[Windows Phone 8 Q&A, Help & Troubleshooting] madb1lly:
Hi everyone,

I need help to recover my Lumia 925 phone, please. I've tried the various tutorials for using Thor2 in emergency mode to flash a new bootloader etc but unfortunately I'm not having any luck. The phone was originally on QHSUSB_DLOAD but is now on QHSUSB_ARMPRG after I tried "Recover Bootloader" in WPInternals.

Here's the story:

A few days ago my Lumia 925 froze. This was after trying to deploy a XAP as explained here. It wouldn't respond to any button presses so I did a soft reset (Vol- and power) and left it for a few minutes. When I came back it asked for my SIM PIN, which I put in, but then it froze again. After I left it for a while and it was still frozen I did another soft reset and left it. Again, I came back later, put in the SIM PIN, but this sim time is said SIM error, and then froze. So I removed the SIM, did a soft reset and left it again. It said SIM error, so I did the same again.

Next time when I came back (after two hours) it was totally dead, nothing on screen, cold to the touch, no response to any buttons, I couldn't reset it. Actually, if I hold down the power button for 10-20 seconds the windows logo lights up and the phone disappears and reappears in device manager.

I tried Windows Device Recovery Tool but it doesn't recognise the phone, doesn't list Lumia 925 and then tells me the device cannot be recovered. When connected to a computer the phone is shown as QHSUSB_DLOAD, "Care Suite Emergency Connectivity", driver dated 12/6/2015.

After searching on these forums and elsewhere I found many references and tutorials for using Thor2 in various recovery procedures. I got my firmware from lumiafirmware.com and used Emergency mode to try and flash the HEX and MBN files.

Unfortunately it didn't succeed, kept failing with error code 8 after trying OPEN_MULTI_REQ and Thor2 exited with error code 85021:

[21:41:08.593] D_MSG : THOR2 1.8.2.18

[21:41:08.593] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[21:41:08.593] D_MSG : Thor2 is running on Windows of version 6.2

[21:41:08.593] D_MSG : thor2 -mode emergency -hexfile C:\lumia\FAST8960_CATWALK.hex -mbnfile C:\lumia\RM892_msimage_v1.0.mbn -orig_gpt

[21:41:08.593] D_MSG : Process started Thu Jul 20 21:41:08 2017

[21:41:08.593] D_MSG : Debugging enabled for emergency

[21:41:08.593] D_MSG : Initiating emergency download

[21:41:09.610] D_MSG : Using default emergency protocol

[21:41:09.610] D_MSG : ALPHA EMERGENCY FLASH START

[21:41:09.611] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[21:41:09.611] D_MSG : Hex download selected

[21:41:09.612] D_MSG : Check if device in Dload

[21:41:09.612] D_MSG : Connection to DLOAD mode succeeded

[21:41:09.612] D_MSG : Get Dload parameters

[21:41:09.612] D_MSG : Sending HEX flasher to the device

[21:41:09.924] D_MSG : Sending GO command if HEX flasher successfully uploaded.

[21:41:11.375] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[21:41:11.376] D_MSG : Mbn download selected

[21:41:11.376] D_MSG : Waiting for connection to flash programmer

[21:41:13.886] D_MSG : Connecting to flash programmer

[21:41:13.902] D_MSG : Received valid HELLO_RSP

[21:41:13.902] D_MSG : Safe version=true, transfer size=15360

[21:41:13.902] D_MSG : Received valid SECURITY_RSP

[21:41:13.902] D_MSG : Successfully connected to flash programmer

[21:41:13.902] D_MSG : Connection to flash programmer succeeded

[21:41:13.902] D_MSG : Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds

[21:41:13.902] D_MSG : Reading GPT from binary

[21:41:13.902] D_MSG :	-- GPT STARTs--

[21:41:13.902] D_MSG : name: SBL1

[21:41:13.902] D_MSG : startLBA: 34

[21:41:13.902] D_MSG : endLBA: 243

[21:41:13.902] D_MSG : size: 0x000000000001a400 bytes

[21:41:13.902] D_MSG : attributes: 0x0

[21:41:13.902] D_MSG :

[21:41:13.902] D_MSG : name: SBL2

[21:41:13.902] D_MSG : startLBA: 244

[21:41:13.902] D_MSG : endLBA: 507

[21:41:13.902] D_MSG : size: 0x0000000000021000 bytes

[21:41:13.902] D_MSG : attributes: 0x0

[21:41:13.902] D_MSG :

