Unbrick G Stylo LS770 Qualcomm HS-USB QDLoader 9008 mode - LG G Stylo ROMs, Kernels, Recoveries, & Other Deve

Code:
Process Index:0
please select the XML file
Start Download
COM Port number:4
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Ack Raw Data:False
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:4
Sending NOP
FireHose NOP sent successfully
Sending Configuration
Device Type:eMMC
Platform:8x26
Set TxBuffer 0x4000, RxBuffer 0x4000
Firehose configure packet sent successfully!
Total Bytes To Program 0x102A2A0
Download Image
PROGRAM: Partition 0, Sector: 0, Length: 33 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\gpt_backup0.bin
PROGRAM: Written Bytes 0x4200 (64)
Program Size: 0.02 MB
PROGRAM: Partition 0, Sector: 0, Length: 34 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\gpt_main0.bin
PROGRAM: Written Bytes 0x4400 (64)
Program Size: 0.02 MB
PROGRAM: Replace the partition sectors number 0xc000 to file size in sector 0x7134
PROGRAM: Partition 0, Sector: 93184, Length: 28980 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\laf.img
PROGRAM: Written Bytes 0xe26800 (64)
Program Size: 14.15 MB
PROGRAM: Replace the partition sectors number 0x1000 to file size in sector 0x7d9
PROGRAM: Partition 0, Sector: 5120, Length: 2009 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\emmc_appsboot.mbn
PROGRAM: Written Bytes 0xfb200 (64)
Program Size: 0.98 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x12f
PROGRAM: Partition 0, Sector: 4096, Length: 303 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\rpm.mbn
PROGRAM: Written Bytes 0x25e00 (64)
Program Size: 0.15 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x70
PROGRAM: Partition 0, Sector: 3072, Length: 112 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\hyp.mbn
PROGRAM: Written Bytes 0xe000 (64)
Program Size: 0.05 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x3b1
PROGRAM: Partition 0, Sector: 2048, Length: 945 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\tz.mbn
PROGRAM: Written Bytes 0x76200 (64)
Program Size: 0.46 MB
PROGRAM: Replace the partition sectors number 0x400 to file size in sector 0x2b1
PROGRAM: Partition 0, Sector: 1024, Length: 689 Sectors, Sector Size: 512 Bytes
File: C:\unbrick\sbl1.mbn
PROGRAM: Written Bytes 0x56200 (64)
Program Size: 0.34 MB
Total Size: 16.16 MB
Total Size: 1 Seconds
Throughput: 16.16 MB/Seconds
PATCH: Partition 0, Sector: 11, Offset 296 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.
PATCH: Partition 0, Sector: 0, Offset 296 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.
PATCH: Partition 0, Sector: 1, Offset 48 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.
PATCH: Partition 0, Sector: 0, Offset 48 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-34.
PATCH: Partition 0, Sector: 1, Offset 32 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-1.
PATCH: Partition 0, Sector: 0, Offset 24 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-1.
PATCH: Partition 0, Sector: 0, Offset 72 Bytes, Size: 8 Bytes, Value: NUM_DISK_SECTORS-33.
PATCH: Partition 0, Sector: 1, Offset 88 Bytes, Size: 4 Bytes, Value: CRC32(2,5120)
PATCH: Partition 0, Sector: 0, Offset 88 Bytes, Size: 4 Bytes, Value: CRC32(NUM_DISK_SECTORS-33.,5120)
PATCH: Partition 0, Sector: 1, Offset 16 Bytes, Size: 4 Bytes, Value: 0
PATCH: Partition 0, Sector: 1, Offset 16 Bytes, Size: 4 Bytes, Value: CRC32(1,92)
PATCH: Partition 0, Sector: 0, Offset 16 Bytes, Size: 4 Bytes, Value: 0
PATCH: Partition 0, Sector: 0, Offset 16 Bytes, Size: 4 Bytes, Value: CRC32(NUM_DISK_SECTORS-1.,92)
Total download file size: 16.16455MB
Throughput: 16.16455M/s
Reset Phone
Waiting for reset done...
Finish Download
Successful unbrick LG LS770 9008 mode
Use QFIL to flash the LS770 recovery file, it works on LS770 with ZV5 only. If you hard bricked at LS770ZV5, then you can unbrick it by flashing the recovery file with QFIL
emmc_appsboot.mbn
gpt_backup0.bin
gpt_both0.bin
gpt_main0.bin
hyp.mbn
laf.img
MPRG8916.mbn
New9008.zip
old_prog_emmc_firehose_8916.mbn
partition-c70n_global_com.xml
patch0.xml
prog_emmc_firehose_8916.mbn
rawprogram0.xml
rpm.mbn
sbl1.mbn
tz.mbn
validated_emmc_firehose_8916.mbn

asialove2013 said:
Hi, I am trying to find out how to unbrick a G Stylo LS770 stuck on Qualcomm HS-USB QDLoader 9008 mode.
First, I need to get the rawprogram0.xml for G Stylo LS770..
from a rooted working LS770 model:
Code:
adb shell su -c 'dd if=/dev/block/mmcblk0 of=/cache/partition0.bin bs=512 count=20480'
Get partition0.bin
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
00 04 00 is sbl1 -Start LBA
00 07 FF is sbl1 - end LBA
In the original Boarddiag tool, there are rawprogram0.xml file for other LG models.
I have to edit it based on the information from partition file i just got.
below entry is what i create based on partition table
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="sbl1.mbn" label="sbl1" num_partition_sectors="1024" physical_partition_number="0" size_in_KB="512.0" sparse="false" start_byte_hex="0x80000" start_sector="1024" />
num_partition_sectors: End LBA- start LBA+1 = 400, Convert it to HEX, that is 1024
start_sector = Start LBA, and convert it to HEX, that is 1024.
start_byte_hex : 1024*512= 524288 convert to hex, it is 80000
Now we have the rawprogram0.xml
---
Forgive my bad English,..(
Click to expand...
Click to collapse
wheres the rawprogram can you share it with me ?
---------- Post added at 03:13 PM ---------- Previous post was at 03:01 PM ----------
jcsaclolo said:
wheres the rawprogram can you share it with me ?
Click to expand...
Click to collapse
hello i got bricked LG LS770 ZV7 it is hard bricked and stuck on QDLoader 9008 i need tot firmware DLL and xml files if you can help me unbrick it im willing to pay just give me step by step instructions. Im not tech savvy willing to pay 100$ to 150$ depend on situation i am very upset about this so i would thank you a lot and pay you if you could really help me please email me at [email protected].com

No need DLL
jcsaclolo said:
wheres the rawprogram can you share it with me ?
---------- Post added at 03:13 PM ---------- Previous post was at 03:01 PM ----------
hello i got bricked LG LS770 ZV7 it is hard bricked and stuck on QDLoader 9008 i need tot firmware DLL and xml files if you can help me unbrick it im willing to pay just give me step by step instructions. Im not tech savvy willing to pay 100$ to 150$ depend on situation i am very upset about this so i would thank you a lot and pay you if you could really help me please email me at [email protected]
Click to expand...
Click to collapse
Just start working on this. I know you! We have been talking about the LS770 QDLoader 9008 issue for almost 30 days.
No need DLL, I am just trying to use LG's official smart boot diag tool to solve this, I will let you know when i got further information.

Successful GOT My LS770 back from Qualcomm HS-USB QDLoader 9008 mode.
now in download mode,
ZV5 is fine,
But ZV7 has Qufse check fail error,

asialove2013 said:
Successful GOT My LS770 back from Qualcomm HS-USB QDLoader 9008 mode.
now in download mode,
ZV5 is fine,
But ZV7 has Qufse check fail error,
Click to expand...
Click to collapse
Could you please post the files you used to do so?

jcsaclolo said:
wheres the rawprogram can you share it with me ?
---------- Post added at 03:13 PM ---------- Previous post was at 03:01 PM ----------
hello i got bricked LG LS770 ZV7 it is hard bricked and stuck on QDLoader 9008 i need tot firmware DLL and xml files if you can help me unbrick it im willing to pay just give me step by step instructions. Im not tech savvy willing to pay 100$ to 150$ depend on situation i am very upset about this so i would thank you a lot and pay you if you could really help me please email me at [email protected]
Click to expand...
Click to collapse
Do you have the ZV5 tot file? What was the final outcome of flashing back to ZV5 from ZV7?
I would like to get a copy of zv5, so how can I get that? Thank you

another try
All LG G Stylo use 8X26, SEE Screen shot below

no way
Sorry, can not share the file!

I am working on it.
I will share as I success
Sent from my XT1093 using XDA-Developers mobile app

asialove2013 said:
Not free! It is no shame to share free kdz firmware, I have share lots of G5, V10, G4, G3, K10, firmware.
I do not share LG G5 H850 TOT firmware because it was build by some developers at xda.
I do not share LG LS770 tot because it was build by others too.
Some one said that it should be free, but you can never get it from AT & T or Sprint,
I noticed you (Wired66) shared other developers ls770 firmware and making profit from it?
So I will never share files to unbrick Quancomm 9008 mode, SORRY
Click to expand...
Click to collapse
Are you okay, really? You know the code in those .TOT files is owned by LG right. Making a tot file is just copy and pasting someone else's work. It does not make it yours no matter how much you want it to be.
And no i'm not in the business of selling big corporations code, where the heck did you pull that out of.
This is your thread you can argue with whoever unwittingly post in it, but I'm out.

sorry
Wired66 said:
Are you okay, really? You know the code in those .TOT files is owned by LG right. Making a tot file is just copy and pasting someone else's work. It does not make it yours no matter how much you want it to be.
And no i'm not in the business of selling big corporations code, where the heck did you pull that out of.
This is your thread you can argue with whoever unwittingly post in it, but I'm out.
Click to expand...
Click to collapse
Sorry, It is my mistake, I mistake you with some one else

you are right
I am trying to edit my previous post,,

asialove2013 said:
Sorry, It is my mistake, I mistake you with some one else
Click to expand...
Click to collapse
No hard feelings, on my part.
I'm taking a stab at throwing together some .TOT files on my own. I should have at least one that I'm throwing together for the LS-770 here later today. I'll post them here on XDA as the community really could use them. If you change your mind about posting those files I would have three other phones to test them out on that I bricked poking at this locked bootloader.

