Develop Bugs

{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory

{GUIDE} {MSL/SPC UNLOCK} -->>Diag Mode: Use QPST - QXDM to Backup & Restore NV Memory
I know everyone is eager to unlock the Verizon Boot-Loader.
We are not quite there yet however this is another step in the right direction.
We are getting deeper and deeper into this so be FOR-WARNED.
If you decide to play around with these tools you do so at your own risk :crying:
I will help anyone who kills there device But I TAKE NO RESPONSIBILITY.
------------------------------------------------------------------------------------------------------------------------------
Follow my instructions exactly and everything will be ok
------------------------------------------------------------------------------------------------------------------------------
Lets Get Started Shall We :highfive:
PREREQUISITES
The ability to follow each step in order :good:
ADB installed ( Android Studio )
Install HTC Sync from the link below. Then uninstall it. This will load and leave the drivers.
Make sure you uninstall it. HTC Sync will interfere.
http://www.htc.com/us/support/software/htc-sync-manager.aspx
STEP 1)
Set Windows 7 or 8 or 10 into TEST MODE ! ( I Am Running Windows 10 )
You can read up on this process here if you have trouble with my instructions.
http://www.drivethelife.com/windows...e-enforcement-on-windows-10-8-7-xp-vista.html
http://www.howtogeek.com/167723/how...8.1-so-that-you-can-install-unsigned-drivers/
You’ll need to run a command from an Administrator Command Prompt to do this. To launch one, right-click the Start button or press Windows+X and select “Command Prompt (Admin)”.
Execute This Command
Code:
bcdedit /set testsigning on
If you did it correct you should see the following.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Reboot your computer.
If you did it correct you should see the following.
STEP 2) Install the Diag Driver in Windows.
Download the DIAG.zip here. It contains all of the files we need to work with at this point.
Code:
http://www.mediafire.com/file/3ta2ua4tkibn3lb/DIAG%282%29.zip
Unzip the file and install the drivers.
There are 2 drivers. 1 for diagnostic mode and one for Emergency Download Mode.
HTC CDMA LTE DIAG Modem Driver v3.0.2.0 (Diagnostic Driver)
Qualcomm_Diag_QD_Loader_2016_driver (Emergency Download Driver)
When you install the Qualcomm_Diag_QD_Loader_2016_driver you will want your screen to look like this.
The Diagnostic Driver install is pretty self explanatory.
I,m going to leave this section for setup details. More could be added later.
In the next post we will install the tools we need and get the phone connected in diagnostic mode.
Also please see here
https://forum.xda-developers.com/desire-626/general/programming-modem-qpst-qxdm-boost-t3488993 @anthonykb deserves the credit for originally leading me to this idea.
We are using the process for different purpose but it all stems from the same idea.
REMEMBER THE DESIRE 526 AND THE DESIRE 626S AND THE DESIRE 530 ALL HAVE THE SAME CHIPSET.
What works for one of these devices should theoretically work on the others.

Checking Drivers + Setup Tools
I think it's time for us to set up some tools and see if our drivers are installed correctly.
There are 3 tools included in the zip.
QPST.2.7.438 ( Just install it. There is nothing special to do )
QXDM Pro 3.14.594 ( Read IMPORTANT text in the patch folder and follow the instructions )
RevSkills V 2.08.6 Pro Edition (Read the readme file)
Install all 3 and proceed to the next step
Set The device into DIAGNOSTIC MODE
My device is already s-off and unlocked. So this might take an extra step for you.
First try this.
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
I tested this on a fully locked 526 so you will get the DIAG Screen.
You should see this screen.
IF ##3424# isn't giving you that screen you will need the extra step
This might not be 100% necessary BUT I RECOMMEND IT
First you will have to get temp root.
Follow here. It will give you root in the shell only. Not root for apps.
https://forum.xda-developers.com/desire-526/general/temp-root100-how-to-temp-root-desire-t3498969
*********************************************************************************************************
ONCE YOU HAVE ROOT ACCESS
Open up a administrator command window.
Execute these commands in the shell.
Code:
adb devices
adb shell
su
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/func_en
*********************************************************************************************************
IF YOU CAN'T GET ROOT THIS SHOULD STILL WORK !!
*********************************************************************************************************
Verify the Diagnostic Port is Available (ALL DRIVERS WORKING)
Open up the phone dial-er on the phone.
Dial ##3424# and hit send.
Connect the device to the computer.
Open up windows device manager.
With all nessessary drivers installed this is what you should see. :highfive:
If you didn't install and uninstall HTC Sync it will look like this
Some things work but this isn't right. DONT DO IT
The HTC Drivers and Diag Drivers are missing. REALLY DONT DO THIS

Time to do some Work
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:

Backup the entire nv ram
Ok lets get too it. Here we will backup the entire NV Ram.
After it is dumped to a file I believe the file can be edited.
It is easy to restore the backup to the device.
Lets get started.
#1) Dial ##3424# then send to get to diagnostic mode.
#2) Open QPST Configuration
#3) You Should See This Screen
#4) In QPST Configuration Click START CLIENTS ( EFS EXPLORER)
Select your device under phone selection
#5)EFS EXPLORER Reads the device
#6)The NV Items Look Like This
Notice the red circle ( We cant access those )
But we can fix NVM to get access using open sesame door
#7)Click File Then NEW then Directory
#7)Add open sesame door
Now reboot the device.
Dial ##3424# again.
Then open QPST Configuration and EFS Explorer again.
Make sure you have the open sesame door folder
Notice NVM is no longe a red circle. ITS UNLOCKED.
After reboot and restart qpst it should look like this.
OK were all done with that part. ( OPEN SESAME DOOR )
Lets dump our Embedded File System now.
Close the EFS File Explorer.
Go to the QPST Configuration and Start Clients -->>> Software Download.
Notice the MPSS Version ---->>>> This tells us what version of Source to USE.
#8)Click The BackupTab
On the backup tab where it says xQCNFile select a a location and name for the file.
#9)Click Start To make the backup.
Pay attention to all the files it creates.
Look at the images below.
TO FLASH A BACKUP EFS FILE
#9)Now Go To the Restore Tab
Select the backup file you want to restore.
Make sure Allow phone/file ESN mismatch is NOT Checked.
The backup you flash has to be from the device you created it from.
Or the backup file will need the ESN Edited to match your device. (DANGEROUS)
I need to find a way to use the ESN mismatch but right now it gives error.
Anyway lets flash our backup.
Select the file.
Click Start.
Restoring NV Memory
Restoring NV ITEM FILES
Restoring BREW FILES
Restoring COMPLETE
So there you have it. We can indeed use the QPST / QXDM tools to communicate and flash the device.
THIS BACKUP IS IMPORTANT.
IF YOU BRICK YOUR PHONE. YOU COULD NEED THIS BACKUP TO RESTORE IT COMPLETELY.
WE CAN EDIT THE BACKUP FILE USING A HEX EDITOR OR THE TOOL I WILL TALK ABOUT NEXT.
In light of all this Someone Who Knows What to Changecould help reduce the device security and help us to further customize the device.
Unfortunately this is fairly new to me so I DONT Know the best things to change.
Best I can think of is to compare the backup from my fully unlocked device. ( S-Off / Super CID )
Against the backup from a factory LOCKED State.
Make any necessary changes to the Locked NV Backup.
Know that the wrong mistake here will brick your device for sure.
Feel free to explore the tools and things that can be accomplished with them.
I recommend highly....DONT CHANGE ANYTHING UNLESS YOU KNOW WHAT YOUR DOING.
Hitting some of the buttons in the tools can be dangerous.
Have Fun. The best thing is this device cost only $34.
So it's perfect for learning these tools and testing.
Then when you do this on your expensive device.
You won't brick it.

GREAT!!
Please make a rom to global GSMcard for connection data,

Wow, I am a newbie and when I seen all these instructions I almost gave up before I started. I can proudly say I successfully completed this tutorial. Does this mean my bootloader is now unlocked? What do I need to do next to root this thing. Once again, please forgive my ignorance, like I said this is all new to me.
I just went in to recovery mode and it still says locked. ???

@blahforme
I'm glad everything worked for you.
I try to write my guides so everyone can follow and get good results.
Unfortunately this is not a boot loader unlock.
So you can't root yet.
But you do have a backup of your NV Memory and you learned something.
Plus you have the drivers and whatnot installed.
So it was worth the effort.
I have build a device image that if it can be flashed will allow you to unlock the boot loader.
I'm working on the flashing part.
The rom build is here and you can learn a whole lot about htc devices in this thread.
Really it's not for a new bee so don't be surprised when you see the complexity of things.
https://forum.xda-developers.com/de...-rom-msm8909-service-rom-source-qpst-t3544178
As soon as i have a way to unlock the boot loader you will all know. Hopefully soon.

