yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note I717] daxxone:
I got Sii E4GT, D710...

I have a fully working model, and one with i9100 bootlaoder flashed to it. When you get to other devices, I can help with this model. I will dig around and find who to switch to qmdload mode or get it to brick further. The current firmware leaves no connections open and working but bluetooth. Even the external SD is broken by this firmware. I got the device in this state. (f**kin' ebay). I would like more info on the switch you put in your device to get it to go back to qualcomm download mode (I'll go back through the info you posted already also).

My current laptop can run most anything, but I have a small hard drive in it, and only got windows7 running right now as I just got it a few days ago. I planned to dual boot with mint, and was going to wait till I got my larger drive to set that up. I think I will load it today and start with a clean dump of my phone flashed fully stock. I can sell off some extra laptops I got around over the next few week and get working or bricked devices to help this project. I got started for a few day with a t989. It was the second device I seen with the qmdload driver and no other signs of life. The other was a Dell streak 7. I no longer have access to either of those devices.

If the Note is where you need more input, then I will get some money together for one. Is a bricked tester of more use or the dumped file of more use right now? When I got enough money I'll check again.
[AT&T Samsung Galaxy Note I717] tyllerdurdent:
waiting for instructions

Hi Darkspr1te,

I will be waiting for your instructions of how to repair the baseband and I will comment you about the entire procedure success in my mobile.

I hope you publish your findings soon and thank you for all the help!!! :good:
[AT&T Samsung Galaxy Note I717] Mokrayz:
bricked htc sensation

Hi I would like to try your method. My sensation has been bricked for months now. Already tried jtag but did not work.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Confirmed dialer codes

Engineer mode
319 712 358 and then the password 0821.

*update* 11/06*
Additional passwords, Possibly for S/K models
774632
996412

*update* 11/07*
LGU MusicOnURL config ?Unknown ?
1478912358 password 1233

EDIT:- Use the 319712358 code to activate CP access, not service mode or phoneutil.

*#2663# touch firmware
*2767*3855# factory format do not use
##DATA# Data config menu
##TTY# TTY menu
##786# RTN repaired menu
*#46744674# set IMSI to 9999
*#9090# Service Mode , MDM/MSM Uart/Usb selection
##8778# PhoneUtil , MODEM/PDA UART/USB
*#0*# Test menu 1
*#0228# battery status
##GPSCLRX# - Reset the GPS
*#2664# - Touchscreen Accuracy Test
*#9900# - SysDump
[AT&T Samsung Galaxy Note I717] darkspr1te:
Is your device in QDLoad mode ? is it enumerated as Qualcomm HS-USB QDLoader 9008/9025 ?

The principle of the fix should be the same across all MSM8660 devices, what is different is the bootloader files and partition info.

In theory once you are in QDLoader mode (PBL Fail) then you can use 8660_msimage.mbn file to setup your device as a SD-CARD then write a new partition table and bootloaders, Sadly i've not even seen a HTC here or ever held one so this is only a assumption, E:V:A might be able to shed more light on that fact.
[AT&T Samsung Galaxy Note I717] darkspr1te:
This method should work on any MSM chipset that we can get the XXXX_msimage.mbn file for, if we can build a proper rawpartition0.xml and patch0.xml file for the device we can build our own .mbn file for it. A quick google of the dell streak 7 lists it's chipset as tegra , i dont know how it's put together but i am assuming the AP (application Processor ) is NVIDIA and CP (Comms Proc) is qualcomm, if dont know if my method would work in that combo.
[AT&T Samsung Galaxy Note I717] tyllerdurdent:
baseband recognized

Hi darkspr1te,

I try your method and everything seems working fine, the mobile is working at 100%.

I will run more tests on the mobile to verify the gps, but the baseband is fully recognized. :D

I look the confirmed dialer codes. But, I 'm not sure what is the change that I have to do to improve the gps accuracy? :confused:

Really good work!!!

Tyller

p.s: also thank u E:V:A :good:
[AT&T Samsung Galaxy Note I717] darkspr1te:
I am very pleased. I was worried i was being lucky on my testing :D

The gps reset code is

##GPSCLRX#
or
##4772579#

Can you post your baseband/ROM version? for our records.

