yashsingh1/xdaforums huggingface dataset:
[Windows 10 Mobile] TristanLeBoss:
Disable Secure Boot: http://www.droid-life.com/2013/11/04/how-to-unlock-the-nexus-5-bootloader/

Unfortunately, these flash programmers are typically 'signed' by the OEM. In the earlier days, this was not the case and could be used interchangeably, but they are now signed will a hardware ID and revision counter.

Regarding the flash programmer,. I don't think you will need it. Of course, you won't be able to use the methods that need it. But, to flash an image, you only need download mode. If somehow you brick the phone, you should be able to reflash the Android system:

http://xdaforums.com/nexus-5x/help/req-help-to-unbrick-t3251740

This program includes the flash programmer (the "8994 dll").

Which version of the Nexus 5X do you have? H791, H790? 16gb or 32gb?
[Windows 10 Mobile] nate0:
It's the 32gb intl variant. And I just realized to that emmcdl doesn't look for it. Thanks. The 5x has two download modes. The edl mode is the one your referencing I believe. I validated it comes in on com5 on my laptop in that mode. I'll see how far I get before I leave for work in 1 hour
[Windows 10 Mobile] TristanLeBoss:
Ok, perfect. The recovery program from the other thread should work if you brick it. Can you go to this URL: http://csmg.lgmobile.com:9002/csmg/b2c/client/auth_model_check2.jsp?esn=353627070501849 (Replace "353627070501849" with your IMEI)? You will find the exact model in the "model" tag of the XML file. Also, is there any http address in the resulting XML file (like in the "sw_url" tag?
[Windows 10 Mobile] nate0:
LGH791

No URLs listed for the sw_ur tag.
[Windows 10 Mobile] TristanLeBoss:
Ok, so the LG tool will work if you brick the phone. Indeed, the TOT file is available for the 32gb version of the H791. I'm reasured to know that: I don't want you to kill the phone ;)

Something awesome would be to convert a FFU file into a TOT file so you can use the LG tool to flash it ;) Actually, it's probably doable.

But for now, either you explode the FFU file into bin files (using emmcdl -dumpffu) and flash them using fastboot starting fromn the GPT.

Either you try to remove the sbl1 partition using fastboot and hope the phone goes into 9008 mode and mount the emmc. This way, you can use most methods.

EDIT: It seems you can reboot to edl mode using a simple ADB command:

Some phone will be detected as 9008 + eMMC drive ("Qualcomm MMC Storage USB Device" under "Disk drives" in Windows "Device manager") mounted and some only as 9008. If it's only detected as 9008, we need a flash programmer to use the 9008 mode.
[Windows 10 Mobile] nate0:
Going to try not to kill the phone definitely. For now I am at work, will take a look at it later tonight. I have put the phone to edl mode, screen goes black, no lights on, and I think it mounts/connects. I am going to need to check the next time I plug it in what mounts. If edl mode is accessible, I will try to succeed with something on that method. If it fails then dumping the ffu to bin files should result in the amount of parts as described in the flashprogrammer*.xml that is created from emmcdl in prior steps, correct? I have dumped an xml from two ffu's so far, and I think both displayed 30 disk parts in through the xml code.
[Windows 10 Mobile] TristanLeBoss:
Ah ah, you live at the exact opposite of me ;) My day is already over here ;)

I greatly updated my previous post: http://xdaforums.com/showpost.php?p=67045151&postcount=18

I am currently researching more information about the flash programmer file and I will update the guide.

The method (using MiFlash, QFIL, ...) involving the "rawprogram0.xml" are not part of my guide yet as they require the flash programmer so I'm not sure we can use them (unless we find the flash programmer for this phone).

The best would be if your phone can boot in Qualcomm 9008 mode with the eMMC already mounted as a disk drive. If it doesn't, then we will need a flash programmer file...

