[Windows 10 Mobile] hikari_calyx:
查看中文版教程 (Chinese version)

View attachment 5864361

To moderators: This phone originally had Windows 10 Mobile installed, so I posted it here. Please move it if topic is unsuitable in Windows 10 Mobile forum.

#/usr/bin/env python3
print('''
Your warranty is... still valid?
I am not responsible for bricked devices, dead SD cards,
thermonuclear war, or you getting fired because the alarm app failed. Please
do some research if you have any concerns about features included in this ROM
before flashing it! YOU are choosing to make these modifications, and if
you point the finger at me for messing up your device, I will laugh at you.
''')

It's been 7 years since HP Elite x3's release, and countless Lumia users' dream has finally come true.

I stopped using Windows Phone for 3 years and I almost forgot some of Windows Phone hacking tricks. With users' request here, I'd like to take notes of flashing procedure in case anyone need it for future.

Details​

Applicable Model​

HP Elite x3 Open Market release. Telstra and Verizon variants are untested, do at your own risk.

Prototype units are supported, but we don't recommend prototype unit owners to follow this guide.

Do not try this on any other Windows Phone models (including Alcatel Idol 4s) unless you know what you are doing!

Known Issues​

* Unable to use Stereo Speaker, can be fixed with Magisk module

* Unable to use fingerprint sensor and infrared sensor

Procedure​

Preparation​

A Windows PC. Since the procedue involves FFU flash and registry editing, macOS and Linux are definitely unusable. We recommend you to use Windows 10 or Windows 11.

HP Elite x3 Open Market variant and a good quality USB cable.

Take notes of your Wi-Fi MAC and downgrade the phone to initial release (10.0.14393.953)​

Head to Settings - System - About, and take note of MAC address shown here. You'll need this for later use.

Then, check if OS version is newer than 10.0.14393.953. If it's newer than 10.0.14393.953 (e.g. 10.0.15254.603), then you'll need to downgrade it back to 10.0.14393.953.

You can download the firmware from here:

https://archive.org/download/W10M_FFUs/HP/Elite%20x3/MR5_Elite_x3-retail-0002.0000.0037.0001-signed_0002.0000.0037.0001.ffu

To flash it, you'll need to use FFUTool or Windows Phone Image Designer. For FFUTool, we recommend you to use the one bundled in OST LA - yes that flash tool developed for early HMD Nokia phones. For example, the ffutool.exe bundled in NOST here will work:

Release NOST v0.6 · StollD/NOST

Fixed NOST running under user accounts with spaces in their name Fixed detection of .QLZ (i.e. uppercase) files. Removed the automated install of the USB Driver since it managed to crash the instal...

github.com

Once you have it installed, open a Command Prompt or PowerShell window at directory where you installed NOST.

Then, power off your phone, and press Volume Up and Power key. When the phone vibrates, release the power key only but do not release Volume Up key. Soon the phone will enter FFULoader mode, with lightning cog displayed on screen.

Now you can execute this command to flash FFU to the phone:

.\ffutool -flash D:\path\to\MR5_Elite_x3-retail-0002.0000.0037.0001-signed_0002.0000.0037.0001.ffu

The flash procedure could take up to 15 minutes, please wait patiently and do not interrupt. Once downgrade completes, finish setup wizard without connecting to Wi-Fi.

Please see reply in case you're locked from Reset Protection after downgrade.

Install Interop Tools and perform Interop Unlock​

Since I left Windows Phone hacking for many years, and I almost forgot about how to enable Interop Unlock. So have to write here again.

Known working version of Interop Tools is 1.9.400.

Interop Tools - A versatile registry app for all devices, now on Github

IMPORTANT ANNOUNCEMENT (11/25/2017): https://xdaforums.com/showpost.php?p=74628972&postcount=1071 IMPORTANT ANNOUNCEMENT (08/02/2020): https://xdaforums.com/showpost.php?p=83193721&postcount=1236 Source code...

xdaforums.com

To install it:

1. Head to Settings - Update & Security - For developers.

2. Choose Developer mode.

3. Copy Interop Tools package (one appxbundle and 5 appx files) to your phone's internal storage.

4. Install appx from Dependencies_ARM folder one by one, wait 10 seconds before you install next one. Finally install Interop Tools package.

5. Once you return to Start screen, you'll find Interop Tools (RC) appears in application list.

To perform Interop Unlock for HP Elite x3:

1. Open Interop Tools (RC) you installed just now, choose the text "THIS DEVICE" instead of the down arrow on the right.

2. Tap left hamburger menu, scroll up until you see "Interop Unlock". Choose "Interop Unlock".

3. Tap the button "Allow the installation of NDTK on any device". Once you finish it, your phone's model will become into "NOKIA Elite x3". You can check it in Settings - System - About.

