Database Users

Need for JTAG interface of Prophet

Hi All!
If someonу have some information about low-level interface of Prophet system board, something like JTAG, usable for primary flash init, please let me know. Look for a way to put some image to a system wich has completely cleaned flash, including bootloader. Service can't do it.
In fact, the primary load on the manufacturing facilities ising JTAG, and it is not a big poblem to find facilities, but extra information about the engineering interface necessary.
Thanks in advance for any help!

i need too

me to i need pls

I don't think you can find out the JTAG interface from the well-manufactured board and use it with ease.
However, I wonder how can the HTC staff themself update the bootloader in the flash chip?

Restore the Universal from scratch via JTAG

Hi Universal cracks,
i got a Qtek device which seems totally bricked.
The history of the device is unknown, so my investigation is getting deeper and deeper.
On gathering all information together it seems that the IPL and maybe also the SPL is damaged and cannot be easily revovered, because the bootmenu is not reachable in any way (believe me, i read everything about recovering intensely ).
That's why i'm looking for a general way to recover bricked devices using JTAG.
The idea is the following:
1. Access the device via jtag
2. Setup ram according to the setting used in wince or linux kernel
3. Rewrite IPL (it is yet unknown how to do it!)
4. Load SPL as executable binary into RAM using JTAG
5. Start the SPL from RAM
6. With SPL running from RAM Re-format the DOC reinstall SPL into DOC
Restart
That's it!
To resume my efforts so far i may report:
1. JTAG connection established (using OpenOCD or OCD Commander)
2. Init SDRAM (using intel PXA270 development kit setup)
3. Write a file to SDRAM and start it
4. Made a dump of IPL and SPL (using haret)
What did not work???
1. Access mDOC G3 in normal mode via JTAG (seems to stick in reset mode)...
2. Rewrite IPL using JTAG...
3. Start the SPL successful from SDRAM base address....
What do you think specialists!
Anyone willing to help?
Cheers,
scholbert

Hello Scholbert,
Sorry I couldn't help you out on this matter. But When I read your post I thought that you gone deeper than me in this technically.
So can Please go though my problem http://forum.xda-developers.com/showthread.php?t=353063 & help me out to solve WHITE SCREEN Problem?
Thanks in Advance.

bootloader
Hi scholbert, it couldn't be enough to simply rewrite the bootloader?
Please could you post the patched version of openwince jtag?

Hi roglio,
roglio said:
Hi scholbert, it couldn't be enough to simply rewrite the bootloader?
Click to expand...
Click to collapse
Maybe you're right , restoring the uni via JTAG could be mission impossible (at least the way described in my starting post).
As far as i got to know from various postings, the bootloader itself does some security checks during runtime (password checking, CRC checking ...).
It could require some real awful hacks, to start the SPL from RAM with an external debugger.
Please could you post the patched version of openwince jtag?
Click to expand...
Click to collapse
I made a lot experiments on other platforms using the openwince jtag.
In this case i used the famous OpenOCD:
http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD
There's PXA270 support out of the box!
You have to download the sources from their SVN-repository .
Anyway i'll have a look on my workstation in a few days, what could be of interest for the geeks out there.
Regards,
scholbert

Geek inside
Hi scholbert, all bricked universal are broken because the bootloader was wrongly updated or overwritten with a bad update. If we look for a fresh bootloader, the right starting address and wrote it back we've fixed the major problem. Recover a universal starting from this point is already well documented...
Tomorrow I'll download OpenOCD and try to compile it on cygwin to start doing some experiments.
I lack of some informations anyway: the most important is the address where to put the correct bootloader...
I'll post any further step ahead.
Thanks.
roglio

Hi again,
roglio said:
Hi scholbert, all bricked universal are broken because the bootloader was wrongly updated or overwritten with a bad update.
Click to expand...
Click to collapse
this seemed to be happened to my device too. With single stepping starting at address 0x0 there's an error after some instructions. So it seems there's wrong assembler code in the IPL section already.
If we look for a fresh bootloader, the right starting address and wrote it back we've fixed the major problem. Recover a universal starting from this point is already well documented...
Click to expand...
Click to collapse
That's the theory .
Tomorrow I'll download OpenOCD and try to compile it on cygwin to start doing some experiments.
Click to expand...
Click to collapse
Good luck for this action! I did compile it on a debian linux system.
I lack of some informations anyway: the most important is the address where to put the correct bootloader...
Click to expand...
Click to collapse
Let's assume we got a working device .
As far as i know, this is what happens after coldboot (comments welcome):
1. DOC is in reset mode, processor jumps to address 0x0 and excutes IPL
2. IPL initializes RAM, switches DOC to normal mode and copies SPL to RAM
3. further details of IPL functions unknown
4. leaving IPL, jump to physical address 0xa0000000
5. execute SPL ....
The problem is, that at this point various system checks are following.
If something goes wrong before we good USB serial connection or bootloader screen. The processor simply could stop at any instruction and we won't know why .
I'll post any further step ahead.
Thanks.
roglio
Click to expand...
Click to collapse
Good luck for your next steps!!!
Maybe, we may draw some attention with this little discussion. It would be nice to get things rollin' and someday there'll be hope for all those bricked devices around .
P.S.:
I already made bootloader dumps. See attachments!
IPL and IPL2 got the same content but they were dumped on different physical addresses. SPL was dumped from RAM. Of course these files were taken from a working device.
scholbert

Hi, after your description of the boot process I'm not so optimist anymore...
Anyway, I've just finished to compile OpenOCD under cygwin, without any major problem.
Just a doubt: which configuration file are you using?
Does you have already configured also the flash banks?
I share your doubts about what's happen after SPL execution... IMHO anyway we should give a chance to a complete reflash: fully dump a working device and after wrote it back to a bricked uni just to see what happen.
Some time ago, I've accidentally overwritten the bootloader of a Toshiba e740 PDA (very nice device indeed). After using a proprietary jtag sw/hw I've resurrected it simply writing the bootloader back in place.
This give me at least a hope...

