Hello XDA people! I'm very noobe in Android devices. so...
I've decided to root my phone via this manual:
***
How to Install Insecure Kernel on Sony Xperia E Dual
Step 1: Download Android.zip then extract in on the desktop.
Step 2: Download XperiaEDual.elf the copy it into the Android.zip extracted folder.
Step 3: Turn off the phone and boot into Fastboot Mode by pressing “Volume Up” and “Power Button” at the same time. Release them when the screen is on.
Step 4: On Android.zip folder, open command prompt window but hold “SHIFT” + “RIGHT-CLICK” on empty space of the folder then click on “Open command window here”.
Step 5: Connect the phone to PC, then it will automatically install the driver (if it is the first time or the PC do not have the driver). Wait for the installation to finish.
Step 6: Now enter the following commands:
fastboot devices
Press enter key to activate.
fastboot flash boot XPERIAEDual.elf
Press enter key to activate.
fastboot reboot
Press enter key to activate.
Now it is done with the installtion of Insecure Kernel then we can start rooting the Xperia E Dual.
How to Root Sony Xperia E Dual
Step 1: Download DooMLoRD_v1-ROOT-insecure-busybox-su.zip then extract it on the desktop.
Step 2: Enable USB debugging option on your phone by going to “Setting” > “Applications” > “Development” > check on the box there to enable “USB Debugging”.
Step 3: Enable Unknown sources option on your phone by going to “Setting” > “Security” > check on the box there to enable “unknown sources”.
Step 4: Connect your phone to PC via USB cable.
Step 5: On the Doomlord extracted folder find a file with this name “runme.bat “ then double-click on it to run.
Step 6: Follow the instruction on the screen.
Now the phone should be rooted. If you encounter any problem, please read the whole article again or use comment section for question.
***
So.
After fastboot flash boot XPERIAEDual.elf and fastboot reboot device cant boot OS. Only Sony logo. When i try to connect to PC - it rebootes in loop and i cant install any drivers. So thereis no access to device and its invisible for my OS.
Logs
---
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot flash boot XPERIAED
ual.elf
sending 'boot' (5352 KB)...
(bootloader) USB download speed was 17236kB/s
OKAY [ 0.337s]
writing 'boot'...
(bootloader) Flash of partition 'boot' requested
(bootloader) S1 partID 0x00000003, block 0x00002000-0x0000bfff
(bootloader) Erase operation complete, 0 bad blocks encountered
(bootloader) Flashing...
(bootloader) Flash operation complete
OKAY [ 0.484s]
finished. total time: 0.822s
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot reboot
rebooting...
finished. total time: 0.004s
---
So can i reflash my firmware or repair my phone?
dipmon said:
Hello XDA people! I'm very noobe in Android devices. so...
I've decided to root my phone via this manual:
***
How to Install Insecure Kernel on Sony Xperia E Dual
Step 1: Download Android.zip then extract in on the desktop.
Step 2: Download XperiaEDual.elf the copy it into the Android.zip extracted folder.
Step 3: Turn off the phone and boot into Fastboot Mode by pressing “Volume Up” and “Power Button” at the same time. Release them when the screen is on.
Step 4: On Android.zip folder, open command prompt window but hold “SHIFT” + “RIGHT-CLICK” on empty space of the folder then click on “Open command window here”.
Step 5: Connect the phone to PC, then it will automatically install the driver (if it is the first time or the PC do not have the driver). Wait for the installation to finish.
Step 6: Now enter the following commands:
fastboot devices
Press enter key to activate.
fastboot flash boot XPERIAEDual.elf
Press enter key to activate.
fastboot reboot
Press enter key to activate.
Now it is done with the installtion of Insecure Kernel then we can start rooting the Xperia E Dual.
How to Root Sony Xperia E Dual
Step 1: Download DooMLoRD_v1-ROOT-insecure-busybox-su.zip then extract it on the desktop.
Step 2: Enable USB debugging option on your phone by going to “Setting” > “Applications” > “Development” > check on the box there to enable “USB Debugging”.
Step 3: Enable Unknown sources option on your phone by going to “Setting” > “Security” > check on the box there to enable “unknown sources”.
Step 4: Connect your phone to PC via USB cable.
Step 5: On the Doomlord extracted folder find a file with this name “runme.bat “ then double-click on it to run.
Step 6: Follow the instruction on the screen.
Now the phone should be rooted. If you encounter any problem, please read the whole article again or use comment section for question.
***
So.
After fastboot flash boot XPERIAEDual.elf and fastboot reboot device cant boot OS. Only Sony logo. When i try to connect to PC - it rebootes in loop and i cant install any drivers. So thereis no access to device and its invisible for my OS.
