yashsingh1/xdaforums huggingface dataset:
[Android General] Oleg69:
Step 3: Open QFIL, load Firehose file

Hello everyone. I have nokia 1.4 TA-1322. I have downloaded several firmwares from the different websites but the emmc filefouse prog_emmc_firehose *** ddr.mbn and Rawprogram .xml files missing in all of them.

Do someone know where can I fount the emmc Firehose and Rawprogram .xml files?
[Android General] Honkette1738:
Hello, my partitions on my phone are wildly different compared to these. The userdata partition says it's only about 3,933,729,792 bytes. It's a 32GB phone, any reasons why it's so tiny?
[Android General] Cirrus9:
Thanks for taking time to write all this out and help out a lot of people. Everything made sense until I got to

"it's Start LBA and LBA number are 0x01E20000 and 0x0565BFDF. Add both of them will get the total sector numbers of whole eMMC storage - in this case, 0x0747BFDF, or 122,142,687 sectors"

I don't think this is common knowledge. Could you please explain or just point me in the right direction to understand how adding 0x01E20000 and 0x0565BFDF resulted in 0x0747BFDF, and how we translate that string of characters into 122,142,687?

Thank you!
[Android General] Sviatoslav1997:
Hello everyone. I have a bricked Asus Zenfone 8 and I'm trying to recover userdata partitiion from it using 9008 mode. I have correct Firehose file and everything should work fine. I've easily recovered data from system partition using this manual, but I have problem with userdata. This partition is huge, around 230 GB, and phone just disconnects from PC in the middle of the process. First time it downloaded 98GB, second time - 60GB, so I don't think this is because of broken flash memory or smth. What can be a reason of this problem and how to solve that? Thanks for any reply!
[Android General] Sviatoslav1997:
Hi. This string of characters is hexadecimal numeral system. You can use standart Windows calculator in programmer mode to convert these numbers.View attachment 5825413
[Android General] Cirrus9:
Thank you! Learned something new today! :)
[Android General] kjullian19:
Hi! This guide is great. I have an issue with the firehose file where I found the right firehose file from my device using firehose finder on GitHub. However, that file is in .bin format instead of .elf. How can I convert it, and is that safe?
[Android General] Renate:
Firehose loaders are technically ELF 32 or 64 bit files but may be named elf, bin, img, mbn, whatever.

Use a hex editor and look at the start of the file.

It should be 7f 45 4c 46

Or use my elfview.exe (in the sig) to check it out.

Or use my qcomview.exe (in the sig) to check it out.

C:\>elfview /p motog.bin
# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 7 1016 000000 00000000
1 null 2.2 7384 001000 4602c000
2 load RWZ 0 06b4b0 0c100000
3 load RX 7772 0549f0 0c119000
4 load RWZ 0 056850 0c11c000
5 load RWZ 0 06b4b0 0c11e000
6 load RWZ 0 0549f0 0c219000
7 load RX 301376 003000 0c225000
8 load RWZ 0 04c940 0c276c00
9 load RW 32932 04c940 0c279c00
10 load RWZ 0 0549f0 0c286c00
11 load RWX 85080 056850 0c29b000
12 load 1RWX 84 06b4b0 0c2c9000
13 load 1RWX 29168 06b504 0c2c9054
14 load 1RWX 1496 0726f4 0c2d0244
15 load 5RX 139264 072ccc 0c350000
16 load RWZ 0 0549f0 45e11000