Hi roglio,
Anyway, I've just finished to compile OpenOCD under cygwin, without any major problem.
Click to expand...
Click to collapse
Great!!!
Just a doubt: which configuration file are you using?
Click to expand...
Click to collapse
I will post the configuration file as soon as possible (it's on my linux machine at work ).
Does you have already configured also the flash banks?
Click to expand...
Click to collapse
No, only the PXA270 chip select for the DOC device was set up. These NAND flashes need special initialisation to switch form reset mode to normal mode to be programmed or to read the filesystem.
This process was not yet successful using JTAG .
I share your doubts about what's happen after SPL execution... IMHO anyway we should give a chance to a complete reflash: fully dump a working device and after wrote it back to a bricked uni just to see what happen.
Click to expand...
Click to collapse
If we are able to access the DOC device in a proper way, this may work.
At least there are professionel programmers on the market, that are able to reprogram these devices using the JTAG interface. But these are very, very expensive .
Some time ago, I've accidentally overwritten the bootloader of a Toshiba e740 PDA (very nice device indeed). After using a proprietary jtag sw/hw I've resurrected it simply writing the bootloader back in place.
Click to expand...
Click to collapse
Yes basically this also possible for the uni, but this damn#?=% DOC device is very hard to handle. There's also no linux device driver for these devices yet.
Great work anyway!!!
This give me at least a hope...
Click to expand...
Click to collapse
Our hope should never die .
Best regards,
scholbert

Googling
Hi, scholbert! Today I was googling around and I've found some interesting informations about mDOCs... These special flashrom are internally handled as NAND flash but with the cpu (when used to eXecute In Place XIP) are handled as NOR flash chips. I haven't still found useful information to understand how this could be useful for our goal.
Another interesting information about mDOCs is that exists some pc software that permit to flash them via jtag but are part of very expensive development packages!
Anyway mDOCs are handled by linux! Basically it is possible to patch the linux kernel to handle them via trueffs. I'll be more detailed tomorrow, but my first impression is that these information about linux drivers for mDOC family aren't useful for our project...
Does you have retrieved the conf file for openocd?

Hi roglio,
that's nice information. I also gathered together anything about the mDOC series i could find, all over the planet. If you need more details
Unfortunately, there's no source code of the low level routines to access this device. If someone would share m-systems BDK for the G3, you're welcome!
Does you have retrieved the conf file for openocd?
Click to expand...
Click to collapse
Yes, but i realized that i used a slightly modified one of the standard package (no SDRAM init, nothing but access PXA270).
You will find it attached!
My efforts with the uni using OpenOCD get stuck at a point, because i only got a very simple JTAG hardware. To use it as a debugger you also need to have influence on the systems reset.
That's why i decided to used some Macraigor stuff to get nice hardware debugger for accessing the universal hardware with OCD Commander.
Obviously both systems are very similar.
OpenOCD is completely GPL, so this should be first choice in the end!!!
You will also find the OCD Commander config file (htc-uni.zip) attached.
This could be the base for an OpenOCD script (very similar stuff).
Just an additional information:
I successfully disassembled the IPL . At the moment i'm in the process of clearing up, how the basic init process is working!
I nearly forgot to mention, that you'll need to update the description for the stepping of PXA270 in the OpenOCD source code. If i remember correctly, the C5 is missing. Without it the PXA is not recognized correctly. I will post the updated file tomorrow.
Stay tuned!!!
scholbert

scholbert said:
I also gathered together anything about the mDOC series i could find, all over the planet. If you need more details
Click to expand...
Click to collapse
Yes! Post it! Thank you! (or send them to rapidshare or similar).
scholbert said:
Just an additional information:
I successfully disassembled the IPL . At the moment i'm in the process of clearing up, how the basic init process is working!
Click to expand...
Click to collapse
A weird idea... What do you think about relocate and then recompile IPL and run it from SDRAM?
You should remove and/or modify IPL routines related to SDRAM init anyway!
Which tools are you using to decompile IPL?

Hi,
Yes! Post it! Thank you! (or send them to rapidshare or similar).
Click to expand...
Click to collapse
I will somehow. Maybe i'll put on my website or post it here!
Very busy at the moment .
A weird idea... What do you think about relocate and then recompile IPL and run it from SDRAM?
You should remove and/or modify IPL routines related to SDRAM init anyway!
Click to expand...
Click to collapse
The first attempt will be to enhance the JTAG config file with all that stuff i already found out, e.g. setup all GPIO, alternate functions .....
Relocate and compile would be nice too, but more work .
Which tools are you using to decompile IPL?
Click to expand...
Click to collapse
Someone in the forum pointed out to use radare. This was the starting point for further investigation.
At least radare uses objdump for disassembly.
So i decided to use the tools itself.
Here's a short howto:
How to convert raw arm binaries to elf and disassemble the code:
Although not every ARM code is compiled with the famous GCC (e.g. wince binaries) you may use some tools
of the GCC to convert raw binary code that is executable on ARM platforms.
Make sure that you made a real memdump or read out pure flash files from a known offset (reset entry points, direct jumps into code, etc).
In other words use pure binaries!!!
Otherwise this method won't work. It is nice to disassemble bootloader code for example.
Image files with filesystem information won't work, either!!
You'll need a working ARM cross compiler in this example the arm-none-eabi gcc version 4.2 from codesourcery was used.
1. first you have to build an elf-binary for ARM without offset (assumed 0x0) from the raw binary.
arm-none-eabi-objcopy -I binary -B arm -O elf32-littlearm ipl_0x0-0x800.bin ipl_0x0-0x800.elf
2. second simply disassemble the elf-binary!
arm-none-eabi-objdump -D ipl_0x0-0x800.elf > ipl_0x0-0x800.asm
That's it!
scholbert
Click to expand...
Click to collapse
Of course you need some skills to point out how assembler code is organized and you'll have to find out where ASCII strings are stored. If you don't check this everything looks like instruction code!
Regards,
scholbert

scholbert said:
Hi,
I will somehow. Maybe i'll put on my website or post it here!
Very busy at the moment .
Click to expand...
Click to collapse
Ok... I'll look forward for these documents! Thanks!
scholbert said:
The first attempt will be to enhance the JTAG config file with all that stuff i already found out, e.g. setup all GPIO, alternate functions .....
Click to expand...
Click to collapse
Great!
After my jtag will be fully functional, I'll try to do some experiments running IPL from memory...
scholbert said:
Of course you need some skills to point out how assembler code is organized and you'll have to find out where ASCII strings are stored. If you don't check this everything looks like instruction code!
Click to expand...
Click to collapse
I'm a little rusty... but I'll try!
Anyway I found a very great tool for disassembling arm code: IDA Pro v5.2
It is awesome.
Cheers,
roglio

Anyway I found a very great tool for disassembling arm code: IDA Pro v5.2
It is awesome.
Click to expand...
Click to collapse
Yeah i know. I once worked with the eval version.
Very nice piece of software, but no freeware.
Good luck for your experiments!!!
scholbert

IPL disassembled
Hi scholbert!
Attached you will find the IPL asm I've disassembled with IDA.
I hope it could be of some usefulness!
Cheers,
roglio

Hi,
roglio said:
Hi scholbert!
Attached you will find the IPL asm I've disassembled with IDA.
I hope it could be of some usefulness!
Cheers,
roglio
Click to expand...
Click to collapse
Great work!
Here's mine. As you will see it's very equal (at least it should be ).
I made some comments already, but it's not finished yet.
The structure can be seen already. It is soon possible to reconstruct the whole asm code and compile it .
scholbert

is it all necessary ?? more easy way in desoldering flash ... and program it or change to flash from dead device

@scholbert: wow you're always at least a step ahead!!!
Great!
@mo3ulla: hi! yes it is worth the effort because the chance to have skills to build a jtag connector is greater than have skills (and tools) to reball a bga chip (and program it!).
With jtag interface and a relocated IPL we can resurrect bricked uni simply loading it in ram and running. Then reflash the pda with a simple usb cable