Please do a tot file for for boost stylo zv5 (5.11).Thanks!!
Sent from my N9521 using Tapatalk

please help me for how repair LG G Stylo LS770 Unbrick MSM8916 fast
thank you

After researching, and waiting months for a .tot file to come out, I have successfully fixed my LS770 Boost Mobile Stylo. I kinda missed this thing. I'll help anyone who needs it. I WILL NOT charge, either. Ain't Android suppose to be Open Source? Then lets keep it 'Open'

mabry said:
After researching, and waiting months for a .tot file to come out, I have successfully fixed my LS770 Boost Mobile Stylo. I kinda missed this thing. I'll help anyone who needs it. I WILL NOT charge, either. Ain't Android suppose to be Open Source? Then lets keep it 'Open'
Click to expand...
Click to collapse
I am trying to find a ZV5 tot, if you can help, thanks. Also if you understand quse, how can I understand flashing and qfuse, thanks

mabry said:
After researching, and waiting months for a .tot file to come out, I have successfully fixed my LS770 Boost Mobile Stylo. I kinda missed this thing. I'll help anyone who needs it. I WILL NOT charge, either. Ain't Android suppose to be Open Source? Then lets keep it 'Open'
Click to expand...
Click to collapse
You were in QDLoader Mode? I could really use the files to debrick some phones. I got as far as getting to a download mode with a black screen and a battery symbol before I put the battery back in but nothing flashes and then upon reboot I'm back to QDloader mode. I must have one of the files off.

jcsaclolo said:
wheres the rawprogram can you share it with me ?
---------- Post added at 03:13 PM ---------- Previous post was at 03:01 PM ----------
hello i got bricked LG LS770 ZV7 it is hard bricked and stuck on QDLoader 9008 i need tot firmware DLL and xml files if you can help me unbrick it im willing to pay just give me step by step instructions. Im not tech savvy willing to pay 100$ to 150$ depend on situation i am very upset about this so i would thank you a lot and pay you if you could really help me please email me at [email protected]
Click to expand...
Click to collapse
can u help my lg ls770zv7 don't pass from lg screen it's on 6.0 android

mabry said:
After researching, and waiting months for a .tot file to come out, I have successfully fixed my LS770 Boost Mobile Stylo. I kinda missed this thing. I'll help anyone who needs it. I WILL NOT charge, either. Ain't Android suppose to be Open Source? Then lets keep it 'Open'
Click to expand...
Click to collapse
would like help in fixing my lg g stylo I'm stuck in QUALCOMM hs-usb qdloader 9008 after using the lg up tool to flash zv7 tot I had forgothen the bloody device updated itself to zv8, so I was playing around with kingoroot managed to delete the recovery wihich in part enables fastboot mode. after failing to input commads I decided to flash back and now qfuse screws me over. help would be appreciated.

Related

[Q] Problem with Heimdall

I try to use the new version of Heimdall but when starting to flash I had the following error:
Code:
Heimdall v1.3.0, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
Initialising connection...
Detecting device...
ERROR: Failed to access device. libusb error: -3
Is there anybody that could explain the problem ?
However my SGS-2 is detect in the utilities tab.
Thanks for your answers.
Django313 said:
I try to use the new version of Heimdall but when starting to flash I had the following error:
Code:
Heimdall v1.3.0, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
Initialising connection...
Detecting device...
ERROR: Failed to access device. libusb error: -3
Is there anybody that could explain the problem ?
However my SGS-2 is detect in the utilities tab.
Thanks for your answers.
Click to expand...
Click to collapse
Heimdall is flashing software? Why not use Odin?
As far as I understand Heimdall is for use on Galaxy S, not S2.
theo80 said:
Heimdall is flashing software? Why not use Odin?
As far as I understand Heimdall is for use on Galaxy S, not S2.
Click to expand...
Click to collapse
Because Heimdall is stable, reliable, open-source, cross-platform, allows for a large degree of flashing freedom and is guaranteed to be legal. None of these are true for Odin. Although not necessarily overly important Heimdall also flashes substantially faster.
Also as of 1.3.0 Heimdall Frontend now supports Heimdall Firmware Packages, which are by far a superior than attempting to flash several description-less tar archives with Odin.
EDIT: Heimdall works with all Galaxy S devices, except the Droid Charge, which we've had difficulties with. Which is another advantage over Odin; one version of Heimdall works with all devices so there's less confusion about versions.
Django313 said:
I try to use the new version of Heimdall but when starting to flash I had the following error:
Code:
Heimdall v1.3.0, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
Initialising connection...
Detecting device...
ERROR: Failed to access device. libusb error: -3
Is there anybody that could explain the problem ?
However my SGS-2 is detect in the utilities tab.
Thanks for your answers.
Click to expand...
Click to collapse
What OS are you running? If it's Windows make sure you follow the README and install the drivers.
@Benjamin Dobell
Yes, I use heimdall 1.3.0 on Kubuntu 11.04.
I read your e-mail and I try to launch Heimdall with sudo and it works !
but it's finished bad, resulting in a "half-bricked" SGS-2.
the flash of the datafs partition, when reaching 100% freeze and heimdall sent the error that it couldn't load datafs. ending the session...
I try twice flashing my phone:
- one with my own built heimdall-firmware-packages
- the other was custom flashing.
both failed.
The third flashing I made with odin in a virtualbox, and succeeded.
here is the results when launching Heimdall in a terminal :
Code:
[email protected]:~$ sudo heimdall-frontend
[sudo] password for didier:
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
QInotifyFileSystemWatcherEngine::addPaths: inotify_add_watch failed: Aucun fichier ou dossier de ce type
QFileSystemWatcher: failed to add paths: /home/didier/.config/ibus/bus
KGlobal::locale::Warning your global KLocale is being recreated with a valid main component instead of a fake component, this usually means you tried to call i18n related functions before your main component was created. You should not do that since it most likely will not work
Error: "/tmp/kde-didier" is owned by uid 1000 instead of uid 0.
Error: "/tmp/ksocket-didier" is owned by uid 1000 instead of uid 0.
kdeinit4: Shutting down running client.
Connecting to deprecated signal QDBusConnectionInterface::serviceOwnerChanged(QString,QString,QString)
Error: "/tmp/ksocket-didier" is owned by uid 1000 instead of uid 0.
Error: "/tmp/kde-didier" is owned by uid 1000 instead of uid 0.
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
kbuildsycoca4 running...
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
Error: "/tmp/ksocket-didier" is owned by uid 1000 instead of uid 0.
Error: "/var/tmp/kdecache-didier" is owned by uid 1000 instead of uid 0.
[email protected]:~$
Django313 said:
@Benjamin Dobell
Yes, I use heimdall 1.3.0 on Kubuntu 11.04.
I read your e-mail and I try to launch Heimdall with sudo and it works !
but it's finished bad, resulting in a "half-bricked" SGS-2.
the flash of the datafs partition, when reaching 100% freeze and heimdall sent the error that it couldn't load datafs. ending the session...
I try twice flashing my phone:
- one with my own built heimdall-firmware-packages
- the other was custom flashing.
both failed.
Click to expand...
Click to collapse
In regards to sudo permissions being required, I just did a bit of searching and I found some information (although it may have been old) that Kubuntu's udev rules are in a different location to Ubuntu's. I also found separate information indicating that Kubuntu is using an outdated udev rules specification. Either of these two things would cause the -3 permissions error without running Heimdall as a super user.
Do you know exactly what the error was you received from Heimdall when flashing failed? The output from Heimdall Frontend only contains the permissions errors and aren't related to the flashing process. When you use Heimdall Frontend, Heimdall's output is displayed in "Status" section of the "Flash" tab so that it can easily be copy and paste.
By the way if your phone gets stuck in a "half-bricked" state again then it can usually be fixed by going to the "Utilities" tab and running the "Close PC Screen" action. This doesn't repair any corrupted files on device (if there are any). This literally just tells the phone that it should at least try boot up, instead of displaying the phone <--> PC screen.
Help please
trying to run heimdall 1.3.0 on Mac OS 10.5.8, I have qt/xcode installed, still doesn't seem to work. everytime i run frontend and try to detect my device (samsung captivate)or save my .pit file I get "FRONTEND ERROR Heimdall crash"
Any suggestions ?
ERROR: Failed to access device. libusb error: -12
Win7 x64
Installed drivers:
Heimdall v1.3.0, Copyright (c) 2010-2011, Benjamin Dobell, Glass Echidna http://www.glassechidna.com.au
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/
Initialising connection...
Detecting device...
Claiming interface...
Setting up interface...
Beginning session...
Handshaking with Loke...
Uploading PITERROR: Failed to send end session packet!
ERROR: Failed to send file part packet!
PIT upload failed!
Ending session...
Odin works, back to odin.
Problem with heimdall on mac 0s 10.5.8
Crappyvate said:
trying to run heimdall 1.3.0 on Mac OS 10.5.8, I have qt/xcode installed, still doesn't seem to work. everytime i run frontend and try to detect my device (samsung captivate)or save my .pit file I get "FRONTEND ERROR Heimdall crash"
Any suggestions ?
Click to expand...
Click to collapse
@benjamin
Problem solved after updating to osx 10.6
there seem to be issues between Heimdall 1.3 on Leopard 10.5 and certain binaries. Heimdall command line does not execute and just crashes.
I'm getting a similar error on Arch Linux running Heimdall v1.3.0 with my Fascinate:
Code:
Initialising connection...
Detecting device...
ERROR: Failed to access device. libusb error: 4
I do have the proper udev rules in place:
Code:
$ lsusb | grep Samsung
Bus 002 Device 068: ID 04e8:6601 Samsung Electronics Co., Ltd Mobile Phone
I couldn't get Heimdall to even detect the device on my MacBook Pro running 10.6.8. I don't have access to a Windows machine to do further testing, and have had a lot of issues trying to update pretty much anything on my phone after I rooted and put a Superclean ROM on a few months ago. Here's my current setup: pastie.org/2358372
Today I tried to flash my SGS-II with heimdall 1.3.0 on Linux Kubuntu 11.04.
I used the latest firmware XXKH3 and it failed as it did with the firmware XXKG6 few weeks ago. Just after it downloaded the file "datafs" it freeze resulting in a half-bricked phone.
Certainly there is a bug in heimdall at this point because all the others files are correctly downloaded.
the question is : why ?
I'm on Mac OsX 10.6.8, and after tried to flash my firmware using the downloaded PIT from my device, Heimdall told me that there were an error with libusb while it was trying to upload the PIT.
My SGS got semi-bricked, and after putting it to download mode again and unchecking Repartition in Heimdall, everything was fine with the flashing.
So, the question is... is there a bug with repartitioning? is it possible to use my device's PIT to repartition?
Need new bootloader for EPIC? How do I tell?
All, I picked up an EPIC from someone and they put DK28 on it which is a bit of a dead end. All searches turned up needing Odin and I don't have a Windows box. I then found Heimdall and then this thread here:
http://forum.xda-developers.com/showthread.php?t=1353310
This all looks promising but then I've read where I need to update the bootloader if I'm using a Mac. My question is, with an EPIC of somewhat unknown past, how do I know if I have the right bootloader on it? DK28 is the leaked Froyo that never got OTA'd. I want to get this EPIC back onto the OTA track so it can get Gingerbread. I've found CWM flashable images but the modem seems to be the biggest struggle. Of course, if Heimdall works, the thread above looks like it will get me all that I want.
So if anyone can help and tell me how to figure out if I've got the right bootloader and won't get the black screen problem, that would be cool.
thanks peterb
Need some help please
My device got messed up and I know nothing about using Linux or fixing partitions with ADB, I have the partition tables I need to fix it but I have no clue and no one in our community knows how to change the "head" sectors from four to ONE. Please this is my partition list from heimdal
Entry Count: 14
Unknown 1: 15718400
Unknown 2: 1
Unknown 3: 0
Unknown 4: 0
Unknown 5: 7703
Unknown 6: 237
Unknown 7: 62704
Unknown 8: 18
--- Entry #0 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 1
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 1
Unknown 2: 0
Unknown 3: 0
Partition Name: IBL+PBL
Filename: boot.bin
--- Entry #1 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 2
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 1
Unknown 2: 0
Unknown 3: 0
Partition Name: PIT
Filename: YPG70_8G-0304.pit
--- Entry #2 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 3
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 5
Unknown 2: 0
Unknown 3: 0
Partition Name: SBL
Filename: Sbl.bin
--- Entry #3 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 4
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 5
Unknown 2: 6226025
Unknown 3: 7143533
Partition Name: SBL2
Filename: Sbl.bin
--- Entry #4 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 5
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 20
Unknown 2: 0
Unknown 3: 0
Partition Name: PARAM
Filename: param.lfs
--- Entry #5 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 6
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 40
Unknown 2: 39021280
Unknown 3: 7143533
Partition Name: EFS
Filename: efs.rfs
--- Entry #6 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 7
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 30
Unknown 2: 36662408
Unknown 3: 0
Partition Name: KERNEL
Filename: zImage
--- Entry #7 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 8
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 30
Unknown 2: 6684793
Unknown 3: 3014771
Partition Name: RECOVERY
Filename: zImage
--- Entry #8 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 9
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 1160
Unknown 2: 0
Unknown 3: 0
Partition Name: FACTORYFS
Filename: factoryfs.rfs
--- Entry #9 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 10
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 536
Unknown 2: 6684780
Unknown 3: 115
Partition Name: DBDATAFS
Filename: dbdata.rfs
--- Entry #10 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 11
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 256
Unknown 2: 115
Unknown 3: 115
Partition Name: CACHE
Filename: cache.rfs
--- Entry #11 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 12
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 7696
Unknown 2: 0
Unknown 3: 0
Partition Name: DATAFS
Filename: datafs.rfs
--- Entry #12 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 13
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 256
Partition Block Count: 20516
Unknown 2: 0
Unknown 3: 0
Partition Name: USERFS
Filename: userfs_8G.rfs
--- Entry #13 ---
Unused: No
Chip Identifier: 2 (Unused: %
s
)
Partition Identifier: 0
Partition Flags: 1 (R)
Unknown 1: 0
Partition Block Size: 0
Partition Block Count: 0
Unknown 2: 0
Unknown 3: 0
Partition Name: GANG
Filename: inand_8G.bin
Ending session...
Rebooting device...
Heyo guys, idk if this can be seen as somehow relate to this topic, cuz its a diff problem with heimdall than originally mentioned in this thread, but my problem is that while trying to flash twrp, my sm-a750fn got half-bricked, and odin didnt want to flash the phones stock ROM, beeing stuck at establishing a connection, so i went and tried to flash it via heimdall-frontend, without sudo cuz else id have issues with the pit not beeing recognised, and everytime i try to flash smth, no matter what .img, be it recovery, boot, misc, etc, heimdall gets stuck at 93% and later gets a fail msg:
"Heimdall v1.4.1
Copyright (c) 2010-2014 Benjamin Dobell, Glass Echidna
Glass Echidna
This software is provided free of charge. Copying and redistribution is
encouraged.
If you appreciate this software and you would like to support future
development please consider donating:
Donate | Glass Echidna
Initialising connection...
Detecting device...
Claiming interface...
Setting up interface...
Initialising protocol...
Protocol initialisation successful.
Beginning session...
Some devices may take up to 2 minutes to respond.
Please be patient!
Session begun.
Downloading device's PIT file...
PIT file download successful.
Uploading BOOT
0%
1%
2%
3%
4%
5%
[...]
80%
81%
82%
83%
84%
85%
86%
87%
88%
89%
90%
91%
92%
93%
ERROR: Failed to confirm end of file transfer sequence!
ERROR: BOOT upload failed!
Ending session...
ERROR: Failed to send end session packet!
Releasing device interface..."
The phone also shows like bout 45% of progress:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