I Also Made a mistake, to access the MODEM (Both of them in this device, GSM/LTE) from QPST /RF NV Manager you use the dial code

319712358 and then passcode 0821
Select SIO Mode
Select DM PORT
Select MODEM under USB

Windows will now see a additional TWO com ports, one is MSM8660 and the other is MDM9600

the MSM8660 deals with your GSM and has the IMEI codes etc stored in it, the can be read by QPST RF NV manger and saved.

regards

darkspr1te
[AT&T Samsung Galaxy Note I717] darkspr1te:
After a little bit of looking around i found a link that has some gps config settings

http://koxda.com/archiver/tid-76871.html

The user says to edit /etc/gps.conf

NTP_SERVER=cn.pool.ntp.org
XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra.bin
XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra.bin
XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra.bin

# DEBUG LEVELS: 0 - none, 1 - Error, 2 - Warning, 3 - Info
# 4 - Debug, 5 - Verbose
DEBUG_LEVEL = 3

# Intermediate position report, 1=enable, 0=disable
INTERMEDIATE_POS=0

# Accuracy threshold for intermediate positions
# less accurate positions are ignored, 0 for passing all positions
# ACCURACY_THRES=5000

I will give this a try today

For completeness here is my /etc/gps.conf file

NTP_SERVER=north-america.pool.ntp.org
XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra.bin
XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra.bin
XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra.bin
SUPL_HOST=supl.google.com
SUPL_PORT=7276

EDIT:

Hunting about i found another gps.conf file, I uploaded it to my phone using adb and changed it's permissions using chmod 644 gps.conf to match original file

Seems to have a great improvement in lock speed, down to a few seconds from a cold boot (battery out)

Test and provide feed back

regards

darkspr1te
[AT&T Samsung Galaxy Note I717] tyllerdurdent:
progress update

Can you post your baseband/ROM version? for our records.

Hi darkspr1te,

My baseband is E160L.FH02.1442.LT

I'm still testing the GPS configuration and the accuracy. I will post my results as soon as I finish.

I will be in touch.

Tyller Durdent
[AT&T Samsung Galaxy Note I717] darkspr1te:
Hi All,

A quick update with shots of the unbrickable mod i did to this unit. The side of the PCB we are looking at goes against the back of the screen, so if you could look through the screen you would see this side of the board (opposite site of the board to the sim card)

The resistor sits at the bottom right of the MSM8660 cpu it the text is straight, in the shot ive taken its in the center of the picture

Regards

darkspr1te
[AT&T Samsung Galaxy Note I717] E:V:A:
Nice, and I see that this device is using a second "modem", the MDM9600 LTE/(aka Gobi 4000), in addition to the MSM8660 SoC/PoP.

The MDM9600 has UE Category 3 LTE, CDMA2000 1x/EVDO Rev.A (and B), GSM/EDGE, and WCDMA/HSPA+ all the way through DC-HSPA+ 42 Mbps.
[AT&T Samsung Galaxy Note I717] darkspr1te:
The debug screens related your info
[AT&T Samsung Galaxy Note I717] RussianBear:
have you had more people contact you with different phones?
[AT&T Samsung Galaxy Note I717] darkspr1te:
Only for information related to Rom issues, non in relation to this thread.:D

I did expect there to be a few more bricked units out there but it seems not.
[AT&T Samsung Galaxy Note I717] formico2:
Hi darkspr1te!

Thanks for your research!

May be you can help me.

I have a a820l phone and it's bricked

thanks to you I have successfully turned qhsusb_dload to sd-card and make a backup.

But then I stuck((

I learning all your thread, please give me advice what I should do next.

I try to understand chineese method (blog.csdn.net/su_ky/article/details/7773273) but I can't (and translate.google could not help)

Thanks!!
[AT&T Samsung Galaxy Note I717] darkspr1te:
Hi there. I am currently in the african bush and signal is bad at its best times. If you can be patient i will be back in front of desktop and internet by sunday.
[AT&T Samsung Galaxy Note I717] formico2:
Waiting for your reply)

Thanks!
[AT&T Samsung Galaxy Note I717] formico2:
The end. The lack of knowledge did the trick. I killed my device. Now it appears in qpst configuration as Q / QCP-XXX (Download).
[AT&T Samsung Galaxy Note I717] darkspr1te:
Hi There,

It's good that you are this far, it means we can recover your device. I am still in the african bush until tuesday due to some issues with the site we are working at but i have started to download the A810L firmware (MIUI based for initial recovery) but i have not been able to find the bootloaders yet. it's possible to recover some of the required files from your device without the original but if we can find a user with a functioning unit I can write a program to pull the bootloaders from it no problem.

