[Nexus 4 General] FLYN:
<Disclaimer>
[FONT=Verdana]All the information and tools mentioned in this post are not my work.
I still need to add a proper credits section to this post, which will take a while,
since the tools and documentation came from many different sources.

As with any experimental tool, proceed with caution.
</Disclaimer>
[/FONT]

Hi Everyone,

I've managed to get myself in a bit of a pickle by hard bricking my Nexus 4 (By accidentally running mkfs on all the block devices, DOH).

This has led me to take a serious look into how the Nexus 4 can be unbricked using the Qualcomm High Speed USB Device (QHSUSB_DLOAD).

The Nexus 4 has a Qualcomm APQ8064 SoC,

As far as I can tell, we will be able to unbrick hard bricked Nexus 4 devices using QPST if we manage to get a couple of files:

1. A working copy of MPRG8064.hex - This is a set of instructions (specific to the APQ8064)

that are sent to the flash programmer on the phone that tells it how to download a copy of the boot image package.

2. A boot image generated for the Nexus 4. This file is typically named 8064_msimage.mbn, which is generated from a couple of other Nexus 4 mbn images.

This file is generated using a Qualcomm utility called emmcswdownload.exe and an XML describing the mbn images and the partition layout of the final 8064_msimage.mbn image.

I have found a couple of examples of these XML files on http://www.anyclub.org/2012/05/how-to-generate-8660msimagembn.html:​

[COLOR=#000000] <?xml version="1.0"?>[/COLOR]
[COLOR=#000000] <image>[/COLOR]
[COLOR=#000000] <physical_partition number="0">[/COLOR]
[COLOR=#000000] <primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl1.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl2.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl3.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="4" type="5" bootable="false" label="EXT" size="1000000">[/COLOR]
[COLOR=#000000] <extended order="1" type="47" label="RPM" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="rpm.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </extended>[/COLOR]
[COLOR=#000000] <extended order="2" type="46" label="TZ" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="tz.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </extended>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] </physical_partition>[/COLOR]
[COLOR=#000000] </image>[/COLOR]

and

<? Xml version = "1.0"?>
<data>
<! - NOTE: Sector size is 512bytes ->
<program file_sector_offset = "0" filename = "" label = "MODEM" num_partition_sectors = "65536" physical_partition_number = " 0 "size_in_KB =" 32768.0 "start_sector =" 1 "/>
<program file_sector_offset =" 0 "filename =" sbl1.mbn "label =" SBL1 "num_partition_sectors =" 1000 "physical_partition_number =" 0 "size_in_KB =" 500.0 "start_sector = "65537" />
<program file_sector_offset="0" filename="sbl2.mbn" label="SBL2" num_partition_sectors="3000" physical_partition_number="0" size_in_KB="1500.0" start_sector="66537"/>
<program file_sector_offset = "0" filename = "rpm.mbn" label = "RPM" num_partition_sectors = "1000" physical_partition_number = "0" size_in_KB = "500.0" start_sector = "69559" />
<program file_sector_offset = "0" filename = "sbl3.mbn "label =" SBL3 "num_partition_sectors =" 4096 "physical_partition_number =" 0 "size_in_KB =" 2048.0 "start_sector =" 70559 "/>
<program file_sector_offset =" 0 "filename =" emmc_appsboot.mbn "label =" ABOOT "num_partition_sectors =" 5000 "physical_partition_number =" 0 "size_in_KB =" 2500.0 "start_sector =" 74655 "/>
<program file_sector_offset =" 0 "filename =" "label =" BOOT "num_partition_sectors =" 20480 "physical_partition_number =" 0 "size_in_KB =" 10240.0 " start_sector = "79655" />
<program file_sector_offset="0" filename="tz.mbn" label="TZ" num_partition_sectors="1000" physical_partition_number="0" size_in_KB="500.0" start_sector="100135"/>
<program file_sector_offset = "0" filename = "pdl_phoneinfo.bin" label = "INFO" num_partition_sectors = "8192" physical_partition_number = "0" size_in_KB = "4096.0" start_sector = "131072" />
<program file_sector_offset = "0" filename = "partition0 . bin "label =" MBR "num_partition_sectors =" 1 "physical_partition_number =" 0 "size_in_KB =" 0.5 "start_sector =" 0 "/>
<program file_sector_offset =" 1 "filename =" partition0.bin "label =" EXT "num_partition_sectors = "22" physical_partition_number = "0" size_in_KB = "11.0" start_sector = "69537" />
</ data>

The relevant mbn images for the Nexus 4.

These can be extracted from either of the following files:

modem.img radio-mako-m9615a-cefwmazm-2.0.1700.48.img

which in turn is extracted using the BinExtractor tool (included in the tools package) from either the Nexus 4 factory image or a Nexus 4 tot image or .

In order to extract the mbn images from the image file, you have to mount it on a loopback device.

For example:

sudo mount -o loop /path/to/occam-jdq39/radio-mako-m9615a-cefwmazm-2.0.1700.48.img /mount/point

Nexus 4 Factory images

​

occam-jdq39-factory-345dc199.tgz

Nexus 4 tot images

​

LGE960AT-00-V10c-NXS-XX-NOV-14-2012-JVP15L-FACTORY_0.zip

BIN_LGE960AT-00-V10c-NXS-XX-NOV-13-2012-JOP40C-USER+0.zip

​

File links:

Nexus 4 Unbricking Tools Package Link

DMSS Protocol Documentation (Used by the QPST tool)

PBL Tool (A perl script that implements part of the DMSS protocol)

Some relevant information:

http://www.anyclub.org/2012/04/how-to-build-emmc-flash-programmer.html

http://xdaforums.com/showthread.php?t=1978703

http://xdaforums.com/showthread.php?t=2086142