C:\>qcomview /h motog.bin
64 bit ELF, Version 6, SHA384
0 00000000 000003f8 a3836cd6c3e2dbed 5dd00c97349c8598 92a5051c08ae65d4 171ba1ece407a7b2 1cdf27a97ff437c7 0488bb944956fbc2 Ok
1 00001000 00001cd8
2 0006b4b0 00000000
3 000549f0 00001e5c 3972d9e5346b52cc e71c31a437500b8f 57f2fc8124e97cd5 b2f70a4829e98196 03d89d4b946261e2 9b2a58949b92b7dc Ok
4 00056850 00000000
5 0006b4b0 00000000
6 000549f0 00000000
7 00003000 00049940 503b424c75f6d657 e4363c830deeebee afe0ac82ce04dfec e8ac03fb47b129a3 fc221acc0d515b22 ed17d86b0f6b585c Ok
8 0004c940 00000000
9 0004c940 000080a4 2f7aec3605fbce70 ec0c83a703435845 e969988f390787d7 aa8d0a13a6d9e06f ee2af4e9b86b8a75 fc81fbe1017d1c64 Ok
10 000549f0 00000000
11 00056850 00014c58 fec3a6b9f6d71a18 aadd3f722fc73bea d3197c24c397d55d 4f3d4a9c25661db1 152c60664fcbe4a6 c2441120afc4b3c9 Ok
12 0006b4b0 00000054 db139c6f70d88269 a61cb1a7be2ce363 55faf1ff1c3b9c3d 27cd8d65bef7f710 9bc83c6255ea8104 6d7ac582cc778f15 Ok
13 0006b504 000071f0 a27a7dc0040a1bfa 8e24e4a42bead90e ae10a91c37d19105 bce9da69383004ea c933b87ac4a88653 ccbb4a6b1407d15d Ok
14 000726f4 000005d8 8dcaae787361a3c4 3bad6d344641d061 35170b5a30607e20 a30cd23884bbc0b0 790681aa36a1fe60 98501a103b62088a Ok
15 00072ccc 00022000 1f939df47e7fae80 2c127e10474ff9e6 2faecd5fab873bf8 928cab0a5ef28261 5d4b19cc57cca817 37fa9fad42971c40 Ok
16 000549f0 00000000
[Android General] kjullian19:
Thanks Renate. I'm new to this stuff, so you might have to ELI5, I'm not seeing 7f 45 4c 46 in your log.

Ultimately, I need to learn how to convert the binary file into a compatible .elf file. Will either elfview or qcomview do that?

Thanks again and sorry for the dumb questions
[Android General] Renate:
Having a Firehose file is always good.

Downgrading is prevented by OEM comparing stuff before doing an update.

If you just do the update without letting OEM code check anything then you can downgrade.

Doing a raw upgrade in a custom recovery will do that.

How depends on whether your update is as an Edify script or a payload.bin.
[Android General] patrik996:
Thanks for your visdom. Im kind of new to most of these stuff.

Im guessing with a locked bootloader there is not much hope to circumvent the downgrade check?

I think its called a Edify script. Its a signed zip-file with boot.img and recovery.img and an updater-script that contains a check on ro.build.date.utc.
[Android General] Renate:
Without some sort of exploit you will need to have the bootloader unlocked or a low-level loader (like EDL or MTK) to install a custom recovery.

A custom recovery can install an update without caring about metadata.

An Edify script (updater-script) will need to have the first line or two edited out to bypass any version or model check.
[Android General] ashamsu:
Dear Sir i have sm6375 loader with .fhprg extension. iam unable to use that in qpst or not with any other edl client tool. i need help to convert that to elf or bin format to work with bkerler edl tool.

Pls can u help
[Android General] Renate:
The post immediately before yours explained that there is no conversion possible or necessary.

Use the loader as is, regardless of how it is named.
[Android General] ashamsu:
Thanks for ur reply. but the loader iam having doesnt has 7f 45 4c 46. also no valid output from elfview & qcomview (Not an ELF file & File is unknown type). attached the fhprg for your ref. pls convert it to as elf or bin format.
[Android General] Renate:
Because it's encrypted. I can't help you there.

Why don't you quote the HWID and PK hash so I can see if there is a normal loader for it.