Logs
---
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot flash boot XPERIAED
ual.elf
sending 'boot' (5352 KB)...
(bootloader) USB download speed was 17236kB/s
OKAY [ 0.337s]
writing 'boot'...
(bootloader) Flash of partition 'boot' requested
(bootloader) S1 partID 0x00000003, block 0x00002000-0x0000bfff
(bootloader) Erase operation complete, 0 bad blocks encountered
(bootloader) Flashing...
(bootloader) Flash operation complete
OKAY [ 0.484s]
finished. total time: 0.822s
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot reboot
rebooting...
finished. total time: 0.004s
---
So can i reflash my firmware or repair my phone?
Click to expand...
Click to collapse
just flash stock firmware!
You are not supposed to quote a very long post, specialy the first one
Sent from my ST21i using xda app-developers app
Flashing stock would be too much. Just flashing a stock kernel would be enough.
Wait a sec.. Isn't unlocked bootloader necessary for flashing an insecure kernel?
Sent from my Xperia E dual using xda app-developers app
dipmon said:
Hello XDA people! I'm very noobe in Android devices. so...
I've decided to root my phone via this manual:
***
How to Install Insecure Kernel on Sony Xperia E Dual
Step 1: Download Android.zip then extract in on the desktop.
Step 2: Download XperiaEDual.elf the copy it into the Android.zip extracted folder.
Step 3: Turn off the phone and boot into Fastboot Mode by pressing “Volume Up” and “Power Button” at the same time. Release them when the screen is on.
Step 4: On Android.zip folder, open command prompt window but hold “SHIFT” + “RIGHT-CLICK” on empty space of the folder then click on “Open command window here”.
Step 5: Connect the phone to PC, then it will automatically install the driver (if it is the first time or the PC do not have the driver). Wait for the installation to finish.
Step 6: Now enter the following commands:
fastboot devices
Press enter key to activate.
fastboot flash boot XPERIAEDual.elf
Press enter key to activate.
fastboot reboot
Press enter key to activate.
Now it is done with the installtion of Insecure Kernel then we can start rooting the Xperia E Dual.
How to Root Sony Xperia E Dual
Step 1: Download DooMLoRD_v1-ROOT-insecure-busybox-su.zip then extract it on the desktop.
Step 2: Enable USB debugging option on your phone by going to “Setting” > “Applications” > “Development” > check on the box there to enable “USB Debugging”.
Step 3: Enable Unknown sources option on your phone by going to “Setting” > “Security” > check on the box there to enable “unknown sources”.
Step 4: Connect your phone to PC via USB cable.
Step 5: On the Doomlord extracted folder find a file with this name “runme.bat “ then double-click on it to run.
Step 6: Follow the instruction on the screen.
Now the phone should be rooted. If you encounter any problem, please read the whole article again or use comment section for question.
***
So.
After fastboot flash boot XPERIAEDual.elf and fastboot reboot device cant boot OS. Only Sony logo. When i try to connect to PC - it rebootes in loop and i cant install any drivers. So thereis no access to device and its invisible for my OS.
Logs
---
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot flash boot XPERIAED
ual.elf
sending 'boot' (5352 KB)...
(bootloader) USB download speed was 17236kB/s
OKAY [ 0.337s]
writing 'boot'...
(bootloader) Flash of partition 'boot' requested
(bootloader) S1 partID 0x00000003, block 0x00002000-0x0000bfff
(bootloader) Erase operation complete, 0 bad blocks encountered
(bootloader) Flashing...
(bootloader) Flash operation complete
OKAY [ 0.484s]
finished. total time: 0.822s
c:\Users\kelt\Documents\AndroidRoot\Android\Android>fastboot reboot
rebooting...
finished. total time: 0.004s
---
So can i reflash my firmware or repair my phone?
Click to expand...
Click to collapse
What u did ? how u resolved issue? I have similar problem
Nikhil_android said:
What u did ? how u resolved issue? I have similar problem
Click to expand...
Click to collapse
Hope this guide helps: http://forum.xda-developers.com/xperia-j-e/general/guide-recover-soft-bricks-xperia-2012-t2631456
Mats
Sent from my C1505 using XDA Premium 4 mobile app
This guide is for people whose V20s are stuck in EDL mode or are otherwise unable to boot recovery, fastboot, or laf/download mode. You know if your device is in EDL mode if it does not react when you try to turn it on, and when plugged into a computer, it shows up as Qualcomm HS-USB QDLoader 9008, or some similar variation. If your phone can boot into recovery, fastboot, or laf/download mode, this guide is not for you.