[FIXING][NO JTAG]H959 stuck in qload 9008 mode

Nobody helps me ??, This community for lg g flex 2 sucks!!!
Anyways, I have made some progress trying to revive my lg g flex 2 h959 from qualcomm qload 9008 mode,
After extensive research and staying up nights, I have finally compiled a MPGR8994.hex programmer for this device, I have found the prog_emmc_firehose_8994_lite.mbn and I am currently trying to compile the 8994msimage.mbn file. After that I will be able to use the emmcdownload from qpst software pack to restore my phone partition table and set the phone into qualcomm qload 9006 mode.
I have problem compiling the 8994msimage.mbn; This image is basically contains the fastboot bootloader. Now if anyone here lends me the fastboot boot loader of their device it would be nice.
Follow this and make one for me, because I don't have the parts necessary, you can pull those parts using adb commands.
Okey here is the full partition table of All Lg G Flex 2 variants, and they all share this same, it is extracted from the PrimaryGPT.bin and it follows :
Code:
Starting to parse GPT
Size of GPT file is 524288
Parsing GPT
-- GPT STARTs--
name: modem
startLBA: 32768
endLBA: 196607
size: 0x0000000005000000 bytes
attributes: 0x0
name: pmic
startLBA: 196608
endLBA: 197631
size: 0x0000000000080000 bytes
attributes: 0x0
name: sbl1
startLBA: 197632
endLBA: 199679
size: 0x0000000000100000 bytes
attributes: 0x0
name: tz
startLBA: 199680
endLBA: 201727
size: 0x0000000000100000 bytes
attributes: 0x0
name: sdi
startLBA: 201728
endLBA: 202751
size: 0x0000000000080000 bytes
attributes: 0x0
name: hyp
startLBA: 202752
endLBA: 203775
size: 0x0000000000080000 bytes
attributes: 0x0
name: rpm
startLBA: 203776
endLBA: 204799
size: 0x0000000000080000 bytes
attributes: 0x0
name: aboot
startLBA: 204800
endLBA: 208895
size: 0x0000000000200000 bytes
attributes: 0x0
name: sbl1bak
startLBA: 208896
endLBA: 210943
size: 0x0000000000100000 bytes
attributes: 0x0
name: pmicbak
startLBA: 210944
endLBA: 211967
size: 0x0000000000080000 bytes
attributes: 0x0
name: tzbak
startLBA: 211968
endLBA: 214015
size: 0x0000000000100000 bytes
attributes: 0x0
name: hypbak
startLBA: 214016
endLBA: 215039
size: 0x0000000000080000 bytes
attributes: 0x0
name: rpmbak
startLBA: 215040
endLBA: 216063
size: 0x0000000000080000 bytes
attributes: 0x0
name: abootbak
startLBA: 216064
endLBA: 220159
size: 0x0000000000200000 bytes
attributes: 0x0
name: sdibak
startLBA: 220160
endLBA: 221183
size: 0x0000000000080000 bytes
attributes: 0x0
name: limits
startLBA: 221184
endLBA: 222207
size: 0x0000000000080000 bytes
attributes: 0x0
name: devinfo
startLBA: 222208
endLBA: 223231
size: 0x0000000000080000 bytes
attributes: 0x0
name: apdp
startLBA: 223232
endLBA: 224255
size: 0x0000000000080000 bytes
attributes: 0x0
name: msadp
startLBA: 224256
endLBA: 225279
size: 0x0000000000080000 bytes
attributes: 0x0
name: dpo
startLBA: 225280
endLBA: 226303
size: 0x0000000000080000 bytes
attributes: 0x0
name: misc
startLBA: 229376
endLBA: 262143
size: 0x0000000001000000 bytes
attributes: 0x0
name: persist
startLBA: 262144
endLBA: 327679
size: 0x0000000002000000 bytes
attributes: 0x0
name: modemst1
startLBA: 327680
endLBA: 330751
size: 0x0000000000180000 bytes
attributes: 0x0
name: modemst2
startLBA: 330752
endLBA: 333823
size: 0x0000000000180000 bytes
attributes: 0x0
name: fsg
startLBA: 333824
endLBA: 336895
size: 0x0000000000180000 bytes
attributes: 0x0
name: fsc
startLBA: 336896
endLBA: 337919
size: 0x0000000000080000 bytes
attributes: 0x0
name: ssd
startLBA: 337920
endLBA: 338943
size: 0x0000000000080000 bytes
attributes: 0x0
name: keystore
startLBA: 338944
endLBA: 339967
size: 0x0000000000080000 bytes
attributes: 0x0
name: DDR
startLBA: 339968
endLBA: 344063
size: 0x0000000000200000 bytes
attributes: 0x0
name: sec
startLBA: 344064
endLBA: 345087
size: 0x0000000000080000 bytes
attributes: 0x0
name: encrypt
startLBA: 345088
endLBA: 346111
size: 0x0000000000080000 bytes
attributes: 0x0
name: eksst
startLBA: 346112
endLBA: 347135
size: 0x0000000000080000 bytes
attributes: 0x0
name: rct
startLBA: 347136
endLBA: 347151
size: 0x0000000000002000 bytes
attributes: 0x0
name: persistent
startLBA: 347152
endLBA: 355343
size: 0x0000000000400000 bytes
attributes: 0x0
name: laf
startLBA: 360448
endLBA: 458751
size: 0x0000000003000000 bytes
attributes: 0x0
name: boot
startLBA: 458752
endLBA: 540671
size: 0x0000000002800000 bytes
attributes: 0x0
name: recovery
startLBA: 540672
endLBA: 622591
size: 0x0000000002800000 bytes
attributes: 0x0
name: drm
startLBA: 622592
endLBA: 638975
size: 0x0000000000800000 bytes
attributes: 0x0
name: sns
startLBA: 638976
endLBA: 655359
size: 0x0000000000800000 bytes
attributes: 0x0
name: mpt
startLBA: 655360
endLBA: 720895
size: 0x0000000002000000 bytes
attributes: 0x0
name: factory
startLBA: 720896
endLBA: 815103
size: 0x0000000002e00000 bytes
attributes: 0x0
name: fota
startLBA: 815104
endLBA: 835583
size: 0x0000000000a00000 bytes
attributes: 0x0
name: raw_resources
startLBA: 835584
endLBA: 843775
size: 0x0000000000400000 bytes
attributes: 0x0
name: raw_resourcesbak
startLBA: 843776
endLBA: 851967
size: 0x0000000000400000 bytes
attributes: 0x0
name: system
startLBA: 851968
endLBA: 8191999
size: 0x00000000e0000000 bytes
attributes: 0x0
name: cust
startLBA: 8192000
endLBA: 8716287
size: 0x0000000010000000 bytes
attributes: 0x0
name: cache
startLBA: 8716288
endLBA: 11239423
size: 0x000000004d000000 bytes
attributes: 0x0
name: userdata
startLBA: 11239424
endLBA: 60981247
size: 0x00000005ee000000 bytes
attributes: 0x0
name: grow
startLBA: 60981248
endLBA: 61071326
size: 0x0000000002bfbe00 bytes
attributes: 0x0
-- GPT ENDs --
Exited with success
Now Please someone who know, tell me which is the fastboot partition and someone exract it for me using adb and the dd command, It doesn't matter which variant for now.
This guide below is only general and I need the appropriate parts for 8994msimage.mbn
HTML:
How to generate the 8660_msimage.mbn
8660_msimage.mbn is released in SW by default, actually, it includes the all the boot images and partition table there. MPRG8660.hex will download this image and reset to mass-storage mode. If customers have different HW settings, such as GPIO/DDR, the default 8660_msimage.mbn may not work for them, so customers need build their own 8660_msimage.mbn by themselves with following ways.
1. Have the QPST 2.7.366 or higher version installed.
2. Make a local folder, copy sbl1/sbl2/sbl3/rpm/tz images to this folder.
3. copy the emmcswdownload.exe from C:\Program Files\Qualcomm\QPST\bin to this folder.
4. Prepare the partition_boot.xml as below and copy the partition_boot.xml to the same folder as above.
<?xml version="1.0"?>
<image>
<physical_partition number="0">
<primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">
<file name="sbl1.mbn" offset="0"/>
</primary>
<primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">
<file name="sbl2.mbn" offset="0"/>
</primary>
<primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">
<file name="sbl3.mbn" offset="0"/>
</primary>
<primary order="4" type="5" bootable="false" label="EXT" size="1000000">
<extended order="1" type="47" label="RPM" size="1000" readonly="false">
<file name="rpm.mbn" offset="0"/>
</extended>
<extended order="2" type="46" label="TZ" size="1000" readonly="false">
<file name="tz.mbn" offset="0"/>
</extended>
</primary>
</physical_partition>
</image>
5. Run the emmcswdownload.exe tool to create OEM boot image with a command below.
emmcswdownload.exe -f 8660_msimage.mbn -x partition_boot.xml -s 1G -g 4M
6. The 8660_msimage.mbn will be generated in the folder.
1. In this mode, you can't flash, you can't to do anything, only the LG Service can repair your phone
2. Currently no hex programmer for msm8994 to repair with QPST at home.
3. One more method is JTAG, (require soldering knowledge, soldering station, flux, wire etc...) need to find, the right emmc pinouts on the pcb, but if the pinouts not in the pcb, need to desolder emmc and flash directly...
stars2 said:
1. In this mode, you can't flash, you can't to do anything, only the LG Service can repair your phone
2. Currently no hex programmer for msm8994 to repair with QPST at home.
3. One more method is JTAG, (require soldering knowledge, soldering station, flux, wire etc...) need to find, the right emmc pinouts on the pcb, but if the pinouts not in the pcb, need to desolder emmc and flash directly...
Click to expand...
Click to collapse