BigCountry907 said:
Lets fire up some tools and get down to business.
Go to QPST and open QPST Configuration
If you are greeted with this screen you are good to go.
Now minimize QPST Configuration
Open RevSkills ( Run as Administrator )
Click on Hardware then Port-Utils then click QC + AT-Cmd
You should see the same port you saw in QPST Config
Now Click On HTC : Unlock SPC
Then Click Change SPC
Then Click Send SPC
Then Click Send SP
You Should be good to go. If you got no errors in revskills.
You will notice there are a lot of READ buttons in Revskills.
You can Explore these if you want. It's a way to read the device.
DO NOT EVER HIT A WRITE BUTTON.
Unless you know why your doing it.
You could kill your device beyond repair.
Anyway if you followed this correctly you now know what you MSL/SPC is.
SPC=000000
Since we know that we can now use the QPST Tools.
more to come.......to be continued..........:crying:
Click to expand...
Click to collapse
Hi @BigCountry907,
First and foremost, thank you for all of your hard work on the MSM8909 chipset. I've found your many posts to be extremely enlightening! I plan to attempt building your AOSP kernel at some point soon on my Desire 626s; I just need to setup my Linux dev box. I realize this is now an older device, but I'm enjoying learning & getting close to the metal on this one.
Pertaining to these instructions, I am encountering an issue and wanted to see if you might have any ideas.
Have QXDM drivers properly installed; diag port enabled via adb; QPST recognizes the phone (although ESN is blank). As I attempt RevSkills, HTC Unlock SPC = success "Done sending SuperSPC." As I click "Change SPC", I receive "Error writing NV value". However, after several attempts at it, I finally get success. Send SPC = I get a return "41 01 ¶ A" and after "Send SP" get a return of "46 01 ¶ F". I'm going to assume these are successful.
The issue presents itself when I enter ##3424# (DM Command- after writing SPC). It prompts me to enter the MSL. I attempt 000000 and the phone will either: reboot or will say incorrect MSL (and will not allow me into the menu). I'm unable to access DM Command.
While I've already enabled the diag port, I am interested in sending AT commands and going further into using qcdiag to monitor gsm/3g/lte packets. As I understand it, I need to enable serial com in order to send AT commands to the modem. I'd like to get my KC and use rtl-sdr to sniff and decrypt my own traffic to better understand... Currently, as I attempt Putty on COM3 (valid diag port) unable to connect.
To give some supporting information, I am using a Cricket Wireless Desire 626s device unlocked on Marshmallow 2.27.651.6 T-Mobile network (Sprint debloated ROM as Cricket did not update to MM). However, I've attempted this after using the Cricket RUU as well as a few other custom ROMs w/o success.
I've also looked into QXDM - NV Browser - Item 0085 after a supposedly successful SPC write, and get the return "No DIAG Response Received". I've tried to pack as much pertinent info into these screenshots as possible.
Ultimately, I'm interested in getting to packet level data using qxdm, and am hoping you might help steer me a bit. Osmo-qcdiag has some really cool stuff they are working towards and I'd like to use this device. Also, if you happen to have an idea of the NV values to open up additional 3g & LTE bands- that would be super helpful! (I'm on T-Mobile network currently).
Thank you so very much for all of your hard work on this device.
FYI, unfortunately unable to post my image as I"m a "new" member. However,
imgur . com /a / ZiuXP

How to full backup any qualcomm phone (no root)

Hi every body, I had reviced a lot of question about how to backup qualcomm devices. So today I will show you how! (test in Obi SF1)
Because if your phone is not root, you can't back up your rom in case brick when you play with the phone. So you will need this!!!
1: Download all necessary files (in my video description) put all of them in the same folder and extract out!
2: in stall the right driver (make sure your usb connect type is MTP)
When your phone and computer are connected and in devices manager you see some thing with a yellow triangle and the QFIL software show “no port available” that mean you need driver!
To install the driver, run qualcomm_Setup as administrator! Restart your computer. If success, no more yellow triangle in devices manager.
3: now put your phone into download mode by: install QPST.2.7.437 to your computer. Then run eMMC Software Download, chose switch device to DLOAD…> chose your phone >ok, now you will see several new hard disks in your computer , and in device manager you will see something like qualcomm emmc or qualcom mmc... in hard disk field! now close the eMMC Software Download software.
4: Run HDDRawCopy1.10Portable, chose Qualcomm MMC Storage USB Device (your phone flash) then click continue > double click on file > browse to pale you want to save the backup file > name the file, in file type field, chose raw img file > save > click continue and wait to complete (it may took along time depend on your memory size)
To wake up the phone out of download mode, just press all three hard buttons same time in 2 minutes !!! (for Obi phone, may different in other phones).
Link to this document in description too!
Attention: this method no need root, and you will have the full rom back up. But be careful if you chose wrong field you may miss your hard disk’s data, and when you apply the back up again to your phone your phone will really hard brick if you break the process. So if you had rooted the phone, use another method for better!!!
Guide video and tool links here:

If read back gets interrupted in between will it brick ?
Demon_king18 said:
Hi every body, I had reviced a lot of question about how to backup qualcomm devices. So today I will show you how! (test in Obi SF1)
Because if your phone is not root, you can't back up your rom in case brick when you play with the phone. So you will need this!!!
1: Download all necessary files (in my video description) put all of them in the same folder and extract out!
2: in stall the right driver (make sure your usb connect type is MTP)
When your phone and computer are connected and in devices manager you see some thing with a yellow triangle and the QFIL software show “no port available” that mean you need driver!
To install the driver, run qualcomm_Setup as administrator! Restart your computer. If success, no more yellow triangle in devices manager.
3: now put your phone into download mode by: install QPST.2.7.437 to your computer. Then run eMMC Software Download, chose switch device to DLOAD…> chose your phone >ok, now you will see several new hard disks in your computer , and in device manager you will see something like qualcomm emmc or qualcom mmc... in hard disk field! now close the eMMC Software Download software.
4: Run HDDRawCopy1.10Portable, chose Qualcomm MMC Storage USB Device (your phone flash) then click continue > double click on file > browse to pale you want to save the backup file > name the file, in file type field, chose raw img file > save > click continue and wait to complete (it may took along time depend on your memory size)
To wake up the phone out of download mode, just press all three hard buttons same time in 2 minutes !!! (for Obi phone, may different in other phones).
Link to this document in description too!
Attention: this method no need root, and you will have the full rom back up. But be careful if you chose wrong field you may miss your hard disk’s data, and when you apply the back up again to your phone your phone will really hard brick if you break the process. So if you had rooted the phone, use another method for better!!!
Guide video and tool links here:
Click to expand...
Click to collapse
Hi ,
Thanks for the video link. I want to use this so that I can get boot image and recovery image so that it can be ported . My phone is Gionee M6S plus Snapdragon chipset with locked boot loader. I would like to ask while In reading mode ,if by unforseen reason the readback gets interrupted ;is there any chance of hard bricking ?
Thanks