Preface
I only have a VS995, so this guide has only been tested with that. However the firehose programmer I found said it was for a H918 so it will likely work for other variants. I performed these steps on Linux, but the tools used are written in Python and should work on Windows and MacOS too.
I take no responsibility if you mess up your phone doing this. Flashing over EDL is a very powerful process that can totally erase your phone's NAND if you're not careful. This process wil likely require a factory reset and you will likely lose all the data stored on the phone.
Prerequisites
Python 3 - Both tools used in this guide are written in Python 3
KDZTools - Used to extract partition images from KDZ files
Bjoern Kerler's EDL Utility - For flashing partition images in EDL mode
v20-root.zip from this XDA post - For the rooted aboot.img
A stock firmware KDZ - Can be obtained from lg-firmwares.com. I used VS99513A. Choose an appropriate KDZ for your device.
A screwdriver and a paper clip - Used to force the device into EDL mode
prog_ufs_firehose_8996_lite.elf - Firehose programmer file for use with the EDL utility
Since the firehose programmer is copyright LG, I cannot link to it as that would be unauthorized distribution of copyrighted work. It can be found online fairly easily though.
Preparation
1. Windows and MacOS: Download and install Python 3. Most Linux distros come with Python 3 already installed. To check, open a terminal/command window and type python --version. It should say "Python 3.x.x"
2. Download and extract KDZTools to a directory of your choosing
3. Download and extract the EDL utility to a directory of your choosing and follow the setup instructions listed on its GitHub page
4. Download v20-root.zip and extract aboot.img into the directory you extracted the EDL utility into
5. Place your KDZ in the KDZTools directory and open a terminal/command window within that directory
6. Type python unkdz.py -f [NAME OF KDZ FILE].kdz -x and press enter. Once complete, you should have a "kdzextracted" folder containing a DZ file and a few other things. If you get an error about missing zstandard, type pip install zstandard and try again
7. Type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -s and press enter. Once complete, you should have a "dzextracted" folder containing a load of files
8. Create seven folders within "dzextracted", named "lun0", "lun1", "lun2", etc
9. Move all the files prefixed with "B." into the folder titled "lun1", all the files prefixed with "C." into the folder titled "lun2", and so on. Move all the files that are not prefixed with any capital letter into the folder titled "lun0"
10. Rename all the files in each folder and remove the letter and the period from the filename. "E.modem_35910.bin" becomes "modem_35910.bin" for example
11. In the "lun0" folder, delete "userdata.bin"
12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r
13. You should now have seven files titled "rawprogram#.xml" where # is a number from 0 to 6
14. Exit the KDZTools directory and go into the directory containing the EDL utility
15. Place the firehose programmer file into the folder named "Loaders"
16. Follow this iFixit guide up to Step 10 to gain access to your phone's motherboard.
Programming
1. Open a terminal/command window in the folder you extracted the EDL utility to. On Windows, you may need to open the command window as administrator. On MacOS and Linux, you will likely have to run the utility with sudo.
2. Type python edl.py printgpt --memory=ufs and press enter. You should see
Code:
Qualcomm Sahara / Firehose Client V3.2 (c) B.Kerler 2018-2021.
main - Trying with no loader given ...
main - Waiting for the device
If you get a message about missing Capstone and Keystone libraries, ignore it.
3. Put your phone's battery back in
4. Look for the following two pads on your phone's motherboard
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If you can't see them, it's the pair of tiny pads just above the silver square with the H etched into it in the center of the image (Photo courtesy of runningnak3d)
5. Hold your paper clip or other conductive item on those two pads to short them out, then, while holding the paper clip in place, plug your phone into your computer. Keep holding the paper clip in place until you get an error about missing the firehose programmer from the EDL utility
6. Unplug your phone and remove the battery
7. In the message from the EDL utility, you should see a hardware ID and pkhash
8. Rename "prog_ufs_firehose_8996_lite.elf" to [Hardware ID]_[PKHASH]_FHPRG.bin where [Hardware ID] is the hwid provided by the EDL utility, and [PKHASH] is the first 16 characters in the pkhash provided by the EDL utility
9. Follow steps 2-5 again, but this time holding the paper clip in place until you see Programmer uploaded successfully :). If all went well, you should see a list of partition names and a load of hexadecimal offsets and such. This means you've set everything up correctly
10. In the terminal/command window, type python edl.py r fsg fsg.bin --memory=ufs --lun=1 and hit enter. If you get "main - Waiting for the device", unplug your phone, remove the battery, and follow steps 3-5 again until you see Programmer uploaded successfully :)
11. Type python edl.py r modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter.
12. Type python edl.py r modemst2 modemst2.bin --memory=ufs --lun=5 and hit enter. These three steps back up your EFS, which contains your phone's IMEI. We want a backup of this in case it gets corrupted by the flashing process. Your IMEI CANNOT be restored if EFS becomes corrupt and your phone will never be able to be activated on a cellular network again if we do not back up these three partitions first
13. In the terminal/command window, type python edl.py qfil "[PATH TO rawprogram0.xml]" "" "[PATH TO dzextracted/lun0]" --memory=ufs and press enter. Note that all the quotation marks are required.
