tried to recover my lumia from QHSUSB_DLOAD but at a certain point it gave me an error and from then my lumia isn't properly recognized by any pc.

if i remove and reinsert the battery and then i connect it to a pc it is recognized as USB Input Device, and if i remove the usb cable and the i reconnect it, the pc see the phone as Unknown Device.

Some suggestion?

Thank You.

The Error
Code:
[16:48:04.892] D_MSG : Sending OPEN_MULTI_REQ
[16:48:05.017] D_MSG : Received valid response to OPEN_MULTI_REQ
[16:48:05.033] D_MSG : Checking eMMC read / write test results...
[16:48:05.033] D_MSG : eMMC Read test passed. eMMC Write test passed!
[16:48:05.033] D_MSG : Programming image C 
[16:48:05.033] D_MSG : Image opened successfully for reading
[16:48:05.095] D_MSG : Uploading MBN image 70%
[16:48:05.111] D_ERR : SAFE hex file was used and unallowed memory address was being written.
[16:48:05.111] D_ERR : Reset the device and use the correct HEX file.
[16:48:05.111] D_MSG : ALPHA EMERGENCY FLASH END
[16:48:10.627] D_MSG : Emergency messaging closed successfully
[16:48:10.627] D_MSG : Operation took about 12.00 seconds.
[16:48:10.627] D_ERR : THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)
 

MrCego

Senior Member
Aug 24, 2014
257
54
Cartagena
These code lines tell your answers..

[16:48:05.111] D_ERR : SAFE hex file was used and unallowed memory address was being written.
[16:48:05.111] D_ERR : Reset the device and use the correct HEX file.
 

ElectroSix

Member
Dec 8, 2010
9
0
These code lines tell your answers..

[16:48:05.111] D_ERR : SAFE hex file was used and unallowed memory address was being written.
[16:48:05.111] D_ERR : Reset the device and use the correct HEX file.

yeah i know but the problem is that it was the same hex file that i used when i bricked another time. how can the hex file wrong? :confused:
 

LucasBeltran

Member
Apr 12, 2016
6
0
As I can generate the file .hex for my Lumia 640 XL - RM -1064 ? WDRT is not compatible with RM- 1064

2h5lbn6.jpg
 

tigerfire25

Senior Member
Aug 14, 2010
386
49
Peshawar
trying to recover a lumia 822 RM-845, cant find hex file for it.
RKH A0AE29AC24C843250D2DD0FFD409A649B4E4A09ED3B1A78413FB2B94B7476AAB
ALL HELP FOR THIS NOOB IS WELCOME.
Thanks.
 

kenkitt

Senior Member
Jul 16, 2013
117
37
Inspired by this thread: Comes Cloud_Commander_1.6_(Anathema) with Lumia Unbrick.
attachment.php

All you need are the hexfiles in their original naming e.g 00E9427DF118D9E27D098D13BECB6C6C89CE59F4.hex in the tools/mpreg folder.
And the ffu+vpl file.
The tool will do the whole procedure without the user issueing a single command.
You can also use uefi flashmode.
Just make sure you have the necessary drivers installed and don't forget to runas administrator.

Download



Sent from my GT-I8260 using xda app-developers app
Sent from my GT-I8260 using xda app-developers app
 

santhosh369

Member
Mar 12, 2016
14
5
Sending OPEN_MULTI_REQ
Message send failed with error code -1
Failed to get response to OPEN_MULTI_REQ
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 7.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.18 exited with error code 85021 (0x14C1D).

RM-875
LUMIA 1020

Please give me a working hex file. Tried all the hex files for this device posted in this thread. HELP ME........................................................
 

harshgupta532

New member
Jun 20, 2016
1
0
anybody please give me HEX file for my lumia 535


RKH of SBL1: BC2353ACA62C327ECCD582A281CA4A5672F35001D87176CCBF3C87DBE215CA3B
RKH of UEFI: BC2353ACA62C327ECCD582A281CA4A5672F35001D87176CCBF3C87DBE215CA3B
 

vecdid

Member
May 18, 2012
26
2
Need Bin file for 640 LTE ATT RM-1073

I tried to downgrade to 8.1 from 10 and blank screen now. My Root Key Hash is 831BE6B18E7006372069545885A80F786C33D064904732D39EFBE0EC7019B5D4 but bin to hex isn't working for me and none of thre created bins shared match. No matter what I try and I have seen many posts and spent hours trying to get this to work. No matter what it shows as QSHUSB_BULK in device manager and thor2 fails, Micrososft Recovery tool fails, Nokia care doesn't show my model and trying to make it do so doesn't match instructions out there. I downloaded the files that match my model from lumiafirmware. Can anyone assit me, or do I have a brick?