Do we have any 810 owners willing to help ?
[AT&T Samsung Galaxy Note I717] formico2:
Hi darkspr1te!

First of all thank you for your help, but I think my phone fully bricked now.

It's Q / QCP-XXX (Download) now, not QHSUSB_DLOAD (and no sd card), so I can't do anything with it.

I followed chineese instruction (my phone the same a820l, so I just copy/past rawprogram0.xml) but at the end QPST showed error and my phone now displayed as Q / QCP-XXX (Download) in qpst configuration. I think this is the end.

So thanks for your help and your thread.

Regards
[AT&T Samsung Galaxy Note I717] darkspr1te:
Hi there.

actually you are lucky you are in QCP mode, you could be stuck on a bootloader which requires jtag/hardware mod to fix. This mode you are in means the device failed the signature check on the bootloaders and has ignored them in favour of usb booting. I return to the city by 14:00 gmt and will post a guide for you. Just to confirm please post the Product id/vendor id of the phone in qcp mode, its under device manager in windows or lsusb command in terminal in ubuntu. You will need a copy of ubuntu and copies of your bootloaders if you have. If not then i might have back in the city on a back up sent to me by another user.

If your product id (vid/pid of device) is 9006/9008/9025/9026 then the future looks good. I spent a long time studying the guide you read and i understand the errors it has in translation, ive based all my software work on that guide but tech does not always translate well. Do you still have the DD backup ? Make another copy as we will need to work on the file to alter it in such a way we can recover some data off it.

for now try and hold off experimenting on the actual device, i had a full backup of the emmc and a hardware reset button so i cant do damage, if you write the wrong set of instructions to the device it can lock up fully.

darkspr1te
[AT&T Samsung Galaxy Note I717] formico2:
Hi darkspr1te,

I had to send the phone to the service to repair it because wife scolded me and said that I ended up experimenting with her phone (yes, a820l was her phone).

You really know much in this issue, and your thread is very useful (I will post link on this threat in my homeforum for people with the same problem, if you don't mind).

Thanks!
[AT&T Samsung Galaxy Note I717] darkspr1te:
I have no problems with that.

Finally back in the big smoke. No more edge speeds.
[AT&T Samsung Galaxy Note I717] Remolten:
Great work you guys are getting done here!

I've come here to ask you if you would mind helping us with bricked HP Touchpads. We've the same MPRG 8660 and have gotten as far as getting our device connected to the Computer in QDL mode and attempting to flash bootloaders via QPST. I was just wondering if you could help us figure this out. We've a few devices stuck in QDL mode that we haven't figured out how to get them out of it and mine personally has a condition called the question mark of death. This condition is caused by the Touchpad's initilization things thinking that the battery doesn't exist (although it obviously does because it turns on) so basically just hoping you can help us out a bit. Refer to this thread to see our progress.

Thanks for any help that you may give us!!!
[AT&T Samsung Galaxy Note I717] darkspr1te:
Challange accepted. :D

I Will get up to speed today but yes its possible to use the same method on the hp.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Hi E:V:A.

Are there any docs available on this? i would like to dig into it a little more.

darkspr1te
[AT&T Samsung Galaxy Note I717] Remolten:
Sounds good!

I'm pretty much willing to do anything as we're getting pretty desperate now.
[AT&T Samsung Galaxy Note I717] RussianBear:
Interesting link. Chinese, I believe: http://blog.csdn.net/su_ky/article/details/7773273
[AT&T Samsung Galaxy Note I717] darkspr1te:
Ok, Ive gone over the basic's of the information you posted via rootswiki, the most important port was you posted the partition layout, i need to work that back to a partition table and binary we can write to the device, do you have copies of any of the bootloaders at all? Qualcomm devices haves a set of loaders they use across all hardware, they change the names but not the partition types, do we have a will user to provide copies of the loaders if not.

darkspr1te
[AT&T Samsung Galaxy Note I717] darkspr1te:
I should also point out in debug hardware there is a switch to ignore eMmc boot , this is our qdl mode, its like selecting f12 in a award bios to boot from device other than hdd.

so the wind hoes version of what we are doing.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Also

is not correct for our device if this sense.

PBL assumes first bootloader , in the msm8660 its Two CPU's (Krait) of which each has a bootloader, for the initial debrick we aim for booting the first one

fully and second partially.