14. Do step 13 again for each of the seven folders you created, replacing "0" in "rawprogram0.xml" and "lun0" with 1, 2, 3, 4, 5, and 6 as needed. This step will take some time
15. Once you have flashed all 7 "lun#" folders, type python edl.py w aboot aboot.img --memory=ufs --lun=4
16. Once complete, unplug your phone, remove the battery, reattach the backplate, and attempt to turn on the phone. It might boot to Android, but it might not. In my case, it did not boot to Android, but I could access fastboot and laf/download mode again, and I used those to finish fixing my phone.
Potential Problems
If you followed the guide and were able to restore your device to functioning order, but find that you have no signal and your phone reports it has no IMEI, type python edl.py w fsg fsg.bin --memory=ufs --lun=1 and hit enter, then type python edl.py w modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter, then type python edl.py w modemst2 modemst2.bin --memory=ufs --lun=5. These three commands will restore your EFS backup.
getting this error while using unkdz.py command.
[!] Error: Data between headers and payload! (offsets 826 to 83768).
tried different kdz for h918 but the error was consistent.
Kiraisuki said:
This guide is for people whose V20s are stuck in EDL mode or are otherwise unable to boot recovery, fastboot, or laf/download mode. You know if your device is in EDL mode if it does not react when you try to turn it on, and when plugged into a computer, it shows up as Qualcomm HS-USB QDLoader 9008, or some similar variation. If your phone can boot into recovery, fastboot, or laf/download mode, this guide is not for you.
Preface
I only have a VS995, so this guide has only been tested with that. However the firehose programmer I found said it was for a H918 so it will likely work for other variants. I performed these steps on Linux, but the tools used are written in Python and should work on Windows and MacOS too.
I take no responsibility if you mess up your phone doing this. Flashing over EDL is a very powerful process that can totally erase your phone's NAND if you're not careful. This process wil likely require a factory reset and you will likely lose all the data stored on the phone.
Prerequisites
Python 3 - Both tools used in this guide are written in Python 3
KDZTools - Used to extract partition images from KDZ files
Bjoern Kerler's EDL Utility - For flashing partition images in EDL mode
v20-root.zip from this XDA post - For the rooted aboot.img
A stock firmware KDZ - Can be obtained from lg-firmwares.com. I used VS99513A. Choose an appropriate KDZ for your device.
A screwdriver and a paper clip - Used to force the device into EDL mode
prog_ufs_firehose_8996_lite.elf - Firehose programmer file for use with the EDL utility
Since the firehose programmer is copyright LG, I cannot link to it as that would be unauthorized distribution of copyrighted work. It can be found online fairly easily though.
Preparation
1. Windows and MacOS: Download and install Python 3. Most Linux distros come with Python 3 already installed. To check, open a terminal/command window and type python --version. It should say "Python 3.x.x"
2. Download and extract KDZTools to a directory of your choosing
3. Download and extract the EDL utility to a directory of your choosing and follow the setup instructions listed on its GitHub page
4. Download v20-root.zip and extract aboot.img into the directory you extracted the EDL utility into
5. Place your KDZ in the KDZTools directory and open a terminal/command window within that directory
6. Type python unkdz.py -f [NAME OF KDZ FILE].kdz -x and press enter. Once complete, you should have a "kdzextracted" folder containing a DZ file and a few other things. If you get an error about missing zstandard, type pip install zstandard and try again
7. Type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -s and press enter. Once complete, you should have a "dzextracted" folder containing a load of files
8. Create seven folders within "dzextracted", named "lun0", "lun1", "lun2", etc
9. Move all the files prefixed with "B." into the folder titled "lun1", all the files prefixed with "C." into the folder titled "lun2", and so on. Move all the files that are not prefixed with any capital letter into the folder titled "lun0"
10. Rename all the files in each folder and remove the letter and the period from the filename. "E.modem_35910.bin" becomes "modem_35910.bin" for example
11. In the "lun0" folder, delete "userdata.bin"
12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r
13. You should now have seven files titled "rawprogram#.xml" where # is a number from 0 to 6
14. Exit the KDZTools directory and go into the directory containing the EDL utility
15. Place the firehose programmer file into the folder named "Loaders"
16. Follow this iFixit guide up to Step 10 to gain access to your phone's motherboard.
Programming
1. Open a terminal/command window in the folder you extracted the EDL utility to. On Windows, you may need to open the command window as administrator. On MacOS and Linux, you will likely have to run the utility with sudo.