Thanks,
Vec
 

vecdid

Member
May 18, 2012
26
2
This problem on my Lumia 640 LTE RM-1073 has driven me mad. I have tried everything and nothing has worked. I have spent countless hours and days. I finally decided to call Microsoft and get warranty service, and what a pain even that was. First to get a hold of the right person/phone number was a royal pain, but finally got someone on the phone for Windows Phone support: (888)665-4228 and (800)246-6542. Turns out there is a 1 year warranty on all Windows phones. So they had me go to https://www.microsoft.com/en-us/mobi...anty-checkers/. Only problem was when I would enter my IMEI number it said it was out of warranty, yet I bought it from the Microsoft store. So while on the phone the agent took my info, sent me an email and I had to take screen shots of my order email from November of last year and email the screen shots back to him. I now have to wait 2-4 days to get a result from the warranty dispute and supposedly a shipping label. If it was out of warranty, it would be about $45 to get repaired from what another agent had said. Either way, hope some of this info helps someone else as it truly was a pain to just get a hold of someone at MS. I would love to fix the phone in the meantime, but I just cannot get it to boot not matter what I try.

Thanks,
Jim
 

LuisGMoraT

Member
Sep 10, 2016
5
0
lumia 640 lte rm-1073

Hi,
Today i tried to downgrade from Wp10 to Wp8.1 using WPRT but it bricked my Lumia 640. The phone does not respond to anything and the screen stays black. Now it shows as QHSUSB_BULK in device manager when i connect te phone to my pc. WPRT says "The connected device cannot be recovered" when i try to recover it.
I also tried to recover it with the THOR2 method but it give error code "THOR2_EMERGENCYFLASHV1_ERROR_XML_PARSING_FAILED" when i run the command "thor2 -mode emergency -hexfile C:\lumia\HEX.hex -mbnfile C:\lumia\GPT0.bin -orig_gpt". Is there any solution to my problem?
Thanks!


amigo donde cnosegiste el rkh del lumia 640
 

gmk044

New member
Jan 8, 2017
2
0
My mobile is lumia 1320 RM 994 CODE 059V6V6. it is in qhsusb_dload mode with no light no vibration. when i tried to flash as per your guidelines it is showing
C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool>thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
Process started Sun Jan 08 23:49:34 2017
Logging to file C:\Users\gmk04\AppData\Local\Temp\thor2_win_20170108234934_ThreadId-5452.log
Debugging enabled for emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Message send failed with error code -1
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 11.00 seconds.

THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED

THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)


plz help me to recover my phone:confused::confused::confused:
 

JTORO0491

New member
Feb 10, 2017
1
0
Info, Firmware and Emergency Files.

Aquí están todos los Archivos de emergencia y firmware para Lumia.
lumiafirmware com/inf
 

r-a-n-d-r-e-y

New member
Nov 29, 2017
2
0
When trying to exit the red screen following the instructions of lumia 820 (rm-825)
after thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt I get this result:

[09:41:44.724] D_MSG : THOR2 1.8.2.18
[09:41:44.724] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015
[09:41:44.724] D_MSG : Thor2 is running on Windows of version 6.2
[09:41:44.724] D_MSG : thor2 -mode emergency -hexfile HEX.hex -mbnfile msimage.mbn -orig_gpt
[09:41:44.724] D_MSG : Process started Wed Nov 22 09:41:44 2017
[09:41:44.724] D_MSG : Debugging enabled for emergency

[09:41:44.724] D_MSG : Initiating emergency download
[09:41:50.708] D_MSG : Using default emergency protocol
[09:41:50.708] D_MSG : ALPHA EMERGENCY FLASH START
[09:41:50.708] D_MSG : Emergency Programmer V1 version 2014.10.31.001
[09:41:50.708] D_MSG : Hex download selected
[09:41:50.708] D_MSG : Check if device in Dload
[09:41:50.708] D_MSG : Connection to DLOAD mode succeeded
[09:41:50.708] D_MSG : Get Dload parameters
[09:41:50.708] D_MSG : Sending HEX flasher to the device
[09:41:51.036] D_MSG : Sending GO command if HEX flasher successfully uploaded.
[09:41:52.407] D_MSG : Emergency Programmer V1 version 2014.10.31.001
[09:41:52.407] D_MSG : Mbn download selected
[09:41:52.407] D_MSG : Waiting for connection to flash programmer
[09:41:54.924] D_MSG : Connecting to flash programmer
[09:41:54.940] D_MSG : Received valid HELLO_RSP
[09:41:54.940] D_MSG : Safe version=true, transfer size=15360
[09:41:54.940] D_MSG : Received valid SECURITY_RSP
[09:41:54.940] D_MSG : Successfully connected to flash programmer
[09:41:54.940] D_MSG : Connection to flash programmer succeeded
[09:41:54.940] D_MSG : Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
[09:41:54.940] D_MSG : Reading GPT from binary
[09:41:54.940] D_MSG : -- GPT STARTs--
[09:41:54.940] D_MSG : name: SBL1
[09:41:54.940] D_MSG : startLBA: 34
[09:41:54.940] D_MSG : endLBA: 243
[09:41:54.940] D_MSG : size: 0x000000000001a400 bytes
[09:41:54.940] D_MSG : attributes: 0x0
[09:41:54.940] D_MSG :

