[Android General] hikari_calyx:
This is a generic guide that could be suitable for many Qualcomm based devices, once the phone can be triggered to EDL mode.

To make sure this guide will work as expect, following requirements are needed:

- Know how to trigger the phone to EDL mode, and you can force reboot the phone (Required for Driver Changing)

- Qualcomm EDL mode doesn't require service authentication, or specially modded (e.g. Lumia Emergency Files)

- Firehose file for your SoC and storage type (eMMC or UFS storage)

- Latest Qualcomm USB Drivers (at least 2.1.2.0 or newer, you can check yourself in Device Manager) and QPST Tool

For non-Android Smartphones, HP Elite X3 (At least for prototype unit) is confirmed working with this method.

Most of Android Smartphones should work as well.

Step 1: Trigger the phone to EDL mode

Following methods can be used as reference:

- Connect your phone to PC with a specific key pressed

e.g. TCL / Alcatel / Blackberry Android Smartphones can use Volume Down key to trigger to EDL mode

- EDL cable (DIY or order it on eBay / AliExpress, keyword: Xiaomi EDL cable)

e.g. Smartisan Smartphones that made recently can use EDL cable to unlock the bootloader.

- Fastboot command

e.g. Few Xiaomi Phones

- Wire trick

If you know where's the test point / components (like resistant) on CLK pin of eMMC/UFS storage is connected as well, short it to the GND will trigger your phone to EDL mode.

This will be usable for almost every Qualcomm devices, once you have schematic provided by the manufacturer.

- Erase aboot / abl / xbl / UEFI from your phone

This method is dangerous, do it at your own risk!

Step 2: Change the Driver to Qualcomm HS-USB QDLoader 9008

Skip this step if it's already indicated as HS-USB QDLoader 9008 in Device Manager, "Ports (COM or LPT)" category.

If it's indicated as HS-USB Diagnostics 9008 in "Ports (COM or LPT)" category, or "QHSUSB__BULK" in "Universal Serial Bus devices" category, you must update the driver to Qualcomm HS-USB QDLoader 9008, then reboot your phone to Qualcomm EDL mode again to ensure the EDL port will not throttle.

To reboot your phone, you need to perform hard reboot until you see the port disappeared immediately or refresh (in case the phone is bricked).

Step 3: Open QFIL, load Firehose file

You must choose correct storage type in right down corner.

In many cases keep it as "emmc" for default, otherwise choose "ufs" for flagship devices. In this case we choose emmc.

Then choose "Flat Build" as Build Type, and select the firehose file for your phone. If there's no firehose file specifically for your device, you may want to choose another firehose file for the same SoC, same storage type for different phone.

For example, I used the "prog_emmc_firehose_8996_ddr.elf" for ZUK Z2 on HP Elite X3 and it works perfectly.

Step 4: Open Partition Manager

Now choose "Tools" - "Partition Manager", and please pay attention to the Status box.

When it indicates:

2019-07-18 20:04:19.775 20:04:19: Sahara protocol completed
2019-07-18 20:04:19.776 Sending Programmer Finished
2019-07-18 20:04:19.776 Switch To FireHose
2019-07-18 20:04:19.777 Wait for 3 seconds...

If you didn't see the output above, then the firehose file is incorrect or the EDL port is throttled. Reboot your phone to EDL mode again.

Then you've partially succeeded, just wait for the Partition Manager appears.

This is the partition table of your phone. Please take note on the Start LBA and LBA number of the last partition.

Take HP Elite X3 partition table for example, the last partition is "Data", it's Start LBA and LBA number are 0x01E20000 and 0x0565BFDF. Add both of them will get the total sector numbers of whole eMMC storage - in this case, 0x0747BFDF, or 122,142,687 sectors. Multiple the sector numbers with 512 will get the total bytes of the eMMC storage, in this case, the capacity of eMMC storage is 62,537,055,744‬ bytes.

You'll need the number 122,142,687 for later use.

If you don't want to dump userdata partition, just use the Start LBA value of userdata partition and convert it to decimal values - the overall dump will not contain actual userdata.

Don't close Partition Manager, we need to keep it for later use.

Now choose either Step 5A or 5B as your wish.

Step 5A: Dump the storage

Please copy following path to your File Explorer:

%AppData%\Qualcomm\QFIL

This will redirect you to C:\Users\[your_user_name]\AppData\Roaming\Qualcomm\QFIL .

Find the COMPORT_XX directory respective to your exact COM port - in this case, I choose COMPORT_8 for example.

And open a command prompt or PowerShell window here.