2. Type python edl.py printgpt --memory=ufs and press enter. You should see
Code:
Qualcomm Sahara / Firehose Client V3.2 (c) B.Kerler 2018-2021.
main - Trying with no loader given ...
main - Waiting for the device
If you get a message about missing Capstone and Keystone libraries, ignore it.
3. Put your phone's battery back in
4. Look for the following two pads on your phone's motherboard
View attachment 5243977
If you can't see them, it's the pair of tiny pads just above the silver square with the H etched into it in the center of the image (Photo courtesy of runningnak3d)
5. Hold your paper clip or other conductive item on those two pads to short them out, then, while holding the paper clip in place, plug your phone into your computer. Keep holding the paper clip in place until you get an error about missing the firehose programmer from the EDL utility
6. Unplug your phone and remove the battery
7. In the message from the EDL utility, you should see a hardware ID and pkhash
8. Rename "prog_ufs_firehose_8996_lite.elf" to [Hardware ID]_[PKHASH]_FHPRG.bin where [Hardware ID] is the hwid provided by the EDL utility, and [PKHASH] is the first 16 characters in the pkhash provided by the EDL utility
9. Follow steps 2-5 again, but this time holding the paper clip in place until you see Programmer uploaded successfully :). If all went well, you should see a list of partition names and a load of hexadecimal offsets and such. This means you've set everything up correctly
10. In the terminal/command window, type python edl.py r fsg fsg.bin --memory=ufs --lun=1 and hit enter. If you get "main - Waiting for the device", unplug your phone, remove the battery, and follow steps 3-5 again until you see Programmer uploaded successfully :)
11. Type python edl.py r modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter.
12. Type python edl.py r modemst2 modemst2.bin --memory=ufs --lun=5 and hit enter. These three steps back up your EFS, which contains your phone's IMEI. We want a backup of this in case it gets corrupted by the flashing process. Your IMEI CANNOT be restored if EFS becomes corrupt and your phone will never be able to be activated on a cellular network again if we do not back up these three partitions first
13. In the terminal/command window, type python edl.py qfil "[PATH TO rawprogram0.xml]" "" "[PATH TO dzextracted/lun0]" --memory=ufs and press enter. Note that all the quotation marks are required.
14. Do step 13 again for each of the seven folders you created, replacing "0" in "rawprogram0.xml" and "lun0" with 1, 2, 3, 4, 5, and 6 as needed. This step will take some time
15. Once you have flashed all 7 "lun#" folders, type python edl.py w aboot aboot.img --memory=ufs --lun=4
16. Once complete, unplug your phone, remove the battery, reattach the backplate, and attempt to turn on the phone. It might boot to Android, but it might not. In my case, it did not boot to Android, but I could access fastboot and laf/download mode again, and I used those to finish fixing my phone.
Potential Problems
If you followed the guide and were able to restore your device to functioning order, but find that you have no signal and your phone reports it has no IMEI, type python edl.py w fsg fsg.bin --memory=ufs --lun=1 and hit enter, then type python edl.py w modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter, then type python edl.py w modemst2 modemst2.bin --memory=ufs --lun=5. These three commands will restore your EFS backup.
Click to expand...
Click to collapse
Can you please make a video for this guide
I've been working with your guide to revive my LG V20 and have stopped at step 7.
Kiraisuki said:
7. Type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -s and press enter. Once complete, you should have a "dzextracted" folder containing a load of files
Click to expand...
Click to collapse
When I extract files from .DZ, my "dzextracted" folder is filled with “.image” and “.params” files.
There is no single .BIN file and no file has any letter prefix.
I have tried with multiple .DZ files from different V20 ROMs.
I have even downloaded “VS99513A” ROM you mentioned.
I have tried in Windows (7) and Linux (Mint 20.1).
Every time I get this mess of files.
KDZTools version is from direct link on GitHub you provided.
Are there any additional steps that are missing from guide?
Did anyone tried to revive V20 stuck in EDL mode, and has any tips to share?
Question: How is this different from using the QFIL software from qualcomm which is easier to do than this guide?