Hi,
roglio thanks for the credits .
But at least this no competition, it's really great that someone took a look at this posting and started to discuss.
This goes out to you roglio .
mo3ulla said:
is it all necessary ?? more easy way in desoldering flash ... and program it or change to flash from dead device
Click to expand...
Click to collapse
When i started this topic, i thought about a way to de-brick some uni's without touching the hardware. So roglio is absolutely right!
Once tried reballing at home???
At least the major point is:
Why touch the hardware, when it's a software problem?
Obviously no one got a programmer for mDOC devices!
If the universal would have NOR flash all things would be less complicated.
So what we are doing here, is to replace a 10.000$ programmer.
These professional devices do the same in the end, they use software algorithm to programm these NAND flashes.
The SPL uses the same software parts to reprogram G3 NAND flashes, but to start SPL (get into bootloader menu), IPL is needed. On a heavily bricked device these parts are damaged.
If we setup the device like IPL does or recompile IPL to run from RAM using JTAG, it could be possible to start SPL and get into bootloader menu.
The rest is already described here ....
Regards,
scholbert

O.K., here's dump from the bricked uni.
The screenshot shows the IPL section. It seems to be IPL version 2.36 which is for devices with a G4 NAND.
Mine is a G3, so this is the reason why it got bricked.
Someone updated the bootloader with a wrong version .
I enhanced the config file for the JTAG debugger with the settings i found out by disassembling IPL version 0.36 (G3 devices).
But unfortunately no success. The SDRAM is not accessible .
Without SDRAM initialised, i am not able do download SPL to the platform.
grumbl....
I'll have to check all settings again.
Especially the SDRAM setup...........
No time for that at the moment.
Anyone who'd like to join our experiments????
Cheers,
scholbert

Unbricking and QPST - All Snapdragon / Qualcomm devices

Hello All,
First let me say thanks to all XDA Developers, and without this forum I would still be a pleb when it comes to unbricking. :highfive:
The link to QPST: androidbrick.com/download/latest-qpst-2-7-build-422-425-430-437-qfil-qualcomm-flasher/
(Sorry, I haven't passed 10 posts yet, so you have to manually enter into the address bar)
I came to this forum seeking answers to unbrick my hardbricked Note 4, and after many hours of heartbreak and headache, I have come across a tool called QPST.
This tool is used by Qualcomm, and if you read carefully through the accompanying documentation, you will find some interesting stamps - such as "Confidential" etc.
While I am no expert in the use of QPST, from my own incomplete research I am convinced this tool can be used on any device which sports a Qualcomm chipset (Snapdragon etc.) to unbrick it from certain death.
I have not yet succeeded with my attempts at unbricking, but it is now only a matter of time and kind people pointing me in the right directions. :fingers-crossed:
I am looking for the right files to go in the "phone image" and "boot image" lines in the QPST Software Download program.
I hope we can all see the opportunity this tool represents and spread the word among the greater community, not just developers.
Edit:
Using Software Download:
Phone image files will have a .hex extension and I do not believe they can be found on sammobile. I still haven't found the right one.
Boot image files: I still don't know what they will look like. Likely a .hex file.
Using QFIL:
I suspect all these files can be acquired from a service ROM (whatever a service ROM is - I don't think it is a ROM for android as I know them). I am not completely sure of this however.
Using the flat build option will let you select the programmer. It will have a file name like:
prog_emmc_firehoseXXXX.mbn
(Replace XXXX with the correct numbers for your snapdragon. I don't know what the right ones for the Snapdragon 805 are, but I strongly suspect 8084, with a remote possibility of 8064. Edit: I don't know, don't take my word.
There are posts for other phones on XDA, I don't know if they use the 805 chipset or if the files are compatible.) <--- If anyone wants to research, feel free. Team efforts make a big job seem easy! Please post your results!
Accompanying your firehose file will be a bunch of other files in the same folder.
You will need two .xml files to go with the above (usually in the same folder), which will look like as follows:
rawprogram0XXXX.xml (here XXXX denotes some numbering system which will be determined by the internal memory of the device eg 16GB, 32GB, 64GB. I saw an example for a OnePlus One which had rawprogram0_64G.xml.
I'm NOT 100% SURE on this numbering system, as elsewhere on XDA I have come across different file names!
Here's the truncated link: androidbrick.com/ultimate-qualcomm-snapdragon-unbrick-guide-snapdragons-are-unbrickable-qhsusb_dload_qpst_qfil/)
patch0.xml
When I find the above, I will post or hassle an admin to post, as these will likely unbrick any Snapdragon 805. Happy hunting!
Here's a truncated link to XproZayd's thread, where a different avenue is explored (and where I got my idea about the 8084 number for firehose -- Remember, I could be wrong!)
forum.xda-developers.com/note-4/help/unbrick-samsung-galaxy-note-4-sm-n910w8-t3249970
This thread is for discussing QPST and how to use it - if you have a hard bricked phone I am not able to help at this stage. However, should anybody find / 'acquire' the right files to use with QPST, we will all benefit.

What made your device hard brick
Sent from my SM-N910G using Tapatalk

Mistake 1: I bought the phone with the known problem of a USB port not working.
Mistake 2: I bought a replacement USB board and replaced it myself, after which the fun and games began. The one time the screen did light up I got an error message about mmc read fail and could not boot.
Mistake 3: Like a fool, I pulled the battery. Now I have a hard bricked / useless Note 4.
Unless the mmc is physically damaged (which I refuse to believe) the phone should be salvageable from its hard brick state. Provided I can find the right files to go with QPST.
Edit:
I have tried contacting Qualcomm to get the files, who have pointed out that they are proprietary to the licensee, ie Samsung. Here's the e-mail below.
Any information other than what is listed on our website (URL listed below for your reference) is Proprietary to Licensees.
However, the following link should help you with the information you're looking for:
http://www.mydragonboard.org
Alternatively, we recommend you follow-up with a vendor that carries this product and seek their feedback on your technical questions.
Please note, Qualcomm is the technology provider, not a manufacturer of consumer products and therefore we are unable to answer your product specific question. We hope this direction helps.
Thank you for your inquiry,
Qualcomm Technologies Inc.

can you explain to me everything that is happening?
i got my note 4 hardbricked from......
i really dont know
i was modifying my phone but then it would not boot

AlexanderDAB said:
can you explain to me everything that is happening?
i got my note 4 hardbricked from......
i really dont know
i was modifying my phone but then it would not boot
Click to expand...
Click to collapse
Is it going in download mode or recovery ?
What were you exactly flashing ?
Is it detected in pc as qhsb loader ?
Is the splash screen GALAXY NOTE 4 showing up ?
Sent from my SM-N910G

Update:
So far I have contacted Qualcomm, Intrinsyc (they sell Snapdragon development boards), and a Samsung retail outlet.
All have come back as a negative - the closest I could get was the Samsung retail outlet where a dude used to work in the repair centre and had access to the files then.
Unfortunately, Samsung revoked his permissions now that he only works in a retail outlet.
He knew what I was talking about, but due to Samsung and their encryption etc, he couldn't provide me with the files.

