[Zenfone 5 Q&A, Help & Troubleshooting] Leomaxwell973:
Hello, First time post, moderate time lurker

---------------------------------------------------------------------------------------------------------------------------

Disclaimer:

I'm just recently learning tampering with android and been pretty obsessed with achieving my personal goal on mine.

With that being said I AM NOT a professional, I am merely posting this guide because I have not yet seen this specific method I used to un-brick my phone, but it does borrow from other similar concepts.

I will probably have limited followup capability and expertise, and everything is AT YOUR OWN RISK, not only do you risk your phone being damaged beyond repair, not just a brick but scrap metal, you also risk anything you connect it to if you are not careful. YOU HAVE BEEN WARNED.

Also, this guide may apply to multiple models of Qualcomm phones (Research first if it applies to yours), but was performed on a ZenFone 5 >-LIVE-< not a regular ZenFone 5, its being posted here due to lack of my phone model on the forum. Do not assume that everything that works on a live will work on a regular, I have found they are VASTLY different and only similar in name.

---------------------------------------------------------------------------------------------------------------------------

Symptoms:

Very Hard-Bricked ZenFone 5 Live, due to attempting to hex edit the boot-loader

(I've already learned my lesson, save your lectures)

The indication that your phone is actually a HARD brick, is that it will not appear to turn on at all, and when connected to a PC will show something along the line of Diagnostics 900E on the COM Port devices section of your device manager

For anyone whose poked at it at the Qualcomm level, you will notice a few things wrong

-It never goes it 9008 QDL mode on its own

-It rejects any kind of memory diagnostics(which is a miniature requirement before a flash by automation) with ACK ERROR FROM DEVICE: NAK_MEMORY_DEBUG_NOT_SUPPORTED

or will report IMAGE_TYPE_INVALID, even when selecting the correct firmware

and lastly you get timeout/phone wait errors, header/reply reads "0" or if you try to manually connect with the QSaharaServer it will only reply to Hello Prompts/commands then reset, and anything else gives unknown command received: 4 or "0", also manual PUTTY connections to it via TELNET over COM port also results in a mass overload of "0"s being sent to PUTTY en-masse and only "0"s can be sent.

If your phone is still able to get to your boot loader or has any other functionality I would suggest looking into alternatives than following this guide first.

---------------------------------------------------------------------------------------------------------------------------

Tools Needed:

- Hard-Bricked QUALCOMM phone

(this will not work if it does not have Qualcomm firmware, I.E. Sahara, Firehose, etc.)

- USB-C cable

(or whichever cable applies to your phone, this was however performed using a -c cable)

- Wire cutting/stripping/joining tools ; soldering is optional ;

I personally used: Box cutter blade, Knife, Scissors, pliers, and a lighter

- Qualcomm flashing software, QPST or QFIL, and Qualcomm Drivers ;

whichever you're used to, if you're new to Qualcomm tools I recommend a standalone version of QFIL, google it, they aren't too hard to find (and I'm too new and don't wanna risk posting links to bad sites)

Also the drivers for Qualcomm specifically ARE REQUIRED

if you found the correct ones you should have a folder in program files (x86)/Qualcomm Incorporated

Google these too, not too hard to find, too many risky links, I'm not a pro.

- Phones Firmware - QUALCOMM LEVEL

this is not your regular ROM with boot.img,system.img, etc.

Qualcomm level firmware will look more like Firehose_8917.mdn, Rawprogram.xml, Patch0.xml

these can be tough to find for some people

If you're lucky your phones regular OTA/Firmware downloads will also contain these, for others its a standard ROM without them. You may need to google fu around for them but do make sure you're using the correct Qualcomm firmware for your phone/msm, or you may risk putting your phone into perma-brick.

- Optional - USB Hub with surge protection ;

Due to the electrical danger of this guide, I highly recommend a USB Hub with surge protection capability, I just so happened to have one laying around, it is optional, but HIGHLY recommended, I believe mine saved my phone/PC during this procedure at least once.