[09:41:54.940] D_MSG : name: SBL2
[09:41:54.940] D_MSG : startLBA: 244
[09:41:54.940] D_MSG : endLBA: 507
[09:41:54.940] D_MSG : size: 0x0000000000021000 bytes
[09:41:54.940] D_MSG : attributes: 0x0
[09:41:54.940] D_MSG :

[09:41:54.940] D_MSG : name: SBL3
[09:41:54.940] D_MSG : startLBA: 508
[09:41:54.940] D_MSG : endLBA: 1193
[09:41:54.940] D_MSG : size: 0x0000000000055c00 bytes
[09:41:54.940] D_MSG : attributes: 0x0
[09:41:54.940] D_MSG :

[09:41:54.940] D_MSG : name: UEFI
[09:41:54.955] D_MSG : startLBA: 1194
[09:41:54.955] D_MSG : endLBA: 3273
[09:41:54.955] D_MSG : size: 0x0000000000104000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: RPM
[09:41:54.955] D_MSG : startLBA: 3274
[09:41:54.955] D_MSG : endLBA: 3559
[09:41:54.955] D_MSG : size: 0x0000000000023c00 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: TZ
[09:41:54.955] D_MSG : startLBA: 3560
[09:41:54.955] D_MSG : endLBA: 3985
[09:41:54.955] D_MSG : size: 0x0000000000035400 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: WinSecApp
[09:41:54.955] D_MSG : startLBA: 3986
[09:41:54.955] D_MSG : endLBA: 4609
[09:41:54.955] D_MSG : size: 0x000000000004e000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: UEFI_BS_NV
[09:41:54.955] D_MSG : startLBA: 4610
[09:41:54.955] D_MSG : endLBA: 4865
[09:41:54.955] D_MSG : size: 0x0000000000020000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: UEFI_NV
[09:41:54.955] D_MSG : startLBA: 4866
[09:41:54.955] D_MSG : endLBA: 4881
[09:41:54.955] D_MSG : size: 0x0000000000002000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: UEFI_RT_NV
[09:41:54.955] D_MSG : startLBA: 4882
[09:41:54.955] D_MSG : endLBA: 5137
[09:41:54.955] D_MSG : size: 0x0000000000020000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: UEFI_RT_NV_RPMB
[09:41:54.955] D_MSG : startLBA: 5138
[09:41:54.955] D_MSG : endLBA: 5153
[09:41:54.955] D_MSG : size: 0x0000000000002000 bytes
[09:41:54.955] D_MSG : attributes: 0x0
[09:41:54.955] D_MSG :

[09:41:54.955] D_MSG : name: SSD
[09:41:54.955] D_MSG : startLBA: 5154
[09:41:54.955] D_MSG : endLBA: 5169
[09:41:54.955] D_MSG : size: 0x0000000000002000 bytes
[09:41:54.971] D_MSG : attributes: 0x0
[09:41:54.971] D_MSG :

[09:41:54.971] D_MSG : name: PLAT
[09:41:54.971] D_MSG : startLBA: 5170
[09:41:54.971] D_MSG : endLBA: 7243
[09:41:54.971] D_MSG : size: 0x0000000000103400 bytes
[09:41:54.971] D_MSG : attributes: 0x0
[09:41:54.971] D_MSG :

[09:41:54.971] D_MSG : -- GPT ENDs --
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG :
[09:41:54.971] D_MSG : Sending OPEN_MULTI_REQ
[09:41:55.065] D_MSG : Received valid response to OPEN_MULTI_REQ
[09:41:55.080] D_MSG : Programming image m
[09:41:55.080] D_MSG : Image opened successfully for reading
[09:41:56.082] D_ERR : Message send failed with error code -1
[09:41:56.082] D_MSG : Uploading MBN image 100%
[09:41:56.082] D_MSG : ALPHA EMERGENCY FLASH END
[09:42:01.114] D_MSG : Emergency messaging closed successfully
[09:42:01.118] D_MSG : Operation took about 17.00 seconds.
[09:42:01.119] D_ERR : THOR2 1.8.2.18 exited with error code 29 (0x1D)

Files were taken from this topic (HMPRG_HEX.zip and CorrectedHexFiles.zip) and from lumiafirmware.com
in all three cases the error is the same. the red screen does not turn on. the battery and the cable turned off everything. the result is the same: black screen and Qualcomm HS-USB QDLoader 9008
What am I doing wrong?
 