4. Download the Windows 10 Mobile Offline Updater V5.3 beta 6 from the link below, then open a Command Prompt / PowerShell window at where repo_initialize.cmd located.

[GUIDE] Win10 Mobile (Semi-)Offline Update Project 10586.107 [UPDATED V5.3 beta6]

So few years after it's released, Windows Phone will finally end it's life. It's time to update Win10 Mobile Offline Update Package to V5.2 (still beta5), then a next step - Semi-Offline Update Package V5.3 beta 6, or "WXM-SOUP". I'm not going...

xdaforums.com

5. Connect the phone to PC and execute this command:

.\bin\iutool -V -p .\ndtk

6. Wait few minutes and the phone will install an update.

7. Once update finishes, open Interop Tools again, and get back to "Interop Unlock" menu.

8. Turn on "Restore NDTKSvc" and "Interop/Cap Unlock" options. Do not turn on New Capability Engine Unlock and Full Filesystem Access.

Inject Developer Menu​

With the debugprod package, even retail Windows Phones can now enter USB Mass Storage Mode for full access of phone's internal storage.

Since activating MTP Full Filesystem Access is usually unstable, I recommend you to inject it with SFTP instead.

1. On left hamburger menu, find and select "SSH Account Manager".

2. Tick "Allow running apps in a non signed environment (UMCIAuditMode) (Redstone and higher) (Required to access cmd)".

3. Reboot the phone, open Interop Tools again and get back to "SSH Account Manager".

4. In "Template for selected" section, tap "Apply Full SFTP Access" button once.

5. In "Options" section, change Authentication method to password, then input "Sirepuser" (without quotes) as username and "password" (without quotes) as password. Once you input these 2, tap the pencil buttons on the right to save them.

6. Now download and install PuTTY from here. Once installed, please run "PSFTP" instead of PuTTY itself.

Download PuTTY: latest release (0.81)

www.chiark.greenend.org.uk

7. Connect your phone to Wi-Fi and make sure it's under same LAN as your working PC. We assume your phone's IP address is 192.168.10.225 .

8. Download and extract the debugprod package attached below. We assume you have it extracted to D:\path\to\extracted\debugprod\ .

9. Execute these commands under PSFTP:

open 192.168.10.225
(input n and press enter)
Sirepuser
password
cd EFIESP/Windows/system32/boot
mv resetphone.efi resetphonx.efi
lcd D:\path\to\extracted\debugprod\
put developermenu.efi
mv developermenu.efi resetphone.efi

Now you have Developer Menu injected, we can now enter Mass Storage mode.

Enter Mass Storage mode​

After you injected Developer Menu, the Mass Storage mode will be accessible with a combination key.

To enter Mass Storage mode, disconnect and power off your phone, then press both Volume Down and Power key. When the phone vibrates, release the power key only but do not release Volume Down key. Soon the phone will show "Windows Phone Boot Menu" instead of an exclamation mark - you can release volume key when you see the Windows Phone Boot Menu.

Make sure the USB Mass Storage mode is highlighted, and press power key to enter. The screen may turn off, which is expected.

You can now backup the bootloader of this phone with utilities like HxD, Win32 Disk Imager. you don't need to backup entire eMMC - you can just backup first 201,326,592 bytes (192 MB) or first 0xBFFFFFF bytes if you prefer hex offset. We assume you saved it as HFCW_bootloader.img. You'll need this to restore your phone back to Windows Phone.

Enable Qualcomm Diag Port and make QCN backup​

MainOS partition will be mounted to your PC with a drive letter. We assume the MainOS partition drive letter is E: .

Download the diagnostics.rar attached belaow, open an Administrator Command Prompt or PowerShell window and execute this command:

.\EnableQCComp E: SerialCompositeConfig

Once the procedure completes, please safely eject the QUALCOMM MSM DEVICE from taskbar. Then, perform a force reboot on your phone.

Soon the phone will reboot with Qualcomm Diag Port enabled. If you don't have driver and QPST installed, you can download them from here:

QPST: https://mirrors.lolinet.com/software/windows/Qualcomm/QPST/QPST.2.7.496.zip

Driver: https://mirrors.lolinet.com/software/windows/Qualcomm/QUD/qud.win.1.1_installer_10061.1.zip

From Start Menu, choose "QPST" - "Software Download", then choose "Backup" tab and create xqcn and qcn backup individually. The xqcn and qcn backup contains your IMEI and we will need this to restore it back to Android OS.