C_dog_1 said:
Mistake 1: I bought the phone with the known problem of a USB port not working.
Mistake 2: I bought a replacement USB board and replaced it myself, after which the fun and games began. The one time the screen did light up I got an error message about mmc read fail and could not boot.
Mistake 3: Like a fool, I pulled the battery. Now I have a hard bricked / useless Note 4.
Unless the mmc is physically damaged (which I refuse to believe) the phone should be salvageable from its hard brick state. Provided I can find the right files to go with QPST.
Edit:
I have tried contacting Qualcomm to get the files, who have pointed out that they are proprietary to the licensee, ie Samsung. Here's the e-mail below.
Any information other than what is listed on our website (URL listed below for your reference) is Proprietary to Licensees.
However, the following link should help you with the information you're looking for:
http://www.mydragonboard.org
Alternatively, we recommend you follow-up with a vendor that carries this product and seek their feedback on your technical questions.
Please note, Qualcomm is the technology provider, not a manufacturer of consumer products and therefore we are unable to answer your product specific question. We hope this direction helps.
Thank you for your inquiry,
Qualcomm Technologies Inc.
Click to expand...
Click to collapse
I have the same problem and also looking for a solution. I will contribute to this post as I find something.
There is a similar post here:
http://forum.xda-developers.com/note-4/help/unbrick-samsung-galaxy-note-4-sm-n910w8-t3249970
---------- Post added at 07:10 PM ---------- Previous post was at 06:30 PM ----------
Try this manual.
http://dl-1.va.us.xda-developers.co....rar?key=yrJPiZgu63c6RxNIbU_xVA&ts=1474829412
I've found it earlier today but haven't had a chance to try it yet.

Says the file is gone
Sent from my SM-N930W8 using XDA Labs

It's just the pdf and .pit that i used here: http://forum.xda-developers.com/note-4/help/hard-brick-phone-off-long-help-fellow-t3468792

yashthemw said:
Is it going in download mode or recovery ?
What were you exactly flashing ?
Is it detected in pc as qhsb loader ?
Is the splash screen GALAXY NOTE 4 showing up ?
Sent from my SM-N910G
Click to expand...
Click to collapse
it won't boot at all
i was messing around with the system on the factory binary firmware
yes, it is
nope, it will not boot

i have same problem does any one sucess with this process ?

Hey guys, i successfully created a Debrick.img for note 4 , used my own functional note 4 to create one .
http://forum.xda-developers.com/showthread.php?t=3488114
Don't forget to Press thanks .
Reporting Via N910G.

yashthemw said:
Hey guys, i successfully created a Debrick.img for note 4 , used my own functional note 4 to create one .
http://forum.xda-developers.com/showthread.php?t=3488114
Don't forget to Press thanks .
Reporting Via N910G.
Click to expand...
Click to collapse
can you get me a dude with an AT&T note 4?

same boat with my N910F
C_dog_1 said:
Hello All,
First let me say thanks to all XDA Developers, and without this forum I would still be a pleb when it comes to unbricking. :highfive:
The link to QPST: androidbrick.com/download/latest-qpst-2-7-build-422-425-430-437-qfil-qualcomm-flasher/
(Sorry, I haven't passed 10 posts yet, so you have to manually enter into the address bar)
I came to this forum seeking answers to unbrick my hardbricked Note 4, and after many hours of heartbreak and headache, I have come across a tool called QPST.
This tool is used by Qualcomm, and if you read carefully through the accompanying documentation, you will find some interesting stamps - such as "Confidential" etc.
While I am no expert in the use of QPST, from my own incomplete research I am convinced this tool can be used on any device which sports a Qualcomm chipset (Snapdragon etc.) to unbrick it from certain death.
I have not yet succeeded with my attempts at unbricking, but it is now only a matter of time and kind people pointing me in the right directions. :fingers-crossed:
I am looking for the right files to go in the "phone image" and "boot image" lines in the QPST Software Download program.
I hope we can all see the opportunity this tool represents and spread the word among the greater community, not just developers.
Edit:
Using Software Download:
Phone image files will have a .hex extension and I do not believe they can be found on sammobile. I still haven't found the right one.
Boot image files: I still don't know what they will look like. Likely a .hex file.
Using QFIL:
I suspect all these files can be acquired from a service ROM (whatever a service ROM is - I don't think it is a ROM for android as I know them). I am not completely sure of this however.
Using the flat build option will let you select the programmer. It will have a file name like:
prog_emmc_firehoseXXXX.mbn
(Replace XXXX with the correct numbers for your snapdragon. I don't know what the right ones for the Snapdragon 805 are, but I strongly suspect 8084, with a remote possibility of 8064. Edit: I don't know, don't take my word.
There are posts for other phones on XDA, I don't know if they use the 805 chipset or if the files are compatible.) <--- If anyone wants to research, feel free. Team efforts make a big job seem easy! Please post your results!
Accompanying your firehose file will be a bunch of other files in the same folder.
You will need two .xml files to go with the above (usually in the same folder), which will look like as follows:
rawprogram0XXXX.xml (here XXXX denotes some numbering system which will be determined by the internal memory of the device eg 16GB, 32GB, 64GB. I saw an example for a OnePlus One which had rawprogram0_64G.xml.
I'm NOT 100% SURE on this numbering system, as elsewhere on XDA I have come across different file names!
Here's the truncated link: androidbrick.com/ultimate-qualcomm-snapdragon-unbrick-guide-snapdragons-are-unbrickable-qhsusb_dload_qpst_qfil/)
patch0.xml
When I find the above, I will post or hassle an admin to post, as these will likely unbrick any Snapdragon 805. Happy hunting!
Here's a truncated link to XproZayd's thread, where a different avenue is explored (and where I got my idea about the 8084 number for firehose -- Remember, I could be wrong!)
forum.xda-developers.com/note-4/help/unbrick-samsung-galaxy-note-4-sm-n910w8-t3249970
This thread is for discussing QPST and how to use it - if you have a hard bricked phone I am not able to help at this stage. However, should anybody find / 'acquire' the right files to use with QPST, we will all benefit.
Click to expand...
Click to collapse
Im in the same boat with my NOTE 4 N910F. Totally blacked out but still picking it up on the PC with QFIL files have found some files but there not the right phone I think.
so fails to load with SAHARA.
cannot find firehose for 910F. Wish someone could solve this one and then publish it all. someone will eventually but QFIL will unbrick all Qualcomm provided you can make the files.
Let me know if you or anyone does. cheers

Lofhario said:
Im in the same boat with my NOTE 4 N910F. Totally blacked out but still picking it up on the PC with QFIL files have found some files but there not the right phone I think.
so fails to load with SAHARA.
cannot find firehose for 910F. Wish someone could solve this one and then publish it all. someone will eventually but QFIL will unbrick all Qualcomm provided you can make the files.
Let me know if you or anyone does. cheers
Click to expand...
Click to collapse
https://forum.xda-developers.com/showthread.php?t=3488114
Tried this?
Reporting Via N910G.

