[Huawei MediaPad M5  Guides, News, & Discussion] goodwin_c:
This is Generic guide for Unbricking or Downgrading Huawei devices with Kirin 960 CPU. Most probably very similar steps can be done for Kirin 970, but i don't have device to test. At the end i did attach my files, that i used for CMR-W09.

This WILL WORK even if you have Black Screen with permanent Fastboot - this is common issue for those, who tried to downgrade from EMUI 9 to EMUI 8. Yes, this is also unbrickable!

Have Fun!

1.	Prerequisites

-	Linux installed on your PC/laptop or as Virtual Machine, with fastboot tool on it

-	Board Software for your device – you can find on easy-firmware.com (about $15 for pass and reach collection) or gem-flash.com (has cheap $3 pass but less firmwares in collection)

HiKey_IDT linux tool – can be found there https://github.com/96boards-hikey/tools-images-hikey960/

-	Knowledge about test point location to interrupt CPU loading routine – ask google or look on this forum

http://forum.gsmhosting.com/vbb/f1022/huawei-test-point-gallery-2291781/index17.html

-	Opened device – you need access to motherboard

2.	Booting device in force update mode

Small intro. Hisilicon Kirin CPUs has special mode, when they are interrupting normal boot process and opening COM port on USB to accept commands. You have chance to load your own binaries directly to device RAM before boot process will continue (still, this images has to be signed by Huawei private key)

-	Disconnect battery connector from motherboard

-	Short test point to ground (any big metal shield on board will work for that)

-	Having test point shorted – connect USB cable. Run “lsusb” command – you should see device “USB SER” in devices

-	Open folder with Board Software. Find xml file with model name in name, for ex. “CMR-W09-BD_1.0.0.19_Download.xml”. In that xml file – check section for “bootloaderimage” – you will find paths and memory addresses for all needed boot stages. Keep that open.

-	Find all three boot img files – copy them to Linux machine. Note: For me, this three files didn’t work. But I found files with same names in other folder of Board Software – and that did a trick. You have to experiment a little bit.

-	Go to folder, where you have HiKey_IDT tools downloaded. Copy three boot files from Board Software to same folder as hikey_idt. Edit “config” file – you should specify correct address and file name – according to Board Software

-	Check “dmesg” command output – look for GSM Modem connected messages – you will see port name attached – like ttyUSB0

-	Run next command “./hikey_idt -c config -p /dev/ttyUSB0”. You should see information about loaded all boot stages, with “Finish downloading” message after each. If you did everything fine – in 5-15 seconds you will have your device ready for downgrade/unbrick/killing_your_cat :D

-	To verify that everything is fine – run “fastboot devices” command. If it will show device with proper serial number in output – you are fine to continue

3.	Fixing your device

On that step – you have special fastboot booted, that has no security/validation on it. You can unbrick your device, or kill it. Do all steps carefully.

-	Flash proper partition table information. You can take it from OTA package (from inside of UPDATE.APP) – normally, it has name HISIUFS_GPT. Run “fastboot flash ptable HISIUFS_GPT.img”

-	Flash other partitions one by one. Skip files CRC.img, SHA256RSA.img, CURVER.img, VERLIST.img, PACKAGE_TYPE.img and HISIUFS_GPT.img (it was already flashed on previous step). To flash this files, run “fastboot flash” with partition name and image file name after it – for ex. “fastboot flash recovery_vendor RECOVERY_VENDOR.img”. Note: Partition names should be written in lowercase. You can see partition names in Huawei Update Extractor, as extracted image files sometimes has shortened names.

-	Run few more commands to cleanup things around:

fastboot erase misc
fastboot erase modemnvm_factory
fastboot erase bootfail_info
fastboot erase dfx
fastboot erase rrecord
fastboot erase patch

-	Flash few more files – from Board Software:

fastboot flash splash2 splash2.img
fastboot erase userdata
fastboot flash userdata userdata.img
fastboot erase version
fastboot flash version version.img
fastboot flash reserved4 gpu_test_data_all_v2.bin (may be different for other devices – look into XML file from Board Software package for any “reserved” partitions)

-	Remove USB cable, connect battery back and boot your device. Most probably your device will boot now! Or at least it will try

4.	Final steps

-	Make factory reset from stock recovery!

-	Make 3-button flash of same or newer firmware just after restoring device!

-	Make backup of your NVME and OEMINFO! Use next commands for that:

dd if=/dev/block/platform/hi_mci.0/by-name/oeminfo of=/storage/emulated/0/oeminfo.img
dd if=/dev/block/bootdevice/by-name/nvme of=/storage/emulated/0/nvme.bak

Above commands are for adb shell with root. If you will do that under TWRP – you can use “of=/sdcard” in dd commands

Note: If your device is in bootloop, but runs recovery/eRecovery fine. If recovery is showing error during factory reset – maybe, you have screwed your nvme during previous upgrades/downgrades. In that case – make NVME backup using TWRP, take nvme.img from Board software package. Using any HEX editor – open both files, and copy all variable values from your backup to nvme.img from Board – manually. After doing that – repeat all steps from beginning until getting forced fastboot mode, and flash this image with “fastboot flash nvme”

P.S. In above links you may find lovely-prepared files for CMR-W09 tablet with region C432 for recovering to b161 firmware (includes recovery.sh script to flash everything in one command) - it can be used to get $4 unlock code with DC Unlocker.

HiKey_IDT => https://drive.google.com/open?id=1EdNfHVc8japoVSe2k4iTWdyp5JyPa1LR

Recovery Files for CMR-W09 C432 B161 => https://drive.google.com/open?id=1YgwwwFITjbJ8vIepcCt0O5w_RRJcKV8F

Board Software for CMR-W09 => https://drive.google.com/open?id=1w3mfVt8ObsViiv5ov3cUAog-M8hHMaSF

Testpoint location on Mediapad 10.8 (should be same on both Pro and non-Pro)