- Optional - Stock Factory ROM

Just to make sure to clear out whatever caused the brick in the first place, I supposed you could flash whatever else works for you if you still have an unlocked boot-loader, somehow, after the flash, heck I don't even know if there's a system left in there to boot into if you try skipping altogether, either way, highly recommend an OEM stock regular flash after the Qualcomm flash.

---------------------------------------------------------------------------------------------------------------------------

Verify phones condition:

First off, your phone should be pretty bricked, if you're this far. Make sure its not DEAD DEAD though. Plugging it into a PC should give at least an unknown device, Qualcomm 900E COM port device, or some kind of life, plugging it in (and maybe holding power + down vol, or up if a different model) indicates a flashing LED.

If there is sign of life, proceed ; if not your phone may have physical/electrical damage and prepare for the worst and consider a new phone.

---------------------------------------------------------------------------------------------------------------------------

We begin the real work at the cable

-Why? (can skip if you dont wanna know whats going on in the software)

The phone is locked-down by the highest level boot-loader (PBL i think?), its name as of this guide, Sahara.

When Sahara security is triggered it locks down the secondary bootloader, Firehose. With Firehose on lockdown it cannot load the usual oem-bootloader you see, or your custom if you have one. This is probably a security feature to try to force would-be thieves to not be able to unlock the phone without bringing it to a service dealer. Or possibly to thwart would be phone moders who can't figure out whats going on and cash in on a voided warranty and a simple flash work labor fee for their techs, or new phone purchase.

Either way, Qualcomm has a backdoor, and the backdoor is in the USB cable.

---------------------------------------------------------------------------------------------------------------------------

Cable work

-Begin Guide

Begin by stripping the sleeving off a section of the USB-C cable, I recommend somewhere in the middle, and a few 3-5 inches worth to give yourself play room, if you're experienced with cable modding then do whatever s comfortable to have room to switch a wire to another, though that's not necessarily accurate on what the next steps are. Keep in mind there is a entire secondary sleeve of tin wire mesh braiding so it can get messy and you need that isolated from other wires.

Once you have your section of stripped wire, examine wires for what type you have

(to my surprise and delayed my work 6 hours of research was the absence of a black wire.)

You will either have:

Red, White, Green Black wires ; including Tin shielding mesh, and possibly a nylon core

OR

Red, White, Green; including Tin shielding mesh, and possibly a nylon core

If yours was like mine, the black wire is actually a mesh of copper wires mixed in with the tin mesh, in this case treat the tin outer mesh like the black wire, which makes things difficult to work with, but very doable still. Just be careful not to fully sever the copper strands mixed in too much, you need at least some of them in-tact to some degree

Next cut the green wire, and strip the tips down a good amount, enough where you can twist it by hand (1/8" or so?)

if you have a black wire do the same and skip the next tin mesh step.

---------------------------------------------------------------------------------------------------------------------------

Tin mesh wire-

If you have a tin mesh, things get a little dicey but it worked for me,

the tin mesh surrounds the cable entirely in a tubular braid pattern

it is impossible to work with in this state

therefore ~1/2 of it needs to be severed in order to craft it from a shielding braid, into a makeshift wire

tip, the thin insulation sleeving separating the wires from the shield when pulled peels the shielding off the wires nicely after the mesh is cut in one spot (severing point a-b on the cable), though bunches it up, this does make it easier to cut it half though, rather than poking and pulling at it by hand.

once you're able to separate it from the rest of the wires, twist the mesh into a wire form, due to its rough tin spike nature it holds in shape quite nicely

The key on the tin mesh type though is to examine it for the copper strands hidden within and do not severe too many of them, the shielding will be disconnected from point a-b on the cable but still the copper wires need to not be mutilated.

once you have your mesh in wire cable form on both ends proceed

---------------------------------------------------------------------------------------------------------------------------

Cable work Pt. 2

At this point you should have:

Green wire, cut and tips stripped

Black wire, the same as green, if it applies

Mesh shield crafted into a wire, if it applies

(either the black wire or mesh are required, but NOT BOTH)