Hi, got a Phicomm Energy M+ (E551). It turned off as the battery was empty, so I charged it overnight.
But:
-Switching it on only shows the phicomm logo
-Trying to enter recovery, shows phicomm logo for a second and then the screen stays lit. Nothing else happens.
-On Windows 7 device manager shows it as "RELINK HS-USB QDLoader 9008 (Com3)" (VOL Up+VOL Down + Power)
-fastboot/adb wont find it
-I tried this http://www.droidsavvy.com/unbrick-qualcomm-mobiles/
I dont have a emmc backup but an unzipped Stock ROM of the E551L which support told me to use. (put on SD card and reboot into recovery, but I cant get into recovery)
Hence I use the unzipped ROM with the Qualcomm FLasher :S (http://na.phicomm.info/release/E551L...TA package.zip)
-It starts the process but then says "Failed to enter EDL" (Emergency) mode
Another thing I stumbled across is :
E551L has Qualcomm MSM8916 and Android 4.4.2
E551M has Qualcomm MSM8915 and Android 4.4.4
Will I have to quire a deepflash cable or am I missing something here ?

yashthemw said:
Hey guys, i successfully created a Debrick.img for note 4 , used my own functional note 4 to create one .
http://forum.xda-developers.com/showthread.php?t=3488114
Don't forget to Press thanks .
Click to expand...
Click to collapse
tried but not working
waiting for other solution

I would like to mod/hack this. Help please? any and all appreciated.

I got a smartwatch from a friend, they said they bought it at walmart. Someone posted a code to type into the dialer, and i got this info from it
LD991A_BSC_A1_LX7789_9304_CAM3A01_LANGA_V2.2
[BRANCH]:
11CW1352MP
MTK61D_BTDIALER_11C
BUILD:BUILD_NO
SERIAL#:
[BUILD TIME]
2016/11/08 12:15
[MRE VERSION] - 266923472
HAL_VERNO:
also, how would i go about getting the IMEI for this thing? do i need to put some sim card in it before it will give me that? I'd like to do.. whatever i can to this thing, most specificially though, change the watch faces. It has a computerized analog clock, i'd rather it show some sort of nifty digital..
Edit : it was *#8375# that showed that info

Look at this: https://forum.xda-developers.com/sm.../readback-extractor-mtk6260-firmware-t3289272
Be careful to take a full recovery dump before anything else !!!
What model is it?

defdefred said:
Look at this: https://forum.xda-developers.com/sm.../readback-extractor-mtk6260-firmware-t3289272
Be careful to take a full recovery dump before anything else !!!
What model is it?
Click to expand...
Click to collapse
That's the thing, with it being chinese with english language. I'm not completely sure. The info there says it's "A1", and it matches the watches called that, on youtube. So, i guess?

Eve_brea said:
That's the thing, with it being chinese with english language. I'm not completely sure. The info there says it's "A1", and it matches the watches called that, on youtube. So, i guess?
Click to expand...
Click to collapse
If it's a "A1" clone I'm very interesting by your firmware !!!
I trashed mine stupidly before having the full dump completed and now I'm stuck with another ROM that cause my screen/touch screen to be inverted!
You need to install the MTK usb drivers under micro$oft windows + the flash tool https://drive.google.com/file/d/0B_hRh3DjuBoeeUk3azBBU0ZvSXc/view?usp=sharing
The first thing to do is a "readback" backup => you will get a 4MB dump of the firmware. Keep it safe!
If you want to try the "test ram" feature, be careful to suppress the NOR test (because it will destroy your firmware) .
You can use the config file from https://drive.google.com/drive/folders/0B_hRh3DjuBoeZktTVXJrWms1U1k to feed the flashtool, but dont "download" neither "format", it will destroy your firmware!

defdefred said:
If it's a "A1" clone I'm very interesting by your firmware !!!
I trashed mine stupidly before having the full dump completed and now I'm stuck with another ROM that cause my screen/touch screen to be inverted!
You need to install the MTK usb drivers under micro$oft windows + the flash tool https://drive.google.com/file/d/0B_hRh3DjuBoeeUk3azBBU0ZvSXc/view?usp=sharing
The first thing to do is a "readback" backup => you will get a 4MB dump of the firmware. Keep it safe!
If you want to try the "test ram" feature, be careful to suppress the NOR test (because it will destroy your firmware) .
You can use the config file from https://drive.google.com/drive/folders/0B_hRh3DjuBoeZktTVXJrWms1U1k to feed the flashtool, but dont "download" neither "format", it will destroy your firmware!
Click to expand...
Click to collapse
Well, if i can pull out a copy of the files, i don't mind sharing them. However I'm not going to do it if there's nothing useful to me. Are there files to. do anything to my watch? Can i change the faces as i want? Add other apps? Unlock the device? It has a sim card slot, i ordered a card from the free company "freedompop" i plan to try in it, but i'm not sure how it's going to go.

Concerning watch faces, is it easly, thanks to Golem, for MT6260 models => https://forum.xda-developers.com/smartwatch/other-smartwatches/watch-vxp-files-t3437311
But it is still ongoing / difficult /maybe impossible for MT6261 models with 4MB ROM / 32 MB RAM.
What is your models (check with the Flashtool / RAM test and don't forget to uncheck the box for the NOR test) ?
One you have a correct backup, you may try other firmware (with other faces) => https://drive.google.com/folderview?id=0B_hRh3DjuBoeblBsakZfUWFCeGM&usp=sharing
Notice that only few will work due to hardware variety of clones.

defdefred said:
If it's a "A1" clone I'm very interesting by your firmware !!!
I trashed mine stupidly before having the full dump completed and now I'm stuck with another ROM that cause my screen/touch screen to be inverted!
You need to install the MTK usb drivers under micro$oft windows + the flash tool
The first thing to do is a "readback" backup => you will get a 4MB dump of the firmware. Keep it safe!
If you want to try the "test ram" feature, be careful to suppress the NOR test (because it will destroy your firmware) .
Click to expand...
Click to collapse
I used *#8375# on the one I just got and came up with the exact match to what OP posted.
Managed to get a Readback on the Rom and formed a back up with the flashtool.
Posted to my google drive if you can download and look at it:
/ file/ d/0ByCO5YTrx3QBWWRqRTJyQVFub3M/ view?usp=sharing
Hope this helps since you were interested. If I need to do something else done to it please let me know username at gmail...