That's why I thought about another method relying on emmcdl and fastboot: The "emmcdl -dumpffu" command will probably dump 30 raw files (one per partition including the GPT). It's possible that the GPT will be dumped 2 times: it's normal, it's normally at the beginning of the disk and also at the end of it. My idea was to flash them using "fasboot flash" command (see my guide).
[Windows 10 Mobile] nate0:
Greatly appreciated...I will try and report back with findings, or maybe success...:D
[Windows 10 Mobile] TristanLeBoss:
Ok, I figured out how to create a TOT file from a FFU file (at least for this phone) :D I just need to write the tool to do so. Actually, I'm almost done: I just need to code the GPT reader.
[Windows 10 Mobile] TristanLeBoss:
Okay, my FFU reading tool is now complete. I can read the FFU, locate the GPT, read the GPT and extract untrimmed version of each partition.

I used it against the Xiaomi Mi4 ROM and discovered something interesting: the partition table contains 33 partitions but the FFU only contains data for 19 of them.

I'm thinking that maybe the partition table in the FFU is the same as the one from Android. This way, when the FFU is flashed by the MiFlash tool, the GPT get replaced but it's replaced by the same one so nothing change. Then, the data for the 19 partitions is loaded on the device actually replacing the data of these 19 partitions but leaving the 14 others intact...

Maybe this is the key to port Windows Mobile to any Android devices? Keep the same layout and only replace some partitions...
[Windows 10 Mobile] TristanLeBoss:
Here is the partition layout from the Xiaomi Mi4 FFU. The ones with a "->" in front of their names are the ones which are untouched. I will try to grab the GPT from the Android version of the Xiaomi Mi4 to confront my hypothesis.

+-----+------------+------------+------------------------------------------------------------------------+
+ # | Start LBA | End LBA | Name |
+-----+------------+------------+------------------------------------------------------------------------+
| 0| 1024| 2047|SBL1 |
| 1| 2048| 2559|UEFI_BS_NV |
| 2| 3072| 3583|UEFI_RT_NV |
| 3| 4096| 8191|UEFI |
| 4| 8192| 10239|->DDR |
| 5| 10240| 12287|->SSD |
| 6| 12288| 14335|PADDING0 |
| 7| 14336| 30719|DPP |
| 8| 30720| 30783|DBI |
| 9| 31744| 32743|RPM |
| 10| 32768| 33767|TZ |
| 11| 33792| 34815|WINSECAPP |
| 12| 34816| 67583|TZAPPS |
| 13| 67584| 68607|->BACKUP_SBL1 |
| 14| 68608| 68671|->BACKUP_DBI |
| 15| 69632| 73727|->BACKUP_UEFI |
| 16| 73728| 74727|->BACKUP_RPM |
| 17| 74752| 75751|->BACKUP_TZ |
| 18| 75776| 76799|->BACKUP_WINSECAPP |
| 19| 76800| 109567|BACKUP_TZAPPS |
| 20| 109568| 117759|MMOS |
| 21| 117760| 131071|->PADDING1 |
| 22| 131072| 134143|->MODEM_FS1 |
| 23| 134144| 137215|MODEM_FS2 |
| 24| 137216| 137247|MODEM_FSC |
| 25| 138240| 154623|PLAT |
| 26| 154624| 220159|EFIESP |
| 27| 220160| 262143|->PADDING2 |
| 28| 262144| 265215|->MODEM_FSG |
| 29| 265216| 491519|->PADDING3 |
| 30| 491520| 524287|->PERSIST |
| 31| 524288| 5537791|MainOS |
| 32| 5537792| 20967423|Data |
+-----+------------+------------+------------------------------------------------------------------------+
[Windows 10 Mobile] TristanLeBoss:
You should be able to revive the phone with the tool I posted earlier: LG UP

http://xdaforums.com/nexus-5x/help/req-help-to-unbrick-t3251740

How did you do to upload the sbl1? "emmcdl -dumpffu flash.ffu sbl1 -o "bins/"" then "emmcdl -p sbl1 "bins/sbl1.bin""? Which flash programmer did you use?

I was not expecting you to use this route because we don't have the flash programmer for the phone :D

I mean we do have it but it's part of the LG UP tool; hence the fact I am trying to make a TOT file from a FFU file.

I was more thinking about the "fastboot" way from my guide but I realized later that emmcdl doesn't extract the GPT from the FFU.

Which 950XL rom are you using? If you have a download URL so I can work with it.

I can extract the sbl1 from the TOT file if you want.