(Those two items are not secret, please quote correctly.)
[Android General] ashamsu:
Thanks again for ur reply. here is the details. pls find in the attached files.
[Android General] Renate:
Only two loaders are possibilities:

https://github.com/bkerler/Loaders/...22f415bec935e3cb_fhprg_rmx3471_695_SM6375.bin

https://github.com/hoplik/Firehose-Finder/blob/master/fh_collection/8E1561B4/prog_firehose_ddr.elf

Either of these might require Oppo authorization, a subject I know nothing about.

If neither of these work, you might try to get somebody to work on decrypting your encrypted loader.

(* That somebody isn't me.)

That might still require Oppo authorization also.
[Android General] ashamsu:
Thanks for ur reply. will try the given loader.
[Android General] atrax1985:
Hello , i just could not find a working loader/firehose for my device.

My device is a Galaxy S21 FE 5G (SM-G990B)

Here the Hash i could receive via edl.exe

Found EDL 9008, handshaking... version 2.1

HWID: 001350e100200000, JTAG: 001350e1, OEM: 0020, Model: 0000

Hash: a828a44aea37b6b8-a1783b79d7d6f0a0-ceadcba32faed6db-a66247062afaaf1b-7b0b81cd7f8c6ccd-f6f38f759b953ee8

0000000000000000-0000000000000000-0000000000000000-0000000000000000-0000000000000000-0000000000000000 (x2)

Maybe you guys know how to find a working loader.

Thanks in advance
[Android General] Renate:
Just a reminder, if you're using my edl.exe you ought to download a new version every once and a while.

The info page has a date at the bottom that is always updated with each new versions of the exe.

Besides, all my stuff is under 1/4 of a MB. No bloat here.
[Android General] ashamsu:
Hi Sir,

how to identify a patched or unpatched firehose loader? any possible to patch a firmware elf?
[Android General] Renate:
The word "patched" in a file description may mean anything or nothing.

You can't modify a normal Firehose loader or xbl or abl or many other partitions without breaking the signing and making it not work.

If you have a device without Secure Boot enabled, yes, you can patch these files and re-hash them and leave the signing broken.

The only devices for which this work are some non-phones, like hot spots, industrial devices or evaluation boards.
[Android General] Renate:
Unless your file is a zip or something there is no conversion necessary or possible.

What do you have? Post it publicly or priately.
[Android General] kjullian19:
This is the file I have. QFIL only accepts .elf or .mbn files. If there's no conversion possible, how could I load the programmer?
[Android General] Renate:
It's a perfectly fine Firehose loader.

Just rename it .elf

Or use an EDL client that isn't so picky on stupid stuff.

Like the Python EDL client. Or mine.
[Android General] kjullian19:
Thanks Renate. I tried to proceed with it. The "partial success" log mentioned in the post shows up:

2023-03-22 10:29:18.787 10:29:18: Sahara protocol completed
2023-03-22 10:29:18.787 Sending Programmer Finished
2023-03-22 10:29:18.788 Switch To FireHose
2023-03-22 10:29:18.788 Wait for 3 seconds...

So I think you were right, the firehose file works. But then I get the following error, and the Partition Manager doesn't open. (Log Attached)

2023-03-22 10:29:21.799 Skip Write:False
2023-03-22 10:29:21.800 Always Validate:False
2023-03-22 10:29:21.800 Use Verbose:False
2023-03-22 10:29:21.802 ***** Working Folder:C:\Users\kandr\AppData\Roaming\Qualcomm\QFIL\COMPORT_6
2023-03-22 10:29:21.802 Download Fail:FireHose Fail:FHLoader Fail:The system cannot find the file specified
2023-03-22 10:29:21.808 Finish Get GPT

Do you or anyone else have solved this error in the past, and managed to get Partition Manager to open?
[Android General] Renate:
If you use Windows you can try my native Windows EDL client (in the sig).

C:\>edl /l000a50e100514985_2acf3a85fde334e2_fhprg_op7t-bin
C:\>edl /g
C:\>edl /u /g
[Android General] kjullian19:
I'll give your EDL client a try thanks. Do I need to change the driver or is the one from this guide okay?