Unbrick hard bricked Motorola Moto E

This DevDB project and it's related files are by Aravind V. Nair. I'm stating this because so many people are trying to impersonate me. For example, @Balaji Sriram More info: Balaji Sriram impersonating Aravind V. Nair
Most of you are probably facing battery issues. Please check what I have to say regarding that before proceeding. So many people have reported success after fixing the battery issue. Details are available at the bottom of the post
Click to expand...
Click to collapse
If your eMMC storage controller is corrupted, no method will work. You need to replace the motherboard. I'm sorry, I can't help you with that.
Click to expand...
Click to collapse
Big thanks to @ariel.buszczak for his continuous support in every way he could!
Big thanks to @waulliano for uploading the backup.img for XT1022! Download from here
Please upvote the TWRP time issue on GitHub here: TWRP 3.0.2-0 build to 3.1.1-0 build time miscalculation on so many devices.
Click to expand...
Click to collapse
Introduction?
Yes, of course. Hi there!
I have a bricked Motorola Moto E 1st Generation XT1022 condor. I watched so many threads on various forums to try and unbrick, but unfortunately all threads just got abandoned. Hence, I have come up with a DevDB project to try and unbrick Motorola Moto E 1st Generation XT1022 condor if possible. Please note, this project is only for Motorola Moto E 1st Generation XT1022, XT1021 and XT1025 condor. Between, I also have an unbricked working Motorola Moto E 1st Generation XT1022 condor along with the bricked one for test purposes.
This XDA DevDB project is aimed at developers mainly to gather all possible ways to unbrick a hard-bricked Motorola Moto E 1st Generation XT1022 condor, but not restricted to people who want to try their luck at unbricking their Motorola Moto E. Please don't post 3-line request like "my device is bricked, please help" as you will be ignored. If you can't do the research required to provide the right details plus finding the correct files required then, this DevDB project is not for you. The programs, its associated files & threads, etc are NOT going to be being actively developed very soon (July 10th 2017) as I get busy and involved with other things. But the thread remains open for user to post more information, additional files, updates from the public, etc. It's not here for lazy people to scream fix my device, can those type of users please speak to your retailer, cell phone service shop??
I will reiterate again, THIS IS A DEVELOPMENT THREAD AND NOT A REQUEST PAGE FOR "fix my device"
Click to expand...
Click to collapse
I haven't stopped working on this. I do update this XDA DevDB and my GitHub repository for the as I get time.
Please go through this DevDB post thoroughly.
Click to expand...
Click to collapse
Rules and regulations:
Please click the 'Follow Project' button to get notifications every time I update files or make any other changes instead of asking me manually via PM or in thread replies. I won't reply to unsolicited spam messages. So, DO NOT waste your time crafting them.
Click to expand...
Click to collapse
Obey all XDA rules posted here along with CODE_OF_CONDUCT.md posted by me here.
Click to expand...
Click to collapse
Please read through this post and also go through the README.MD file on my GitHub repository for this project carefully and thoroughly. They are created for a reason. I won't reply to unsolicited spam messages, tags, quotes, replies, etc. So, DO NOT waste your time crafting.
Click to expand...
Click to collapse
Warning: I am in no way responsible for your actions. You are on your own. Please undertake all actions at your own risk.
Click to expand...
Click to collapse
Please compress all files before uploading to the cloud after removing personal data. I'm not going to check otherwise.
Click to expand...
Click to collapse
Please attach error codes and other additional information is separate files to avoid clutter. I'm NOT going to check otherwise.
Click to expand...
Click to collapse
DO NOT share anything from this thread. DO NOT mirror anything without prior permission. I have recently busted so many people who have tried to do so despite my warning and even got them banned.
How can I get in touch with you?
My personal blog (All social media profiles link are available):
About Aravind V. Nair
Click to expand...
Click to collapse
Or
Just Search Google for 'Aravind V. Nair' and you can find me.
Click to expand...
Click to collapse
Or
My website: Get to know Aravind V. Nair
Click to expand...
Click to collapse
Or
XDA: Aravind V. Nair - XDA Developers
Click to expand...
Click to collapse
Where can I find the files and instructions?
Please check here: Motorola Moto E XT1022 condor files - GitHub (Aravind V. Nair)
How do I support you?
Hit the thanks button below and the 5-star button above to show your support. Also, you can 'star' and 'watch' my GitHub repository Motorola Moto E XT1022 condor files - GitHub (Aravind V. Nair).
Follow me on social media networking sites if you wish.
Donate to me if you wish by clicking here
What is the goal of this project?
The goal of this project is to gather all possible ways to unbrick a hard bricked Motorola Moto E 1st Generation XT1022 condor. Methods 3, 5, 6, 7 and 8 are perfectly working. Your mileage will vary with other methods. Please don't give up on first try. You need to try a lot of times and test your luck.
What is the proof that this has worked?
I have attached photos to this DevDB post. Please have a look at them.
Will this work for everyone?
As long as you haven't corrupted any of your phone's hardware, you do have chances of unbricking. If the NAND adapter or related parts are not functional, don't even expect to unbrick. A lot of you have tried weird files on the internet, so chances will reduce accordingly.
Where can I find the changelog?
I frequently update and patch things in my GitHub repository as I get time. Be sure to check the changelog here.
How do I find out which bootloader I have?
Sorry, I don't think that's possible when the phone is bricked. I'm not sure though. But definitely, your bootloader version would be the version from your last working stock OS (or custom OS, only if you flashed the motoboot.img or any other equivalent bootloader image).
If fastboot works,
Code:
fastboot getvar all
Can I restore factory aka original firmware if my bootloader is locked?
Yes, you can. However attempting to downgrade to an older version of Android may fail and isn't a good idea. Even with an unlocked bootloader, downgrading cannot be guaranteed. It's also important to be aware that flashing the wrong bootloader (motoboot.img) for your model can have serious consequences. Always identify your model of Moto E and verify the files before flashing.
If you downgrade your phone, it is advised to avoid all OTA updates. These updates can result in a hard-brick (phone will not turn on) if you have a newer bootloader than the one expected. For example, most of you had the Lollipop bootloader, but have downgraded to Android KitKat and thus bricking your phones.
How to disable OTA Updates?
Without root access
Settings > Apps > [swipe left to 'All'] > MotorolaOTA (or Motorola Update Services or something similarly named) > Disable​
With root access
Google Play Store has many apps that will allow you to 'freeze' the OTA Update service. Titanium Backup is a common example.
Alternatively, with a 'root access' file explorer, you can delete or rename the following files:
/system/etc/security/otacerts.zip
/system/priv-app/3c_ota/3c_ota.apk​
These additional files can be removed or renamed: (If you still get an OTA Update notification)
/system/priv-app/3c_checkin/3c_checkin.apk
/system/priv-app/3c_devicemanagement/3c_devicemanagement.apk
/system/priv-app/3c_notification/3c_notification.apk​
I'm a developer or programmer or want to help. Could you please give some reference links?
Yes, of course. All contributions are welcome! Code, documentation, graphics or even design suggestions are welcome; use GitHub to its fullest. Submit pull requests, contribute tutorials or other wiki content -- whatever you have to offer, it would be appreciated!
Please feel free to get in touch with me. I'll always be available even after the deadline. Refer CONTRIBUTING.md on my GitHub repository for reference material and other things.
What are the possible methods of unbricking?
Refer Unbrick methods.md on my GitHub repository.
Where can I download the firmware files?
Check my GitHub README.md file for all files for all models or alterantively Moto E Factory Firmware Images by @lost101
Moto E won't power on. Only white light LED comes up when connecting powers source. Can I charge on AC, etc.
This has nothing to do with clearing cache, recovery and other nonsense. It is just a problem of overly discharged battery when the battery voltage drops below the 3.8 V, which is the minimum voltage of LiPo aka Lithium ion Polymer battery. Unlike other phones, all Motorola devices come with LiPo batteries.
When the battery reaches less than 0%, i.e., less than 3.8 V the phone will not allow it to turn on, as it is harmful for the battery and it might burst. So for these physical security reasons, the phone's adapter chipset/regulator stops the battery from charging. I faced the same problem many times while bricking and unbricking. One thing you could try is to jumpstart the battery by providing excessive power at your own risk, or consider replacing the battery. It is advisable, to never let the battery fall below 10 %. Below 0 %, the internal resistance or rather the impedance of the battery increases to a very very high constant, thus rendering the battery in a 'cannot be charged state'. I won't by trying to fix via firmware as it is very dangerous to charge a battery in such a state. We do not want another bomb apart from the already existing Samsung Galaxy Note 7, do we? :laugh:
Please check your battery voltage using a multimeter or voltmeter and contact me with the same. Please be very careful when removing the battery as Moto E has a loose pin and is easy to break. Caution advised!! For checking using multimeter, set to DC 20 Volts and use the correct input pins. For voltmeter, just use any DC voltmeter having a range of 0-5 Volts.
If the voltage is below 3.8 V, you have to replace the battery. If it is between 3.3 - 3.5 V, you have chances of resurrecting the battery. So try using a above 2 A charger (connecting to laptop won't work as that is just 0.5 A) and leave it like that for about 5 days continuous. Below 3.3 V, please replace the battery. It's not advisable to try and jumpstart.
For the prerequisites, you need a T4 Torx screwdriver and a new Moto E battery. Please buy genuine things. You could have a look at Amazon, Flipkart, eBay, IFIXIT, Snapdeal, etc and also offline stores. Search with the model number of the battery. For XT1022, XT1021 and XT1025, it is Motorola EL40 manufactured by SONY Electronics with a typical mAh of 1980 and minimum of 1860 mAh aka 1860/1980 mAh (min/typ) and 7.1/7.5 Wh (min/typ).
PLEASE DO NOT USE AC TO CHARGE DC BATTERIES DIRECTLY.
You have a high risk of causing serious damage. You might end up killing yourself! Please do not try this. To charge in this manner, you need a bridge rectifier. Noobs, please don't even venture here or think of making it. The battery will not get charged because AC supply changes its polarity after each half cycle. In India, it changes 50 times per second, Brazil 60. Therefore, the battery will be charged in one half cycle and discharged in the next half cycle. So basically, you are damaging the battery due to frequent charging and discharging cycles. Please do not try this!! There is high risk of fire damage and explosion. Those of you who already tried this, please discard the battery immediately to a recycling firm or any other relevant organisation for your country or city. It is not advisable to keep a spoilt battery at home. Using a resistor is not a good idea either as a resistor obeys Ohm's Law which states that the current flowing through any conductor, in this case the battery, is directly proportional to the potential difference across the terminals. So you wouldn't have a steady output. A diode would be preferable. Those who have no clue about these, please do not venture here. I reiterate, I won't be held accountable for any damage caused by you to yourself or your belongings or to anything else.
I was using the Moto E and it suddenly died. What do I do?
Step 1: Open up the phone as I have mentioned earlier. (If you read whatever I have written, you should be knowing what I'm talking about.)
Step 2: Detach the battery. Be very careful not to destroy any internal parts such as the connector which is very fragile.
Step 3: Connect the official charger. (Other chargers didn't work for me always during my testing.)
Step 4: Wait for the screen to say 0% or battery not connected or even if the screen turns on, consider yourself lucky.
Step 5: Attach the battery and reassemble the phone without removing the Moto charger.
Step 6: Go to fastboot, unlock the bootloader and use my fastboot unbrick script for your OS (I have made for Linux, Windows and MacOS). Leave it on charger for a day or two after this.
Step 7: Voila!
This is caused due to undercharging, overcharging or excessive battery drain cycles. In case the phone doesn't power on after connecting battery, check that the EMF of the battery is above 2.9 V with a multimeter as mentioned before.
How to power on Moto E without charger and unbrick?
Safest way is to use the original Motorola charger. As far as I have seen, all the original Motorola chargers have the 4th pin available. For the geeks:
Pin 1: VDD (+5V)
Pin 2: D- (Data-)
Pin 3: D+ (Data+)
Pin 4: ID (ID)
Pin 5: GND (Ground)
The additional pin added to the conventional USB port is the ID pin added to the 4th electrical pin which allows to recognize the device. The technical name is micro USB - B for the one on the charger and mini USB - A for the one on the charger. You can bypass power using this concept. This too is strictly not for noobs.
Errors:
Code:
Preflash validation failed
Buy a new phone. I doubt anyone can help you now...
Code:
Not able to flash GPT / Motoboot
You are not using the right firmware. Try another firmware.
Code:
FAILED (blank-flash: sdl-transfer-image: sdl-hello: invalid HDLC frame)
or
Code:
FAILED (blank-flash: sdl-transfer-image: sdl-hello: error sending packet)
Your bootloader files do not match your bootloader version, use another bootloader.
Code:
Stuck on Opening device: . COM ??
or
Code:
Greeting device for command (Or any other) mode
or
Code:
Switch To FireHose (Or any other) mode
Press and hold power button until detection or until flashing begins.
I'm fed up!! Nothing is working for me!!
Calm down!! Replace your motherboard and/or battery and/or screen, whichever is spoilt. That's the easiest option. But it wouldn't be a good choice to buy new parts now. The phone is quite old. I suggest you buy a new phone instead. That would be a wiser idea. Methods 3, 5, 6, 7 and 8 are perfectly working. Your mileage will vary with other methods. Please don't give up on first try. You need to try a lot of times and test your luck. You are the one who brought your device to this condition. Only you can help yourself.
Does this project have a website?
Yes, a very basic one though. Check here.
Please go through this XDA DevDB main post and my GitHub repository for the same before commenting, messaging or posting.
XDA:DevDB Information
Unbrick hard bricked Motorola Moto E, Tool/Utility for the Moto E
Contributors
aravindvnair99, Thanks for all support!
Source Code: https://github.com/aravindvnair99/Motorola-Moto-E-XT1022-condor-unbrick
Version Information
Status: Stable
Current Stable Version: 309
Stable Release Date: 2018-05-29
Current Beta Version: 309
Beta Release Date: 2018-05-29
Created 2017-05-01
Last Updated 2018-05-29