Suhi02 said:
Hi ,
Thanks for the video link. I want to use this so that I can get boot image and recovery image so that it can be ported . My phone is Gionee M6S plus Snapdragon chipset with locked boot loader. I would like to ask while In reading mode ,if by unforseen reason the readback gets interrupted ;is there any chance of hard bricking ?
Thanks
Click to expand...
Click to collapse
Nope, in backup process just don't format or delete any any thing in your phone's internal memory, your phone will be ok. But when you restore the phone, if the process broke, your phone maybe brick depen on how many percen had complete!

how to restore?

Hi,
thanks for this tutorial but i have a question, my device is Asus Zenfone 4 Selfie Lite ZB553KL (Sd425), i want to know how to wake my device from download mode before i start this tutorial as i dont want to brick my device

Can we backup full boot.img and system.img with that?
Or does it only backup data partition?

skeleton1911 said:
Can we backup full boot.img and system.img with that?
Or does it only backup data partition?
Click to expand...
Click to collapse
When you using this method, it will backup all of your partition: boot, recovery, efs, system, and user data too!

Rempoiiii said:
Hi,
thanks for this tutorial but i have a question, my device is Asus Zenfone 4 Selfie Lite ZB553KL (Sd425), i want to know how to wake my device from download mode before i start this tutorial as i dont want to brick my device
Click to expand...
Click to collapse
For my device (Obi Sf1) just long press (may up to 3 minutes) all of my 3 hard buttons to wake him up!

irwan_dcp said:
how to restore?
Click to expand...
Click to collapse
Sorry, my phone had lost, so i can't made a guide video for you. But there is a guide here: https://www.droidsavvy.com/unbrick-qualcomm-mobiles/
Hope usefull!

Nice tutorial but eroor 0x80004005 when pressing download mode
Nice tutorial thanks, but I'm getting error code 0x80004005 after pressing download mode, trying to backup huawei scl-l01 in QC 9008 mode port is visible drivers are ok

Hi @Demon_king18, sorry for bringing this old thread back up but I am having the same problem as @Provokuoji is.
When I open emmc software download app, and I try to switch to DLOAD, I get this message
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This is the only thing stopping me for now. Might you know what is happening? :crying:

Hi @Demon_king18, sorry for bringing this old thread back up but I am having the same problem as @Provokuoji is.
When I open emmc software download app, and I try to switch to DLOAD, I get this message
This is the only thing stopping me for now. Might you know what is happening? :crying:

Getting the 0x80004005 error also. Any suggestion? The phone shows up as qualcomm device just fine.

find another way to boot into EDL mode. usually you have a timeout ~30 sec

Can we restore userdata with qfil ?

aIecxs said:
find another way to boot into EDL mode. usually you have a timeout ~30 sec
Click to expand...
Click to collapse
There is no other way to boot into EDL if your screen is completely blacked out and all what the computer recognises is a Qualcomm device in Device Manager.

deep flash cable? test point method?

aIecxs said:
deep flash cable? test point method?
Click to expand...
Click to collapse
I have a cable and it doesn't work.
I took my phone apart and did the test point shorting, that doesn't work either.
I have also been told that the phone is already in EDL mode but the problem is me getting that error message!

if it is already in EDL mode, just install Qualcomm HS-USB QDLoader 9008 Driver

aIecxs said:
if it is already in EDL mode, just install Qualcomm HS-USB QDLoader 9008 Driver
Click to expand...
Click to collapse
Done that from the start.