Is this EDL mode? Unlocked the bootloader and now uppercut, LGUP, NOTHING "sees" the phone USB connection (tho adb and fastboot do, but something's seriously ___ in there, I can't do much with either adb or fastboot)
Either adb or fastboot complain of "locked" this or that - but unlocked bootloader, from LG... (US996 turns out it has BPT - brightpoint - in the barcode, if that matters)
for h918, @Kiraisuki the elf file not work for me i got this error
Code:
sahara - Trying loader: Loaders\009470e10031026c_2cf7619a278d26073f7eea79bb7f4b7949c221487fea058ea072cffe38ce1496_fhprg.bin
sahara - Uploading loader Loaders\009470e10031026c_2cf7619a278d26073f7eea79bb7f4b7949c221487fea058ea072cffe38ce1496_fhprg.bin ...
sahara
sahara - [LIB]: Timeout while uploading loader. Wrong loader ?
No suitable loader found :(
no, edl mode must
virginwidow said:
Is this EDL mode? Unlocked the bootloader and now uppercut, LGUP, NOTHING "sees" the phone USB connection (tho adb and fastboot do, but something's seriously ___ in there, I can't do much with either adb or fastboot)
Either adb or fastboot complain of "locked" this or that - but unlocked bootloader, from LG... (US996 turns out it has BPT - brightpoint - in the barcode, if that matters)
View attachment 5305585
Click to expand...
Click to collapse
no , edl mode is black screen no bootloader, no recovery , no charge animation, nothing just 9008 mode
try to install original kdz with lgup
walidham said:
no, edl mode must
no , edl mode is black screen no bootloader, no recovery , no charge animation, nothing just 9008 mode
try to install original kdz with lgup
Click to expand...
Click to collapse
TY for response -
It appears I'm in a 'purgatory' between brick and "dead"... due to being a noob again (nothing like breaking things to learn).
LGUP, Uppercut - both of these go "No Device Connected" - the closest I can provide for a logcat is 'getvar all' from fastboot.
Code:
fastboot getvar all
(bootloader) version:0.5
(bootloader) variant:MTP eMMC
(bootloader) secure:yes
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) display-panel:
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) max-download-size: 0x20000000
(bootloader) partition-type:cache:ext4
(bootloader) partition-size:cache: 0x4d000000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0xced000000
(bootloader) partition-type:system:ext4
(bootloader) partition-size:system: 0x180000000
(bootloader) serialno:LGUS996fzzzzzzzz
(bootloader) kernel:lk
(bootloader) product:MSM8996
(bootloader) unlocked:yes
all:
finished. total time: 0.194s
(Serial editted) There's not enuff info left for the usual end-user tools to "see"
Any thoughts?
Thanks in Advance
VW
........main - Device detected
main - Mode detected: sahara
Device is in EDL mode .. continuing.
sahara -
------------------------
HWID: 0x009470e100310000 (MSM_ID:0x009470e1,OEM_ID:0x0031,MODEL_ID:0x0000)
CPU detected: "MSM8996"
PK_HASH: 0x2cf7619a278d26073f7eea79bb7f4b7949c221487fea058ea072cffe38ce1496
Serial: 0xe895007b
sahara - Detected loader: Loaders\009470e100310000_2cf7619a278d2607_[FHPRG].bin
sahara - Uploading loader Loaders\009470e100310000_2cf7619a278d2607_[FHPRG].bin ...
Successfully uploaded programmer
firehose - Nop succeeded.
firehose - Chip serial num: 3902079099 (0xe895007b)
oneplus
oneplus - [LIB]: No module named 'Library.Modules.oneplus_param'
firehose -
firehose_client - Target detected: MSM8996
firehose
firehose - [LIB]: <?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="fh.attrs.MaxPayloadSizeToTargetInBytes of 1048576 > fh.channel_buffer_capacity of 4096"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1'"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Calling hotplug_poll_device('UFS')"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="Storage device of type 'UFS' cannot be opened"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="storage_device_open() returned FALSE"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR 13: Line 1142: HANDLE_CONFIGURE_FAILURE"/>
</data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" />
</data>
\\\\\\\\\\\\\\\\Getiing this error/////////////// oneplus param And firehose lib
facing this problem
[Question]
At the step 12 of preparation
"12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r"
There were no rawprogram.xml and cmd window showed
C:\kdztools>undz.py -f kdzextracted/H99010b_00.dz -r
usage: undz.py [-h] -f DZFILE (-l | -x | -c | -s | -i) [-d OUTDIR]
undz.py: error: one of the arguments -l/--list -x/--extract -c/--chunk -s/--sing
le -i/--image is required
How to generate the xml files? Thanks.