Sorry for being not crystal clear :(
[Windows 10 Mobile] TristanLeBoss:
I just posted a request for the original partition layout of a Xiaomi Mi4 LTE with stock Android ROM: http://xdaforums.com/mi-4/help/request-partition-table-stock-xiaomi-t3388882

I just want to be sure we are going in the right direction but I think we do ;)

Regarding the "rawprogram0.xml" file, you're right. I'm not 100% sure but from my understanding, the 9008 mode is just a download mode but you can't download to the eMMC: you can only download something in the memory of the phone. What you actually do is send a eMMC (flash) programmer to the phone memory then the flash programmer get the control.

There is 3 types of flash programmers: STREAMING, SAHARA and FIREHOSE. Firehose is the one using the rawprogram0.xml file. I disassembled a prog_mbn_firehose.mbn file and I think the XML is sent to the Firehose programmer and it's the Firehose programmer who does all the work asking the PC only to send the data.
[Windows 10 Mobile] TristanLeBoss:
The rawprogram0.xml file contains the information about the GPT.

You need to look for the "<program" line who has " start_sector="0"". It's more likely to be at the end of the XML file.

<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="3484160" filename="10586.1102.3063.Retail.FFU" label="ffu_image_29" num_partition_sectors="256" physical_partition_number="0" size_in_KB="128" sparse="false" start_byte_hex="0x0" start_sector="0"/>

Then, you just have to look for the "file_sector_offset="XXXXX"" attribute. Just multiply the sector by 512 and you get the offset of the GPT in the FFU file. To dump the GPT, just extract (512 + 512 + 128 * 128) bytes from the offset.

My tool just implements the FFU file specification and it's easy to find the location of the GPT because the Data Block instruct to write it at sector 0 (like in the XML). Also, there is 3 GPT in a FFU file, all their locations are stored in the "_STORE_HEADER" of the FFU file. The one which is of interest is the one pointed by "dwFinalTableIndex".

https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufacture/mobile/ffu-image-format
[Windows 10 Mobile] nate0:
No Worries TirstanLeBoss. Consider this my own endeavor. I used the 950 ROM RM1104_1078.0038.10586.13080.12745.033045_retail_prod_signed.ffu dumped into bin chunks and sent sbl1 with emmcdl using the flash programmer for the same MSM8992 of another phone, probably why I did not get as far. Used command emmcdl emmcdl -p COM10 -f prog_emmc_firehose_8992_ddr.mbn SBL1 c:\path_to_sbl1.bin\sbl1.bin. I am game for this, this is not my only phone, and I am willing to work on it to see it come together.

Though I have not went very far into working with the LGUP commands I am unable to get to the LG FW download mode....I just saw your last post via email. Curious... can you do this in reverse??? If you are able to get your convert for the 5x a tot file into FFU file, then that would be another workaround for reviving the LG phone from a bricked state such as the qualcomm diag and download modes. Would just need the actual flash programmer file for it.

---------- Post added at 08:16 AM ---------- Previous post was at 07:49 AM ----------

This is very good for other troubleshooting and potentially more.

Along the lines or tot and ffu files...Do you think you will be able to have conversion from ffu to tot? If so I could try to reflash the sbl1 for the 5x back to revive the phone if you could extract it, and or I will work at getting it back to booting again one way or another if the re-flash does not work.

Additionally I tried the solution here to unbrick it, but no luck yet. I will inform back if this solution ends up being of any use.

Lastly I am wondering now if there is a way to dump what would be a rawprogram0.xml from the tot file?
[Windows 10 Mobile] TristanLeBoss:
I will exact the SBL1 partition from the TOT file found on the LG UP thread for the H791 32GB. Then, you can always try to reflash to the phone using 9008 mode and the 8992 flasher. This way we will quickly now if the programmer works or not ;)

Didn't you get an error message when you first send the sbl1 file?