Hey mate, Thanks for the reply. My phone is model H959 and that is a Hongkong version, But I live in UK and bought the phone from a UK ebay seller, and UK LG service is not liable for my phone model, and I cant get a service from HongKong either. I'm screwed.
I've been trying to use the Lg flash tool 2015 which has board dl mode, I tried it and it does see my phone in qualcomm 9008 mode and establishes connection but when it wants to download the stuff it gets failed. I extracted some bin files from the kdz rom.
I am also able to see the phone from QPST tools but the software download fails to initiate the downloader. If you have the same model, using qpst you can build the mbn files nessesary for me to restore mine. I know you've got the knowledge, may be please try.
Well l have the sprint version the ls996 and mine shows qsusb_bulk is the issues the same? Sorry lm a noon
Akihiromeep said:
... the issues the same? ...
Click to expand...
Click to collapse
Yes, same problem
If you install the driver, you get QHS-USB QDLoader 9008 mode, but currently no fix, only LG Service can help...
32 bit
https://www.androidfilehost.com/?fid=24269982087002410
64 bit
https://www.androidfilehost.com/?fid=24269982087002409
if you can flash any rom, phone boots with no problem, I flashed a lot of kdz from diferent versions over my h950.
you may lost your imei, so after all, make a backup from qpst. so when you boots your phone, you can restore.
which partitions do you need?
In which format?
I can try to extract from mine. is an h950 with h955ar firmware, mixed with h950pr... H959 kdz boots with no signal in my phone... so I think h950pr partitions must work in your phone...
pelelademadera said:
if you can flash any rom, phone boots with no problem, I flashed a lot of kdz from diferent versions over my h950.
you may lost your imei, so after all, make a backup from qpst. so when you boots your phone, you can restore.
which partitions do you need?
In which format?
I can try to extract from mine. is an h950 with h955ar firmware, mixed with h950pr... H959 kdz boots with no signal in my phone... so I think h950pr partitions must work in your phone...
Click to expand...
Click to collapse
I think I have already lost my IMEI as my phone is in qualcomm 9008 mode, that is to say there is no partition table on the phone and emmc is blank. That happened when I was flashing the stock rom and the flash tool on my pc crashed. That said if you read the first thread I have said I need the part which is necessary enough to make the phone boot into download mode, lg logo, fastboot, laf(I already have this one). I 'm not a expert and dont know what are they called in terms as in the full partition table I have provided. So I need help if you know them. SO that I can compile the 8994msimage.mbn
Masteryates said:
How does that work? Does it allow you to have the best of both worlds? :angel:
Click to expand...
Click to collapse
So so, problem is imei and baseband, the rest, all roms works in h950, so all roms works in all flex2, you have to keep imei!!!!
Afshin44 said:
I think I have already lost my IMEI as my phone is in qualcomm 9008 mode, that is to say there is no partition table on the phone and emmc is blank. That happened when I was flashing the stock rom and the flash tool on my pc crashed. That said if you read the first thread I have said I need the part which is necessary enough to make the phone boot into download mode, lg logo, fastboot, laf(I already have this one). I 'm not a expert and dont know what are they called in terms as in the full partition table I have provided. So I need help if you know them. SO that I can compile the 8994msimage.mbn
Click to expand...
Click to collapse
You probably not, cause no kdz have modemst1 and modemst2 partitions. If you dobt flash another kdz that overwright that partitions, imei are safe.
Modem are the baseband.
So which partitions you need?
Qpst see the phone as a phone?
Laf is download mode, if you dont have that, you have fastboot that dont work in flex 2, all commands are invalid
Enviado desde mi LG-H955 mediante Tapatalk
anyone managed to.fixed???
moonmoon8 said:
anyone managed to.fixed???
Click to expand...
Click to collapse
I don't think any of my work is going to work unless we have the proper files and the proper software. I have tried many different ways but phone does not respond to any. Phone is obviously seen by qpst by none of its apps work with this chip. The qpst is old and we need new version. I have given up. Only way is JtagBox like Octopus Box which does support lg g flex 2.
I'm trying to fix one that I have kept in the closet, this qualcomm 9008, I did everything I could, even with BoarDiag but does not support it, I went to a page that is android1brick called and told me that it can be done only with direct EMMC but no boxes, and I do not guarantee unfortunately, I'm just hoping to take out a hope , we have to create a new BoarDiag o another program for fix this dificult mobile
Adriantech said:
I'm trying to fix one that I have kept in the closet, this qualcomm 9008, I did everything I could, even with BoarDiag but does not support it, I went to a page that is android1brick called and told me that it can be done only with direct EMMC but no boxes, and I do not guarantee unfortunately, I'm just hoping to take out a hope , we have to create a new BoarDiag o another program for fix this dificult mobile
Click to expand...
Click to collapse
I feel you , but I don't know how the softwares work and to flash directly we need the pin outs and we have no idea of where the pin outs of the emmc is either.
Exactly , we have to do a program or a way to fix this phone , maybe easyjtag can fixed or riff box
LG G Flex2 Sprint in Volcano Red (LS996) no enciende después de flash.
Such friends, I am new to this great forum.
I have a Sprint LG G Flex2 in Volcano Red (LS996) which wanted to change the firmware. Enter a support page and found this firm:
ARGENTINA
1 TFS / TELEFONICA (ARGENTINA) V15A LGH955AR 13
You install the "LG Flash Tool 2014", and the process is 100% complete smoothly. But when I went to see the phone does not turn on.
He did not catch more or disconnecting the battery.
When I connect it to the PC it detects it as QHSUSB_BULK me and nothing else. No Dowland nothing enters mode.
Please help!!!! Hopefully we can find a solution.
And probe using interfaces because not assign me any port when I connect it to use the TOT or DDL
I have been recently been looking for a way to unbrick my G Flex 2. I made a mistake and flashed Zv5. I keep seeing there might be a way to recover the phone if we had a zv6 or above tot. i have found what seems to be vv8 tot on chinese website. would this be any help?
http://www.xuexiaowuwo.com/forum.php?mod=viewthread&tid=653
@astaccz is no solution for now
Adriantech said:
@astaccz is no solution for now
Click to expand...
Click to collapse
aww. i literally bought a new g flex 2 from the sprint store for 250 and bricked it in 2 days. smh. i had to order a logic board online from ifixit. i updated it to zv9 and rooted. now i know not to go back to zv5.
the logic board i ordered was revision 2 and the one coming from the sprint store was revision 4. both were lag free when updated to 5.1.1 but the revision 2 board is noticeably just a pinch slower.
gonna send board for boot repair to a guy states away
astaccz said:
aww. i literally bought a new g flex 2 from the sprint store for 250 and bricked it in 2 days. smh. i had to order a logic board online from ifixit. i updated it to zv9 and rooted. now i know not to go back to zv5.
the logic board i ordered was revision 2 and the one coming from the sprint store was revision 4. both were lag free when updated to 5.1.1 but the revision 2 board is noticeably just a pinch slower.
gonna send board for boot repair to a guy states away
Click to expand...
Click to collapse
Do have to wait bro :crying:
I successfully can fix soft brick (bootloop) only for LS996 for now. I spent hours fiddling making a custom tot that flashes ZV8. Already rooted after tot flash.
If interested message me on [email protected] Carln2ubb
astaccz said:
I successfully can fix soft brick (bootloop) only for LS996 for now. I spent hours fiddling making a custom tot that flashes ZV8. Already rooted after tot flash.
If interested message me on [email protected] Carln2ubb
Click to expand...
Click to collapse
That's great! You should make a tutorial and post it. A lot of people would be grateful for that.