Execute following command here, remember to change the COM port number and num_sectors to your exact number, or the actual path of fh_loader.exe and your dump if possible:

Note, this command will not create the path of your dump for you, you must create yourself.

"C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\your\dump --convertprogram2read --sendimage=full_dump.bin --start_sector=0 --lun=0 --num_sectors=122142687 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc

Now just wait for dumping procedure complete.

Expected output should look like this:

20:45:50: INFO: Current working dir (cwd): C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\
20:45:50: INFO: Showing network mappings to allow debugging
20:45:50: INFO: Looking for file 'full_dump.bin'

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:45:50: WARNING: Couldn't find the file 'full_dump.bin', returning NULL

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:45:50: WARNING: User specified --num_sectors=524288 but file only has 524288 sectors. **Ignoring --num_sectors

20:45:50: INFO: User wants to talk to port '\\.\COM8'
20:45:50: INFO: Took 0.00000000 seconds to open port
20:45:50: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:45:50: INFO: If you don't want this, use --dontsorttags

20:45:50: INFO: Looking for file 'full_dump.bin'

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:45:50: WARNING: Couldn't find the file 'full_dump.bin', returning NULL
20:45:50: INFO: Sending <configure>

20:45:50: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''

20:45:50: INFO: TARGET SAID: 'Calling hotplug_poll_device('MMC')'
20:45:50: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
20:45:50: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
20:45:50: INFO: In handleRead('full_dump.bin')
20:45:50: INFO: Looking for file 'full_dump.bin'

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:45:50: WARNING: Previous Filesize is 0 bytes. Therefore reading size of partition!! Please check 'full_dump.bin'
20:45:50: INFO: =======================================================
20:45:50: INFO: <read> (262144.0KB) 524288 sectors from location 0 FILE: 'full_dump.bin'
20:45:50: INFO: =======================================================

20:45:52: INFO: Overall to target 2.000 seconds (32.34 MBps)
20:45:54: INFO: Overall to target 4.000 seconds (32.38 MBps)
20:45:56: INFO: Overall to target 6.000 seconds (32.37 MBps)
20:45:58: INFO: Overall to target 7.844 seconds (32.64 MBps)

20:45:58: INFO: TARGET SAID: 'Finished reading from sector address 0 to 524288'
20:45:58: INFO: =======================================================
20:45:58: INFO: ===================== SUCCESS =========================
20:45:58: INFO: =======================================================

20:45:58: INFO: ==============================================================
20:45:58: INFO: Files used and their paths
20:45:58: INFO: 1 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt'
20:45:58: INFO: 2 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\full_dump.bin'

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:45:58: INFO: ==============================================================
20:45:58: INFO: NOTE: There were WARNINGS!! Repeated here, but please see log for more detail
Couldn't find the file 'full_dump.bin', returning NULL
User specified --num_sectors=524288 but file only has 524288 sectors. **Ignoring --num_sectors

Couldn't find the file 'full_dump.bin', returning NULL
Previous Filesize is 0 bytes. Therefore reading size of partition!! Please check 'full_dump.bin'
NOTE: There were WARNINGS!! Repeated above, but please see log for more detail

20:45:58: INFO: ==============================================================
20:45:58: INFO: _ (done)
20:45:58: INFO: | |
20:45:58: INFO: __| | ___ _ __ ___
20:45:58: INFO: / _` |/ _ \| '_ \ / _ \
20:45:58: INFO: | (_| | (_) | | | | __/
20:45:58: INFO: \__,_|\___/|_| |_|\___|
20:45:58: INFO: {All Finished Successfully}

20:45:58: INFO: Overall to target 7.969 seconds (32.12 MBps)

Writing log to 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt', might take a minute

Log is 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt'

You can use 7-Zip archiver to open this dump and extract any partition you want.

Step 5B: Write the dump back to storage

Open Partition Manager, and don't close it.

Please copy following path to your File Explorer:

%AppData%\Qualcomm\QFIL

This will redirect you to C:\Users\[your_user_name]\AppData\Roaming\Qualcomm\QFIL .

Find the COMPORT_XX directory respective to your exact COM port - in this case, I choose COMPORT_8 for example.

And open a command prompt or PowerShell window here.

Execute following command here, remember to change the COM port number and num_sectors to your exact number, or the actual path of fh_loader.exe and your dump if possible:

In this case, the dump is located at D:\path\to\your\dump\full_dump.bin .

"C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\your\dump --sendimage=full_dump.bin --start_sector=0 --lun=0 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc

Now just wait for the procedure complete.