Reserved
By @kyocell
I am currently getting some SAHARA Port errors I'm trying to install and uninstall drivers and trying.
Will keep updating if it works.
Edit- Fixed SAHARA Port errors but now experiencing different ones.
Edit2- Now experiencing some kind of SAHARA Protocol errors.
Fixed errors guide- If you get any kind of SAHARA Port error then follow this easy guide.
1) First off, delete all the preinstalled drivers
2) disable your machine's driver signature enforcement by doing this -
Click the Start menu and select Settings.
Click Update and Security.
Click on Recovery.
Click Restart now under Advanced Startup.
Click Troubleshoot.
Click Advanced options.
Click Startup Settings.
Click on Restart.
On the Startup Settings screen press 7 or F7 to disable driver signature enforcement.
3) After you enter your machine with driver enforcement disabled, Now go to the folder "Drivers" and extract the Qualcomm drivers and install them.
4) Here comes the tricky part. Now open your "moto e unbrick folder". Provided by @aravindvnair99 at his GitHub page and open the folders patch0.xml , prog_emmc_firehose_8x10 , rawprogram0.xml and copy all the contents into a new folder called "unbrick".
5) Now install the QPST tool. (installer in the unbrick folder provided by @aravindvnair99 at his GitHub.
6) Once you have this installed, go to the location of the installation of Qualcomm--> QPST --> Bin --> and copy this folder we made called "unbrick" into "bin" folder.
7) Now run Qfil.exe file which is located in the "bin" folder as well.
8) Now, plug your moto e with USB to your pc. If any drivers start installing, let them install.
9) Now select the port. Then browse the path for Programmer. For this click browse --> locate to the "unbrick" folder and select on "All files (*.*)" located at the bottom right of the browse window (dropdown).
10) Now select the file "programmer_8x10.mbn" and click ok.
11) Now click on load XML and locate to the "unbrick" folder and select the "rawprogram0.xml" file then another browse box will open and this time select "patch0.xml" and click ok.
12) You are now all set!
13) Finally click the "download" box and watch your phone come alive!
Hope this guide was easy. @aravindvnair99 you can use these instructions for method 1 as they are more elaborated & also it will save up your time so that you wont have to type so much data instructions. Its all up to you! i only wanna help all those people with this 'Dead moto e' problem and show them that there is still hope!
Much love! Hope it helped!
<3
P.S @aravindvnair99 please correct me if i have told anything wrong anywhere.
Edit - The following error still persists for me
20:39:51: ERROR: function: sahara_rx_data:194 Unable to read packet header. Only read 0 bytes.
20:39:51: ERROR: function: sahara_main:854 Sahara protocol error
20:39:51: ERROR: function: main:265 Uploading Image using Sahara protocol failed
EDIT - FIX FOR THE SAHARA ERROR
1) right as you plug in your phone to your pc and hear that sound (when device is plugged in to pc) right away click the download button without any waste of time.