[HOW TO] Fixing a hardbricked Yuphoria (lettuce) using an external SD card

Read before continue:
http://forum.xda-developers.com/showthread.php?t=1914359
http://forum.xda-developers.com/showthread.php?t=2136738
http://forum.xda-developers.com/showthread.php?t=2345860
http://forum.xda-developers.com/showthread.php?t=3303112
DrGit said:
As I understand it, this only works because the Snapdragon boot ROM (NOT the bootloader, which resides on the eMMC - this is part of the CPU) has a fallback mode which reads the bootloader from an SD card if the eMMC fails.
Click to expand...
Click to collapse
ᴿℓᴚ said:
Check the references below about MSM8960 boot architecture. PBL (Primary Bootloader) Error Handler sequence:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click to expand...
Click to collapse
Requirements:
A hardbricked Yuphoria/lettuce (YU5010/YU5010A) - when connected with a PC, it should expose itself as QHUSB_BULK (when no driver is installed)/Qualcomm HS-USB QDLoader 9008 (when appropriate driver is installed).
(Optional) A working Yuphoria/lettuce, if you want to create the recovery image yourself.
A microSD card - contrary to the popular belief, you don't need a 16 GB or bigger one. 1 GB is sufficient.
Win32 Disk Imager (Windows) / dd (*nix).
Information regarding the recovery image:
The partition structure of Yuphoria is as follows:
Code:
Number Start (sector) End (sector) Size Code Name
1 131072 262143 64.0 MiB 0700 modem
2 262144 262145 1024 bytes FFFF fsc
3 262146 262161 8.0 KiB FFFF ssd
4 262162 263185 512.0 KiB FFFF sbl1
5 263186 264209 512.0 KiB 0700 sbl1bak
6 264210 265233 512.0 KiB FFFF rpm
7 265234 266257 512.0 KiB 0700 rpmbak
8 266258 267281 512.0 KiB FFFF tz
9 267282 268305 512.0 KiB 0700 tzbak
10 268306 269329 512.0 KiB FFFF hyp
11 269330 270353 512.0 KiB 0700 hypbak
12 270354 273425 1.5 MiB FFFF modemst1
13 273426 276497 1.5 MiB FFFF modemst2
14 276498 296977 10.0 MiB FFFF splash
15 393216 393279 32.0 KiB FFFF DDR
16 393280 396351 1.5 MiB FFFF fsg
17 396352 396383 16.0 KiB FFFF sec
18 396384 398431 1024.0 KiB FFFF aboot
19 398432 400479 1024.0 KiB 0700 abootbak
20 400480 466015 32.0 MiB FFFF boot
21 466016 531551 32.0 MiB FFFF recovery
22 531552 4725855 2.0 GiB FFFF system
23 4849664 4980735 64.0 MiB FFFF cache
24 4980736 5046271 32.0 MiB FFFF persist
25 5046272 5048319 1024.0 KiB FFFF misc
26 5048320 5049343 512.0 KiB FFFF keystore
27 5049344 5050367 512.0 KiB FFFF config
28 5050368 30785502 12.3 GiB FFFF userdata
From the above table, its evident that dumping the first 200 MB should be enough to include all required partitions, but you can opt for a full dump as well.
To dump, we can use any of the following methods:
Directly to the PC using ADB.
Be rooted, connect to adb shell with root privilege & call dd to dump it in external sdcard.
Without being rooted but on unlocked bootloader, boot to (tethered booted/permanently flashed) TWRP, get shell access in TWRP or via adb shell, call dd to dump it in external sdcard.
For dumping the whole eMMC, use:
Code:
dd if=/dev/block/mmcblk0 of=/external_sd/backup.img bs=512 count=30535646
For dumping first 200 MB, use:
Code:
dd if=/dev/block/mmcblk0 of=/external_sd/backup.img bs=512 count=409600
You can directly write to the external sdcard as well:
Code:
dd if=/dev/block/mmcblk0 of=/dev/block/mmcblk1
Be very careful working with dd! mmcblk0 is the eMMC and mmcblk1 is the external SD card.
Pre-created eMMC dump:
eMMC backup - Google Drive
drive.google.com
It is created from a bootloader unlocked Yuphoria running cm-12.1-YOG4PAS47N build.
The size of the whole dump is ~14.5 GB.
After compression, the size is ~998 MB. Its compressed using 7-Zip & split into 10 parts.
File hashes (SHA-1) are as follows:
Code:
9ce4d504395e1c64fbb6960c781fc537eb6b04a2 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.001
523287e0c3fb85c5c2ca1004a1b8219585845462 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.002
ad88026b7b723adf2591b622ebdb3051220c69d8 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.003
b0c6396ddae119d85c9135a6ff4e3cf122e5823e *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.004
c88b13065babcb7792fd66b877af5f2f4811f710 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.005
bbf88b156bd67d79bd3da64a1b9273d92c1487ee *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.006
99c2be608f8c359caabcd13889828ea1777dde73 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.007
e60acbafd6326d4d000a81128f8195ad0c14342e *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.008
895d7db6e961e56ce5c9e541adddfb72815f44c5 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.009
6267aac32bedcff93f4b873a5bce749b85d0ba09 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.010
0c7639808db3480dd06246e952f1f0d363edf6ba *cm-12.1-YOG4PAS47N-lettuce-eMMC.img
Usage:
Download the eMMC dump created by me or make it yourself.
Use Win32 Disk Imager (Windows) / dd (*nix) to write in a microSD card. I've used a 16 GB Class 10 one.
Insert the sdcard into the hardbricked Yuphoria, insert the battery, press Volume Up key & connect it with PC. It should expose itself as a bootloader/fastboot interface.
Flash official Cyanogen OS - you may need to omit the bootloader unlock/re-lock part.
Profit!
Note:
Try at your own risk! If you've any doubt, please contact with the nearest YU service center & ask them for a replacement.
Credit goes to the countless number of people, who risked their devices to find a working method to unbrick it (especially the girlfriend of my friend, who was forced to lend her device for the experiment).
The process is known to many persons out there - earlier I advised some of the Yureka users to try it out, but didn't get any further feedback. Credit goes to @Jimmyz0r for testing the hypothesis on Yureka on his own.
Please provide detailed feedback regarding your success/failure story, so that this tutorial can be enhanced more.
Reserved for future v1.
Reserved for future v2.
@Titokhan,
I tried using first 100MB dump before using full eMMC dump from Yureka but unfortunately I was unable to boot into fastboot, didn't tried 200MB though. I might make one 200MB dump and try it when I get enough time to brick and unbrick my device again.
PS: thanks for the credit m8
Thank You man For the nice Post I just got my phone back , I sucessfully restore my phone from Hell. It was complete Dead , Showing only qualcomm 9008 mode . I followed ur steps And My mobile is working again ... WAITED 4 mOnths for this Post I though i have to put my phone is trash , But it is working now
After Flashing Phone Nothing Boot Up
After follow your steps and download your EMMC data in 16GB 10class SD Card phone is able to connect with pc in fastboot mode and after i download the firmware and flash this with fastboot on my phone it is not booting up ..when i connect my phone to my it nothing show up any..please send me instrucations what can i do for my phone :crying::crying::crying::crying:
@lakhwinderlucky
1. How did you brick the device?
2. Which was original OS - Cyanogen OS or stock Android?
3. Is there any error while flashing via fastboot?
first my phone start restarting automattically and i thought that
there is any problem in firmware and i download the YU Yuphoria firmware and when i flash the downloaded package the phone become completely dead....now i put my phone in trash and crack it with aa big hammer..now i never purchase aa Yu Phone its all bull ****...without any major reason the phone was unexpetdly dead ...and service center is very poor and they refuse for the replacement in the warranty..anyway now i am free to that phone...:laugh::laugh:
Just one question. Does it matters if bootloader is locked or unlocked ? I have a dead Yuphoria with locked bootloader so just want to make sure before trying this revival guide.
Ruvy said:
Just one question. Does it matters if bootloader is locked or unlocked ? I have a dead Yuphoria with locked bootloader so just want to make sure before trying this revival guide.
Click to expand...
Click to collapse
Shouldn't be a problem - please post your feedback.
I have my friend's Yuphoria, due to some problem, I was asked to re-flash the stock rom, I tried to do the same. At that time it was in working condition, successfully entered the fastboot mode, flashed he file, while flashig I saw some message asking me "" volume up to Continue"" or
"" volume down to Cancel"" .. I don't remember the HEAD of the message, and also I don't remember which button I pressed (vol up or vol down). But the phone got bricked and it was never ON back. Now I nneed to try out your procedure.
My doubt is, are all the 3 procedures required to be done to dump the emmc ? If I have a 16GB memory card with class 4, is it OK ?
Rajatmohod said:
Thank You man For the nice Post I just got my phone back , I sucessfully restore my phone from Hell. It was complete Dead , Showing only qualcomm 9008 mode . I followed ur steps And My mobile is working again ... WAITED 4 mOnths for this Post I though i have to put my phone is trash , But it is working now , If anybody has difficulty to restore this phone , Pls Dont bother to call me .. I will help you to Get back your Phone My cell no. is +919975235086
Click to expand...
Click to collapse
Hi bro,
I am trying to reach you on your mobile but you are not picking up the phone. I have downloaded all the 10 zip filrs, made an image file and tried to write to the micro SD card of 16 GB class 10. But I saw about 67 files in my 16gb memory card and can't find the 25+ files as mentioned in the original post. Please guide me...
Sent from my YU5010 using XDA-Developers mobile app
Titokhan said:
Read before continue:
http://forum.xda-developers.com/showthread.php?t=1914359
http://forum.xda-developers.com/showthread.php?t=2136738
http://forum.xda-developers.com/showthread.php?t=2345860
http://forum.xda-developers.com/showthread.php?t=3303112
Requirements:
A hardbricked Yuphoria/lettuce (YU5010/YU5010A) - when connected with a PC, it should expose itself as QHUSB_BULK (when no driver is installed)/Qualcomm HS-USB QDLoader 9008 (when appropriate driver is installed).
(Optional) A working Yuphoria/lettuce, if you want to create the recovery image yourself.
A microSD card - contrary to the popular belief, you don't need a 16 GB or bigger one. 1 GB is sufficient.
Win32 Disk Imager (Windows) / dd (*nix).
Information regarding the recovery image:
The partition structure of Yuphoria is as follows:
Code:
Number Start (sector) End (sector) Size Code Name
1 131072 262143 64.0 MiB 0700 modem
2 262144 262145 1024 bytes FFFF fsc
3 262146 262161 8.0 KiB FFFF ssd
4 262162 263185 512.0 KiB FFFF sbl1
5 263186 264209 512.0 KiB 0700 sbl1bak
6 264210 265233 512.0 KiB FFFF rpm
7 265234 266257 512.0 KiB 0700 rpmbak
8 266258 267281 512.0 KiB FFFF tz
9 267282 268305 512.0 KiB 0700 tzbak
10 268306 269329 512.0 KiB FFFF hyp
11 269330 270353 512.0 KiB 0700 hypbak
12 270354 273425 1.5 MiB FFFF modemst1
13 273426 276497 1.5 MiB FFFF modemst2
14 276498 296977 10.0 MiB FFFF splash
15 393216 393279 32.0 KiB FFFF DDR
16 393280 396351 1.5 MiB FFFF fsg
17 396352 396383 16.0 KiB FFFF sec
18 396384 398431 1024.0 KiB FFFF aboot
19 398432 400479 1024.0 KiB 0700 abootbak
20 400480 466015 32.0 MiB FFFF boot
21 466016 531551 32.0 MiB FFFF recovery
22 531552 4725855 2.0 GiB FFFF system
23 4849664 4980735 64.0 MiB FFFF cache
24 4980736 5046271 32.0 MiB FFFF persist
25 5046272 5048319 1024.0 KiB FFFF misc
26 5048320 5049343 512.0 KiB FFFF keystore
27 5049344 5050367 512.0 KiB FFFF config
28 5050368 30785502 12.3 GiB FFFF userdata
From the above table, its evident that dumping the first 200 MB should be enough to include all required partitions, but you can opt for a full dump as well.
To dump, we can use any of the following methods:
Directly to the PC using ADB.
Be rooted, connect to adb shell with root privilege & call dd to dump it in external sdcard.
Without being rooted but on unlocked bootloader, boot to (tethered booted/permanently flashed) TWRP, get shell access in TWRP or via adb shell, call dd to dump it in external sdcard.
For dumping the whole eMMC, use:
Code:
dd if=/dev/block/mmcblk0 of=/external_sd/backup.img bs=512 count=30535646
For dumping first 200 MB, use:
Code:
dd if=/dev/block/mmcblk0 of=/external_sd/backup.img bs=1M count=200
You can directly write to the external sdcard as well:
Code:
dd if=/dev/block/mmcblk0 of=of=/dev/block/mmcblk1 bs=1M count=200
Be very careful working with dd! mmcblk0 is the eMMC and mmcblk1 is the external SD card.
Pre-created eMMC dump:
https://drive.google.com/folderview?id=0B9zZIJPXbMsuaGg2SXFHcW5mbzQ&usp=sharing
It is created from a bootloader unlocked Yuphoria running cm-12.1-YOG4PAS47N build.
The size of the whole dump is ~14.5 GB.
After compression, the size is ~998 MB. Its compressed using 7-Zip & split into 10 parts.
File hashes (SHA-1) are as follows:
Code:
9ce4d504395e1c64fbb6960c781fc537eb6b04a2 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.001
523287e0c3fb85c5c2ca1004a1b8219585845462 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.002
ad88026b7b723adf2591b622ebdb3051220c69d8 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.003
b0c6396ddae119d85c9135a6ff4e3cf122e5823e *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.004
c88b13065babcb7792fd66b877af5f2f4811f710 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.005
bbf88b156bd67d79bd3da64a1b9273d92c1487ee *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.006
99c2be608f8c359caabcd13889828ea1777dde73 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.007
e60acbafd6326d4d000a81128f8195ad0c14342e *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.008
895d7db6e961e56ce5c9e541adddfb72815f44c5 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.009
6267aac32bedcff93f4b873a5bce749b85d0ba09 *cm-12.1-YOG4PAS47N-lettuce-eMMC.7z.010
0c7639808db3480dd06246e952f1f0d363edf6ba *cm-12.1-YOG4PAS47N-lettuce-eMMC.img
Usage:
Download the eMMC dump created by me or make it yourself.
Use Win32 Disk Imager (Windows) / dd (*nix) to write in a microSD card. I've used a 16 GB Class 10 one.
Insert the sdcard into the hardbricked Yuphoria, insert the battery, press Volume Up key & connect it with PC. It should expose itself as a bootloader/fastboot interface.
Flash official Cyanogen OS - you may need to omit the bootloader unlock/re-lock part.
Profit!
Note:
Try at your own risk! If you've any doubt, please contact with the nearest YU service center & ask them for a replacement.
Credit goes to the countless number of people, who risked their devices to find a working method to unbrick it (especially the girlfriend of my friend, who was forced to lend her device for the experiment).
The process is known to many persons out there - earlier I advised some of the Yureka users to try it out, but didn't get any further feedback. Credit goes to @Jimmyz0r for testing the hypothesis on Yureka on his own.
Please provide detailed feedback regarding your success/failure story, so that this tutorial can be ehanced more.
Click to expand...
Click to collapse
Dear Mr Titokhan,
I have done the same exercise as was mentioned in post #1 of thsi thread, but nothing has happened. Let me come with my exercise..
* I have downloaded all the 10 files from google drive and made it 1 image file with 7Z
* I have downloaded win32 disk imager and wrote the image to a Samsung 16 GB Class 10 with 48/mbps Memory card
* Inserted this card into the bricked device and pressed volume up and connected the cable to PC for flashing. But nothing came up.
* Tried vol+ and Power button retaining the MC in the device - no use.
* When tried to see the contents of memory card that was written the image file, I could not see anything except 63 mb of free data. (
* When entered the Disk Management I could see number of partitions without any names.
* I have tried with the ROM files, cm-12.1-YOG4PAS47N-lettuce-signed-fastboot-5d674b9b61 and cm-12.0-YNG1TBS2P2-lettuce-signed-fastboot but no use.
I have my friend's Yuphoria, due to some problem, I was asked to re-flash the stock rom, I tried to do the same. At that time it was in working condition, successfully entered the fastboot mode, flashed he file, while flashig I saw some message asking me "" volume up to Continue"" or
"" volume down to Cancel"" .. I don't remember the HEAD of the message, and also I don't remember which button I pressed (vol up or vol down). But the phone got bricked and it was never ON back. Now I need your help.
Note: I have 1 more YU5010 with me and presently using that. Since if it is useful for any type of backup of stock rom, I am just telling you in advance. Please help me with step by step procedure.
@vsrkmurthy
1. Please don't quote the whole first post.
2. Have you matched the hash of the eMMC image after extracting?
3. Windows can't see multi-partitioned removable media; it only shows the first readable partition.
4. After inserting the sdcard, pressing volume up & connecting the device with PC please send me the screenshot of Device Manger.
Titokhan said:
@vsrkmurthy
1. Please don't quote the whole first post.
2. Have you matched the hash of the eMMC image after extracting?
3. Windows can't see multi-partitioned removable media; it only shows the first readable partition.
4. After inserting the sdcard, pressing volume up & connecting the device with PC please send me the screenshot of Device Manger.
Click to expand...
Click to collapse
Thanks for the reply, If you can give me your whatsapp number, I want to send you the screenshots thro' that. Infact, yesterday, Rajat (refer post #5 of this thread) and myself tried a lot by connecting Team Viewer also. But no use. Please give me your contact number so that we can discuss and finalise. else, my number is +919059927728 (whatsapp also).
Bro ; you are a god. Seriously bro ; i went to All shops of NEHRU PLACE; NEW Delhi. They all said ; we can't do it. we(Service centre guys) have to change the motherboard of your YUpHORIA YU5010. and they were asking for ₹3k ;. I literally ordered a new smart phone ; but after reading your post and following each step i got my Yuphoria back. Thank You bro. Hats off to u. Thank You so much bro.
Please give me your contact number
Sent from my 2013023 using XDA-Developers mobile app
eMMc Dump not extracting
Titokhan said:
Shouldn't be a problem - please post your feedback.
Click to expand...
Click to collapse
Hello @Titokhan I have downloaded all the files but they are not extracting i have 16 Gb class 10 samsung card so can you please tell how to only dump necessary files.
Thanks in advance
How did you dump only 100mb?
YuganshT7 said:
Hello @Titokhan I have downloaded all the files but they are not extracting i have 16 Gb class 10 samsung card so can you please tell how to only dump necessary files.
Thanks in advance
Click to expand...
Click to collapse
Jimmyz0r said:
@Titokhan,
I tried using first 100MB dump before using full eMMC dump from Yureka but unfortunately I was unable to boot into fastboot, didn't tried 200MB though. I might make one 200MB dump and try it when I get enough time to brick and unbrick my device again.
PS: thanks for the credit m8
Click to expand...
Click to collapse
Can you tell me how can i Dump only 200mb of eMMc on My SD card . I am on windows
@YuganshT7
Can you please elaborate more? What was the exact error message you got?