- From here-on the tin wire mesh is effectively the black wire, if it applies, and thus will be refereed interchangeably to as such unless otherwise specified-

Take your black wires, twist them together and secure them

you must make sure of 4 things

1 - Obviously, the copper of the wire is in contact

2 - they do not accidentally become disconnected and can withstand at least some force before separating

3 - However, they must remain QUITE EXPOSED, you need the bare wire to be somewhat accessible for later steps

If you're experienced you can do this your own way after reviewing the next steps, but these wires must be able to connect and disconnect at will without unplugging the USB cable itself

4 - Make sure the wires are in such a configuration that they can reach the green wire, but stay - 100% ISOLATED FROM EVERYTHING ELSE- (oh if you have a black wire, this INCLUDES THE SHIELDING, NO BLACK ON TIN)

If you fail to practice safety first you risk frying your phone, and whatever else you connect it to, I.E. your 10k Gaming PC, anything you fry you are responsible for and I disclaim any responsibility for your actions, even if you follow this guide accurately you're still at your own risk.

Next do the same to the green wire

---------------------------------------------------------------------------------------------------------------------------

Cable Work Pt. 3

- Pre-EDL "Deep Flash"

at this point, if you've followed the cable instructions your EDL "Deep Flash" Cable is actually complete

you may be asking yourself why? all you did was strip wires and reconnect them

the trick is actually, that you've provided one cable to cross-talk to another temporarily

to prep for the EDL "Deep Flash" command initiation one more step is needed though

you must connect the exposed and completed green wire, to the black wire

this however MUST be temporary, you must be able to separate these wires, safely, and without disconnecting the USB device.

For example in my build I bent my twisted makeshift tin black wire into a u-shape that just barley held onto the green wires copper, and could be removed with a simple tug

Depending on the internals of your wire and how rugged they are this may work for you

however if you have an actual black wire in yours, or your material is more "rubbery" and less rigid you may need to find your own method, maybe stick them both on duck-tape crossing wires or something

Still you get the idea though, cross the green and black wire, but in a temporary fashion.

Finished Product (This is post-EDL command, with the green wire pulled)

[IMG="Finished EDL cable (Currently in post EDL exectuion configuration, pulled green wire)"]https://i.ibb.co/x8jdmY0/IMG-0411.jpg[/IMG]

---------------------------------------------------------------------------------------------------------------------------

Testing and Driver preparation

At this point were good to go for a deep flash, but I would recommend testing before plugging it into a PC

(you can fry a PC through a USB port btw)

I recommend testing your setup with a USB adapter on a power outlet or a powered USB hub (preferable surge protected and not connected to your PC for now)

If your cable works, you should get a flashing LED

More-so now than if you didn't before, because sometimes the LED won't light when in Firehose mode, but only Sahara. If you didn't have an LED before... they its a maybe... use a multi-meter to make sure you have live connections and no shorts? if you have a flashing LED though you're golden, or should be.

Also, you want to make sure you're PC is prepped for the flash with the Qualcomm drivers, QPST/QFIL software, and your phones correct Qualcomm Level Firmware, in my case Its a Firehose_xxxx.mdn rawprogram.xml patch0.xml files.

Looking at the software though, depending on your model you may end up using a .hex file as well?

-this guide is more about the EDL cable and less about the software, many guides exist for those so if you need more info go looking for those. I'm posting this as this specific method of EDL cable I couldn't find anywhere, this is not a complete a-b guide, just the most crucial part of recovery for peoples hard bricked Qualcomm phones. -

---------------------------------------------------------------------------------------------------------------------------

The Deep Flash

Here comes the risky part, risking a PC

I've already warned you 2-3 times so whatever happens, you are responsible for.

Connect the phone with the PC, preferably through a surge protected USB HUB, or directly if you're desperate and brave/suicidal.

You should get NO CONNECTION indication from the PC, nothing in device manager, no USB connected audio blips, nothing. The only thing that should happen is the LED will flash on your phone. This is good.

Wait for about 10-20 seconds, you do not want to jump the gun or you will have to reset your wires.

after 10-20 seconds, execute your wire release / pull method on the green & black wire, separating them, but making sure their own connections don't get severed in the process.