Yes, FFU to TOT is almost done. For this phone, generating a rawprogram0.xml for a TOT file should also be possible. I will see what I can do ;) But first I will dump the SBL1.
[Windows 10 Mobile] nate0:
At first I got an error. This programmer I found is for the mi4c, I also have one for the Lenovo device using 8992 soc. It works only for the sbl1 file, most likely due to the layout being same on all devices for sbl1.
[Windows 10 Mobile] TristanLeBoss:
Hum,. the TOT file doesn't contains the SBL1 partition. It only contains 4 partitions: modem, boot, recovery, system. It's probably more an update package :(

I found factory images of Google Nexus here:

https://developers.google.com/android/nexus/images#bullhead

Does any of the versions listed on this page says something to you?

And I also found a tweet saying the "bootloader.img includes many low-level partitions: sbl1 (bootloader), tz, rpm, aboot, pmic, hyp, keymaster, cmnlib, sdi, imgdata, sec.".

This "bootloader.img" is in the zip file from the Google pages.

https://twitter.com/copperheadsec/status/699889806088675328

It's easy to extract sbl1 from the bootloader.img
[Windows 10 Mobile] nate0:
Downloading the 6.0.1 (MTC19T) Image from google. Take look at the primary gpt dump bin file from the tot of the Lg5x. This might be your map of the partitions. I have attached it here. I see 46 partitions though. So those others might be protected partions...
[Windows 10 Mobile] TristanLeBoss:
There is another method using another LG program: http://xdaforums.com/showpost.php?p=63969457&postcount=10

You may also want to try the MiFlash tool which is able to work with 9008 mode...

I downloaded all stock images from the Goole page and extracted them all to discover there was only 3 unique bootloader.img files.

I then proceeded to extract the partitions included in each file.

You will find everything in the ZIP file. Hope it helps.
[Windows 10 Mobile] TristanLeBoss:
This file exactly match the one from the TOT file.

The bootloader.img already contains 11 of these partitions; probably the most important ones.
[Windows 10 Mobile] nate0:
Perfect. Thank you.
[Windows 10 Mobile] TristanLeBoss:
Xiaomi Mi4 FFU file partitions :

Out of the 19 partitions which contains data in the FFU, 6 of them are empty partitions (the data in the FFU is only zeroes).

We end up with 13 partitions really containing data.

"SBL1" is a Qualcomm Secure Boot file

-> "UEFI_BS_NV" is an empty partition

-> "UEFI_RT_NV" is an empty partition

"UEFI" is an unknown partition/file (first 16 bytes: 05000000030000000000000000002000)

-> "PADDING0" is an empty partition

"DPP" is a FAT partition

"DBI" is an unknown partition/file (first 16 bytes: 1e0000000300000000000000000080fe)

"RPM" is an Executable and Linkable Format (ELF) file

"TZ" is an Executable and Linkable Format (ELF) file

"WINSECAPP" is an Executable and Linkable Format (ELF) file

"TZAPPS" is a FAT partition

-> "BACKUP_TZAPPS" is an empty partition

-> "MODEM_FS2" is an empty partition

-> "MODEM_FSC" is an empty partition

"PLAT" is a FAT partition

"EFIESP" is a FAT partition

"MMOS" is a FAT partition

"MainOS" is a NTFS partition

"Data" is a NTFS partition

If the partition layout from Windows Mobile match the one from the Android (like I speculate), the fact that these partitions are empty but part of the FFU data means that their content is meant to be erased when switching from Android to Windows Mobile.

I just asked for the partition layout on the Mi4 official forum: http://en.miui.com/thread-287522-1-1.html
[Windows 10 Mobile] TristanLeBoss:
Ok, here are the final findings: the partition layout is not the same from Android and Windows Phone. But, some partitions have the same starting LBA, ending LBA and size so they are at the same location and have the same size in both partition layouts. Because the FFU doesn't contain data block to write in these partitions, we can assume they stay intact during the update from Android to Windows Mobile.