Save it to a safe place, and click "Start" to finish backup.

WARNING: Do not share your XQCN/QCN backup to anyone else, or it violates rules of XDA! ​

Install Android​

WARNING: This is the most dangerous part of entire guide! Please read this section carefully before you proceed, or you'll get an irrecoverable brick! ​

Do not disconnect the phone until you complete this part!

Please download newer Android OS image here and extract it: https://api.hikaricalyx.com/FileDownload/MegaNz?FileID=vxcERC4J

SHA256: D5EA5D85D2FADEE12AF6DB7A2724D2C53911E92AE4179D54B0AD1B7900FBFF09

Comparing to old method, we've optimized it so the entire flashing procedure would take up to 6 minutes.

Now enter Mass Storage mode again.

Before we install Android bootloader, we'll need to erase the partition table of existing phone, so Windows won't stop us from overwriting protected partitions like EFIESP.

To do that, please execute "diskpart" in Administrator Command Prompt or PowerShell.

First, check what's the phone's disk ID under diskpart command prompt with:

list disk

Usually, the last 64GB disk is your phone's internal storage. We assume your phone's disk ID is 2.

Then, execute these commands to erase the partition table:

select disk 2
clean
exit

Now it's time to install Android bootloader. You can use Rufus to load HFCA_0.42.238_bootloader.img.gz and flash it to your phone. This procedure took me 2 minutes and 23 seconds to finish. After Android bootloader flashed, close Rufus.

Rufus can be downloaded here:

Rufus - The Official Website (Download, New Releases)

Rufus is a small application that creates bootable USB drives, which can then be used to install or run Microsoft Windows, Linux or DOS. In just a few minutes, and with very few clicks, Rufus can help you run a new Operating System on your computer...

rufus.ie

Then, run HxD as Administrator, then choose "Tools" - "Read Disk" here. Make sure to deselect "Read as read only" above.

Choose one with device name "MSFT Phone MMC Storage" inside of the list.

Now use HxD to open gpt_backup0_E8F7FBE00.bin as well, select all and copy it.

Get back to your phone's disk hex edit tab, press Ctrl+G, and input E8F7FBE00 here, then press Ctrl+B to write the gpt_backup0 at the end of phone's internal storage, then press Ctrl+S to save it (choose yes).

Now you can close HxD and safely eject the phone and perform force reboot.

Unlock the bootloader and flash system partition​

To reduce the image size, I didn't include system image into the bootloader image. You'll need to enter Fastboot mode manually by pressing Volume Down and Power key. Release both keys when you see Fastboot mode screen like this. Entering fastboot mode first time might be difficult, you can try multiple of times until you enter.

Since HP Fastboot driver doesn't exist, you may want to use Device Manager to install Fastboot driver from other OEMs manually. For example, the Google USB Driver will work.

You should unlock the bootloader before you proceed to next step:

fastboot oem unlock-go

Press volume key when unlock warning message appears, and choose Fastboot here.

Now you can flash system image included in this package:

fastboot flash system system.img
fastboot erase oem
fastboot erase userdata
fastboot erase cache

System partition flashing may take up to 9 minutes, please wait patiently.

Once these 3 commands are executed, your phone should boot right into Android OS. Finish Setup Wizard here.

If the phone freezes at android animation for over 10 minutes, disconnect the phone and perform force reboot. This happens sometimes when the phone is connected to PC.

Install Magisk Root​

To restore QCN properly, you must use Magisk 23.0 and you cannot use anything newer. Once QCN is successfully restored, you can upgrade to newer Magisk.

There are 2 options to install Magisk root:

1. Patch the boot image included in package and flash the patched boot image to boot partition.

2. Use the TWRP provided here to install Magisk.

Release Magisk v23.0 · topjohnwu/Magisk

This release is focused on fixing regressions and bugs. Note: Magisk v22 is the last major version to support Jellybean and Kitkat. Magisk v23 only supports Android 5.0 and higher. Bug Fixes [App]...

github.com

You should be able to find the guide everywhere.

Install TWRP (Optional)​

If you want to use TWRP, download the TWRP image from here:

[GUIDE] How to install Android to HP Elite x3

查看中文版教程 (Chinese version) To moderators: This phone originally had Windows 10 Mobile installed, so I posted it here. Please move it if topic is unsuitable in Windows 10 Mobile forum. #/usr/bin/env python3 print(''' Your warranty is... still...

xdaforums.com

Then flash it under fastboot:

fastboot flash twrp twrp_fixed.img

Restore QCN​

Once you successfully rooted the phone with Magisk, you should install SELinux permissive module to enable access of Qualcomm diag port.