Reserved

Happy to see this thread. I also have a bricked Moto E XT1022. After searching in many websites , i found that only flashing emmc using EasyJtag box has sloved the problem. Can you do anything with that flash file which flash the bootloader.

arputhatonyking said:
Happy to see this thread. I also have a bricked Moto E XT1022. After searching in many websites , i found that only flashing emmc using EasyJtag box has sloved the problem. Can you do anything with that flash file which flash the bootloader.
Click to expand...
Click to collapse
@arputhatonyking Thanks for the positive response. Sorry to hear that you too have a bricked condor. Yes, for hard bricked only JTag seems to work now. I don't see any other methods. For soft bricked, it is easy to recover. I am trying to find a solution (if possible) using blankflash or any such similar flashing procedures.
Stay tuned as you might be of help to us.

aravindvnair99 said:
@arputhatonyking Thanks for the positive response. Sorry to hear that you too have a bricked condor. Yes, for hard bricked only JTag seems to work now. I don't see any other methods. For soft bricked, it is easy to recover. Me and @Balaji Sriram are trying to find a solution (if possible) using blankflash or any such similar flashing procedures.
Stay tuned as you might be of help to us.
Click to expand...
Click to collapse
Hope to get a successful one..

i flash emmc backuped from eazy jtag with old riff box 1 but, not enter to fastboot. need read from worked phone and try flash to dead one. i look it to ebay but not find with low price phone/ if find and buy one, i will try read it and post here. i have hard bricked XT1021. it flashed customer from XT1022 firmware, now it dead.

VIPER_GE said:
i flash emmc backuped from eazy jtag with old riff box 1 but, not enter to fastboot. need read from worked phone and try flash to dead one. i look it to ebay but not find with low price phone/ if find and buy one, i will try read it and post here. i have hard bricked XT1021. it flashed customer from XT1022 firmware, now it dead.
Click to expand...
Click to collapse
I didn't quite understand what you were trying to say. As far as I understood:
You should have never flashed wrong firmware even though the only difference is the modem files between XT1022 and XT1021. Sure, will wait for your reply. Thanks for your time @VIPER_GE :good:

has XT1021 flashed as XT1022, now it dead. flashed with customer. i try restore with emmc isp flashing with riff box but not work. need try with Z3X easy jtag, not have this one

VIPER_GE said:
has XT1021 flashed as XT1022, now it dead. flashed with customer. i try restore with emmc isp flashing with riff box but not work. need try with Z3X easy jtag, not have this one
Click to expand...
Click to collapse
Oh, okay. Now I understand. Thanks a lot for the clarification @VIPER_GE !
Actually, Riff Box is mainly for selected Samsung devices. Apart from those, only for the ancient (first few) Motorola and HTC devices. Z3X I heard works for recent devices. I am not sure though. Give it a try. There was another JTag thing. I don't remember the name now. It works for all devices having Qualcomm chipset. Let me see if I can find or remember it. I'll send you the link. Between, are you a technician or something? Or just another curious one like us?

just another curious one like us

Anyone know how to generate BlankFlash Files

Can anyone just give the method to flash in bootloader
And is the file listed in the thread is enough or need some more things to unbrick

https://www.youtube.com/watch?v=Qf7kG3qnyx0 https://www.youtube.com/watch?v=_KRFxtz4h24

Do you guys have jtag ?

i have only FIFF Box 1,

We need RawPatch And Programmer Files for QFIL Flash.

mannu233 said:
Can anyone just give the method to flash in bootloader
And is the file listed in the thread is enough or need some more things to unbrick
Click to expand...
Click to collapse
@mannu233 Some more things are required. You can try though with whatever is uploaded. I'm constantly updating the files. I'm working on this day and night. Waiting for @Balaji Sriram to join me soon.

If I replace the "prom_emmc" file in the "blankflash" folder, can I test if flashing works? Thank you!

aravindvnair99 said:
@mannu233 Some more things are required. You can try though with whatever is uploaded. I'm constantly updating the files. I'm working on this day and night. Waiting for @Balaji Sriram to join me soon.
Click to expand...
Click to collapse
cAN you please do me a favour that i wanted to know how to use these files i haven't got any clue how to use them
---------- Post added at 05:19 PM ---------- Previous post was at 05:05 PM ----------
Can someone list up all files whatever is founded in the thread it would be easy for those who are looking for the files