[Motorola Edge 40 Pro  / Moto X40 (China)] zw666:
This article will record the whole process of fixing my hardbrick x40 through a DIY 9008 deep flash data cables in EDL mode

The research, conclusions, and experiments in this article all come from my hardbricked rtwo-retcn (x40 CN Retail). Please operate with caution in other bricked situations and other models.

A. FAQ​

1. What is x40 hardbrick​

A hardbrick phone means that the phone can only enter EDL (Qualcomm Emergency Download) mode and cannot boot to the bootloader. The phone will enter a completely black state and cannot light up. No feedback will be received from any key presses and operations. When plugged into the computer, no USB information will be recognized (the computer will not beep).

2. Why does hardbrick occur?​

Flashing the third-party Rom (like lineage)does not flash the copy-partition copy partition. Specific explanation cite the original text

At present, my experience is limited to this and I have reproduced it many times in experiments. Other hardbrick trigger situations (such as BL version, relock BL, etc.) will not be discussed here. I hope someone can help me add some other experience.

Theoretically, if your phone meets the phenomenon mentioned above, it should be repairable using this method.

3. Purpose of entering EDL​

Let the PC recognize the phone and Boot the device into Fastboot AP mode. Then re-flashing the full system package.

4. Can other versions RTWO be fixed in this way​

You can flash your retail region firmware after booting into AP mode. It's theoretically possible at the hardware level, but I'm not sure.

B. Preparation​

1. Get a 9008 cable​

Find a Type-C to A or mircoUSB to A data cable (needs an adapter to Type-C) and test that the data cable can transfer files stably. It is best to have a larger cable diameter. D

Use tools such as wire strippers to peel away the skin/metal shielding/filler to expose the wiring. Remove the D+ (usually green) and GND(usually black) to expose the conductors, use tweezers or make direct contact between the two wires to achieve a short circuit\switch effect

There are many tutorials for making 9008-deep flash cable, this is just a brief introduction. You can easily find tutorials on YouTube or you can purchase them on Amazon

View attachment 6067836

2. Prepare your PC​

Windows OS is needed；

Make sure you have installed the Motorola-related drivers (Fastboot, ADB). We need to flash the Stock ROM after EDL

Install QUD driver (9008 serial port)， ignore the signature warning， choose WWAN mode https://mirrors.lolinet.com/software/windows/Qualcomm/QUD/QUD.1.00.76.Windows-AnyCPU_patched.zip

When the 9008 cable is ready, test the transmission stability of the 9008 cable in the normal state (do not short-circuiting D+ and GND here) to ensure that the transmitted data will not be disconnected.

Download the Blankflash brick rescue package and unzip it https://mirrors.lolinet.com/firmwar...flash_rtwo_retcn_T1TR33.4-30-10-2_rebuild.zip

Download the relevant flash packages and tools for normal AP mode flashing

C. 【Attention】FIX HardBrick​

1. Enter EDL mode and be recognized by the computer​

Since the phone is a hardbrick, it is difficult to check the status of the phone. You won't get any response (Display/Vibra/sound) until you successfully connect to the PC. So you need to do everything blindly.

***charge your phone before this procedure***

Connect your phone and PC with 9008 cable（do not Short D+ and GND now）

Hold the Power Button for 10 seconds and your phone will enter an unknown mode， I guess it is the Primary Bootloader (PBL).

Now, Short the D+ and GND and keep holding them（Use a conductor to connect two exposed wires or bring them into direct contact）

Quickly press and lift both volume buttons (+-) together, and repeat about ten times.

Disconnect the short-circuited D+ and GND（Disconnect the conductor or make the two wires separate）

At this time, the computer should beep because the USB device is recognized, and the 9008 serial port will be displayed in the pc device manager. This means that the device has successfully entered EDL mode

It's easy to fail at this part, so try it a few times. The sequence of operations cannot be wrong, hold power - short D+ and GND - press both volume up and down multiple times quickly - disengagement D+ and GND

2. Run Blankflash​

Run the blank-flash.bat script and let the program run automatically

This part is mainly about flashing some basic firmware so that the system can successfully boot to the Secondary Bootloader (SBL)

View attachment 6067847

If the script runs successfully, you will see the running total time

3. Enter the AP Fastboot and flash the Stock ROM​

After blankflash, the phone will reboot to AP Fastboot itself.

View attachment 6067848

flash the stock ROM as usual and reboot

Entered the system successfully.

D. Postscript​

My inspiration for repairing my phone came from this post

He mentions a Russian guy saved his RTWO this way， But I don't know if he fixed his own. Thank you for your inspiration.

Here I would like to sincerely appreciate this friend from the Russian forum. I wonder if he can see it.， He accidentally entered the EDL mode through exhaustive methods and recorded it (at the end he used методом тыка, which is the Poke Method). I just refined his method to improve the reproducibility, thanks again 👏

https://4pda.to/forum/index.php?sho...a.to/forum/index.php?showtopic=1045614&st=800

Regarding the EDL mode of Qualcomm equipment, you can read the first article of this series of essays.

Exploiting Qualcomm EDL Programmers This series consists of five articles that explain EDL-related knowledge from the hardware security side. The author concludes by raising concerns about the abuse of EDL with the highest permissions and proposes two improvement measures. 1. The permissions of the EDL programmer cannot exceed the scope allowed by the OEM. 2. The permissions scope of the EDL itself should be limited. In response to these two points, the author believes that OEMs should add hardware-level fuses to prevent the device from entering EDL mode (hardbrick has no solution), and should prevent users from entering EDL mode too easily (such as using the `adb reboot edl` command and using DIY USB cable)

Today is Chinese New Year, and I’m writing this post alone in my small apartment in San Jose. I haven’t spent New Year’s Eve with my family in years. But at least I was happy to have my phone back.

Regardless of your race, color, religion, or nationality, I wish you all a happy Spring Festival🎆.