Last edited:

Malik5785

Member
Apr 24, 2018
6
1
Hello everyone

I think I made a solution for all Lumia dead phone QHSUSB_DLOAD

But still stuck Failed to get respone from Open_Multi_Req
 
Last edited:
  • Like
Reactions: verdugon

marioland2

Member
Dec 22, 2010
12
0
Hi all, i have a bricked lumia 1320 with samsung emmc. When i power it on, it says: unable to find boot options
This problem started when i downgraded from windows 10 mobile to lumia denim using WDRT. The flashing procedure went well and, at reboot, the error message appeared on screen.
i've tried with thor2, windows phone internals, WDRT to unbrick the device but i failed. Do you have other suggestions? I read that exists a way to restore the device using jtag or atf box but i don't want to buy a 100$ peripheral for a one-time procedure.
 

ea1985294

New member
Jul 18, 2019
3
0
Thnxz guys, i brought back my dead 920 which bricked while downgrading to 8.1 from 10..

The only thing i did different was, i was stuck after Nokia with green background ..now just reboot to windows
thor2 -mode rnd -bootnormalmode

i opened MRT and while holding down volume and Power button it recognized my phone and started downloading the full firmware and installed it without issue. My phone was back from dead ..

This mrng i went back to WP10 ..new version is rock solid next up is to try Astoria side loading ..

Once Again THNXZZZZZZZZZZ

could u attach your hex file?
 

Leokolly06

Senior Member
Jun 17, 2018
50
8
Hi guys. I have a lumia 635 rm-974. On day, I powered it on and got the blue screen of death. I tried to reset it with the key combination but it only worsened everything. Now it boots, shows the nokia logo, then shows "Uefi error 1" and then goes to the red screen with the directional arrows. No key combinations work on it. It's not recognized by wdrt. Nokia care says that I have to reboot the phone to flash mode by pressing volume down and power, but when I do it the phone just reboots and returns to its red screen
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    It's ALIVE

    @skiddd, thank you a lot!
    My Lumia 925 RM-892 is charging now!

    If ever anyone will ask me about recommendation for phone recovery, I will always say that should use/buy ATF.

    P.S. All newly generated hexes are attached. Big bin conversion made correctly, flashed my RM-892 with it.

    P.S.S. To identify eMMC manufacturer use this command, when you have red nokia screen
    thor2 -mode rnd -readcid -skip_com_scan
    2
    Can you tell us your way?
    Thanks

    i cannot post thread
    1) Windows Phone Recovery Tool 2.1.1 (WPRT), firmware downloaded(if you cannot get it, i can tell you how to get it)

    2) copy firmware to C:\ProgramData\Microsoft\Packages\Products\RM-XXX
    3) open your MPRT, then connect your phone. you must hear the sound of usb connecting. even QHSUSB_BULK can have it. If you don't, open device manager, delete the driver, reconnect it. try your best to make it detect something from usb. you must leave your phone for at least 1 day to let the battery die. then connect, the computer will find it.
    4) choose "My phone was not detected", "LUMIA", you will see your phone is listed.
    5) click your phone recovery file listed.
    6) wait and it will say "emergency recovery" and it will download a several MB file.
    7) NOKIA red interface shows up, you succeed.

    Maybe I'm just lucky, but it's kind of way. I search for the hex file for days, but I cannot find it. Finally I use this way to recover my LUMIA 929 (ICON).
    Good luck!
    1
    Thank you John.

    Actually my experiments started based on your thread only. You had provided enough data (like all the binary files, tools, etc. etc.) to investigate the recovery process. Thanks a lot :)
    1
    There is someone on the Answers.microsoft forum that has access to a working 925 892, that can pull the hex file, if we have instructions on where/how to pull it off of there. I haven't been able to find anything about how to actually pull hex/bin files from a working phone tho.

    If you know where/how, could you post a tutorial, or link? Thanks

    unfortunately no,i don't...I'll search it too,i find anything I'll let you no
    1
    Hello everyone

    I think I made a solution for all Lumia dead phone QHSUSB_DLOAD

    But still stuck Failed to get respone from Open_Multi_Req