[Kindle Fire HD 7] 3rd Gen (2013) SOHO - Bring it back alive with emmc adapter flash

Hello,
I need some help. At the moment I am connected with the eMMC flash of my SOHO 3rd GEN tablet.
I used the exploitee.rs emmc adapter.
The problem:
-The tablet want not booting anymore. Stuck fw was on it (no idea wich fw).
-I try to bring it back with a fastboot cable but something burned on the mainboard (If you had a 3rd gen device and a microscope pls help)
What I want to try:
-I want to reflash the bootloader (are there two on this device???) and the recovery with my emmc adapter to be able to flash the stock fw again. I want to give him just manually 3.7V with a power adapter, at the battery connector.
The problem now:
I really dont know how to extract the right img-files from the stock-bin file. There are some different img files: (md5 sum at begining)
Code:
f82a8c5518a76b96b95dc0448b772d81 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/images/boot.img
Code:
a5224737ba83a65d40e3049ba6d71582 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/images/boot-prod.img
Code:
4e6181ea47c7868c2104147dc0b2fce6 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/images/u-boot.bin
Code:
38cfffa45008955f2887f7998dbd1c4e /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/images/u-boot-prod.bin
Code:
aa4b135a185e5486656893f4c7101271 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/recovery_images/recovery-eng.img
Code:
5cba5636109eec7c7e5faa35104d65c0 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/recovery_images/recovery-prod.img
Code:
Here is recovery from the old system:
7e781998261c22852f6bae53e02335c6 /media/galliumos/MULTIBOOT/Amazon_Kindle_Fire_HD_3rd_gen_SOHO/recovery.img
I really think the bootloader was broken and that was the reason why the device was still black.
So I really would like to flash with
Code:
sudo dd if=/sdcard/bin-extract-stock/images/the-right.img of=/dev/sda2
the needed partitions. Like when I let the device making an update.
Can you help me to get the 100% right image files for the right partitions.
Here are some informations about the current partitions:
Code:
Disk /dev/sda: 14.6 GiB, 15634268160 bytes, 30535680 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: F9F21FFF-A8D4-5F0E-9746-594869AEC34E
Device Start End Sectors Size Type
/dev/sda1 256 511 256 128K Microsoft basic data
/dev/sda2 512 1023 512 256K Microsoft basic data
/dev/sda3 1024 1151 128 64K Microsoft basic data
/dev/sda4 1152 1183 32 16K Microsoft basic data
/dev/sda5 1184 1187 4 2K Microsoft basic data
/dev/sda6 2048 34815 32768 16M Microsoft basic data
/dev/sda7 34816 51199 16384 8M Microsoft basic data
/dev/sda8 51200 67583 16384 8M Microsoft basic data
/dev/sda9 67584 2623487 2555904 1.2G Microsoft basic data
/dev/sda10 2623488 4466687 1843200 900M Microsoft basic data
/dev/sda11 4466688 30535679 26068992 12.4G Microsoft basic data
Code:
Command (? for help): ?
b back up GPT data to a file
c change a partition's name
d delete a partition
i show detailed information on a partition
l list known partition types
n add a new partition
o create a new empty GUID partition table (GPT)
p print the partition table
q quit without saving changes
r recovery and transformation options (experts only)
s sort partitions
t change a partition's type code
v verify disk
w write table to disk and exit
x extra functionality (experts only)
? print this menu
Command (? for help): i
Partition number (1-11): 1
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F00-A8D4-5F0E-9746-594869AEC34E
First sector: 256 (at 128.0 KiB)
Last sector: 511 (at 255.5 KiB)
Partition size: 256 sectors (128.0 KiB)
Attribute flags: 0000000000000000
Partition name: 'xloader'
Command (? for help): i
Partition number (1-11): 2
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F01-A8D4-5F0E-9746-594869AEC34E
First sector: 512 (at 256.0 KiB)
Last sector: 1023 (at 511.5 KiB)
Partition size: 512 sectors (256.0 KiB)
Attribute flags: 0000000000000000
Partition name: 'bootloader'
Command (? for help): i
Partition number (1-11): 3
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F02-A8D4-5F0E-9746-594869AEC34E
First sector: 1024 (at 512.0 KiB)
Last sector: 1151 (at 575.5 KiB)
Partition size: 128 sectors (64.0 KiB)
Attribute flags: 0000000000000000
Partition name: 'idme'
Command (? for help): i4
Partition number (1-11): 4
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F03-A8D4-5F0E-9746-594869AEC34E
First sector: 1152 (at 576.0 KiB)
Last sector: 1183 (at 591.5 KiB)
Partition size: 32 sectors (16.0 KiB)
Attribute flags: 0000000000000000
Partition name: 'crypto'
Command (? for help): i
Partition number (1-11): 5
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F04-A8D4-5F0E-9746-594869AEC34E
First sector: 1184 (at 592.0 KiB)
Last sector: 1187 (at 593.5 KiB)
Partition size: 4 sectors (2.0 KiB)
Attribute flags: 0000000000000000
Partition name: 'misc'
Command (? for help): i
Partition number (1-11): 6
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F05-A8D4-5F0E-9746-594869AEC34E
First sector: 2048 (at 1024.0 KiB)
Last sector: 34815 (at 17.0 MiB)
Partition size: 32768 sectors (16.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'efs'
Command (? for help): i
Partition number (1-11): 7
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F06-A8D4-5F0E-9746-594869AEC34E
First sector: 34816 (at 17.0 MiB)
Last sector: 51199 (at 25.0 MiB)
Partition size: 16384 sectors (8.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'recovery'
Command (? for help): i
Partition number (1-11): 8
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F07-A8D4-5F0E-9746-594869AEC34E
First sector: 51200 (at 25.0 MiB)
Last sector: 67583 (at 33.0 MiB)
Partition size: 16384 sectors (8.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'boot'
Command (? for help): i
Partition number (1-11): 9
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F08-A8D4-5F0E-9746-594869AEC34E
First sector: 67584 (at 33.0 MiB)
Last sector: 2623487 (at 1.3 GiB)
Partition size: 2555904 sectors (1.2 GiB)
Attribute flags: 0000000000000000
Partition name: 'system'
Command (? for help): i
Partition number (1-11): 10
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F09-A8D4-5F0E-9746-594869AEC34E
First sector: 2623488 (at 1.3 GiB)
Last sector: 4466687 (at 2.1 GiB)
Partition size: 1843200 sectors (900.0 MiB)
Attribute flags: 0000000000000000
Partition name: 'cache'
Command (? for help): i
Partition number (1-11): 11
Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)
Partition unique GUID: F9F21F0A-A8D4-5F0E-9746-594869AEC34E
First sector: 4466688 (at 2.1 GiB)
Last sector: 30535679 (at 14.6 GiB)
Partition size: 26068992 sectors (12.4 GiB)
Attribute flags: 0000000000000000
Partition name: 'userdata'
gparted
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Greetings by I_did_it_just_tmrrow
overlode said:
Edit - SUCCESS!!! It seems I may have had one wire touching another so I tidied up the soldering and the eMMC was recognised straight away
I have successfully accessed the Soho eMMC and can see all partitions as in the attached image!!!
Now if only I could find the commands to backup the entire eMMC...
Click to expand...
Click to collapse
overlode said:
Ok, files uploaded -
Bootloader - https://drive.google.com/file/d/0BwMwdZJ36fBoVTNRVmNjX2FmZTQ/edit?usp=sharing
eMMC Dump - https://drive.google.com/file/d/0BwMwdZJ36fBoNTQyUENvbmVGY1E/edit?usp=sharing
Enjoy
Click to expand...
Click to collapse
I found this post here.
So now I had a 100% bootloader partition and my recovery partition.
What is about 'xloader' partition name?
And the partition 8: "boot". It that "u-boot.bin" from my source?
Pls, I need some answers.
Greetings by Idijt
its been awhile since i got mine revived! soo all this is like something new to me! howeveer ill provide what little that i have
abatoir said:
its been awhile since i got mine revived! soo all this is like something new to me! howeveer ill provide what little that i have
Click to expand...
Click to collapse
Did you still own your device? Can dump your partitions with dd?
Greetings by Idijt
No I don't own it anymore. But mine was an 8gb version, seems like yours is a 15gb version or something like that. I do have photos of my complete partitions.
Sent from my Redmi Note 2 using XDA Free mobile app
---------- Post added at 05:07 AM ---------- Previous post was at 04:48 AM ----------
this is my partiton table after succesfully uploading to emmc
Hello, I'm soho everything is normal, but then teardown accidentally short after the motherboard usb boot don't boot, but the computer have a reaction, but did not show for help how to solve the screen is black, from youdao translation
Hope this helps...
I did something similar. I was using a cheap cable so I swapped them out. I got a LG cable and plugged it in, well it borked my tablet. Black Screen, I took cable apart and found a resistor soldered to a pin! Tested it and it was sending odd pulses, whatever it broke mine. Here is a list of what I backed up before testing.
KF3_p1-xloader.img
-rwxrwxrwx 1 root vboxusers 35002 Sep 3 17:35 KF3_p1-xloader.rar
-rwxrwxrwx 1 root vboxusers 262144 Sep 3 17:27 KF3_p2-BootLoader-Orig.img
-rwxrwxrwx 1 root vboxusers 65536 Sep 3 17:35 KF3_p3-idme.img
-rwxrwxrwx 1 root vboxusers 16384 Sep 3 17:35 KF3_p4-crypto.img
-rwxrwxrwx 1 root vboxusers 2048 Sep 3 17:35 KF3_p5-misc.img
-rwxrwxrwx 1 root vboxusers 16777216 Sep 3 17:35 KF3_p6-efs.img
I assume you need to dd a original image to xloader &or bootloader.
I can only get mine in usb boot mode, which shows as omap4470 windows and Linux as:
Bus 002 Device 005: ID 0451:d012 Texas Instruments, Inc. I suspect I may need to mod & recompile the usbboot source. I think its hardcoded for 4430 or 4460.
*Your Method is even more promising.
I will upload the files if you need them. All except idme & efs as it contains my serials, etc. I *assume* those 2 files will work as they are stock and should have signatures intact.
Would You Post a Pic of the rs device connected to your Kindle?
I would love to find the serial and JTAG pinouts...?
any try this and did can repier of this problem
can you help me please
unimatrix725 said:
I did something similar. I was using a cheap cable so I swapped them out. I got a LG cable and plugged it in, well it borked my tablet. Black Screen, I took cable apart and found a resistor soldered to a pin! Tested it and it was sending odd pulses, whatever it broke mine. Here is a list of what I backed up before testing.