[21:41:13.902] D_MSG : name: SBL3

[21:41:13.918] D_MSG : startLBA: 508

[21:41:13.918] D_MSG : endLBA: 1193

[21:41:13.918] D_MSG : size: 0x0000000000055c00 bytes

[21:41:13.918] D_MSG : attributes: 0x0

[21:41:13.918] D_MSG :

[21:41:13.918] D_MSG : name: UEFI

[21:41:13.918] D_MSG : startLBA: 1194

[21:41:13.933] D_MSG : endLBA: 3273

[21:41:13.933] D_MSG : size: 0x0000000000104000 bytes

[21:41:13.933] D_MSG : attributes: 0x0

[21:41:13.933] D_MSG :

[21:41:13.933] D_MSG : name: RPM

[21:41:13.933] D_MSG : startLBA: 3274

[21:41:13.933] D_MSG : endLBA: 3559

[21:41:13.949] D_MSG : size: 0x0000000000023c00 bytes

[21:41:13.949] D_MSG : attributes: 0x0

[21:41:13.949] D_MSG :

[21:41:13.949] D_MSG : name: TZ

[21:41:13.949] D_MSG : startLBA: 3560

[21:41:13.949] D_MSG : endLBA: 3985

[21:41:13.949] D_MSG : size: 0x0000000000035400 bytes

[21:41:13.949] D_MSG : attributes: 0x0

[21:41:13.965] D_MSG :

[21:41:13.965] D_MSG : name: WinSecApp

[21:41:13.965] D_MSG : startLBA: 3986

[21:41:13.965] D_MSG : endLBA: 4609

[21:41:13.965] D_MSG : size: 0x000000000004e000 bytes

[21:41:13.980] D_MSG : attributes: 0x0

[21:41:13.980] D_MSG :

[21:41:13.980] D_MSG : name: UEFI_BS_NV

[21:41:13.980] D_MSG : startLBA: 4610

[21:41:13.980] D_MSG : endLBA: 4865

[21:41:13.980] D_MSG : size: 0x0000000000020000 bytes

[21:41:13.980] D_MSG : attributes: 0x0

[21:41:13.980] D_MSG :

[21:41:13.996] D_MSG : name: UEFI_NV

[21:41:13.996] D_MSG : startLBA: 4866

[21:41:13.996] D_MSG : endLBA: 4881

[21:41:13.996] D_MSG : size: 0x0000000000002000 bytes

[21:41:13.996] D_MSG : attributes: 0x0

[21:41:13.996] D_MSG :

[21:41:14.011] D_MSG : name: UEFI_RT_NV

[21:41:14.011] D_MSG : startLBA: 4882

[21:41:14.011] D_MSG : endLBA: 5137

[21:41:14.011] D_MSG : size: 0x0000000000020000 bytes

[21:41:14.011] D_MSG : attributes: 0x0

[21:41:14.011] D_MSG :

[21:41:14.011] D_MSG : name: UEFI_RT_NV_RPMB

[21:41:14.011] D_MSG : startLBA: 5138

[21:41:14.011] D_MSG : endLBA: 5153

[21:41:14.011] D_MSG : size: 0x0000000000002000 bytes

[21:41:14.011] D_MSG : attributes: 0x0

[21:41:14.027] D_MSG :

[21:41:14.027] D_MSG : name: SSD

[21:41:14.027] D_MSG : startLBA: 5154

[21:41:14.027] D_MSG : endLBA: 5169

[21:41:14.027] D_MSG : size: 0x0000000000002000 bytes

[21:41:14.027] D_MSG : attributes: 0x0

[21:41:14.027] D_MSG :

[21:41:14.043] D_MSG : name: PLAT

[21:41:14.043] D_MSG : startLBA: 5170

[21:41:14.043] D_MSG : endLBA: 7243

[21:41:14.043] D_MSG : size: 0x0000000000103400 bytes

[21:41:14.043] D_MSG : attributes: 0x0

[21:41:14.043] D_MSG :

[21:41:14.043] D_MSG :	-- GPT ENDs --

[21:41:14.043] D_MSG :

[21:41:14.043] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.058] D_MSG :

[21:41:14.074] D_MSG :

[21:41:14.074] D_MSG :

[21:41:14.074] D_MSG : Sending OPEN_MULTI_REQ

[21:41:14.871] D_ERR : Message send failed with error code 8

[21:41:14.871] D_ERR : Failed to get response to OPEN_MULTI_REQ

[21:41:14.871] D_MSG : ALPHA EMERGENCY FLASH END

[21:41:19.905] D_MSG : Emergency messaging closed successfully

[21:41:19.905] D_MSG : Operation took about 11.00 seconds.