[Guide] How to flash the Open Market FFU for the IDOL4s Open Market 6071W

As we currently know it the open market FFU for the IDOL 4s will not flash properly to the open market model IDOL 4s phone. The below steps and attached files will allow this to change.
I was thankfully able to find this information due to a member over at 4pda who put together steps using the full engineering tool (link). They shared the link here to that post. Since I cannot attach the full files of that tool here due to size restrictions, I came up with an alternate method to share on this site and attach the needed files to flash.
This is a an alternate method to flash your open market IDOL 4s with the Open market FFU. You do this at your own risk. I personally feel it is relatively safe to use this method since we are in EDL (Emergency Download) mode anyway, yet even though I have done this now 4 or 5 times flashing an ffu to the IDOL 4s there is still a risk that something could go wrong. So I/we are not responsible if you kill your phone. The following directions assume you are running Windows 10 Creators update on the PC you are flashing from. If you need assistance downloading or installing the Qualcomm HS-USB QDLoader 9008 drivers you will need to look on the internet or search XDA forums. There are plenty of resources on that. The good thing is that when I tested it from my tablet for the first time the device showed up in device manager as QHUSB_BULK. I simply right clicked it in device manager and updated the driver to get the correct USB driver installed. It flashed fine after that. With that out of the way I can share the information to flash the open market ffu.
Make sure you charge your phone prior. To be safe 100%. This can be done at the minimum 40% charge or maybe 20% but that could be pushing it depending on the health of your battery.
--Obtain the open market ffu file
Download the open market firmware ffu from WDRT by opening the tool and selecting the open market IDOL 4s and advancing the steps/windows until it finishes downloading. Click cancel once done and close WDRT. By default it should download to C:\ProgramData\Alcatel\Packages\Products\6071W\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
--Download the attached Idol4S.zip
Download the attached zip file
In the attached zip file you will find the following:
Idol4S_PRO_WIN_NPRG7627.bin
rawprogram_6071w_OM.xml
emmcdl.exe
You only need to use the emmcdl.exe file and the bin file. Don't worry about the xml file for now.
--Setup the files for flashing
Extract them to their own folder. So for the sake of argument we have them here: C:\Idol4S\
There will be 3 files in the Idol4s folder. Next move the FFU file you downloaded previously to this folder for simplicity.
Now you will see 4 files there under C:\Idol4S\:
RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
Idol4S_PRO_WIN_NPRG7627.bin
rawprogram_6071w_OM.xml
emmcdl.exe
--Reboot your IDOL 4s into Emergency download mode.
Turn off your Idol 4s windows phone. Once powered down push and hold the volume Down Key in and keep it held in.
Next plug in the phone to the USB C cable connected to your PC.
It will vibrate but continue to hold the Down volume key for a second or two. You should see device manager recognize the phone as something like QHUSB_BULK or Qualcomm HS-USB QDLoader 9008.
If it shows up as QHUSB_BULK or something else you need to install the correct drivers in order for it to appear as QDloader 9008.
Once it shows as QDloader 9008 like the pic below. Write down the port number it shows up under...in my case COM3
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
--Flash the phone
Once in EDL mode open the folder where your 4 files for flashing are stored. Then either open a powershell prompt or command prompt Click File > Open Windows PowerShell or click File > Open Command prompt.
Begin to run the below commands:
from Windows PS --
Code:
.\emmcdl.exe -p com3 -f C:\Idol4S\Idol4S_PRO_WIN_NPRG7627.bin -ffu C:\Idol4S\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
from cmd --
Code:
emmcdl.exe -p com3 -f C:\Idol4S\Idol4S_PRO_WIN_NPRG7627.bin -ffu C:\Idol4S\RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
The flashing takes a bit of time. You will see lots of output scrolling. Just leave the device and the screen alone for a bit until it finishes. Once it's finished the phone will reboot automatically.
If it stalls at he beginning or fails. Reboot your phone and put it into EDL mode again. Or reattach the usb cable and put into EDL mode again. Retry the command.
Again, to repeat, if you choose to do any of this it is at the risk to your own device. Thanks.

Did you ever try WPID for it?

djtonka said:
Did you ever try WPID for it?
Click to expand...
Click to collapse
I believe so. Tried ffutool.exe too.

Great tutorial Nate!
Easy to follow and working without a glitch.
Just a remark for those who might think that this could sim-unlock their 6071W - IT DOES NOT!
While it will load the Open market FFU the model reported is still 6071W, still locked to TMO and WDRT will still not recognise it to load Open market sw.

the sequence for 9008 mode is Vol_dn & Power

compu829 said:
the sequence for 9008 mode is Vol_dn & Power
Click to expand...
Click to collapse
If I plug the phone in while it is powered off, and push only both volume rocker buttons in at the same time it will go into edl mode every time. I dont think I tried both the power and volume down keys though. If that works too, then good.

nate0 said:
If I plug the phone in while it is powered off, and push only both volume rocker buttons in at the same time it will go into edl mode every time. I dont think I tried both the power and volume down keys though. If that works too, then good.
Click to expand...
Click to collapse
If you are starting it with the phone off, just hold VolDn while plugging it into the computer.

Thanks for double checking this. I updated the post with that small detail .

Folks, here is the tool that helped me acquire the loader file for this phone. The tool packages are greater than 30MB so I had to share a link for them. Someone might find this useful. It was originally hosted on the 4pda forums, so the credit goes to those guys over there for making this tool available. The tool can also reflash the OpenMarket Idol4s. It basically works by building a compressed exe file from the FFU based on the model you chose (Idol4Pro). You launch that newly made exe file and it opens as a flashing tool. You put your phone into EDL mode and the tool then can flash the phone. Link

Model of alcatel idol 4s is: ALCATEL IDOL 4S with Windows 10 NA
If I connect my idol 4s to WDRT & select 'Open Market' from the list and proceed, in firmware line it says firmware version: unknown. [for Device]
available firmware on server: 1052.16.09031.50700
How to proceed? Thanks.

sco1984 said:
Model of alcatel idol 4s is: ALCATEL IDOL 4S with Windows 10 NA
If I connect my idol 4s to WDRT & select 'Open Market' from the list and proceed, in firmware line it says firmware version: unknown. [for Device]
available firmware on server: 1052.16.09031.50700
How to proceed? Thanks.
Click to expand...
Click to collapse
Are you trying to flash your device from WDRT? What have you done so far, what are you trying to do?

nate0 said:
Are you trying to flash your device from WDRT? What have you done so far, what are you trying to do?
Click to expand...
Click to collapse
@nate0 : As per the instructions in this thread I am trying to =
Download the open market firmware ffu from WDRT
Click to expand...
Click to collapse
My device has same firmware version as on server.
So the question is do I need to download that file to proceed with rest of the process?
The reason I want to flash my device using better/different firmware is because WhatsApp web isn't working in my phone.
Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code.
However 3rd party application is able to scan whatsapp web QR code.

sco1984 said:
@nate0 : As per the instructions in this thread I am trying to =
My device has same firmware version as on server.
So the question is do I need to download that file to proceed with rest of the process?
The reason I want to flash my device using better/different firmware is because WhatsApp web isn't working in my phone.
Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code.
However 3rd party application is able to scan whatsapp web QR code.
Click to expand...
Click to collapse
Alcatel only has one fw revision per device variant. Each has the same issue which you list...Camera in my IDOL 4s with Windows 10 NA is unable to scan whatsapp web QR code. You can change fw but I doubt that will fix your issue as each variant faces that whatsapp issue even the Idol 4 Pro EURO variant.

I tried to get into Emergency Download Mode.
Q1: Instead of "QHUSB_BULK" or "Qualcomm HS-USB QDLoader 9008" I only see "Care Suite Emergency Connectivity". What should I do?
Q2: Once Q1 is solved, can I use VMware running Windows 10 Creators update? Because it says it's assumed to run that. Also I have Windows 7 on my machine; that's why I should use the Virtual Machine

dyasten said:
I tried to get into Emergency Download Mode.
Q1: Instead of "QHUSB_BULK" or "Qualcomm HS-USB QDLoader 9008" I only see "Care Suite Emergency Connectivity". What should I do?
Q2: Once Q1 is solved, can I use VMware running Windows 10 Creators update? Because it says it's assumed to run that. Also I have Windows 7 on my machine; that's why I should use the Virtual Machine
Click to expand...
Click to collapse
For Q1 you might try to right click it in device manager and Update the Driver manually. Or let windows search for a better driver...
For Q2, technically you can as long as your HW supports virualizaion which is enabled in the bios (whole other topic...)

nate0 said:
For Q1 you might try to right click it in device manager and Update the Driver manually. Or let windows search for a better driver...
For Q2, technically you can as long as your HW supports virualizaion which is enabled in the bios (whole other topic...)
Click to expand...
Click to collapse
I managed to get Q1 working. Thanks
I asked a friend to borrow his computer running the latest Windows 10 update. Should I use his computer? He will bring it this weekend. Or do I really need the Windows 10 Creators update?

@dyasten
With emmcdl.exe do a test first.
emmcdl.exe -l ::: this should list devices it sees and you should see your port COMxx...or whatever the COM number is.
emmcdl.exe -p COMxx -f <Idol4S_PRO_WIN_NPRG7627.bin> ::: this should result in just a command complete. All it does is load the programmer and look for a repsonse.
If those work, I would assume you are good to flash the phone at that point. I will leave it up to you to decide on using a W10 pc or not...

nate0 said:
@dyasten
With emmcdl.exe do a test first.
emmcdl.exe -l ::: this should list devices it sees and you should see your port COMxx...or whatever the COM number is.
emmcdl.exe -p COMxx -f <Idol4S_PRO_WIN_NPRG7627.bin> ::: this should result in just a command complete. All it does is load the programmer and look for a repsonse.
If those work, I would assume you are good to flash the phone at that point. I will leave it up to you to decide on using a W10 pc or not...
Click to expand...
Click to collapse
I got command complete on my current Windows 7. It was on COM6. I did shift + right-click in the folder and opened cmd; there I did:
Code:
emmcdl.exe -p COM6 -f Idol4S_PRO_WIN_NPRG7627.bin -ffu RTM_IDOL_4S_Open_F1052.16.09031.50700_1052.16.09031.50700.FFU
It flashed succesfully I think:
Code:
<log value="Finished programming start_sector 122142720 and TotalSectorsToProgram 256"/>
</data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="ACK" rawmode="false" />
</data>
Status: 0 The operation completed successfully.
The reason I wanted to flash is because I want Dutch language on my phone. But after succesfully flashing I still don't see Dutch. How could I get the Dutch (Belgian) language pack?