The output should look like this:

20:05:30: INFO: Current working dir (cwd): C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\
20:05:30: INFO: Showing network mappings to allow debugging
20:05:30: INFO: Looking for file 'full_dump.bin'
20:05:31: INFO: User wants to talk to port '\\.\COM8'
20:05:31: INFO: Took 0.01600000 seconds to open port
20:05:31: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:05:31: INFO: If you don't want this, use --dontsorttags

20:05:31: INFO: Looking for file 'full_dump.bin'
20:05:31: INFO:

Total to be tansferd with <program> or <read> is 36.09 GB

20:05:31: INFO: Sending <configure>

20:05:31: INFO: TARGET SAID: 'Calling usb_al_bulk_set_zlp_mode(TRUE) since ZlpAwareHost='1''

20:05:31: INFO: TARGET SAID: 'Calling hotplug_poll_device('MMC')'
20:05:31: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 1048576
20:05:31: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
20:05:31: INFO: In handleProgram('full_dump.bin')
20:05:31: INFO: Looking for file 'full_dump.bin'
20:05:31: INFO: =======================================================
20:05:31: INFO: {<program> FILE: 'D:\path\to\your\dump\full_dump.bin'}
20:05:31: INFO: {<program> (36.09 GB) 75685888 sectors needed at location 0 on LUN 0}
20:05:31: INFO: =======================================================

20:05:31: INFO: TARGET SAID: 'start 0, num 75685888'

20:05:33: INFO: Overall to target 2.031 seconds (26.59 MBps)
20:05:33: INFO: {percent files transferred 0.15%}
20:05:35: INFO: Overall to target 4.063 seconds (26.34 MBps)
20:05:35: INFO: {percent files transferred 0.29%}
20:05:37: INFO: Overall to target 6.094 seconds (26.26 MBps)
20:05:37: INFO: {percent files transferred 0.43%}
20:05:39: INFO: Overall to target 8.110 seconds (26.26 MBps)
20:05:39: INFO: {percent files transferred 0.58%}
20:05:41: INFO: Overall to target 10.125 seconds (26.27 MBps)
20:05:41: INFO: {percent files transferred 0.72%}
20:05:43: INFO: Overall to target 12.141 seconds (26.27 MBps)
20:05:43: INFO: {percent files transferred 0.86%}
20:05:45: INFO: Overall to target 14.141 seconds (26.31 MBps)
20:05:45: INFO: {percent files transferred 1.01%}
20:05:47: INFO: Overall to target 16.156 seconds (26.49 MBps)
20:05:47: INFO: {percent files transferred 1.16%}
20:05:49: INFO: Overall to target 18.172 seconds (26.52 MBps)
20:05:49: INFO: {percent files transferred 1.30%}
20:05:51: INFO: Overall to target 20.188 seconds (26.55 MBps)
20:05:51: INFO: {percent files transferred 1.45%}
20:05:53: INFO: Overall to target 22.188 seconds (26.59 MBps)
20:05:53: INFO: {percent files transferred 1.60%}
20:05:55: INFO: Overall to target 24.188 seconds (26.62 MBps)
20:05:55: INFO: {percent files transferred 1.74%}
20:05:57: INFO: Overall to target 26.188 seconds (26.62 MBps)
20:05:57: INFO: {percent files transferred 1.89%}
20:05:59: INFO: Overall to target 28.188 seconds (26.61 MBps)
20:05:59: INFO: {percent files transferred 2.03%}
20:06:01: INFO: Overall to target 30.235 seconds (26.59 MBps)
20:06:01: INFO: {percent files transferred 2.18%}
20:06:03: INFO: Overall to target 32.266 seconds (26.56 MBps)
20:06:03: INFO: {percent files transferred 2.32%}
20:06:05: INFO: Overall to target 34.281 seconds (26.57 MBps)
20:06:05: INFO: {percent files transferred 2.47%}
20:06:07: INFO: Overall to target 36.328 seconds (26.56 MBps)
20:06:07: INFO: {percent files transferred 2.61%}
20:06:09: INFO: Overall to target 38.328 seconds (26.56 MBps)
20:06:09: INFO: {percent files transferred 2.75%}
20:06:11: INFO: Overall to target 40.360 seconds (26.56 MBps)
20:06:11: INFO: {percent files transferred 2.90%}
20:06:13: INFO: Overall to target 42.391 seconds (26.56 MBps)
20:06:13: INFO: {percent files transferred 3.05%}

(ignored too many logs)

