Fairphone 3 unbricking

I’d like to give you a few handfuls of euros for the work you do for us. :slight_smile: Whether or not you buy a Fairphone for it, I leave it to you. However, it would be great if you could develop better.

In the end the Fairphone Open might be based on your work.

Wait, that’s not fair, many here are doing good work for the community. I would like to give you money to buy a Fairphone 3. It would be very nice if you would continue working on it, but that’s not a condition of mine.

1 Like

Are you crazy :scream:?!? Well, thank you so much! Testing shortening L and K pins was going to be my next step, but I wanted first to have a close look to these pins and the main board, and post some more detailed pictures for checking with you if L and K really looked like the right ones. Nevertheless, there was no point in trying to burn a second phone: mine was already in a situation in which there was nothing else left to do than testing.

I left behind a lot of stuff such as my multimeter, resistors, soldering iron… when moving out some time ago. Then testing electronics-related stuff is a bit slow for me: I need to find people to borrow the stuff. I’ll try to resurrect my phone when I get hand on a resistor: even if it worked for you I think it is still better not to directly shortcut two pins…

It seems it is possible to reboot into EDL at different stages. For me it was very instructive to read both Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals and Secure boot on Snapdragon 410 - Timesys. The second link allows us to make a good interpretation of what happened when trying to unbrick the phone:

  1. The SBL, aboot, tz, rpm and splash were properly restored. However the other partitions remained corrupted
  2. When booting, the PBL checked the SBL, which was fine, properly signed, and accepted, and chain booted on it without going to EDL mode
  3. The SBL started verifying the authenticity of other partitions, including aboot, tz and rpm, but also lksecapp and maybe others, which were still corrupted
  4. Failing to do so at the SBL stage brings the phone to memory dump mode as a fallback, unlike the normal EDL fallback at the PBL stage when verification of the SBL is unsuccessful

I fully support the found raising idea :smiley:.

Well, we did that only after testing the EDL-cable, which did work before.
After that didn’t work anymore either, I couldn’t leave @basxto with a bricked phone :joy:

ifixit has some nice pictures of the internals:

As said, we did use a resistor as well.

I have read the first one a while ago, I’ll check out the second link, thank you.

Forget about checking the SBL, as we already established there is no signature checking done on SBL.

After your first unbrick attempt aboot, tz and rpm were all fine and I would have assumed that that’s enough to get fastboot.
Apparently more is needed for that, which is why the new unbrick-zip also contains lksecapp, keymaster, cmnlib(64) and devcfg.
devcfg was the last partition I added, after adding only lksecapp, keymaster and cmnlib(64) wasn’t working either.

Again, forget about the verification of SBL, that isn’t happening.

I’ll add a paypal link to my threads, unless you have a better idea how to do that…

Yes, you are right, there is no signature verification. But there is some sort of verification, at least of whether or not chain booting suceeded: if there is crap in the SBL partition, the PBL will make the device enter into EDL mode.

And now that you mention it: the PBL is not veryfying the signature of the programmer we used to reflash the images, so we could do it. Does that really mean that it also does not verify the signature of the SBL?

In androidfilehost, once you finish downloading a file, you get a message:

Don’t forget to share the love with your developers, without whom this download wouldn’t be here. Contact them to say thanks or send a donation their way.

It suggests it could be possible for you to indicate some contact/donate information also there.

Yes it does, since there is only one PK_HASH fuse, which basically stores the hash of the root-certificate used for signing sbl or programmer.
Since the fuse wasn’t burnt in, it CAN’T verify the signatures. (Which is probably also the reason, the fastboot screen displays “Secure boot disabled” even on a locked bootloader.

I do have a paypal-donation link on my XDA-profile, I don’t think androidfilehost has a mechanism for that itself.

EDIT:
I have added a paypal link at the top :wink:

2 Likes

We had a working deep flash cable, what could possibly go wrong?
It looked like the usb-shorting was caught by PBL since there was no aboot output on UART.

I connected my FP3 and lsusb didn’t give me more than Bus 001 Device 036: ID 05c6:900e Qualcomm, Inc.. I tried getting the phone into a different mode, but I can’t figure out if it has changed.

What exactly did you do, to end up there?
Did you try taking out the battery, replacing it and boot into fastboot by holding Volume Down + Power?

I tried taking out the battery. I couldn’t boot into fastboot. I tried connecting the phone in time, but the computer didn’t recognize it either.
I was (probably wrongly) flashing the single images in the upper package (TWRP installable stock firmware packages for Fairphone 3) via fastboot. After I flashed the b slot and rebooted the system it didn’t start (or at least it didn’t show anything on the display). My Pc sees that there is a Qualcomm device connected to it, but nothing more

How did you try to boot into fastboot, what do you mean by “connecting in time”?

I’ve already told you in SIM not recognised after flashing FP3_A0105 image - #6 by k4y0z that these ZIPs are to be installed using TWRP.

You’ll have to be a bit more precise in what you are doing…

I tried it using this suggestion to connect the phone as you press Volume + & -, so that it goes into EDL (right?)
mode.
I am trying to get the phone to be sth. like this Qualcomm, Inc. Gobi Wireless Modem (QDL mode) and get the methods in the main thread working
I’m sorry if I am not precise enough, I’m trying the best I can

That is not what I suggested to you.
I asked you to remove the battery and put it back in.
Then press Vol Down + Power and see if you can access fastboot.

I tried, but as I plug in the battery, there is no response on the display, also nothing after pressing Vol Down + Power. Can’t access fastboot either.

There should be no response when you plug in the battery.
There should be no cable connected.
You press and hold “Vol Down” + “Power”.
If you still don’t get a response, remove the battery AGAIN and put it back in.
Then hold both volume-buttons while plugging the device in.

Still nothing. I put the battery in (not pressing anything) and held the buttons while connecting it to the pc. Fastboot didn’t find a device and the edl script also didn’t

So you tried the fastboot button-combination?
That didn’t work?
You removed the battery again and replaced it?
Then tried both volume buttons while plugging in?
What USB device does it show?

Yes, nothing of it gave any response.
Bus 001 Device 051: ID 05c6:900e Qualcomm, Inc.

I thought it might be the same problem. I was able to dump the memory, but didn’t know where else to go afterwards.

If you are in the same situation and you have confirmed, that neither of the button combinations works from a powered off state, the only option is to take the device apart and short two testpoints using a resistor (Or sending it in for repair)
You might want to ask someone who has some experience tinkering with electronics to help you.

Oh dang, okay, however, thank you.
What about those EDL cables? Are they worth a try?