You should be able to load the language pack cab file if it is missing by using iutool. What region are you residing in? If you are in Europe I guess you could flash the Idol 4 Pro variant ffu which I believe should have that language pack already packed in, but you would need to confirm that first...
Edit: There are 3 variant FFUs for this phone. The T-Mobile US / Open market / Idol 4 Pro

I flashed your ffu open marked there is no Dutch in it. Where to download the cab? I'm from Belgium, language is Dutch/Flemisch

Question RM6/6Pro Unbrick Tool - EDL Flash / Switch from CN to EU

Hello guys,
I received the following unbrick tool from my supplier in Shenzhen - China and wanted to share it with you since I noticed that many people are desperate to fix their RM6 and swap it to EU.
The process is super easy:
1) Download & extract the following .zip
https://mega.nz/file/ntBSxDKa#h9vUPGoWVyqtyDYWYmSgz8bE1_vNimBMAqTp9csvv-w
2) Make sure all the drivers are installed correctly (Qualcomm, EDL etc...)
3) Open the MiTool application
4) in MiTool, select the folder images
5) Put your phone in EDL mode
6) Once connected, Click flash - the brushing process will start automatically.
7) Once done, force reset and Voilà!
There's an alternative as well: MultiportQLoader
I haven't tried it myself, feel free to try it and share the steps.
Im sorry if any details aren't clear, but I'm typing this while driving xD
Good luck and would appreciate a shout-out on insta @Out.Geeked ^^

THANK YOU SIR

To ask a dumb question, but is this only the 6 or for the pro as well?

Works for both

Thank you so much, it work after someone help me erase flash

Outgeeked.net said:
Works for both
Click to expand...
Click to collapse
Yeah I checked the model number against the box it came in and gave it a shot, now it shows the RM logo and then reboots to the bootloader lmao this phone legit hates me
*edit*
So I think either I'm doing something wrong or this phone is actually messed up. Checked the drivers, tried 2 other cables, all my USB ports and still all it does is briefly show the white "System Rebooting" screen and then the RM logo for about 20 seconds and then reboots to fastboot/bootloader.
MiFlash shows "couldn't find flash script" but otherwise looks like it goes through the reflash process completely but QLoader always fails with an error "Unknown chunk type cac2"
Does this unbrick method require the bl to be unlocked?

anyone lost their imei after doing this? hahahha
i did lost my imei, but manage to repair it but... it still doesnt detect mobile network idk what to do now lol

Nocturne Seigneur said:
anyone lost their imei after doing this? hahahha
i did lost my imei, but manage to repair it but... it still doesnt detect mobile network idk what to do now lol
Click to expand...
Click to collapse
Did you ever find a way to recover your IMEI? Turns out that I'm in the same situation as you with a lost IMEI

CyberWolf92 said:
Did you ever find a way to recover your IMEI? Turns out that I'm in the same situation as you with a lost IMEI
Click to expand...
Click to collapse
loool welcome to the club xD, I didn't found any solution yet, i will tell u once confirmed, for now i can write imei but mobile network still not functioning

Does it actually work?
According to the file name, it's EU V3.10.
I thought we should apply the NA/Asia version.

cannon3025 said:
Does it actually work?
According to the file name, it's EU V3.10.
I thought we should apply the NA/Asia version.
Click to expand...
Click to collapse
yes it does work, some ppl lose imei some not idk why, mine lose imei and cant connect to any mobile network right now T^T
after u unbrick it, u can flash via local update to v4.13 i did that working fine

Nocturne Seigneur said:
yes it does work, some ppl lose imei some not idk why, mine lose imei and cant connect to any mobile network right now T^T
after u unbrick it, u can flash via local update to v4.13 i did that working fine
Click to expand...
Click to collapse
After you update to V4.13, your phone still no IMEI right?
How about flashing it again?

cannon3025 said:
After you update to V4.13, your phone still no IMEI right?
How about flashing it again?
Click to expand...
Click to collapse
its gone, forever lol
i just gave my phone to someone else to fix this, if he can.
[Guide] Restore Lost IMEIs / Repair Network or Radio Issues
I accidentally restored TWRP backup of another Zuk Z2 phone on my new pgone and in this process over-wrote the EFS partition. This left me with a phone having no IMEI, no mac for Wifi and Bluetooth. Effectively No Network on phone. Worried, I...
forum.xda-developers.com
this maybe work, havent test it out

Since we have the partition layout & the correct firehose, it should actually be a good practice by anyone wanting to play with their phone (BL unlock, root, dev, etc) to first dump the critical partitions.
That way, you can always restore. Example: EFS, misc, persist, etc.

Thanks for your help
When I use MiFlash shows "couldn't find flash script"
Can you please help
My RM6pro restarting all time to fastboot mode after I tried to relock bootloader and oem
Now I need to solve this issue by using this tools
I am beginner
Thanks

Same issue for @CyberWolf92

Alaryani said:
Thanks for your help
When I use MiFlash shows "couldn't find flash script"
Can you please help
My RM6pro restarting all time to fastboot mode after I tried to relock bootloader and oem
Now I need to solve this issue by using this tools
I am beginner
Thanks
Click to expand...
Click to collapse
Select the images folder and then hit flash.

Mine is alive again, no more problems.
I think I know why a lot of people have probably bricked their device after flash from CN to Global. If you do a local update, let the device REboot until the end. After the restart it uses the update.zip again. I think a lot of people did a factory reset immediately after the reboot (like me in Recovery) and the system can no longer find the update.zip.
Therefore, let the update run through, reboot until you are back in the system. Then you can do a factory reset.