[21:41:19.952] D_ERR : THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)

I tried this several times. After each failure with error code 85021 Thor2 would be unable to use DLOAD mode and would exit with error 85030:

[22:30:22.169] D_MSG : THOR2 1.8.2.18

[22:30:22.170] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[22:30:22.172] D_MSG : Thor2 is running on Windows of version 6.2

[22:30:22.173] D_MSG : thor2 -mode emergency -hexfile C:\Lumia\FAST8960_CATWALK.hex -mbnfile C:\Lumia\RM892_msimage_v1.0.mbn -orig_gpt

[22:30:22.175] D_MSG : Process started Wed Jul 19 22:30:22 2017

[22:30:22.181] D_MSG : Debugging enabled for emergency

[22:30:22.183] D_MSG : Initiating emergency download

[22:30:23.185] D_MSG : Using default emergency protocol

[22:30:23.186] D_MSG : ALPHA EMERGENCY FLASH START

[22:30:23.188] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[22:30:23.189] D_MSG : Hex download selected

[22:30:23.191] D_MSG : Check if device in Dload

[22:30:25.195] D_MSG : Waiting connection to DLOAD: 2 of 2

[22:30:25.196] D_MSG : Check if device in Dload

[22:30:25.201] D_ERR : Failed to connect to DLOAD mode

[22:30:25.202] D_ERR : Make sure that the COM port is free. Close QPST.

[22:30:25.205] D_MSG : ALPHA EMERGENCY FLASH END

[22:30:30.220] D_MSG : Emergency messaging closed successfully

[22:30:30.227] D_MSG : Operation took about 8.00 seconds.

[22:30:30.233] D_ERR : THOR2 1.8.2.18 exited with error code 85030 (0x14C26)

To attempt another flash I had to hold down the phone power button for 10-15 seconds, after which the windows logo lit up and the QHSUSB_DLOAD device disappeared and reappeared again in device manager.

Sometimes Thor2 would crash.

[22:39:39.671] D_MSG : THOR2 1.8.2.18

[22:39:39.672] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[22:39:39.674] D_MSG : Thor2 is running on Windows of version 6.2

[22:39:39.675] D_MSG : thor2 -mode emergency -hexfile C:\Lumia\FAST8960_CATWALK.hex -mbnfile C:\Lumia\RM892_msimage_v1.0.mbn -orig_gpt

[22:39:39.676] D_MSG : Process started Wed Jul 19 22:39:39 2017

[22:39:39.680] D_MSG : Debugging enabled for emergency

[22:39:39.683] D_MSG : Initiating emergency download

[22:39:40.685] D_MSG : Using default emergency protocol

[22:39:40.686] D_MSG : ALPHA EMERGENCY FLASH START

[22:39:40.687] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[22:39:40.689] D_MSG : Hex download selected

[22:39:40.690] D_MSG : Check if device in Dload

[22:39:40.692] D_MSG : Connection to DLOAD mode succeeded

[22:39:40.693] D_MSG : Get Dload parameters

[22:39:40.696] D_MSG : Sending HEX flasher to the device

[22:39:41.014] D_MSG : Sending GO command if HEX flasher successfully uploaded.

I tried to use WPInternals Restore Bootloader but it crashed every time (see log in post below) so I changed to using another USB port. Then the device appeared as QHSUSB_ARMPRG. I tried more emergency mode flashing but got the same errors as when it was recognised as QHSUSB_DLOAD. The only difference is that it now takes ~20 seconds of holding the power button down to get the windows logo to light up, so something has obviously changed somewhere. UPDATE: This is not consistent, it's now back to 10-15 seconds.

