Fairphone 3 unbricking

Yes it does, since there is only one PK_HASH fuse, which basically stores the hash of the root-certificate used for signing sbl or programmer.
Since the fuse wasn’t burnt in, it CAN’T verify the signatures. (Which is probably also the reason, the fastboot screen displays “Secure boot disabled” even on a locked bootloader.

I do have a paypal-donation link on my XDA-profile, I don’t think androidfilehost has a mechanism for that itself.

EDIT:
I have added a paypal link at the top :wink:

2 Likes

We had a working deep flash cable, what could possibly go wrong?
It looked like the usb-shorting was caught by PBL since there was no aboot output on UART.

I connected my FP3 and lsusb didn’t give me more than Bus 001 Device 036: ID 05c6:900e Qualcomm, Inc.. I tried getting the phone into a different mode, but I can’t figure out if it has changed.

What exactly did you do, to end up there?
Did you try taking out the battery, replacing it and boot into fastboot by holding Volume Down + Power?

I tried taking out the battery. I couldn’t boot into fastboot. I tried connecting the phone in time, but the computer didn’t recognize it either.
I was (probably wrongly) flashing the single images in the upper package (TWRP installable stock firmware packages for Fairphone 3) via fastboot. After I flashed the b slot and rebooted the system it didn’t start (or at least it didn’t show anything on the display). My Pc sees that there is a Qualcomm device connected to it, but nothing more

How did you try to boot into fastboot, what do you mean by “connecting in time”?

I’ve already told you in SIM not recognised after flashing FP3_A0105 image - #6 by k4y0z that these ZIPs are to be installed using TWRP.

You’ll have to be a bit more precise in what you are doing…

I tried it using this suggestion to connect the phone as you press Volume + & -, so that it goes into EDL (right?)
mode.
I am trying to get the phone to be sth. like this Qualcomm, Inc. Gobi Wireless Modem (QDL mode) and get the methods in the main thread working
I’m sorry if I am not precise enough, I’m trying the best I can

That is not what I suggested to you.
I asked you to remove the battery and put it back in.
Then press Vol Down + Power and see if you can access fastboot.

I tried, but as I plug in the battery, there is no response on the display, also nothing after pressing Vol Down + Power. Can’t access fastboot either.

There should be no response when you plug in the battery.
There should be no cable connected.
You press and hold “Vol Down” + “Power”.
If you still don’t get a response, remove the battery AGAIN and put it back in.
Then hold both volume-buttons while plugging the device in.

Still nothing. I put the battery in (not pressing anything) and held the buttons while connecting it to the pc. Fastboot didn’t find a device and the edl script also didn’t

So you tried the fastboot button-combination?
That didn’t work?
You removed the battery again and replaced it?
Then tried both volume buttons while plugging in?
What USB device does it show?

Yes, nothing of it gave any response.
Bus 001 Device 051: ID 05c6:900e Qualcomm, Inc.

I thought it might be the same problem. I was able to dump the memory, but didn’t know where else to go afterwards.

If you are in the same situation and you have confirmed, that neither of the button combinations works from a powered off state, the only option is to take the device apart and short two testpoints using a resistor (Or sending it in for repair)
You might want to ask someone who has some experience tinkering with electronics to help you.

Oh dang, okay, however, thank you.
What about those EDL cables? Are they worth a try?

If pressing both volume-buttons doesn’t work, the EDL-cable likely won’t either.

What about the SBL?! It was also clear to me that both key combinations or USB-shortening were caught (if caught at all) before aboot. I was also definitely sure that my phone was reaching the SBL (otherwise it would have gone into EDL on its own), so I knew that the key-combinations were caught by the SBL at some later stage than where I was caught. However, I had some hope for the USB-shortening, and it was dissipated both by reading

We also encountered SBLs that test the USB D+/GND pins upon boot (e.g. Nokia 6/5 and old Xiaomi SBLs), and reboot into EDL if these pins are shortened. This is known as the EDL or ‘Deep Flashing’ USB cable. Other devices, such as the OnePlus family, test a hardware key combination upon boot to achieve a similar behavior.

in Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals and by testing myself (I tested with absolutely no hope, given what I had read).

aboot catches the key combination since aboot gives output via UART.

Even if the EDL-cable or key-combinations were caught by sbl1 that should happen way before trying to load other stuff.
So it seems kind of weird it is implemented such, that sbl1 can fall back into memory-dump before catching the button-combination or EDL-cable.
Since as you said @calvofl0, if sbl1 wasn’t working at all, it should go straight into EDL.