EDIT: I managed to get the partition manager working, and got Start LBA 0x00479676 and LBA Number 0x0184C185. Added together it gives 0x01CC57FB or 30,169,083.

Spoiler content hidden.

Does anyone know where this error may be coming from? Is it safe to stop the process or disconnect my device?
[Android General] kjullian19:
Last question. I have the full_dump.img file now, and I tried using 7-zip to extract my (user)data. The file is 115 GB which is in line with phone's storage, but it only extracts to a 7.6MB folder. How can I actually access the userdata?
[Android General] Renate:
Doing a full raw dump is only useful as a snapshot.

If you want to backup useful data you'll have to backup files when userdata is mounted (and decrypted) by the system.
[Android General] kjullian19:
Thanks for the clarification there. You've been super helpful all around!
[Android General] marc.2377:
Renate: Do you know of a way to decrypt offline, i.e. from a PC?
[Android General] Renate:
No, I don't know how to decrypt offline.

The whole point of encryption is to make that difficult.
[Android General] Isrgish:
Thanks for this great guide.

My Partition Manager results seems to have 2 separate last partitions. Which numbers should I use to get the number of sectors to use? There is a partition called "ALIGN_TO_128K_2" which starts again from 0x06. Should I calculate the numbers from both last partitions separately and then combine them to get my number?

My device is UFS, should I change the `--memoryname=emmc` to `--memoryname=ufs`?

I'm attaching my Partition list file.
[Android General] Renate:
No, it actually has 4.

That's just unused space at the end of each unit. There could be 6.

Yes
[Android General] Isrgish:
I'm not clear how to calculate the number of sectors I should use.

Am I only looking for the dump of the partitions of LUN 0? (This seems to be what the OP is using since the command has --lun=0).

Wouldn't I need ALL partitions to be able to restore my device?

What are the other LUN's?
[Android General] Renate:
I'm not sure about the Python EDL client, but with mine you can just do:

C:\>edl.exe /r /u0 unit0.img

You don't have to count sectors.
[Android General] Isrgish:
Will this get all the sectors from all the parts (LUNs)?

How do I connect to the device using your program? I tried edl.exe /I just to see if it works but I get error no device found.
[Android General] Renate:
If you have UFS and 6 LUNs you will need to do 6 separate operations.

Th /u specifies which LUN, obviously the output files should be different.

QFIL only uses the bogus Qualcomm driver.

The Python EDL client can use the Qualcomm driver or generic WinUsb driver (installed by Zadig).

My native Windows EDL client only uses WinUsb driver. See the documentation.
[Android General] Isrgish:
Will I need to uninstall the dricers I currently have insralled? Will QFIL be able to use the WinUSB driver?
[Android General] Renate:
Installing new drivers replaces old drivers.
[Android General] Isrgish:
Thanks for all your help.
[Android General] Isrgish:
Can I use the /t flag to truncate the partitions when I do a full dump?

If not is there any way to truncate the partitions without needing to read each partition separately?
[Android General] Renate:
No, truncating a partition makes no sense.

You could convert it to a sparse file, but none of my software does that.

(I do have a utility for converting a sparse full to a raw file though.)
[Android General] Isrgish:
Maybe I'm not asking it right. What I would like is to get only the important parts of each partition (or whatever it ia called). Similar to what I would have when I download tne original firmware. This way the whole dump would only be a few GB insread of the 256GB it is now.

Also is there a way to extract a partition from the image creared with your edl dump nethod?
[Android General] Renate:
If you've got a 256GB device most of that is userdata (/data).

If you have a dump of a single partition you could mount it on a Linux desktop using a "loop" block device.

But userdata is encrypted and you can't do that on your Linux desktop.

If you have the space on your desktop you can pull whatever you want off your device then convert it to a sparse file using img2simg

Then you can delete the raw dump.

Of course when you want to do something with it you will need to expand it first with simg2img

The Python EDL client may be able to flash sparse files directly. I don't know.