FFU integrity check:

[21:46:46.100] D_MSG : THOR2 1.8.2.18

[21:46:46.116] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[21:46:46.116] D_MSG : Thor2 is running on Windows of version 6.2

[21:46:46.116] D_MSG : thor2 -mode ffureader -ffufile C:\Lumia\RM892_3039.0000.1318.0000_RETAIL_eu_euro1_016_00_187379_prd_signed.ffu

[21:46:46.116] D_MSG : Process started Thu Jul 20 21:46:46 2017

[21:46:46.116] D_MSG : Debugging enabled for ffureader

[21:46:46.116] D_MSG : Initiating do FFUReader operations

[21:46:46.116] D_MSG : Version of FfuReader is 2015061501

[21:46:46.116] D_MSG : Parsing FFU... Please wait...

[21:46:46.116] D_MSG : readFfu() Start.

[21:46:46.116] D_MSG : readSecurityHdrAndCheckValidity() Start.

[21:46:46.116] D_MSG : readSecurityHdrAndCheckValidity() End.

[21:46:46.288] D_MSG : readGpt() Start.

[21:46:46.288] D_MSG : readGpt() End.

[21:46:46.288] D_MSG : readRkh() Start.

[21:46:46.553] D_MSG : readRkh() End.

[21:46:46.553] D_MSG : readRkh() Start.

[21:46:46.835] D_MSG : readRkh() End.

[21:46:46.835] D_MSG : checkDppPartition() Start.

[21:46:46.835] D_MSG : checkDppPartition() End.

[21:46:46.835] D_MSG : readFfu() End.

[21:46:46.835] D_ERR :

Successfully parsed FFU file. Header size: 0x000c0000, Payload size: 0x0000000054a80000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000c0000

[21:46:46.835] D_MSG : HeaderStart 0x60000

[21:46:46.835] D_MSG :

GPT Header

-------------

[21:46:46.835] D_MSG : Revision : 65536

[21:46:46.835] D_MSG : CRC32 : 0xf586c0e9

[21:46:46.835] D_MSG : FirstUsableLBA : 34

[21:46:46.850] D_MSG : LastUsableLBA : 20971486

[21:46:46.850] D_MSG : AlternateLBA : 20971519

[21:46:46.850] D_MSG : MyLBA : 1

[21:46:46.850] D_MSG : NumberOfPartitionEntries : 128

[21:46:46.850] D_MSG : PartitionEntryLBA : 2

[21:46:46.850] D_MSG : PartitionEntryArrayCRC32 : 0x26a20c4c

[21:46:46.850] D_MSG :

GPT Partitions

-------------

[21:46:46.850] D_MSG : DPP

[21:46:46.850] D_MSG :	startLBA : 0x0000000000001000

[21:46:46.850] D_MSG :	endLBA : 0x0000000000004fff

[21:46:46.866] D_MSG :	Size : 0x0000000000004000

[21:46:46.866] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.866] D_MSG : MODEM_FSG

[21:46:46.866] D_MSG :	startLBA : 0x0000000000005000

[21:46:46.866] D_MSG :	endLBA : 0x00000000000067ff

[21:46:46.866] D_MSG :	Size : 0x0000000000001800

[21:46:46.866] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.882] D_MSG : SSD

[21:46:46.882] D_MSG :	startLBA : 0x0000000000007000

[21:46:46.882] D_MSG :	endLBA : 0x000000000000701f

[21:46:46.882] D_MSG :	Size : 0x0000000000000020

[21:46:46.882] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.882] D_MSG : SBL1

[21:46:46.882] D_MSG :	startLBA : 0x0000000000008000

[21:46:46.882] D_MSG :	endLBA : 0x0000000000008bb7

[21:46:46.882] D_MSG :	Size : 0x0000000000000bb8

[21:46:46.882] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.882] D_MSG : SBL2

[21:46:46.897] D_MSG :	startLBA : 0x0000000000009000

[21:46:46.897] D_MSG :	endLBA : 0x0000000000009bb7

[21:46:46.897] D_MSG :	Size : 0x0000000000000bb8

[21:46:46.897] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.897] D_MSG : SBL3

[21:46:46.897] D_MSG :	startLBA : 0x000000000000a000

[21:46:46.897] D_MSG :	endLBA : 0x000000000000afff

[21:46:46.897] D_MSG :	Size : 0x0000000000001000

[21:46:46.897] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.897] D_MSG : UEFI