KF3_p1-xloader.img
-rwxrwxrwx 1 root vboxusers 35002 Sep 3 17:35 KF3_p1-xloader.rar
-rwxrwxrwx 1 root vboxusers 262144 Sep 3 17:27 KF3_p2-BootLoader-Orig.img
-rwxrwxrwx 1 root vboxusers 65536 Sep 3 17:35 KF3_p3-idme.img
-rwxrwxrwx 1 root vboxusers 16384 Sep 3 17:35 KF3_p4-crypto.img
-rwxrwxrwx 1 root vboxusers 2048 Sep 3 17:35 KF3_p5-misc.img
-rwxrwxrwx 1 root vboxusers 16777216 Sep 3 17:35 KF3_p6-efs.img
I assume you need to dd a original image to xloader &or bootloader.
I can only get mine in usb boot mode, which shows as omap4470 windows and Linux as:
Bus 002 Device 005: ID 0451:d012 Texas Instruments, Inc. I suspect I may need to mod & recompile the usbboot source. I think its hardcoded for 4430 or 4460.
*Your Method is even more promising.
I will upload the files if you need them. All except idme & efs as it contains my serials, etc. I *assume* those 2 files will work as they are stock and should have signatures intact.
Would You Post a Pic of the rs device connected to your Kindle?
I would love to find the serial and JTAG pinouts...?
View attachment 3866692
Click to expand...
Click to collapse
can you help me please
Nit an expert, mine is still bricked sitting on shelf.
arikurdi said:
can you help me please
Click to expand...
Click to collapse
I would suggest reading from first post. I don't know allot about the kindle. I spent many hours reading the threads to try and fix mine. I would suggest googling for an identification guide, since kindles are hard to tell apart. To make sure you are in the correct place. The second thing when needing help is to provide a detailed description of your problem. You increase chances of more than one person helping.
kindle fire soho
unimatrix725 said:
I would suggest reading from first post. I don't know allot about the kindle. I spent many hours reading the threads to try and fix mine. I would suggest googling for an identification guide, since kindles are hard to tell apart. To make sure you are in the correct place. The second thing when needing help is to provide a detailed description of your problem. You increase chances of more than one person helping.
Click to expand...
Click to collapse
my problem is my kindel fire soho is just read on pc omap4470 and idont know how to make short
and install driver on linux ihave linux but idont how is work iflashed wrong bootloader file
Hi, I also have Kindle Fire HD 7 Soho (2013). I was attempting to unlock the bootloader and install TWRP, following this thread:
https://forum.xda-developers.com/ki...ment/unlock-kfsowi-bootloader-unlock-t3262770
I was able to get into fastboot mode, then proceeded to flash boot with the hijack image, but in the next line, where the system partition is flashed with a system image, I mistakenly flashed system image to the boot partition. I then did continue, before I realized my mistake. It doesn't boot anymore, but I believe the card reader emmc access would be able to get me back in business again.
I've read this thread, and the thread for the HD 7 2012 Tate emmc, I don't see anything pointing to the connections for the card reader to the 2013 soho motherboard. If there is something that has been posted, could someone put a link in this thread? I think it will be very helpful for those of us that want to try that method to unbrick our Kindles (2013, 3rd generation). Thank you.
EDIT: After more reading, I came across a thread which shows the points to connect an sd card reader to the motherboard of a Kindle Fire HD 7 Soho (2013, 3rd gen) in order to access the emmc of the kindle, it will show up as a usb drive when the card reader is connected to the usb port.
https://forum.xda-developers.com/showthread.php?t=2674737&page=3
Here is another related link, it shows the connections using the pins of a micro-sdcard adapter, you should read the entire article because it mentions a 50k-ohm pull up resistor that is required between pins 2 & 4. This was used on a Kindle Fire HD 7 Tate (2012)
https://forum.xda-developers.com/kindle-fire-hd/7-inch-help/kindle-fire-hd-7-emmc-access-t2828906
I am waiting on a fastboot cable first, and it should arrive soon. If I can't get into fastboot mode with the new cable, then I will try the card reader method.
@crackitopen any news?
I found a pin decription for the SOHO and I got a image.
Currently I had still the broken SOHO-8GB from the first post. But I got a second SOHO-16GB version. I could imagine that the bootloader ist the same but I am not sure how to read it and flash it in the right way. Could anybody help with that?
Greetings by Idijt
I_did_it_just_tmrrow said:
@crackitopen any news?
Click to expand...
Click to collapse
Hi Sorry for the late reply, but yes - I waited for the fastboot cable to arrive, and when it did, I was able to get into fastboot mode, so I had only to reflash those 2 partitions. I was very careful this time around, and I was successful in updating the Soho to CyanogenMod 12 unofficial Soho, Android 5.0.2 as described in that other post that I referenced.
crackitopen said:
Hi Sorry for the late reply, but yes - I waited for the fastboot cable to arrive, and when it did, I was able to get into fastboot mode, so I had only to reflash those 2 partitions. I was very careful this time around, and I was successful in updating the Soho to CyanogenMod 12 unofficial Soho, Android 5.0.2 as described in that other post that I referenced.
Click to expand...
Click to collapse
Did you have some tipps for me?
I own 2 SOHO devices and grab from the first one the following partitions:
Code:
=========================================
soho:/ # df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 470440 480 469960 1% /dev
tmpfs 470440 0 470440 0% /mnt
/dev/block/mmcblk0p10 1251544 707172 544372 57% /system
/dev/block/mmcblk0p12 5316696 2888156 2428540 55% /data
/dev/block/mmcblk0p11 907096 15708 891388 2% /cache
/dev/fuse 5316696 2888156 2428540 55% /mnt/runtime/default/emulated
/dev/fuse 5316696 2888156 2428540 55% /mnt/runtime/read/emulated
/dev/fuse 5316696 2888156 2428540 55% /mnt/runtime/write/emulated
=========================================
soho:/ # ls -la /dev/block/platform/omap_hsmmc.1/by-name
total 0
drwxr-xr-x 2 root root 280 2017-10-22 01:35 .
drwxr-xr-x 4 root root 380 2017-10-22 01:35 ..
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 boot -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 bootloader -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2017-10-22 01:35 cache -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 crypto -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 efs -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 exploit -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 idme -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 recovery -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 2017-10-22 01:35 system -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 20 2017-10-22 01:35 xloader -> /dev/block/mmcblk0p1
The following partition was to big ofr internal memory:
Code:
lrwxrwxrwx 1 root root 21 2017-10-22 01:35 userdata -> /dev/block/mmcblk0p12
What would I like to do next:
I wanna solder my gtv-Hacker emmc adapter to my SOHO mainboard to fix it. Then I would like to flash "bootloader -> /dev/block/mmcblk0p2" & "recovery -> /dev/block/mmcblk0p7" & "exploit -> /dev/block/mmcblk0p9".
Commands to flash the 3 partitions?
Greetings by Idijt
Jesus christ you fixed it? You are a god to me OP.
Galaxyninja66 said:
Jesus christ you fixed it? You are a god to me OP.
Click to expand...
Click to collapse
If you mean me, no I dont fix it yet. I was on the right way but then my noob-Linux knowledge or any other reason seems to destroy the one mainboard. I had SOHO mainboard, one with hardware error and one with software-Brick error.
But I think you have another kindle, I had 2 SOHO boards and you seems to have a TATE:
Code:
>KFHD 7 2012 (tate) - CyanogenMod 13 (Considering an SFOS port)
Greetings by Idijt
I_did_it_just_tmrrow said:
If you mean me, no I dont fix it yet. I was on the right way but then my noob-Linux knowledge or any other reason seems to destroy the one mainboard. I had SOHO mainboard, one with hardware error and one with software-Brick error.
But I think you have another kindle, I had 2 SOHO boards and you seems to have a TATE:
Code:
>KFHD 7 2012 (tate) - CyanogenMod 13 (Considering an SFOS port)
Greetings by Idijt
Click to expand...
Click to collapse
I know we have different kindles, but raising a messed up board from the dead is an accomplishment no less
On a side note, and SFOS port might not be possible due to the nature of the Kindle fire bootloader. Each build just goes straight to fastboot which is un heard of on any other device.
Just wanted to say thank you to @overlode and @unimatrix725. Thanks to you I was able to bring my hard bricked Fire HD 3rd gen (soho) back to the land of living. I've made a mistake of flashing a wrong bootloader.
After a bit of googling I came across a thread on xda where @overlode shared an immensely helpful photo with eMMC pins mapped out - you rock! Using this mapping I was able to solder an usb sdcard reader to the eMMC and access it from gparted. Then I've found this thread where @unimatrix725 shared his original bootloader.img which I then subsequently flashed to my device. Now my Fire HD is happy again - thank you!
Glad you were able to sort it @pfoltyn, I haven't looked at this for a couple of years and have since moved on to other projects but glad it's still helping people

sch-I535 do you have this files: 8960_msimage.mbn MPRG8960.hex

hi everyone. i have bricked i535. i am working on it for about 3 days. sd card method, qfil method and others did not worked. so i am looking for this files for flashing it with unbrick.sh script on ubuntu.
unbrick.sh came with this files but i think they are not for i535. hex is working but at the end:
:
:
:
Writing 1024 bytes to 0x2a02ec00; 1180 bytes left.
Writing 1024 bytes to 0x2a02f000; 156 bytes left.
Writing 156 bytes to 0x2a02f400; 0 bytes left.
Executing file...
Failed to get response.
Sending MAGIC...
Invalid MAGIC response.
i think the hex and mbn are for 8960 cpu but not for i535. Can you help

Categories

Resources