8960_boot_architecture.pdf explains the actual boot process we need to rebuild, to two cpus and two sets of primary and secondary boot loaders and one ROM based one.

See the msm8960 based devices thread for the pdf . anyway, rebuild the primary boot chain up to aboot.mbn, the rest wont matter so long as you have a dd (linux copy ) of your emmc.

to get a copy of your emmc just use emmcswdownload.exe from qpst (the only program you need to do the actual unbrick) to write the 8660_msimage.mbn file to your device to switch to sdcard mode, if that works then we write new partition table and bootloaders.

The hard part is getting the loaders and a original partition table, thats because most of our readers are bricked already .

also there is the resistor that controls qdl mode on my device, if you can trigger yours any time then once you have the bootloaders and partition table you are unblickable.

but before we go any further we need to see if we can write the .mbn sdcard based image and then do a dd backup.

hope i am explaining this ok, it's been long day, will edit for further clarity in the am.

darkspr1te
[AT&T Samsung Galaxy Note I717] Remolten:
What file extension? .mbn or .bin or .hex?

I probably have what you want just specify.
[AT&T Samsung Galaxy Note I717] darkspr1te:
these files

SBL1.MBN
SBL2.MBN
RPM.MBN
TZ.MBN
SBL3.MBN
ABOOT.MBN

they are the basic bootloaders required to get a qualcomm device into a recoverable state
[AT&T Samsung Galaxy Note I717] Remolten:
Wow am I happy. Just found those recently so here they are zipped. They were under /boot in the filesystem. I also have provided the xml that specified what each does.

Here they are.

Hopefully we can get these things fixed!
[AT&T Samsung Galaxy Note I717] ph3d:
Darkspr1te and remolten I have two touchpads here one working and one in Qualcomm USB if theres anything I can help with just let me know.
[AT&T Samsung Galaxy Note I717] dadwarf:
@Darkspr1te

For our TouchPad (and my Pre3) after uploading the bootloader (MPRG8660.HEX) with emmcdownload the device complains about lack of partition table and stop here without trying to go futherer.
[AT&T Samsung Galaxy Note I717] TopTongueBarry:
topaz.xml

darkspr1te,

I think you may also need this file:

topaz.xml

Its what the installer uses to configure the device.

Note p14 is LVM, and mounts as a crypto fs

I can also get you the bootloader image (a uImage file). There's also a boot.bin and topaz-boot.bin (think they are the same) . These may be needed after the partition table is restored.

Let me know if there's any other files you may need.

One more thing, can someone please post links to the two QHUSB-DLOAD threads (Pre 3 and Touchpad) in webOSnation forums for darkspr1te? I don't have enough posts here to do that yet.

Thanks,

TTB :)
[AT&T Samsung Galaxy Note I717] unoaman:
Ntt docomo sc_03d dead boot repair without jtag

Thanks folks for such a wonderul post and work in progress.

I want to share my success story.

my phone got bricked due to wrong flashing by mobile repair guy(most probabily i9100 pit).

it was detected as Qualcomm HSUB in device manager. No support of this on riff box.

So following darkspr1te steps i have successfully recovered my SC-03D partially :)

partially means i am able to see the phone in odin mode in my win 7 machine (though the phone screen is black, it may be due to incorrect aboot.mbn). i can flash stock rom on the phone but it fails on flashing assm.bin file (most of the part are flashed successfully in odin). This is certainly due to wrong partition.

To get it finally working i definitely need the actual mbn files and the pit file for SC-03D.

SBL1.MBN
SBL2.MBN
RPM.MBN
TZ.MBN
SBL3.MBN
ABOOT.MBN

if some one can help in getting these files i can provide the success story of such a genius guy darkspr1te. with fixing my SC-03D