[21:46:46.913] D_MSG :	startLBA : 0x000000000000b000

[21:46:46.913] D_MSG :	endLBA : 0x000000000000c387

[21:46:46.913] D_MSG :	Size : 0x0000000000001388

[21:46:46.913] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.913] D_MSG : RPM

[21:46:46.913] D_MSG :	startLBA : 0x000000000000d000

[21:46:46.913] D_MSG :	endLBA : 0x000000000000d3e7

[21:46:46.913] D_MSG :	Size : 0x00000000000003e8

[21:46:46.913] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.913] D_MSG : TZ

[21:46:46.913] D_MSG :	startLBA : 0x000000000000e000

[21:46:46.928] D_MSG :	endLBA : 0x000000000000e3e7

[21:46:46.928] D_MSG :	Size : 0x00000000000003e8

[21:46:46.928] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.928] D_MSG : WINSECAPP

[21:46:46.928] D_MSG :	startLBA : 0x000000000000f000

[21:46:46.928] D_MSG :	endLBA : 0x000000000000f3ff

[21:46:46.928] D_MSG :	Size : 0x0000000000000400

[21:46:46.928] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.928] D_MSG : BACKUP_SBL1

[21:46:46.928] D_MSG :	startLBA : 0x0000000000010000

[21:46:46.928] D_MSG :	endLBA : 0x0000000000010bb7

[21:46:46.944] D_MSG :	Size : 0x0000000000000bb8

[21:46:46.944] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.944] D_MSG : BACKUP_SBL2

[21:46:46.944] D_MSG :	startLBA : 0x0000000000011000

[21:46:46.944] D_MSG :	endLBA : 0x0000000000011bb7

[21:46:46.944] D_MSG :	Size : 0x0000000000000bb8

[21:46:46.944] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.944] D_MSG : BACKUP_SBL3

[21:46:46.944] D_MSG :	startLBA : 0x0000000000012000

[21:46:46.944] D_MSG :	endLBA : 0x0000000000012fff

[21:46:46.944] D_MSG :	Size : 0x0000000000001000

[21:46:46.960] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.960] D_MSG : BACKUP_UEFI

[21:46:46.960] D_MSG :	startLBA : 0x0000000000013000

[21:46:46.960] D_MSG :	endLBA : 0x0000000000014387

[21:46:46.960] D_MSG :	Size : 0x0000000000001388

[21:46:46.960] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.960] D_MSG : BACKUP_RPM

[21:46:46.960] D_MSG :	startLBA : 0x0000000000015000

[21:46:46.960] D_MSG :	endLBA : 0x00000000000153e7

[21:46:46.960] D_MSG :	Size : 0x00000000000003e8

[21:46:46.960] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.960] D_MSG : BACKUP_TZ

[21:46:46.975] D_MSG :	startLBA : 0x0000000000016000

[21:46:46.975] D_MSG :	endLBA : 0x00000000000163e7

[21:46:46.975] D_MSG :	Size : 0x00000000000003e8

[21:46:46.975] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.975] D_MSG : BACKUP_WINSECAPP

[21:46:46.975] D_MSG :	startLBA : 0x0000000000017000

[21:46:46.991] D_MSG :	endLBA : 0x00000000000173ff

[21:46:46.991] D_MSG :	Size : 0x0000000000000400

[21:46:46.991] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.991] D_MSG : UEFI_BS_NV

[21:46:46.991] D_MSG :	startLBA : 0x0000000000018000

[21:46:46.991] D_MSG :	endLBA : 0x00000000000181ff

[21:46:46.991] D_MSG :	Size : 0x0000000000000200

[21:46:46.991] D_MSG :	Attributes: 0x8000000000000000

[21:46:46.991] D_MSG : UEFI_NV

[21:46:46.991] D_MSG :	startLBA : 0x0000000000019000

[21:46:46.991] D_MSG :	endLBA : 0x00000000000191ff

[21:46:46.991] D_MSG :	Size : 0x0000000000000200

[21:46:46.991] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.007] D_MSG : PLAT

[21:46:47.007] D_MSG :	startLBA : 0x000000000001a000

[21:46:47.007] D_MSG :	endLBA : 0x000000000001dfff

[21:46:47.007] D_MSG :	Size : 0x0000000000004000

[21:46:47.007] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.007] D_MSG : EFIESP

