[Hardware Hacking General] alecxs:
I applied 1.8 V through 1k resistor to pin 115 but no success with/without battery/reset. all I get is 900E diag mode even without 1.8 V

this is what I get on UART

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2-00059
S - IMAGE_VARIANT_STRING=LAATANAZA
S - OEM_IMAGE_VERSION_STRING=ubuntu-236
S - Boot Config, 0x000000e0
B - 1216 - PBL, Start
B - 3723 - bootable_media_detect_entry, Start
B - 4382 - bootable_media_detect_success, Start
B - 4386 - elf_loader_entry, Start
B - 7840 - auth_hash_seg_entry, Start
B - 8061 - auth_hash_seg_exit, Start
B - 51509 - elf_segs_hash_verify_entry, Start
B - 91050 - PBL, End
B - 98789 - SBL1, Start
B - 156343 - pm_device_init, Start
B - 176473 - PM_SET_VAL:Skip
D - 18086 - pm_device_init, Delta
B - 177479 - boot_config_data_table_init, Start
D - 174917 - boot_config_data_table_init, Delta - (420 Bytes)
B - 355935 - CDT version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B - 362401 - sbl1_ddr_set_params, Start
B - 365878 - cpr_init, Start
D - 0 - cpr_init, Delta
B - 371520 - Pre_DDR_clock_init, Start
D - 213 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 384361 - pm_driver_init, Start
D - 4575 - pm_driver_init, Delta
B - 396744 - sbl1_qhsusb_al_do_fast_enum, Start
B - 397049 - clock_init, Start
D - 152 - clock_init, Delta
B - 401044 - boot_flash_init, Start
B - 404796 - Error code 303e at boot_flash_dev_nand.c Line 571
B - 12814117 - Sahara: Hello pkt sent

xubuntu@xubuntu:~/edl$ lsusb -vs 001:054

Bus 001 Device 054: ID 05c6:900e Qualcomm, Inc. QHSUSB__BULK
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x05c6 Qualcomm, Inc.
idProduct 0x900e
bcdDevice 0.00
iManufacturer 1 Qualcomm CDMA Technologies MSM
iProduct 2 QHSUSB__BULK
iSerial 3 1234567890ABCDEF
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0020
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 2mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
can't get device qualifier: Resource temporarily unavailable
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)

interestingly detected as sahara (kinda)

xubuntu@xubuntu:~/edl$ python3 edl --loader=Loaders/qualcomm/factory/mdm9x07/000480e100000000_cc3153a80293939b_fhprg_9x07.mbn rl out
Capstone library is missing (optional).
Keystone library is missing (optional).
No module named 'Cryptodome'
Qualcomm Sahara / Firehose Client V3.61 (c) B.Kerler 2018-2023.
main - Using loader Loaders/qualcomm/factory/mdm9x07/000480e100000000_cc3153a80293939b_fhprg_9x07.mbn ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
Device is in memory dump mode, dumping memory
Reading 32-Bit partition from 0x87c89990 with length of 0x1a0
OCIMEM.BIN(OCIMEM): Offset 0x8600000, Length 0x4000, SavePref 0x1
CODERAM.BIN(RPM Code RAM region): Offset 0x200000, Length 0x20000, SavePref 0x1
DATARAM.BIN(RPM Data RAM region): Offset 0x290000, Length 0x10000, SavePref 0x1
MSGRAM.BIN(RPM MSG RAM region): Offset 0x60000, Length 0x5000, SavePref 0x1
PMIC_PON.BIN(Pmic PON stat): Offset 0x87c00338, Length 0x8, SavePref 0x1
RST_STAT.BIN(Reset Status Region): Offset 0x87c00330, Length 0x4, SavePref 0x1
DDRCS0.BIN( DDR CS0 Memory): Offset 0x80000000, Length 0x10000000, SavePref 0x1
load.cmm(CMM Script): Offset 0x87c89190, Length 0x25c, SavePref 0x2
Dumping OCIMEM.BIN(OCIMEM) at 0x8600000, length 0x4000
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping CODERAM.BIN(RPM Code RAM region) at 0x200000, length 0x20000
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping DATARAM.BIN(RPM Data RAM region) at 0x290000, length 0x10000
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping MSGRAM.BIN(RPM MSG RAM region) at 0x60000, length 0x5000
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping PMIC_PON.BIN(Pmic PON stat) at 0x87c00338, length 0x8
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping RST_STAT.BIN(Reset Status Region) at 0x87c00330, length 0x4
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping DDRCS0.BIN( DDR CS0 Memory) at 0x80000000, length 0x10000000
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory
Dumping load.cmm(CMM Script) at 0x87c89190, length 0x25c
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Done dumping memory

the reset pin works fine and also the Vbus pin, so I assume pin 115 is the correct pin. does it make sense to try edl.exe in 900E diag mode?

for the pinephone I found AT command echo -ne "AT+QFASTBOOT\r\n" but I don't know how to apply.

xubuntu@xubuntu:~/edl$ echo -ne "AT+QFASTBOOT\r\n" | xxd -u
00000000: 4154 2B51 4641 5354 424F 4F54 0D0A AT+QFASTBOOT..
xubuntu@xubuntu:~/edl$ edlclient/Tools/qc_diag cmd 41542B5146415354424F4F540D0A -vid 0x05c6 -pid 0x900e -interface 0
Capstone library is missing (optional).
Keystone library is missing (optional).

Qualcomm Diag Client (c) B.Kerler 2019-2021.
---------------------------------------

DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(5, 'Input/Output Error')
DeviceClass - USBError(5, 'Input/Output Error')
Traceback (most recent call last):
File "edlclient/Tools/qc_diag", line 1488, in <module>
main()
File "edlclient/Tools/qc_diag", line 1484, in main
dg.run(args)
File "edlclient/Tools/qc_diag", line 1211, in run
print(diag.send_cmd(args.cmdval))
File "edlclient/Tools/qc_diag", line 808, in send_cmd
if reply[0] != cmdtosend[0]:
TypeError: 'int' object is not subscriptable

the USBError(5, 'Input/Output Error') makes me believe I need a capacitor or something on the usb-dm/dp lines.