I may add writing of sparse files to my EDL client, but reading/compressing sparse files is more complicated.

I only have 32 GB devices so it's not as bad for me.
[Android General] Isrgish:
I tried this and it seems to stop at 69%. The file does show 236gb which is what the file should be. Can I rely that I got the whole lun?

I tried this twice.
[Android General] Renate:
Well, something's wrong. Probably my code.

I don't have any UFS devices to test this.

So, what does "stop" mean? It froze? It returned an error? It exploded?
[Android General] Isrgish:
The program exits but the last line where it shows the percentage shows 69%.

PS C:\Me\Downloads\Tools\edl> .\edl.exe /r /u0 dump.img
Found EDL 9008
Configuring... Ok
Requesting info on LUN 0... Ok
Requesting read dump.img... Ok, reading 69% Ok
PS C:\Me\Downloads\Tools\edl>
[Android General] Renate:
Could you try that with a /v added and quote the response?

And exactly how long is the resulting file?
[Android General] Isrgish:
Sorry for the late response.

I'm running it now but this will take some time. I will post the results later today or tomorrow.

The length is reported at 236 GB (253,679,894,528 bytes)
[Android General] Renate:
Oh, don't post anything enormous!

I just need the beginning information before it starts getting to the boring part of transfering blocks.
[Android General] Renate:
Oops, my bad.

The problem is only in the reporting of percentages as it goes along.

The read is correct, in content and in length.

I just put a new version up that will report the percentage correctly.
[Android General] Isrgish:
Thanks I will try it.

BTW How can I stop the dump while its downloading from device? Can I do Ctrl c?
[Android General] Renate:
Mmm, well you can, but that was not really anticipated.

If you do you should probably reset your device.

The protocol is fairly fragile and if you stop it it may run off the tracks.

Most operations take less than a second or two so usually it's not an issue.
[Android General] Isrgish:
Coming back to this issue...

Now that I have the dump of LUN 0 is there any way to either mount it or extract from it a single partition?
[Android General] Renate:
The point of doing a whole raw dump is to make a restore trivial.

With eMMC or NAND a single operation gets you back to where you were.

UFS requires an operation for each LUN.

If you want a partition, dump a partition.

Sure, you could extract a partition out of a raw dump, then extract a file out of a partition, but why?

You may be able to write a full raw dump to an SD card and mount that in Linux.

You may be able to loop mount a whole device dump in Linux.

You should be able to loop mount a partition dump in Linux.
[Android General] nasch007:
I wish I knew more about this before I started fudging with it. But I am where I am.

I have a Zenfone 8 that will boot to bootloader but nothing further. I tried a couple bad attempts at flashall_AFT scripts to see if I could reinstall the OS without losing my user data. They failed. I ended up in EDL mode and using the QFIL with Qualcomm drivers.

Wish I saw this thread beforehand!! Anyways, I was able to read partitions, and "extract" or dump the userdata partition. I now have a 117GB "ReadData_ufs_Lun0_0x23e628_Len28273107_DT_09_08_2023_22_12_23.bin" file.

I read all comments up to here, but I'm also pretty dense. Could you say for certainty, there is no way to mount this file and for me to pull individual files from it? No programs on Windows or Linux will read the .bin file and reveal its precious data? And this is because it is encrypted?

No chance of bruteforcing or finding the encryption key anywhere on the phone or in another partition? I ask with the tiniest but of hope since my phone can get to boot loader, but bootloader is locked, and adb is unauthorized. Is there anything at all I can do?

Thank you for the workup and I may use your tools in the future. If you have a place to donate a cup of coffee, I'd like to do that too, simply for the contribution to the community.