[21:46:47.007] D_MSG :	startLBA : 0x0000000000020000

[21:46:47.007] D_MSG :	endLBA : 0x000000000003ffff

[21:46:47.007] D_MSG :	Size : 0x0000000000020000

[21:46:47.007] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.007] D_MSG : MODEM_FS1

[21:46:47.022] D_MSG :	startLBA : 0x0000000000040000

[21:46:47.022] D_MSG :	endLBA : 0x00000000000417ff

[21:46:47.022] D_MSG :	Size : 0x0000000000001800

[21:46:47.022] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.022] D_MSG : MODEM_FS2

[21:46:47.022] D_MSG :	startLBA : 0x0000000000042000

[21:46:47.022] D_MSG :	endLBA : 0x00000000000437ff

[21:46:47.022] D_MSG :	Size : 0x0000000000001800

[21:46:47.038] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.038] D_MSG : UEFI_RT_NV

[21:46:47.038] D_MSG :	startLBA : 0x0000000000044000

[21:46:47.038] D_MSG :	endLBA : 0x00000000000441ff

[21:46:47.038] D_MSG :	Size : 0x0000000000000200

[21:46:47.038] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.038] D_MSG : UEFI_RT_NV_RPMB

[21:46:47.053] D_MSG :	startLBA : 0x0000000000045000

[21:46:47.053] D_MSG :	endLBA : 0x00000000000450ff

[21:46:47.053] D_MSG :	Size : 0x0000000000000100

[21:46:47.053] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.053] D_MSG : MMOS

[21:46:47.053] D_MSG :	startLBA : 0x0000000000046000

[21:46:47.053] D_MSG :	endLBA : 0x0000000000072cc1

[21:46:47.053] D_MSG :	Size : 0x000000000002ccc2

[21:46:47.053] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.053] D_MSG : MainOS

[21:46:47.053] D_MSG :	startLBA : 0x0000000000074000

[21:46:47.053] D_MSG :	endLBA : 0x00000000003f9180

[21:46:47.053] D_MSG :	Size : 0x0000000000385181

[21:46:47.069] D_MSG :	Attributes: 0x0000000000000000

[21:46:47.069] D_MSG : Data

[21:46:47.069] D_MSG :	startLBA : 0x00000000003fc000

[21:46:47.069] D_MSG :	endLBA : 0x00000000013fefff

[21:46:47.069] D_MSG :	Size : 0x0000000001003000

[21:46:47.069] D_MSG :	Attributes: 0x8000000000000000

[21:46:47.069] D_MSG : Number of partitions found 28

[21:46:47.069] D_MSG : RKH of SBL1: CD84376222AAF204C85119532BF34EA55C8844E4CEA35F3E508D25AA34D96637

[21:46:47.069] D_MSG : RKH of UEFI: CD84376222AAF204C85119532BF34EA55C8844E4CEA35F3E508D25AA34D96637

[21:46:47.069] D_MSG : Platform ID: Nokia.MSM8960.P6023

[21:46:47.069] D_MSG : Hi. index sector 20967168

[21:46:47.085] D_MSG : Computing integrity of FFU. Please wait...

[21:47:06.085] D_MSG :

[21:47:06.085] D_MSG : FFU integrity OK.

[21:47:06.100] D_MSG : Exited with success

Unsuccessful attempt to read eMMC manufacturer:

[13:27:32.787] D_MSG : THOR2 1.8.2.18

[13:27:32.787] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[13:27:32.788] D_MSG : Thor2 is running on Windows of version 6.2

[13:27:32.789] D_MSG : thor2 -mode rnd -readcid -skip_com_scan

[13:27:32.790] D_MSG : Process started Sun Jul 23 13:27:32 2017

[13:27:32.792] D_MSG : Initiating do RnD operations

[13:27:32.793] D_MSG : WinUSB in use.

