[General Questions and Answers] Desmanto:
Hi everyone,

I'm currently using Hisense Pureshot aka HS-L671, using android Lollipop 5.0.2. It has Snapdragon 415 MSM8929, which is very similiar to Snapdragon 615 MSM8939, but with some missing feature (just like rip-off version of SD615). AFAIK currently there are only two phones use this SD415, the other one is Micromax Canvas Nitro 4G (E455) (3, if we count in the 5,5 inch variant of Pureshot+/HS-L695). That's why the documentation is still very scarce.

Edit : it seems there are several phones using this SoC now. I am currently researching about j7

Main Purpose

I post this thread for two main reasons :

1. To do full backup of my current phone, without root or modifiying any existing partitions (as I do below with my previous phone). This is to ensure I can revert back any modified phone to its original state, should we need to claim for RMA in case of hardware failure (not software). I know reverting to original state is possible to be done by flashing rooted stock ROM; then unroot afterward. But AFAIK, full unroot will leave trail of modified timestamp in /system partition. I don't want any trail of modification. (preferred if possible)

2. After backup, I will take the recovery.img and boot.img to compile TWRP in BBQLinux. Then flash it back to the phone. Boot up to TWRP and flash SuperSU.zip to obtain root access. Then I will proceed on a lot of modifications which require root. If number 1 cannot be done first, I have no problem if there is a way to obtain root first, then do the backup later using different tool.

Previous experience with SD200

Based on my experience with previous phone, Andromax C2 aka Hisense AD688G (1st gen), Android JB 4.3, Snapdragon 200 MSM8610; it can boot directly to Qualcomm MMC Storage Mode, which maybe known as Emergency Host DownLoad or Qualcomm HS-USB Diagnostics 9006 (CMIIW). To enter this mode, I need to turn off the phone, unplug the battery, holding down Power + Volume Down button, while connecting it to PC (Win 7 64 bit) via USB cable (I have installed qualcomm driver before). Then it will pop up a lot of prompt to format the drives, which I ignore all of them. In the device manager, it will be detected as Qualcomm MMC Storage. From there, I can proceed on backup every partition of the phone using HDDRaw copy, partition guru or emmc raw tool (preferred one). This can be done without root or any modification to the phone. Which is why this method of backup is preferred, since i can always start with "clean slate", should anything wrong happen (restore using the same method). And it doesn't leave trail of folder modification timestamp as it will be if I flash rooted stock ROM then unroot.

Power button + combination

Now, with the latest snapdragon family 410, 615, including 415 above, it seems there is no way to boot directly to the same Qualcomm MMC Storage / (as far as I read till now from tirta.agung thread). I have tried several combination, and the result is below.

Power : Turn on Phone

Power + Vol Up : nothing happen. If not followed by next action, Phone boot normally

Power + Vol Up, followed by holding vol down at the second logo : Enter safe mode

Power + Vol down : Enter firmware status (Official)

Power + Vol down, followed by holding Power : Enter Recovery mode

In the recovery menu, there is a menu to "Reboot to bootloader", which will boot the phone to Fastboot downloading mode.

Power + Vol Up + Vol Down : TF update

Combining with USB cable

Power + Plug in USB cable : Turn On Phone

Vol Up + Plug USB : Enter Fastboot downloading

Vol up + Vol down + Plug USB : TF Update. Seems like the USB become the power button

Vol Up + Power + Plug USB, Release Power button after vibrate : EngTest mode, diagnostic mode. In QPST will be detected as the diagnostic port, seems to be Hisense Proprietary one.

Unplug battery : Any combination of power button, vol up and vol down didn't give any response or vibration, nothing detected in device manager or usb deview.

Using adb, only 3 reboot choice : reboot, reboot recovery, reboot bootloader. Reboot edl don't work (wonder if anyone success at another phone)

Using fastboot, is similiar to adb : fastboot reboot and fastboot reboot bootloader. Reboot edl don't work either. Fastboot oem unlock do nothing as well.

Enter Qualcomm HS-USB QDLoader 9008

It seems the Engtest mode boot in android OS, as I can see the prompt asking for USB connection mode (MTP, CD ROM, charge only etc). And IDK if it is a bug, but every time I boot to this Engtest, the next reboot always remove all of my account (Google, whatsapp, mysmartfren (my ISP)). I need to add back, resync contact, resetting gmail and etc. Later, I discovered that i don't need this engtest anymore. As long as I have installed all driver : Qualcomm, Hisense and QPST; every time I connect the USB when the phone is on, it will detected as diagnostic mode.