Illusings said:
[Question]
At the step 12 of preparation
"12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r"
There were no rawprogram.xml and cmd window showed
C:\kdztools>undz.py -f kdzextracted/H99010b_00.dz -r
usage: undz.py [-h] -f DZFILE (-l | -x | -c | -s | -i) [-d OUTDIR]
undz.py: error: one of the arguments -l/--list -x/--extract -c/--chunk -s/--sing
le -i/--image is required
How to generate the xml files? Thanks.
Click to expand...
Click to collapse
getting this same error. has anyone fixed it?
dmad767 said:
getting this same error. has anyone fixed it?
Click to expand...
Click to collapse
Illusings said:
[Question]
At the step 12 of preparation
"12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r"
There were no rawprogram.xml and cmd window showed
C:\kdztools>undz.py -f kdzextracted/H99010b_00.dz -r
usage: undz.py [-h] -f DZFILE (-l | -x | -c | -s | -i) [-d OUTDIR]
undz.py: error: one of the arguments -l/--list -x/--extract -c/--chunk -s/--sing
le -i/--image is required
How to generate the xml files? Thanks.
Click to expand...
Click to collapse
i found a fix
dmad767 said:
i found a fix
Click to expand...
Click to collapse
how did you fix it
ezzony said:
Question: How is this different from using the QFIL software from qualcomm which is easier to do than this guide?
Click to expand...
Click to collapse
the goal is the same, I think it's easier with qfil partition manager. because the results of extracting the .dz file are in the form of a single image without the lun description as described above.
ROMSG said:
how did you fix it
Click to expand...
Click to collapse
I suggest using qfil manager (raw data manager), manually input the image file to be flashed.
Kiraisuki said:
This guide is for people whose V20s are stuck in EDL mode or are otherwise unable to boot recovery, fastboot, or laf/download mode. You know if your device is in EDL mode if it does not react when you try to turn it on, and when plugged into a computer, it shows up as Qualcomm HS-USB QDLoader 9008, or some similar variation. If your phone can boot into recovery, fastboot, or laf/download mode, this guide is not for you.
Preface
I only have a VS995, so this guide has only been tested with that. However the firehose programmer I found said it was for a H918 so it will likely work for other variants. I performed these steps on Linux, but the tools used are written in Python and should work on Windows and MacOS too.
I take no responsibility if you mess up your phone doing this. Flashing over EDL is a very powerful process that can totally erase your phone's NAND if you're not careful. This process wil likely require a factory reset and you will likely lose all the data stored on the phone.
Prerequisites
Python 3 - Both tools used in this guide are written in Python 3
KDZTools - Used to extract partition images from KDZ files
Bjoern Kerler's EDL Utility - For flashing partition images in EDL mode
v20-root.zip from this XDA post - For the rooted aboot.img
A stock firmware KDZ - Can be obtained from lg-firmwares.com. I used VS99513A. Choose an appropriate KDZ for your device.
A screwdriver and a paper clip - Used to force the device into EDL mode
prog_ufs_firehose_8996_lite.elf - Firehose programmer file for use with the EDL utility
Since the firehose programmer is copyright LG, I cannot link to it as that would be unauthorized distribution of copyrighted work. It can be found online fairly easily though.
Preparation
1. Windows and MacOS: Download and install Python 3. Most Linux distros come with Python 3 already installed. To check, open a terminal/command window and type python --version. It should say "Python 3.x.x"
2. Download and extract KDZTools to a directory of your choosing
3. Download and extract the EDL utility to a directory of your choosing and follow the setup instructions listed on its GitHub page
4. Download v20-root.zip and extract aboot.img into the directory you extracted the EDL utility into
5. Place your KDZ in the KDZTools directory and open a terminal/command window within that directory
6. Type python unkdz.py -f [NAME OF KDZ FILE].kdz -x and press enter. Once complete, you should have a "kdzextracted" folder containing a DZ file and a few other things. If you get an error about missing zstandard, type pip install zstandard and try again
7. Type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -s and press enter. Once complete, you should have a "dzextracted" folder containing a load of files
8. Create seven folders within "dzextracted", named "lun0", "lun1", "lun2", etc
9. Move all the files prefixed with "B." into the folder titled "lun1", all the files prefixed with "C." into the folder titled "lun2", and so on. Move all the files that are not prefixed with any capital letter into the folder titled "lun0"
10. Rename all the files in each folder and remove the letter and the period from the filename. "E.modem_35910.bin" becomes "modem_35910.bin" for example
11. In the "lun0" folder, delete "userdata.bin"
12. In the command window, type python undz.py -f kdzextracted/[NAME OF DZ FILE].dz -r
13. You should now have seven files titled "rawprogram#.xml" where # is a number from 0 to 6
14. Exit the KDZTools directory and go into the directory containing the EDL utility
15. Place the firehose programmer file into the folder named "Loaders"
16. Follow this iFixit guide up to Step 10 to gain access to your phone's motherboard.
Programming
1. Open a terminal/command window in the folder you extracted the EDL utility to. On Windows, you may need to open the command window as administrator. On MacOS and Linux, you will likely have to run the utility with sudo.