[13:27:32.795] D_MSG : Debugging enabled for rnd

[13:27:32.813] D_MSG : Starting to read manufacturer of eMMC

[13:27:32.815] D_MSG : Detecting UEFI responder

[13:27:32.816] D_ERR : Device is not in Lumia UEFI mode

[13:27:32.817] D_ERR : Reading device mode failed

[13:27:32.818] D_MSG : Detecting UEFI responder

[13:27:32.819] D_ERR : Device is not in Lumia UEFI mode

[13:27:32.820] D_ERR : Reading device mode failed

[13:27:32.840] D_ERR : THOR2 1.8.2.18 exited with error code 84002 (0x14822)

Tried with apparently good RM-892 HEX file from here, but unsuccessful:

[14:05:10.613] D_MSG : THOR2 1.8.2.18

[14:05:10.613] D_MSG : Built for Windows @ 13:36:46 Jun 16 2015

[14:05:10.614] D_MSG : Thor2 is running on Windows of version 6.2

[14:05:10.615] D_MSG : thor2 -mode emergency -hexfile C:\lumia\rm-892.hex -mbnfile C:\lumia\RM892_msimage_v1.0.mbn -orig_gpt

[14:05:10.616] D_MSG : Process started Sun Jul 23 14:05:10 2017

[14:05:10.625] D_MSG : Debugging enabled for emergency

[14:05:10.626] D_MSG : Initiating emergency download

[14:05:11.626] D_MSG : Using default emergency protocol

[14:05:11.628] D_MSG : ALPHA EMERGENCY FLASH START

[14:05:11.629] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[14:05:11.630] D_MSG : Hex download selected

[14:05:11.631] D_MSG : Check if device in Dload

[14:05:11.632] D_MSG : Connection to DLOAD mode succeeded

[14:05:11.633] D_MSG : Get Dload parameters

[14:05:11.648] D_MSG : Sending HEX flasher to the device

[14:05:11.969] D_MSG : Sending GO command if HEX flasher successfully uploaded.

[14:05:13.399] D_MSG : Emergency Programmer V1 version 2014.10.31.001

[14:05:13.401] D_MSG : Mbn download selected

[14:05:13.410] D_MSG : Waiting for connection to flash programmer

[14:05:15.914] D_MSG : Connecting to flash programmer

[14:05:15.931] D_MSG : Received valid HELLO_RSP

[14:05:15.934] D_MSG : Safe version=true, transfer size=15360

[14:05:15.936] D_MSG : Received valid SECURITY_RSP

[14:05:15.937] D_MSG : Successfully connected to flash programmer

[14:05:15.939] D_MSG : Connection to flash programmer succeeded

[14:05:15.940] D_MSG : Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds

[14:05:15.942] D_MSG : Reading GPT from binary

[14:05:15.945] D_MSG :	-- GPT STARTs--

[14:05:15.946] D_MSG : name: SBL1

[14:05:15.948] D_MSG : startLBA: 34

[14:05:15.949] D_MSG : endLBA: 243

[14:05:15.951] D_MSG : size: 0x000000000001a400 bytes

[14:05:15.952] D_MSG : attributes: 0x0

[14:05:15.957] D_MSG :

[14:05:15.959] D_MSG : name: SBL2

[14:05:15.961] D_MSG : startLBA: 244

[14:05:15.965] D_MSG : endLBA: 507

[14:05:15.967] D_MSG : size: 0x0000000000021000 bytes

[14:05:15.969] D_MSG : attributes: 0x0

[14:05:15.972] D_MSG :

[14:05:15.973] D_MSG : name: SBL3

[14:05:15.976] D_MSG : startLBA: 508

[14:05:15.977] D_MSG : endLBA: 1193

[14:05:15.979] D_MSG : size: 0x0000000000055c00 bytes

[14:05:15.980] D_MSG : attributes: 0x0

[14:05:15.984] D_MSG :

[14:05:15.987] D_MSG : name: UEFI

[14:05:15.988] D_MSG : startLBA: 1194

[14:05:15.989] D_MSG : endLBA: 3273

[14:05:15.990] D_MSG : size: 0x0000000000104000 bytes

[14:05:15.991] D_MSG : attributes: 0x0

[14:05:15.993] D_MSG :

[14:05:15.994] D_MSG : name: RPM

[14:05:15.995] D_MSG : startLBA: 3274

[14:05:15.998] D_MSG : endLBA: 3559

[14:05:15.999] D_MSG : size: 0x0000000000023c00 bytes

[14:05:16.000] D_MSG : attributes: 0x0

[14:05:16.002] D_MSG :

[14:05:16.003] D_MSG : name: TZ

[14:05:16.005] D_MSG : startLBA: 3560

[14:05:16.005] D_MSG : endLBA: 3985

[14:05:16.007] D_MSG : size: 0x0000000000035400 bytes

[14:05:16.009] D_MSG : attributes: 0x0

[14:05:16.011] D_MSG :