Outgeeked.net said:
Select the images folder and then hit flash.
Click to expand...
Click to collapse
When I selected images folder shows "couldn't find flash script"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
And when I go to edl mode my phone disappeard from list devices in MiFlash.
but still showing in driver manger
What driver needs for this issue "Make sure all the drivers are installed correctly (Qualcomm, EDL etc...)" what else I need?
also when i did it on fastboot mode i face this massge

Alaryani said:
When I selected images folder shows "couldn't find flash script"
View attachment 5329645
And when I go to edl mode my phone disappeard from list devices in MiFlash.
View attachment 5329643
but still showing in driver manger
View attachment 5329647
What driver needs for this issue "Make sure all the drivers are installed correctly (Qualcomm, EDL etc...)" what else I need?
also when i did it on fastboot mode i face this massge
View attachment 5329661
Click to expand...
Click to collapse
you must be in edload mode not fastboot

Repair IMEI - Diag mode

While trying to install a Custom ROM, all went wrong with a hard bricked Redmi Note 8T as result.
Have been able to revive the phone in EDL mode (Test Points method). Now running again on MIUI Global 12.5.5 (RCXEUXM).
However, the IMEI's are nulled, can't activate a SIM card. Only WiFi works.
A first, essential step in the process to repair the IMEI's, is to open the diag mode. Found a few methods, but none of these methods work.
Not via *#*#717717#*#* (Open diag failed), not via adb devices // adb shell // su // setprop sys.usb.config diag,adb (Permission denied).
The phone is rooted with Magisk; recovery OrangeFox.
Does anyone have a helpful suggestion how to proceed?
Follow-on: Meanwhile, I've been able to open the Diag-mode. Apparently, one or two switches in Magisk had masked the rooting of the phone.
Now on to editing the qcn-file with the correct IMEI's. First,I have to figure out the location of the two IMEI's, and then to correct these into the correct values.
To be continued...

gjongbloed said:
While trying to install a Custom ROM, all went wrong with a hard bricked Redmi Note 8T as result.
Have been able to revive the phone in EDL mode (Test Points method). Now running again on MIUI Global 12.5.5 (RCXEUXM).
However, the IMEI's are nulled, can't activate a SIM card. Only WiFi works.
A first, essential step in the process to repair the IMEI's, is to open the diag mode. Found a few methods, but none of these methods work.
Not via *#*#717717#*#* (Open diag failed), not via adb devices // adb shell // su // setprop sys.usb.config diag,adb (Permission denied).
The phone is rooted with Magisk; recovery OrangeFox.
Does anyone have a helpful suggestion how to proceed?
Follow-on: Meanwhile, I've been able to open the Diag-mode. Apparently, one or two switches in Magisk had masked the rooting of the phone.
Now on to editing the qcn-file with the correct IMEI's. First,I have to figure out the location of the two IMEI's, and then to correct these into the correct values.
To be continued...
Click to expand...
Click to collapse
I have had the same problem with my previous Redmi Note 3. And I tried so may ways to re-write the IMEI number. Finally I found a little software on the net and using my computer I was able to re-write the IMEI number to the phone. I was a long time back, so I dont remember the exact name of the software. It was something like IMEI writer (root). Connected the phone which was also rooted. Then opened the software on my PC and the software asked for superuser access, which I granted on the phone. Then there from the pc using the software I entered the IMEI numbers for both sim1 & 2, and applied then reboot phone. After reboot, the phone then detected the simcards and the imei were back.

chris5k said:
I have had the same problem with my previous Redmi Note 3. And I tried so may ways to re-write the IMEI number. Finally I found a little software on the net and using my computer I was able to re-write the IMEI number to the phone. I was a long time back, so I dont remember the exact name of the software. It was something like IMEI writer (root). Connected the phone which was also rooted. Then opened the software on my PC and the software asked for superuser access, which I granted on the phone. Then there from the pc using the software I entered the IMEI numbers for both sim1 & 2, and applied then reboot phone. After reboot, the phone then detected the simcards and the imei were back.
Click to expand...
Click to collapse
My current problem: I can find a .qcn file and have to edit it with the proper IMEI's. Found a Qualcomm IMEI Rebuilder tool, but that tool doesn't work. With a Hex-editor it is difficult to find the proper location. Found the location of one IMEI and then saved the file with a different name. Loading that file into the Rebuilder tool indeed shows (one) correct IMEI. Have installed that file with QFIL, but when I check with *#06#, it shows a completely different IMEI...
Meanwhile, I've searched for IMEI write (root). Found IMEI Tools (ROOT)_1.4_apkcombo.com.apk.
Prooved incompatible for my phone.
Then found qualcomm-smartphone-write-imei-tool-v1.01.apk
Tried that out, but couldn't establish communication with the diag-COMport.
In fact, I can't activate the diag mode any longer... Tried and re-tried, but all in vain.
When I enter the last command ('setprop .... etc.), communication via the USB port is also stopped. Re-establishing that doesn't make a difference. No COMport appearing in device manager or in QFIL...

You need special tools like UMT or Hydra to write Note 8 imei

engage4 said:
You need special tools like UMT or Hydra to write Note 8 imei
Click to expand...
Click to collapse
UMT works with dongle? Price?
I tried Hydra, but got a Trojan Horse warning, and therefore broke off installation.

Umt needs dongle.

First restore original qcn(unedited) then try flashing ENG firmware.
!! Iam not responisble if anything wrong happens with your phone.