@walamana: I just went out of the very same situation in which you are. The USB-EDL cable will not be helpful in this situation. You really need to disassemble the whole phone. If you are not used to do this kind of things, I recommend that you start that when you are not in a hurry, count 5 hours ahead of you. Before starting, make sure you have read and thoroughly understood every single step here below. If one step does not work, don’t even try to move forward, it will not work and probably lead to a cascade of new problems. If you have any doubt/problem, ask in this thread, people will help you. Don’t follow instructions blindly, make sure you know what you do at each time and why you do it. I hope not to scare you: it is really not that complicated, but it is quite long. Do as follows:

  1. First relax. Open the phone as if you wanted to change the SIM card, make sure it is disconnected from USB and the battery is away
  2. Prepare close to you: a screw-driver like the one provided (or the one provided), a Torx screw-driver of size T5; if you do not have a star-shaped screw-driver, a very small flat one will make the job; prepare also a small box/glass/cup (where you will put extremely small screws you don’t want to lose); a 1KOhm resistor; make sure you are working on a clear surface, without any kind of textile or any stuff carrying electrostatic charges
  3. Prepare all the stuff you will need on the computer: clone https://github.com/bkerler/edl and unzip https://www.androidfilehost.com/?fid=4349826312261722607 in the same folder. Make sure you have Python >= 3.7, qcserial is not running (stop ModemManager if you have it, and killall qcserial), make sure you have followed the installation instructions on the README, and then try to run ./edl.py --help, just to check that all Python stuff is all right; finally prepare on a line the command ./edl.py wl unbrick --loader=unbrick/prog_emmc_firehose_8953_ddr.mbn, that you will not yet execute, and on another shell execute watch -n 0.1 lsusb, which will inform you in live of the plugged USB peripherals; in order to get information about new plugged devices, you might prefer the more verbose sudo dmesg -w, which will provide more detailed information and report all kind of events
  4. Remove all 13 screws from the back
  5. At this point you have to remove the display, best is that you watch the official video https://support.fairphone.com/hc/en-us/articles/115001041206, and keep in mind that it is more difficult than what it looks in the video; don’t force, rather see how they proceed in a more clever way here: https://d3nevzfk7ii3be.cloudfront.net/igi/WW6DNwFaZxDLFQWG.huge. Please take note of the plastic tool used in the picture. If you have long nails, that can also do the job, but NEVER USE A METALLIC STUFF, never use a screw-driver or a knife for separating delicate components!
  6. Now that the display is out, you will see a relatively big metallic plate; it is covering the main board. Touch it with both hands (in order to prevent electrostatic discharge later on to the board that is below), and remove the two smaller black screws that keep this plate where it is
  7. Remove the metallic plate, and carefully disconnect the main board underneath from the modules around
  8. At this point you managed to extract from the phone the main board; further remove the bottom module (the one with the USB plug, you will have to remove 4 additional screws)
  9. Reconnect the bottom module to the main board
  10. Identify the two pins labelled L and K on https://github.com/k65onyx/fp3-notes/blob/master/images/test_point_labels.png
  11. Plug the USB cable to the bottom module (but not yet to the computer), sit comfortably, in such a way that you can hold single-handed the resistor between the two pins, so that one leg of the resistor touches L and the other leg touches K
  12. With your free hand plug the USB to the computer and then remove the resistor
  13. Now check on the shell where lsusb was running that your phone appears in EDL mode (it will say EDL at the end of one line, if that is the case)
  14. Now that you have your phone in EDL mode, go to the EDL shell on your computer and press ENTER to the command that you prepared; if all went well you should see the progression of a variety of images been flashed on your phone
  15. Run ./edl.py reset, disconnect the USB, very carefully reassemble the bottom module first, then the main board (be very careful, make sure it is really completely in, and all the plugs are properly connected to all the modules around) and put back the metal plate
  16. Now you will properly observe the display, check for its connector. You will observe that there are two holes for two screws, around the connector; you will plug back the screen, and put back only these two screws that you have observed: before reassembling the whole lot we want to make sure that all is fine indeed
  17. With Vol- and Power pressed at the same time, plug the USB from the phone to the computer; in the lsusb shell you should now see a Google device; also with fastboot devices you should see your phone appear; if this is okay, you can move forwards
  18. Reflash properly your phone with fastboot, reboot, and check that all works
  19. Put back all the missing screws and
  20. Well done, your phone just resurrected :slight_smile:

NOTE: you need a lot of patience and confidence, and if possible someone experienced next to you. You might have to repeat these steps. Think that at this point FP3 is almost unbrickable in a definitive way, but it is not unbreakable, especially when you start removing screws. So the slowest and more careful you go, the best. Don’t hesitate to take pictures of what you do to help you reassemble. If you don’t find an experienced person to help you, ask any friend to be next to you carefully watching what you do and let that person take the pictures (four eyes often see better than two).

Good luck!

EDIT: the suggestions/corrections of k4y0z in the next post are now accounted for in the above instructions

15 Likes