From this diagnostic mode, I can switch the phone to Download mode (9008), by using eMMC software download (QPST) > Switch device to DLoad; or using EFS Pro - Qualcomm NV Tools > Change mode to Download Mode. Phone will reboot, screen off and vibrate a while. Diagnostic port now is closed and it will add a new port, Q/QCP-XXX - Sahara Memory Dump. Device manager will detect Qualcomm HS-USB QDLoader 9008.

From this mode, AFAIK I still need MPRG8929.hex and 8929_msmimage.mbn to boot it to 9006 mode. But the current available hex/bin and mbn only for 8974, 8916 and 8939 (8936 mbn). Looking to the build.prop and the lib folder of my phone, it seems to have a lot of similiarity with MSM8939. So i was thinking to use the MPRG and mbn from MSM8939. But I still haven't tried it yet, as i need more confirmation. This is my main phone, that's why i am very careful with it, my backup phone is too weak now for daily usage.

BTW, I am using latest WHQL qualcomm driver, version 2.1.0.5 and Hisense driver directly from the phone's CDROM iso. Using universal driver installer also give the same driver. QPST 2.7 build 425.1. Build 422 give me the same result. Main PC is Win 7 Ultimate 64 bit SP1. I have tested it in XP SP3, and give the same result, so not the WHQL driver signing problem.

TF Update

Someone point me out about TF Update file for HS-L965 (the 5.5 inch variant). This file supposed to be flashed through TF Update process (Power + Vol Up + Vol Down). I manage to download it and of course i don't flash it to my phone, since it is from different version. I try to extract out recovery.img and boot.img, by mounting it or open it from archive program. Disk Internal Linux reader can mount the bin properly and show up with 20 something partition, which is very similiar to what I see from qualcomm partitions. I try to open each partition, of course it fails, as it is not ext4 file system (even /system also fail). Try to create image from recovery, boot and system partition; and it manage to be extracted out. But the result is very different from the typical raw img. It doesn't contain proper file header for recovery, boot, and system .img. The hex header supposed to be "ANDROID". But all of the extracted img don't have it. If I unpack the boot.img and recovery.img, carliv unpacker also give no folder structured result, only compressed ram-disk. Try to use ext4unpacker also no luck. So any image extracted is useless, as they don't seems to have the correct file header (or maybe it is wrong reading from the linux reader).

I have spent this whole week trying to find the way to boot the phone to 9006 mode. I have googled a lot, have finisihed reading from 1st page to the last page

[PROJECT] Reviving Hard Bricked YU (QLoader 9008 Mode)

[R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features

and some other thread. I might miss some info, partially because I sometimes read it in half drowsy state. So, I'll be glad to be pointed out the missing info.

Alternative root method

I have searched for the canvas nitro 4G rooting process, and there is no answer yet at http://xdaforums.com/general/xda-assist/root-micromax-canvas-nitro-3-4g-e455-t3225783 and http://xdaforums.com/android/help/how-to-root-micromax-canvas-nitro-4g-t3209976.

I also know about kingroot. But there are a lot of privacy issues with that program, so I want to stay away from it. From my friend, they said they've tried the latest version, but still fail to root. So I don't try it anymore. But if there is no other way, I might give it a shot as well. A lot of other root tools also fail to root this phone. So, flashing SuperSU.zip from TWRP, seems to be the only way to root it.

Question

From all information above, now here comes the questions :

1. Is there a way to enter 9006 Mode without doing any modification or flash programmer file in the latest qualcomm SoC ? (SD410, SD415, SD615, SD810 above)

2. What the MPRG and MBN really do when flashed to device? Do they stay at the emmc, means they replace some partition inside the Phone? Or they just stay at RAM and will be wiped out on the next reboot; so we need to flash it again if we want to enter 9006 from 9008?

3. What is the risk of using wrong MPRG and MBN file from different SoC? As I wanna try to use the ones from MSM8916 and MSM8939 (MSM8936). I have downloaded it already, but too scare to use it.

4. How we can know we are using the correct MPRG and MBN file? How they were created at first? Is it possible to create it from some partition in the phone?

5. How to extract the TF update .bin file properly? And how they were created at first? And it is possible to create it our self, without the need of any signature/certificate from the vendor?

Sorry if there are too many questions and this thread is very long. I don't expect all questions to be answered though. As long as the main purpose above is achieved, that's nice already.:)

If there is any additional info needed, I will provided it later.

Thanks in Advance.