To do that, download the SELinux permissive module from here:

[GUIDE] How to install Android to HP Elite x3

查看中文版教程 (Chinese version) To moderators: This phone originally had Windows 10 Mobile installed, so I posted it here. Please move it if topic is unsuitable in Windows 10 Mobile forum. #/usr/bin/env python3 print(''' Your warranty is... still...

xdaforums.com

Then install it in Magisk. Once installed and reboot the phone, you should be able to enable Qualcomm diag port with this command:

adb shell
su
(grant root permission on screen)
setprop sys.usb.config diag,adb

Now you can reopen Software Download and restore the QCN or XQCN file you previously backed up. If the COM port does not show "MSM8996 00000000 (MPSS.TH.2.0.1.c8-00017-M8996FAAAANAZM-1)", it means you either doesn't have SELinux Magisk module properly installed or you're using too new version of Magisk. Reboot the phone once you successfully restore QCN or XQCN file.

Restore Wi-Fi MAC and Bluetooth Address​

Although you can still use Wi-Fi and Bluetooth, but the value of them are incorrect, which will cause trouble when you have multiples of phones connecting to same Wi-Fi hotspot.

To fix this, you'll have to write your own Wi-Fi MAC into persist partition. Assuming the MAC address you took note before was AA-BB-CC-DD-EE-FF.

Execute these commands:

adb shell
su
printf 'Intf0MacAddress=AABBCCDDEEFF\nIntf1MacAddress=AABBCCDDEEFE\nIntf2MacAddress=AABBCCDDEEFD\nIntf3MacAddress=AABBCCDDEEFC\n' > /persist/wlan_mac.bin

Intf1 - Initf3 addresses were reduced by 1 based on their previous MacAddress as you can see.

For Bluetooth address, assuming the Bluetooth address you took note before was 11-22-33-44-55-66, execute this command after you restore MAC:

printf '\x01\x00\x06\x66\x55\x44\x33\x22\x11' > /persist/bluetooth/.bt_nv.bin

6 hex values need to be written backwards.

Reboot the phone will take effect.

Install Stereo Speaker Magisk module​

By default only the speaker on bottom will work under Android. To fix it, you need to install EliteStereo Magisk module.

[GUIDE] How to install Android to HP Elite x3

查看中文版教程 (Chinese version) To moderators: This phone originally had Windows 10 Mobile installed, so I posted it here. Please move it if topic is unsuitable in Windows 10 Mobile forum. #/usr/bin/env python3 print(''' Your warranty is... still...

xdaforums.com

Now the phone is fully usable. Enjoy Android on your glorious HP Elite x3.

Revert it back to Windows Phone​

I wonder what's the reason of reverting it back to an operating system lacks app support?

Click button below if you're insisted to do that.

Please boot your phone into TWRP. Use following commands if you haven't flashed TWRP to your phone:

adb reboot-bootloader
fastboot boot twrp_fixed.img

Then, write HFCW_bootloader.img you backed up previously to your phone:

adb push D:\path\to\HFCW_bootloader.img /tmp/
adb shell dd if=/tmp/HFCW_bootloader.img of=/dev/block/mmcblk0

Wait few seconds until xxx records in, xxx records out message appear. Now you have finished Windows Phone bootloader restoration.

Reboot the phone now.

adb reboot

Your phone will reboot with Blue screen, which means you have successfully restored Windows Phone bootloader. What you need to do is, repeat downgrade the procedure by entering FFULoader mode (lightning cog) and reinstall Windows Phone firmware with ffutool.

Procedure for Prototype Unit​

If you're not sure if you have a prototype unit, check if your phone meets any of following conditions:

- HP Sample, Not for Sale is printed on the back

- You can see Not for Resale text displayed during boot

- No fingerprint sensor and a more generally known HP logo is used

If your phone doesn't meet any of conditions above, then your phone isn't a prototype unit. This part is not for you.

Simply follow this guide to put your phone into EDL mode, use any Snapdragon 820 eMMC firehose programmer to backup/restore the entire phone. The prototype variant allows you to revert it back to Windows Phone variant whenever you want.

[GUIDE] How to dump and write back the storage on most of Qualcomm devices

This is a generic guide that could be suitable for many Qualcomm based devices, once the phone can be triggered to EDL mode. To make sure this guide will work as expect, following requirements are needed: - Know how to trigger the phone to EDL...

xdaforums.com

Special Thanks​

gus33000 and Rafael Rivera for discovering the production signed Developer Menu and Interop Tools development

My partner for discovering the existence of HP Elite x3 prototype with Android OS

abc145 for his first trial and error procedure

Computershik for TWRP and minor fix procedures