20:28:17: INFO: Overall to target 1366.235 seconds (26.33 MBps)
20:28:17: INFO: {percent files transferred 97.33%}
20:28:19: INFO: Overall to target 1368.266 seconds (26.33 MBps)
20:28:19: INFO: {percent files transferred 97.48%}
20:28:21: INFO: Overall to target 1370.281 seconds (26.33 MBps)
20:28:21: INFO: {percent files transferred 97.63%}
20:28:23: INFO: Overall to target 1372.313 seconds (26.33 MBps)
20:28:23: INFO: {percent files transferred 97.78%}
20:28:25: INFO: Overall to target 1374.313 seconds (26.33 MBps)
20:28:25: INFO: {percent files transferred 97.93%}
20:28:27: INFO: Overall to target 1376.344 seconds (26.34 MBps)
20:28:27: INFO: {percent files transferred 98.08%}
20:28:29: INFO: Overall to target 1378.344 seconds (26.34 MBps)
20:28:29: INFO: {percent files transferred 98.22%}
20:28:31: INFO: Overall to target 1380.360 seconds (26.34 MBps)
20:28:31: INFO: {percent files transferred 98.37%}
20:28:33: INFO: Overall to target 1382.375 seconds (26.34 MBps)
20:28:33: INFO: {percent files transferred 98.51%}
20:28:35: INFO: Overall to target 1384.406 seconds (26.34 MBps)
20:28:35: INFO: {percent files transferred 98.66%}
20:28:37: INFO: Overall to target 1386.438 seconds (26.34 MBps)
20:28:37: INFO: {percent files transferred 98.80%}
20:28:39: INFO: Overall to target 1388.438 seconds (26.34 MBps)
20:28:39: INFO: {percent files transferred 98.94%}
20:28:41: INFO: Overall to target 1390.453 seconds (26.34 MBps)
20:28:41: INFO: {percent files transferred 99.09%}
20:28:43: INFO: Overall to target 1392.485 seconds (26.34 MBps)
20:28:43: INFO: {percent files transferred 99.25%}
20:28:45: INFO: Overall to target 1394.516 seconds (26.34 MBps)
20:28:45: INFO: {percent files transferred 99.40%}
20:28:47: INFO: Overall to target 1396.531 seconds (26.34 MBps)
20:28:47: INFO: {percent files transferred 99.55%}
20:28:49: INFO: Overall to target 1398.750 seconds (26.33 MBps)
20:28:49: INFO: {percent files transferred 99.66%}
20:28:51: INFO: Overall to target 1400.766 seconds (26.33 MBps)
20:28:51: INFO: {percent files transferred 99.81%}
20:28:53: INFO: Overall to target 1402.797 seconds (26.33 MBps)
20:28:53: INFO: {percent files transferred 99.96%}
20:28:54: INFO: Overall to target 1403.422 seconds (26.33 MBps)
20:28:54: INFO: {percent files transferred 100.00%}

20:28:54: INFO: TARGET SAID: 'Finished programming start_sector 75685888 and TotalSectorsToProgram 75685888'
20:28:54: INFO:
20:28:54: INFO: =======================================================
20:28:54: INFO: ==================== {SUCCESS} ========================
20:28:54: INFO: =======================================================

20:28:54: INFO: {percent files transferred 100.00%}
20:28:54: INFO: ==============================================================
20:28:54: INFO: Files used and their paths
20:28:54: INFO: 1 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt'
20:28:54: INFO: 2 'D:\path\to\your\dump\full_dump.bin'

20:28:54: INFO: _ (done)
20:28:54: INFO: | |
20:28:54: INFO: __| | ___ _ __ ___
20:28:54: INFO: / _` |/ _ \| '_ \ / _ \
20:28:54: INFO: | (_| | (_) | | | | __/
20:28:54: INFO: \__,_|\___/|_| |_|\___|
20:28:54: INFO: {All Finished Successfully}

20:28:54: INFO: Overall to target 1403.578 seconds (26.33 MBps)
20:28:54: INFO: {percent files transferred 100.00%}

Writing log to 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt', might take a minute

Log is 'C:\Users\HikariCal\AppData\Roaming\Qualcomm\QFIL\COMPORT_8\port_trace.txt'

If you only want to write back only one specific partition, you need to specify the start_sector value to the decimal value of a partition's Start LBA.

Always keep the Partition Manager window opened!

Step 6: Quit Partition Manager

After everything dumped, you can close Partition Manager, the QFIL will reboot your phone back to EDL mode or reboot your phone back to normal mode.

Then you can force reboot your phone or mess up your phone as you want.