If success, you will get a connection blip from the PC and if you have QUALCOMM DRIVERS in stalled you will see the fabled 9008 QDL loader install on its own without having to force it through device manager.

If you get 900E still, try again. if you can't get 9008 without forcing it something is wrong, either your phone has actually been in Firehose the whole time or there is a different method for your phone, or the cables are mismatched on the wire, or some other issue.

---------------------------------------------------------------------------------------------------------------------------

Successful 9008 EDL Deep flash

- A footnote for those familiar with Qualcomm already

Nice having 9008 on its own without going through device manager isnt it? ( for those experienced with Qualcomm already lol)

This is a proper QDL Deep flash and the way its meant to be loaded on these drivers.

If you had issues with QPST/QFIL before, proceed as normal if you're familiar with the process, the rest of the guide will briefly touch up on that. Just be careful not to sever the connection mid-flash, the Firehose firmware flash is much quicker than a ROM flash, so it won't be long if you already know what you're doing.

I recommend either safe-proofing your cable or switching to a UN-modified one ASAP to minimize risk to your equipment.

God-speed.

---------------------------------------------------------------------------------------------------------------------------

Qualcomm Flashing

- For those new to Firehose/Sahara

As mentioned previously this is not a Qualcomm software guide

This stuff is shrouded in mystery and proprietary hush hush so not a-lot is known and depending on what you got can be quite confusing to understand.

If you're new to Qualcomm software i previously recommenced QFIL, so that's what i will briefly touch, if you got QPST you're on your own.

(though usually QPST has QFIL included in SOME builds just fyi, if so you can continue following but you will ONLY be using QFIL using this guide, ignore all other tools in the package)

When you load QFIL, you will most likely be in "Meta" mode, this is not what we want, hit the radio bubble for "flat build" if you're missing these bubbles you may be on an ancient version of it and I recommend finding a more up to date version.

Next you must specify your programmer, this is going to be your eMMC_Firehose_XXXX.mbn file

(XXXX is your phones snapdragon MSN #, look it up on qualcomm snapdragon spec sheets if you need to)

I've only worked with my Zenfone 5 Live with this software, so eMMC_Firehose is all I know, if you find that your phone uses .hex or any other format aside from .mbn's or .xml's then I recommend you stop here and find a Qualcomm flashing guide for your specific phone, but try to keep your phone connected IF ITS SAFE TO DO SO (I.E. no risk of cat/pet attacks, children, liquids, living thing contact, etc.) , otherwise if you disconnect your phone you will need to re-perform the deep flash sequence from before.

Next click "Load XML"

this will prompt you to load both your rawprogram.xml and patch0.xml (one after the other)

Then click download.

This process took my phone about 20 seconds, its very quick

once this is complete reboot your phone with its "special reboot" key combo, whatever it is for your phone.

For mine its Vol down + power

if all goes well, you should have your good old fashioned OEM boot-loader

to make sure that whatever caused Sahara to lock-down your phone is gone, proceed to flash a factory/stock ROM to your phone. If you've made it this far I assume you either already have one on hand or found it while looking for you Qualcomm firmware.

And your phone is back from the dead.

Praise the sun!

---------------------------------------------------------------------------------------------------------------------------

FIN!

P.S. -

While waiting for your phone to flash your factory stock ROM I recommend listening to

Korn - Another Brick In The Wall (Pink Floyd Cover)

P.S.S -

I am continuing my research on brute forcing the unlock on this device, ZenFone 5 LIVE

if you have any information to share, please PM me for anything you can share or if you would like to collaborate on this project.

If you found this guide helpful and you want to show your appreciation share your feedback!

Also I wouldn't mind any donations, I am a paycheck to paycheck sweatshop callcenter tech. Link in my profile :)

- Sources for this methods inspiration -

club.lenovo (china)

User:

francescotagliam**te

en.miui -

Users:

tofi@movistar.e

mitch002

id post links, but i am forbidden as a new member.