the easiest i can suggest is to bacup few partitions using adb like below

mkdir backup

# for windows use md backup
# md backup

#back-up script
echo "Backing up Bootloaders"
echo
echo " if any of the following fail with errors do no reboot your device, correct the error and re-execute"
echo
adb shell dd if=/dev/block/mmcblk0p2 of=/sdcard/sbl1.mbn bs=512
adb pull /sdcard/sbl1.mbn backup/sbl1.mbn
adb shell dd if=/dev/block/mmcblk0p3 of=/sdcard/sbl2.mbn bs=512
adb pull /sdcard/sbl2.mbn backup/sbl2.mbn
adb shell dd if=/dev/block/mmcblk0p5 of=/sdcard/rpm.mbn bs=512
adb pull /sdcard/rpm.mbn backup/rpm.mbn
adb shell dd if=/dev/block/mmcblk0p6 of=/sdcard/sbl3.mbn bs=512
adb pull /sdcard/sbl3.mbn backup/sbl3.mbn
adb shell dd if=/dev/block/mmcblk0p7 of=/sdcard/aboot.mbn bs=512
adb pull /sdcard/aboot.mbn backup/aboot.mbn
adb shell dd if=/dev/block/mmcblk0p8 of=/sdcard/boot.mbn bs=512
adb pull /sdcard/aboot.mbn backup/boot.mbn
adb shell dd if=/dev/block/mmcblk0p9 of=/sdcard/tz.mbn bs=512
adb pull /sdcard/sbl1.mbn backup/tz.mbn
adb shell dd if=/dev/block/mmcblk0p10 of=/sdcard/maybepit.mbn bs=512
adb pull /sdcard/sbl1.mbn backup/maybepit.mbn
adb shell dd if=/dev/block/mmcblk0p11 of=/sdcard/pit.mbn bs=512
adb pull /sdcard/sbl1.mbn backup/pit.mbn

The above is taken from darkspr1te basefix.sh file with addition of few more partitions

Please some one help with the above files and definitely my phone can get second life..

Waiting for above files to proceed further
[AT&T Samsung Galaxy Note I717] worthlessgenius:
I also have 2 (1 functional and 1 non-functional) 16GB TouchPads. The non-functional one was just a week out of warranty when this started happening (the same QDLoader issue, with no booting), and I even replaced the battery, with no change.

There is an army of rabid TouchPad owners out there waiting with baited breath for a possible solution. So, if there is anything you guys need, just ask.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Thats just perfect, do you have adb access? i need the partition table as the device sees it and then the real partition table (mbr & ebr)

I only got power back at 2am this morning my time so i've only just got online, am pulling the bootloaders from mediafire right now, i need to study the headers a little and the structure of the partition table but if we have a working unit it should ease our lives.

to dump the mbr to a file via adb on a working device

adb shell

dd if=/dev/block/mmcblk0 of=/sdcard/mbr-large.bin count=100 bs=512

exit

adb pull /sdcard/mbr-large.bin

and post the .bin file we just created. i've set the count to 100 blocks as it also give me a chance to view the header partition.

once ive worked out the location of the ebr then we should be in a position to create the basic brixfix file.

Looks like i am going to have to rewrite brixfix script so we can specify or identify each device, any coders out there ? lol.

I would like the end result to be a windows/linux one click solution,

anyway back on topic.

As i've never even held one of the devices so i have some questions,

can a user trigger QDL mode at any time ?

it mentioned that topaz.xml is used by the installed to configure the device, is this at first power on? or before/during/after a upgrade ?

is it known or assumed the steps taken to end up with a brick (even on purpose) ?

can we post a clear picture of the device's sticker containing model numbers etc, please blank serial & imei etc out of the picture.

dont laugh, but is this the device http://www.ifixit.com/Device/HP_TouchPad ?

do we have any hires shots of the MSM8660 on the touchpad ? (it would assist in tracking down a QDL trigger solution for unbrickable mod)

Also when i/if i come up with a solution i may send the initial files to testers first, this is really to stop new users further bricking their devices before we finish testing, this will also reduce filling this thread up with help but no feed back requests.

I am also going to pick up a 16gb sd card, this should help with creating partition table structures (although ubuntu fdisk now has a fake a disk option which renders the purchase null, but who dont like shopping for electronics :laugh: !).

It also may be worth renaming the thread to MSM8660 unbrick but we will see, it may be easier to keep thread as dev work and start a new thread for the actual process, i will approach a mod.
[AT&T Samsung Galaxy Note I717] darkspr1te:
Yes the more info for me the better, also any mistakes, one user has got odin working (no screen etc) by writing bootloaders of a unknown origin, this tells me a lot about the device (and range of devices) in relation to this important partition and bootloader structure.

Please avoid posting from anyclub website, i think ive burst a vein reading that site and if you are assisting in the info collection/dev side please try and read the thread from the start (Not aimed at you, TTB, it's just quick reminder for all new users)

can i have a link to the u-image.bin / topaz-boot.bin please,

I better start a new folder on my hdd as if i get these hp bootloaders mixed up with my shv-e160l bootloaders there may be confused looks on my side, but then again... i wonder ?