This way I found out that 5 partitions are kept from Android, 13 are written with data and 6 are nulled (content is all zeroes):

+-----+-----------+-----------+--------+-----------------+---------+-------------------+
+ # | Start LBA | End LBA | Size | Name | In FFU | Status |
+-----+-----------+-----------+--------+-----------------+---------+-------------------+
| 0| 1024| 2047| 1024|SBL1 | Yes | Written |
| 1| 2048| 2559| 512|UEFI_BS_NV | Yes | Nulled |
| 2| 3072| 3583| 512|UEFI_RT_NV | Yes | Nulled |
| 3| 4096| 8191| 4096|UEFI | Yes | Written |
| 4| 8192| 10239| 2048|DDR | | Kept from Android |
| 5| 10240| 12287| 2048|SSD | | Kept from Android |
| 6| 12288| 14335| 2048|PADDING0 | Yes | Nulled |
| 7| 14336| 30719| 16384|DPP | Yes | Written |
| 8| 30720| 30783| 64|DBI | Yes | Written |
| 9| 31744| 32743| 1000|RPM | Yes | Written |
| 10| 32768| 33767| 1000|TZ | Yes | Written |
| 11| 33792| 34815| 1024|WINSECAPP | Yes | Written |
| 12| 34816| 67583| 32768|TZAPPS | Yes | Written |
| 13| 67584| 68607| 1024|BACKUP_SBL1 | | |
| 14| 68608| 68671| 64|BACKUP_DBI | | |
| 15| 69632| 73727| 4096|BACKUP_UEFI | | |
| 16| 73728| 74727| 1000|BACKUP_RPM | | |
| 17| 74752| 75751| 1000|BACKUP_TZ | | |
| 18| 75776| 76799| 1024|BACKUP_WINSECAPP | | |
| 19| 76800| 109567| 32768|BACKUP_TZAPPS | Yes | Nulled |
| 20| 109568| 117759| 8192|MMOS | Yes | Written |
| 21| 117760| 131071| 13312|PADDING1 | | |
| 22| 131072| 134143| 3072|MODEM_FS1 | | Kept from Android |
| 23| 134144| 137215| 3072|MODEM_FS2 | Yes | Nulled |
| 24| 137216| 137247| 32|MODEM_FSC | Yes | Nulled |
| 25| 138240| 154623| 16384|PLAT | Yes | Written |
| 26| 154624| 220159| 65536|EFIESP | Yes | Written |
| 27| 220160| 262143| 41984|PADDING2 | | |
| 28| 262144| 265215| 3072|MODEM_FSG | | Kept from Android |
| 29| 265216| 491519| 226304|PADDING3 | | |
| 30| 491520| 524287| 32768|PERSIST | | Kept from Android |
| 31| 524288| 5537791| 5013504|MainOS | Yes | Written |
| 32| 5537792| 20967423|15429632|Data | Yes | Written |
+-----+-----------+-----------+--------------------------+---------+-------------------+
[Windows 10 Mobile] TristanLeBoss:
Flashing the Noki Lumia 950XL FFU as-is to another phone will probably not work: we need to craft a special FFU (or a GPT + bin files) which allows to preserve (DDR, SSD, MODEM_FS1 ("modemst1" on Android), MODEM_FSG ("fsg" on Android), PERSIST) from Android.
[Windows 10 Mobile] nate0:
The FFU is just the lock and key of the data though, isn't it? Maybe the programming of the xml and flashprogrammer would be simpler? Thoughts...?
[Windows 10 Mobile] TristanLeBoss:
Yes, the FFU is just one type of container (TOT is another one). But we can of course create a GPT + BIN files to flash with a rawprogram0.xml. or fastboot...

Actually, it depends on how we can flash something on the Nexus 5x... :D
[Windows 10 Mobile] nate0:
Does the below have any meaning to you. It looks like it is not reading my sbl version. Which is not good still. I blanked out two of the fields for my own good...

C:\Users\nate0\Documents\platform-tools\Windows\Flash\test\windows>emmcdl.exe -p COM1 -info
Version 2.15
SerialNumber: -
MSM_HW_ID: 0x009690e1
OEM_PK_HASH: -
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.