[14:05:16.012] D_MSG : name: WinSecApp

[14:05:16.013] D_MSG : startLBA: 3986

[14:05:16.015] D_MSG : endLBA: 4609

[14:05:16.015] D_MSG : size: 0x000000000004e000 bytes

[14:05:16.016] D_MSG : attributes: 0x0

[14:05:16.026] D_MSG :

[14:05:16.027] D_MSG : name: UEFI_BS_NV

[14:05:16.029] D_MSG : startLBA: 4610

[14:05:16.030] D_MSG : endLBA: 4865

[14:05:16.032] D_MSG : size: 0x0000000000020000 bytes

[14:05:16.033] D_MSG : attributes: 0x0

[14:05:16.036] D_MSG :

[14:05:16.037] D_MSG : name: UEFI_NV

[14:05:16.040] D_MSG : startLBA: 4866

[14:05:16.041] D_MSG : endLBA: 4881

[14:05:16.043] D_MSG : size: 0x0000000000002000 bytes

[14:05:16.044] D_MSG : attributes: 0x0

[14:05:16.046] D_MSG :

[14:05:16.049] D_MSG : name: UEFI_RT_NV

[14:05:16.051] D_MSG : startLBA: 4882

[14:05:16.052] D_MSG : endLBA: 5137

[14:05:16.053] D_MSG : size: 0x0000000000020000 bytes

[14:05:16.055] D_MSG : attributes: 0x0

[14:05:16.058] D_MSG :

[14:05:16.061] D_MSG : name: UEFI_RT_NV_RPMB

[14:05:16.062] D_MSG : startLBA: 5138

[14:05:16.063] D_MSG : endLBA: 5153

[14:05:16.065] D_MSG : size: 0x0000000000002000 bytes

[14:05:16.066] D_MSG : attributes: 0x0

[14:05:16.070] D_MSG :

[14:05:16.072] D_MSG : name: SSD

[14:05:16.073] D_MSG : startLBA: 5154

[14:05:16.074] D_MSG : endLBA: 5169

[14:05:16.076] D_MSG : size: 0x0000000000002000 bytes

[14:05:16.077] D_MSG : attributes: 0x0

[14:05:16.079] D_MSG :

[14:05:16.082] D_MSG : name: PLAT

[14:05:16.083] D_MSG : startLBA: 5170

[14:05:16.084] D_MSG : endLBA: 7243

[14:05:16.085] D_MSG : size: 0x0000000000103400 bytes

[14:05:16.086] D_MSG : attributes: 0x0

[14:05:16.089] D_MSG :

[14:05:16.091] D_MSG :	-- GPT ENDs --

[14:05:16.093] D_MSG :

[14:05:16.094] D_MSG :

[14:05:16.096] D_MSG :

[14:05:16.097] D_MSG :

[14:05:16.098] D_MSG :

[14:05:16.099] D_MSG :

[14:05:16.102] D_MSG :

[14:05:16.103] D_MSG :

[14:05:16.104] D_MSG :

[14:05:16.105] D_MSG :

[14:05:16.107] D_MSG :

[14:05:16.108] D_MSG :

[14:05:16.109] D_MSG :

[14:05:16.110] D_MSG : Sending OPEN_MULTI_REQ

[14:05:17.110] D_ERR : Message send failed with error code -1

[14:05:17.111] D_ERR : Failed to get response to OPEN_MULTI_REQ

[14:05:17.112] D_MSG : ALPHA EMERGENCY FLASH END

[14:05:22.124] D_MSG : Emergency messaging closed successfully

[14:05:22.128] D_MSG : Operation took about 12.00 seconds.

[14:05:22.134] D_ERR : THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)

Same result with Hex from HeathCliff (I think it's the same one) and from skiddd (different). All Hexs are different from the FAST8960_CATWALK.hex from lumiafirmware.com and also different sizes (204kB vs 201kB from lumiafirmware.com).

So, is QHSUSB_ARMPRG better or worse than QHSUSB_DLOAD? What should my next steps be?

I think I remember finding an explanation of how the Windows Phone bootloaders work but I can't find it anymore, has someone got the link?

Thanks in anticipation of lots of useful suggestions and explanations :)