[OnePlus 3T Guides, News, & Discussion] smaeul:
QFIL Mini-HOWTO

The OnePlus 3T is always able to enter Qualcomm USB download mode because the soft straps are hooked up to the volume button (turn the phone off; hold volume up while plugging into USB). On the one hand, this makes the phone a great unbrickable development platform. On the other hand, it completely ruins the security of the device, as it makes it trivially easy to downgrade the Android bootloader or install a malicious kernel without wiping the device.

Here are instructions for using the QFIL tool to restore your kernel or bootloader if somehow you break your locked-bootloader setup. (If you forget to sign your kernel/recovery, you can use this method to later flash a fixed one.)

Things you need:

First, you need QFIL, which you can find in QPST downloads floating around the Internet, as well as separately.

Second, you need a driver for the Qualcomm USB download mode. I used the one linked to from https://xdaforums.com/showthread.php?t=3515306 (https://mega.nz/#!AgohmbqC!h16GeeOnlvubYDyfID3feY-qVJuBZiWVvYsXSAeKIA8).

Third, you need a programmer binary. This is copied to the phone during the download process and is responsible for handling the high-speed protocol and writing the flash memory. I used the one linked to from https://xdaforums.com/showthread.php?t=3515306 (https://mega.nz/#!Q1YnTTAT!gnLf6NEkSRy7W-WY8J0H2SmJJLzO91-vReKx7B1VVpI). Choose the programmer with "ddr" in the filename.

SHA256 checksums for the files linked above:

b8fc07bafc49a6bf985a9b140061eefaab6a2db0da7810d358417914318c2066 *driver.rar
b4cf9e48df3842a9308caa73225a161b4d34b7069f8b7f66850d068e2267b63e *OP3T Unbrick Tool.7z

Fourth, you need one or more XML files that describe the partitions to be flashed. For the OnePlus 3T, I used the XML below (in a file named "rawprogram4.xml"), derived from the file named "rawprogram4.xml" in the unbrick tool archive:

<?xml version="1.0" ?>
<data>
<program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="emmc_appsboot.mbn" label="aboot" num_partition_sectors="2048" partofsingleimage="false" physical_partition_number="4" readbackverify="false" size_in_KB="8192.0" sparse="false" start_byte_hex="0x990a000" start_sector="39178"/>
<program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="emmc_appsboot.mbn" label="abootbak" num_partition_sectors="2048" partofsingleimage="false" physical_partition_number="4" readbackverify="false" size_in_KB="8192.0" sparse="false" start_byte_hex="0xa10a000" start_sector="41226"/>
<program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="boot.img" label="boot" num_partition_sectors="16384" partofsingleimage="false" physical_partition_number="4" readbackverify="false" size_in_KB="65536.0" sparse="false" start_byte_hex="0xb90a000" start_sector="47370"/>
<program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="recovery.img" label="recovery" num_partition_sectors="16384" partofsingleimage="false" physical_partition_number="4" readbackverify="false" size_in_KB="65536.0" sparse="false" start_byte_hex="0xcf90a000" start_sector="850186"/>
</data>

You only need the "program" tags for the partitions you want to flash. For example, if you accidentally flash an unsigned TWRP, just keep the last "program" tag for the recovery partition.

Finally, you need image files for the partitions you want to flash. That means a bootloader ("emmc_appsboot.mbn") extracted from the stock firmware download, or a signed TWRP or boot.img. Put them in the same directory as the XML file.

How to flash:

Open QFIL.

Open the QFIL configuration (from the menu at the top), and select "UFS" for the device type.

Put your phone in download mode. The large text at the top of the window should change from "no port" to the name of the device (from Device Manager) and a port number.

Select flat build.

Select the programmer you downloaded.

Click "Load XML", browse to your "rawprogram*.xml" file, and click "OK".

When it prompts for a "patch*.xml" file, click "Cancel".

Click download, and wait for it to finish.

Unplug your phone from USB, and hold down the power button for a couple of seconds to power it off; then power it back on.

Example: