[Windows Phone 8 Development and Hacking] zeizieh:
Well I kept the phone unplugged since my last post, plugged it in now and it's switched back to QHSUSB_DLOAD mode by itself.

I tried using thor2 to write the hex and mbn files but I got the same error as last time: "SAFE hex file was used and unallowed memory address was being written."

And now the phone is stuck in ARMPRG mode again.

Here's the full log from thor2 if it's of any help:

C:\Lumia>thor2 -mode emergency -hexfile 00E9427DF118D9E27D098D13BECB6C6C89CE59F4.hex -mbnfile lum_retail\RM821_msimage_v1.0.mbn -orig_gpt
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.1
thor2 -mode emergency -hexfile 00E9427DF118D9E27D098D13BECB6C6C89CE59F4.hex -mbnfile lum_retail\RM821_msimage_v1.0.mbn -orig_gpt
Process started Fri Jun 22 18:39:36 2018
Logging to file C:\Users\xxx\AppData\Local\Temp\thor2_win_20180622183936_ThreadId-1112.log
Debugging enabled for emergency

Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
Reading GPT from binary
-- GPT STARTs--
name: SBL1
startLBA: 34
endLBA: 243
size: 0x000000000001a400 bytes
attributes: 0x0

name: SBL2
startLBA: 244
endLBA: 507
size: 0x0000000000021000 bytes
attributes: 0x0

name: SBL3
startLBA: 508
endLBA: 1193
size: 0x0000000000055c00 bytes
attributes: 0x0

name: UEFI
startLBA: 1194
endLBA: 3273
size: 0x0000000000104000 bytes
attributes: 0x0

name: RPM
startLBA: 3274
endLBA: 3559
size: 0x0000000000023c00 bytes
attributes: 0x0

name: TZ
startLBA: 3560
endLBA: 3985
size: 0x0000000000035400 bytes
attributes: 0x0

name: WinSecApp
startLBA: 3986
endLBA: 4609
size: 0x000000000004e000 bytes
attributes: 0x0

name: UEFI_BS_NV
startLBA: 4610
endLBA: 4865
size: 0x0000000000020000 bytes
attributes: 0x0

name: UEFI_NV
startLBA: 4866
endLBA: 4881
size: 0x0000000000002000 bytes
attributes: 0x0

name: UEFI_RT_NV
startLBA: 4882
endLBA: 5137
size: 0x0000000000020000 bytes
attributes: 0x0

name: UEFI_RT_NV_RPMB
startLBA: 5138
endLBA: 5153
size: 0x0000000000002000 bytes
attributes: 0x0

name: SSD
startLBA: 5154
endLBA: 5169
size: 0x0000000000002000 bytes
attributes: 0x0

name: PLAT
startLBA: 5170
endLBA: 7243
size: 0x0000000000103400 bytes
attributes: 0x0

-- GPT ENDs --

Sending OPEN_MULTI_REQ
Received valid response to OPEN_MULTI_REQ
Checking eMMC read / write test results...
eMMC Read test passed. eMMC Write test passed!
Programming image l
Image opened successfully for reading
SAFE hex file was used and unallowed memory address was being written.
Reset the device and use the correct HEX file.
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 11.00 seconds.

Unknown error code.

THOR2 1.8.2.18 exited with error code 85034 (0x14C2A)