Thanks!
[Android General] amanmaz:
Please tell how I can read the userdata.img file ? Its neither mounting nor able to extract using 7zip. I even tried Accessdata FTK Imager software, It shows as Unrecognised file system [Unknown type] unallocated space of size 23 GB ? Please help.
[Android General] amanmaz:
Going through all the comments and replies I have understood that since the userdata is encrypted, it can't be read by an external system. My phone is stuck on logo and I have taken the full_dump.bin backup and extracted userdata.img from it. Now how to mount or decrypt the userdata.img by using the system ? Please Guide.

Sorry if the question is very dumb to be answered, I dont have knowledge of it. Please help.
[Android General] Renate:
My specialty is not encryption. The whole point of Android encryption of userdata is to prevent someone making a raw copy of your flash and being able to read the files. There were/are two different encryption system used. I'm not aware when each version was used. In one version the individual files were encrypted but the filesystem was completely normal. With this you could make a snapshot of the userdata partition and copy or loop mount on a foreign system. You would see a ton of files with long gobble-dee-gook names and the content would be gobble-dee-gook. In the other version of Android encryption the entire userdata partition would be encrypted and not even recognizable as a filesystem.

I believe that some custom recoveries have the ability to mount and decrypt userdata.

The only use for a backup of the userdata partition might be if you did something that wiped userdata (like fastboot unlocking) you might be able to restore the old data.

My heart bleeds every time I read that someone has a zillion photos that were never backed up and now their phone is broken.
[Android General] Renate:
I really know nothing about this crappy software.

Your device is responding with Firehose protocol, so it must have loaded a Firehose loader.

Did you look a port_trace.txt (like that dialog shows)?
[Android General] Hcfu:
Already loaded firehose I have post port_trace. Txt above.
[Android General] Renate:
You're confusing me because your posting in different threads for the same thing.

Yes, but I want to see where it was loaded and what file it is.

Look at your screen shot above post #61

You have this sub-dialog "Raw Data Manager" blocking anything interesting to read.

What is under there? What is the directory? Did you look there?
[Android General] Hcfu:
Help I backup my phone and write back the storage. When I reboot my phone. The phone ask me data partition password I filled it use my lock screen password. wait a minute. The phone telled me Decryption failed The password you entered is correct, but unfortunately your data is corrupted. Why is it.

I must format my data partition to use my phone.

But I wanna write back my data.

PPlease help
[Android General] Renate:
How did you back up your phone?

How did you restore it?

What file(s) were generated?

Don't go around formating anything!
[Android General] Hcfu:
I do something by the aritcle.open qfil load fire hose and use this command "C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\your\dump --convertprogram2read --sendimage=full_dump.bin --start_sector=0 --lun=0 --num_sectors=122142687 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc to backup the whole Emmc stroage

And use this command "C:\Program Files (x86)\Qualcomm\QPST\bin\fh_loader.exe" --port=\\.\COM8 --search_path=D:\path\to\your\dump --sendimage=full_dump.bin --start_sector=0 --lun=0 --noprompt --showpercentagecomplete --zlpawarehost=1 --memoryname=emmc to write back the whole Emmc

All finished I reboot this phone it tell me.

The password you entered is correct, but unfortunately your data is corrupted

Must to reset phone factory mode.

I cannot enter userdata successfully
[Android General] Renate:
How big was the file that you read? 62,537,055,744

How did you come up with 122142687?

You didn't erase or format anything between those two commands, did you?

I don't like this goofy convertprogram2read stuff.

And did you ever find the Firehose loader file?
[Android General] Hcfu:
The file that is about 58Gb size my phone stroage is 64Gb size. I guess this problem is my phone cannot correct mount data partition.
[Android General] Hcfu:
The file that is about 58Gb size my phone stroage is 64Gb size. I guess this problem is my phone cannot
[Android General] Renate:
My question had 11 digits of precision and you answer "about"?

Also, you didn't answer any of my other questions.
[Android General] Hcfu:
The file that is about 58Gb size my phone stroage is 64Gb size. I guess this problem is my phone cannot

I Add data partition start LBA and LBA number both of them will get the total sector numbers of whole eMMC storage - 122,142,687 sectors