2. Type python edl.py printgpt --memory=ufs and press enter. You should see
Code:
Qualcomm Sahara / Firehose Client V3.2 (c) B.Kerler 2018-2021.
main - Trying with no loader given ...
main - Waiting for the device
If you get a message about missing Capstone and Keystone libraries, ignore it.
3. Put your phone's battery back in
4. Look for the following two pads on your phone's motherboard
View attachment 5243977
If you can't see them, it's the pair of tiny pads just above the silver square with the H etched into it in the center of the image (Photo courtesy of runningnak3d)
5. Hold your paper clip or other conductive item on those two pads to short them out, then, while holding the paper clip in place, plug your phone into your computer. Keep holding the paper clip in place until you get an error about missing the firehose programmer from the EDL utility
6. Unplug your phone and remove the battery
7. In the message from the EDL utility, you should see a hardware ID and pkhash
8. Rename "prog_ufs_firehose_8996_lite.elf" to [Hardware ID]_[PKHASH]_FHPRG.bin where [Hardware ID] is the hwid provided by the EDL utility, and [PKHASH] is the first 16 characters in the pkhash provided by the EDL utility
9. Follow steps 2-5 again, but this time holding the paper clip in place until you see Programmer uploaded successfully :). If all went well, you should see a list of partition names and a load of hexadecimal offsets and such. This means you've set everything up correctly
10. In the terminal/command window, type python edl.py r fsg fsg.bin --memory=ufs --lun=1 and hit enter. If you get "main - Waiting for the device", unplug your phone, remove the battery, and follow steps 3-5 again until you see Programmer uploaded successfully :)
11. Type python edl.py r modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter.
12. Type python edl.py r modemst2 modemst2.bin --memory=ufs --lun=5 and hit enter. These three steps back up your EFS, which contains your phone's IMEI. We want a backup of this in case it gets corrupted by the flashing process. Your IMEI CANNOT be restored if EFS becomes corrupt and your phone will never be able to be activated on a cellular network again if we do not back up these three partitions first
13. In the terminal/command window, type python edl.py qfil "[PATH TO rawprogram0.xml]" "" "[PATH TO dzextracted/lun0]" --memory=ufs and press enter. Note that all the quotation marks are required.
14. Do step 13 again for each of the seven folders you created, replacing "0" in "rawprogram0.xml" and "lun0" with 1, 2, 3, 4, 5, and 6 as needed. This step will take some time
15. Once you have flashed all 7 "lun#" folders, type python edl.py w aboot aboot.img --memory=ufs --lun=4
16. Once complete, unplug your phone, remove the battery, reattach the backplate, and attempt to turn on the phone. It might boot to Android, but it might not. In my case, it did not boot to Android, but I could access fastboot and laf/download mode again, and I used those to finish fixing my phone.
Potential Problems
If you followed the guide and were able to restore your device to functioning order, but find that you have no signal and your phone reports it has no IMEI, type python edl.py w fsg fsg.bin --memory=ufs --lun=1 and hit enter, then type python edl.py w modemst1 modemst1.bin --memory=ufs --lun=5 and hit enter, then type python edl.py w modemst2 modemst2.bin --memory=ufs --lun=5. These three commands will restore your EFS backup.
Click to expand...
Click to collapse
If you have successfully manage to generate raw program.xml. why don't you just share with us and save us from the trouble
Faisal_Mystic said:
If you have successfully manage to generate raw program.xml. why don't you just share with us and save us from the trouble
Click to expand...
Click to collapse
Is your phone having problems? if the partition can still be read by QFIL, you can still manually flash the partitions one by one. But if the partition is blank, I have a raw firmware backup from kdz H990DS. It can be used to save the phone to boot and enter download mode. then just fix it with LGup partition DL, select All partition
lambtur said:
Is your phone having problems? if the partition can still be read by QFIL, you can still manually flash the partitions one by one. But if the partition is blank, I have a raw firmware backup from kdz H990DS. It can be used to save the phone to boot and enter download mode. then just fix it with LGup partition DL, select All partition
Click to expand...
Click to collapse
if you have such backup firmware it would be so nice of you if you upload on G_Drive and provide me the links
I will be very grateful