The good thing is is that the board is readable.
[Windows 10 Mobile] TristanLeBoss:
Can you try these commands:

emmcdl -p COM1 -gpt

Dump the GPT from the connected device so we can check if the GPT is intact and has not been damaged.

emmcdl -p COM1 -f prog_emmc_firehose_8994_lite.mbn -d SBL1 -o SBL1_from_Phone.bin

Dump the SBL1 partition from the connected device so we can check if the SBL1 partition is intact and has been written correctly. This way we can check if the flash programmer you used works.
[Windows 10 Mobile] nate0:
I am realizing now what events took place now. I never was able to write over or erase the sbl1 from emmcdl in Emergency mode even though I could put the phone in edl mode from fastboot, I actually pushed the SDL1.bin from fastboot. Then tried to push other images to the other partitions manually. It was kinda late at night so I did not remember at first. Then when the phone got stuck in EDL mode I attempted to use the 3 or 4 different flash programmers to send the sdl1 back or do other functions. None have succeeded. All fail and I believe since the programmer is not the correct one needed. Any command I run with the current programmers does not succeed. See below as all give same or similar output. They try to run but the phone ends up timing out or disconnecting, because I have to reconnect it to the cable or reboot it to get it to respond normally again

GPT Check:

C:\Users\nate0\Documents\platform-tools\Windows\Flash\test\windows>emmcdl -p COM1 -gpt

Version 2.15

Finding all devices in emergency download mode...

Qualcomm HS-USB QDLoader 9008 (COM1)

Finding all disks on computer ...

0. \\.\PhysicalDrive0 Size: 305245MB, (625142448 sectors), size: 512 Mount:C:, Name:[]

\\.\PhysicalDrive1

No valid GPT found

Status: 13 The data is invalid.

Attempt Dump of GPT:

C:\Users\nate0\Documents\platform-tools\Windows\Flash\test\windows>emmcdl -p COM1 -f prog_emmc_firehose_8994_lite.mbn -d SBL1 -o SBL1_from_Phone.bin

Version 2.15

Downloading flash programmer: prog_emmc_firehose_8994_lite.mbn

Successfully open flash programmer to write: prog_emmc_firehose_8994_lite.mbn

Waiting for flash programmer to boot

Dumping data to file SBL1_from_Phone.bin

Dumping at start sector: 0 for sectors: 0 to file: SBL1_from_Phone.bin

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>

ERROR: No response to configure packet

Status: 21 The device is not ready.

The GPT is invalid. I did not notice this before, so I changed the port number and see it now as physical drive41:

C:\Users\nate0\Desktop\8675_W00\8675_W00>emmcdl -p COM41 -gpt

Version 2.15

Finding all devices in emergency download mode...

Qualcomm HS-USB QDLoader 9008 (COM41)

Finding all disks on computer ...

0. \\.\PhysicalDrive0 Size: 305245MB, (625142448 sectors), size: 512 Mount:C:, Name:[]

\\.\PhysicalDrive41

No valid GPT found

Status: 13 The data is invalid.
[Windows 10 Mobile] TristanLeBoss:
Can you try this tool and see if the "Restore/Upgrade/Download" option works?

http://www.wugfresh.com/nrt/

To be sure the programmer doesn't work, you can try to use these tools (and especially QFIL from Qualcomm; the method #2):

https://boycracked.com/2015/06/03/unbrick-lenovo-a6000/

Indeed, they both use a flash programmer and a rawprogram0.xml + BIN files. I think if the flash programmers you have don't work, QFIL (the official tool from Qualcomm) should somehow complain.

Can you also try this:

http://xdaforums.com/nexus-5x/general/lg-nexus-5x-download-mode-t3237490
[Windows 10 Mobile] TristanLeBoss:
Ok, I created a rawprogram0.xml using the TOT file and the files from the bootloader.img (part of the Google packages).

Unzip and put the TOT file (LGH791AT-00-V10f-NXS-XXX-OCT-03-2015-32G-MDA89E-US.tot) from the other thread in the same folder.

There is also a simpler version which only uses files from the bootloader.img: I think it's best to start with this one as - if it works - it should restore the boot.
[Windows 10 Mobile] nate0:
Taking a look...

Any specific way to flash? Pulling my hair out trying different flashers, some give different errors at times, but honestly the phone seems to time out time to time and I have to reset it holding the power button in for like 15 sec.
[Windows 10 Mobile] TristanLeBoss:
Yes, the 2 methods from this page: https://boycracked.com/2015/06/03/unbrick-lenovo-a6000/

QFIL will give you a log file (Right click in the "Status" part of the window and "Save log"), post them here.

Here is a ZIP file with 5 flashers.